void 0.20.3 → 0.21.0

package/dist/{deploy-BAhhcg5q.mjs → deploy-H968Lo4T.mjs}

@@ -1,51 +1,63 @@
-import { n as __exportAll, r as __toESM, t as __commonJSMin } from "./rolldown-runtime-rQ84J-ij.mjs";
-import { c as relative, i as extname, l as resolve, n as dirname, o as join, s as normalize, t as basename } from "./dist-BrsS7cai.mjs";
-import { A as outro, B as ensureCloudflaredToken, D as log$1, E as intro, H as ensurePlatformProxyAccess, I as isCancel, M as select, c as import_picocolors$1, d as formatCloudflareUserMessage, ft as require_picocolors, i as createSpinner, k as note, r as cliTitle, w as confirm } from "./output-B0cfNSx5.mjs";
-import { i as resolveProjectPaths, n as readProjectPaths, t as assertNoRootSourceConventionConflicts } from "./project-paths-SK8nMHPp.mjs";
-import { a as scanQueuesSync, i as scanWebSocketRoutesSync, o as scanJobsSync, r as scanRoutes, s as findVoidAuthConfig } from "./scan-BMH4rzlv.mjs";
+import { n as __toESM, t as __commonJSMin } from "./rolldown-runtime-DXIUcv95.mjs";
+import { a as join, l as relative, n as dirname, o as normalize, r as extname, t as basename, u as resolve } from "./dist-4WkAWhWx.mjs";
+import { c as import_picocolors$1, d as require_picocolors, i as createSpinner, r as cliTitle } from "./output-urU86XeT.mjs";
+import { i as resolveProjectPaths, n as readProjectPaths, t as assertNoRootSourceConventionConflicts } from "./project-paths-CKQ-Q5JS.mjs";
+import { t as findVoidAuthConfig } from "./config-uP7ZDtVZ.mjs";
 import { i as trustedCloudflareWorkerAccessHeaders, r as scopedAccessCredentials, t as cfAccessHeaders } from "./cf-access-DRsQRe6k.mjs";
-import { E as writeProjectConfig, S as readProjectConfig, d as isStagingMode, l as getToken, o as getApiUrl, s as getProxyUrl, u as getTokenSource, w as writeDeploymentPlatform, x as readDeploymentPlatform, y as attachSelectedPlatform } from "./auth-DPl6kck4.mjs";
-import { A as writeWranglerPublishedTrafficSnapshot, D as syncWranglerWebSockets, E as syncWranglerDurableObjects, M as isSandboxEnabled, N as requiresSandboxPlatformImage, P as resolveSandboxConfig, S as readWranglerPublishedTrafficSnapshot, T as syncWranglerBindings, a as LIVE_MIGRATION_TAG, c as bindingEntriesForField, f as findBindingNameOwner, g as readExistingLiveBindingConfig, h as normalizeWranglerCompatibilityFlags, k as writeProvisionedWranglerConfig, l as ensureWranglerCompat, o as acknowledgeWranglerManagedQueueRemovals, r as FRIENDLY_BINDING_NAMES, w as resolveLiveBindingConfig, x as readWranglerManagedQueueCleanupCandidates } from "./wrangler--imS8n0d.mjs";
-import { c as getDatabaseDialect, f as readConfig, l as isNodeTarget, p as resolveBindingNames } from "./config-uNGuFsI2.mjs";
+import { a as getApiUrl, c as getToken, l as getTokenSource, o as getProxyUrl, u as isStagingMode } from "./auth-B9_D6ygs.mjs";
+import { r as ensurePlatformProxyAccess, t as ensureCloudflaredToken } from "./cf-access-rAZxzMkL.mjs";
+import { d as writeProjectConfig, i as readDeploymentPlatform, l as writeDeploymentPlatform, o as readProjectConfig, t as attachSelectedPlatform } from "./project-CWNIPoXc.mjs";
+import { d as isNodeTarget, h as resolveBindingNames, m as readConfig, u as getDatabaseDialect } from "./config-Dxr6cTXn.mjs";
+import { A as writeWranglerPublishedTrafficSnapshot, D as syncWranglerWebSockets, E as syncWranglerDurableObjects, L as materializeCloudflareConfig, M as isSandboxEnabled, N as requiresSandboxPlatformImage, P as resolveSandboxConfig, R as persistCloudflareConfig, S as readWranglerPublishedTrafficSnapshot, T as syncWranglerBindings, V as stashCloudflareDeployPointer, a as LIVE_MIGRATION_TAG, c as bindingEntriesForField, f as findBindingNameOwner, g as readExistingLiveBindingConfig, h as normalizeWranglerCompatibilityFlags, k as writeProvisionedWranglerConfig, l as ensureWranglerCompat, o as acknowledgeWranglerManagedQueueRemovals, r as FRIENDLY_BINDING_NAMES, w as resolveLiveBindingConfig, x as readWranglerManagedQueueCleanupCandidates } from "./wrangler-D01qs6VB.mjs";
 import { i as voidWarn, r as voidLog } from "./log-ChfPKsVd.mjs";
-import { n as lintDuplicateSources, r as mergeRoutingRules, t as lintDestinationSplats } from "./headers-BAHwgHdW.mjs";
-import { i as inferProjectBindings, n as FRAMEWORK_SCAN_DIRS, r as detectFramework } from "./plugin-inference-BDRfZngg.mjs";
-import { o as validateSsrEntry } from "./entry-DU3oDoQ3.mjs";
-import { a as buildMigrationPlanBundle, c as collectMigrations, r as validateMigrations, t as assertJournalCoherence } from "./validate-tBBN_dXH.mjs";
+import { n as lintDuplicateSources, r as mergeRoutingRules, t as lintDestinationSplats } from "./headers-B_HBMgi0.mjs";
+import { a as scanQueuesSync, i as scanWebSocketRoutesSync, o as scanJobsSync, r as scanRoutes } from "./scan-DdDvRCU1.mjs";
+import { i as inferProjectBindings, n as FRAMEWORK_SCAN_DIRS, r as detectFramework } from "./plugin-inference-DsvtJLll.mjs";
+import { o as validateSsrEntry } from "./entry-DdRFGK0y.mjs";
+import { t as collectMigrations } from "./collect-DXHNWHcT.mjs";
+import { r as buildMigrationPlanBundle } from "./plan-BEZ8VJW0.mjs";
 import { r as scanWranglerDotenvKeys } from "./dotenv-VQxupEUv.mjs";
-import { t as discoverSchema } from "./discover-xvfrgJeo.mjs";
-import { t as findEnvFile } from "./env-types-BNPhro-M.mjs";
-import { a as deriveSelfHostEnvContextFromVars, c as fetchRemoteSecretNames, d as readEmittedWorkerVars, f as selfHostSchemaFailureMessage, i as SelfHostSecretListError, l as formatEnvReport, n as SelfHostFirstDeployError, o as dischargeSelfHostEnvContext, p as validateProdEnv, r as SelfHostSchemaError, t as SelfHostEnvValidationError, u as listSelfHostSecretNames } from "./env-validation-CF6KvTRf.mjs";
-import { n as CLOUDFLARE_DEPLOY_BUILD_ENV, o as resolveRemoteMode, s as stripInternalEnvKeys } from "./env-DBKmK4vc.mjs";
-import { n as writeDrizzleConfig } from "./config-NOG_U1aK.mjs";
-import { t as runMySqlMigrations } from "./runner-mysql-7BPUNGmL.mjs";
-import { t as runPgMigrations } from "./runner-pg-BkEza-dX.mjs";
+import { t as discoverSchema } from "./discover-C4O6YxVS.mjs";
+import { t as findEnvFile } from "./env-types-CWDtqHgw.mjs";
+import { d as formatEnvReport, f as listSelfHostSecretNames, g as validateProdEnv, h as selfHostSchemaFailureMessage, i as SelfHostSecretListError, l as dischargeSelfHostEnvContext, n as SelfHostFirstDeployError, p as readEmittedWorkerVars, r as SelfHostSchemaError, s as deriveSelfHostEnvContextFromVars, t as SelfHostEnvValidationError, u as fetchRemoteSecretNames, v as readGeneratedWranglerConfigFile } from "./env-validation-BsFEXps5.mjs";
+import { n as CLOUDFLARE_DEPLOY_BUILD_ENV, o as resolveRemoteMode, s as stripInternalEnvKeys } from "./env-DX_v-Q-v.mjs";
+import { E as confirm, I as select, N as note, O as intro, P as outro, W as isCancel, j as log$1 } from "./dist-Dn6nn2IU.mjs";
+import { t as writeDrizzleConfig } from "./config-BSe70f4T.mjs";
+import { i as runMySqlMigrations } from "./runner-mysql-BhwMk2Bm.mjs";
+import { i as runPgMigrations } from "./runner-pg-CJ_JeGF6.mjs";
 import { n as openMigrationValidationDatabase, t as SqliteMigrationError } from "./sqlite-validation-BzKMWnO4.mjs";
-import { t as scanPages } from "./scan-CpK-57ug.mjs";
-import { renderPrerenderPaths } from "./prerender-render.mjs";
-import { a as scanEmailHandlersSync, r as hasEmailHandlers } from "./email-Ce6SQq-i.mjs";
-import { a as isExpiredTokenError, i as isCliOutdatedError, n as PlatformClient, o as parsePlatformErrorBody, s as platformErrorMessage, t as PlatformApiError } from "./client-BQBrZoCX.mjs";
-import { a as resolveProjectCommand, i as hasBackendFiles, n as detectPreset, o as resolveWranglerArgv, r as formatProjectCommand, t as FRAMEWORK_PRESETS } from "./preset-lAy0B0BQ.mjs";
-import { i as cloudflareKeyringNeedsTerminal, s as ensureCloudflareAuthentication, t as CloudflareAuthenticationError } from "./cloudflare-auth-6M5llVPC.mjs";
-import { n as createCloudflareEmptyDomainPublisher } from "./cloudflare-operations-BzWnlC1_.mjs";
-import { i as promptProjectSetupAction, n as promptAndCreateProject, r as promptProjectSelection } from "./create-project-D0oXA090.mjs";
-import { r as resolveProjectBySlug, t as getRequestedProjectSlug } from "./resolve-project--Vxawf7z.mjs";
+import { i as validateMigrations, t as assertJournalCoherence } from "./validate-qNhV00PD.mjs";
+import { t as scanPages } from "./scan-DJbooZm2.mjs";
+import { t as renderPrerenderPaths } from "./prerender-render-Cf_WDE9W.mjs";
+import { a as scanEmailHandlersSync, r as hasEmailHandlers } from "./email-C5kaZXzJ.mjs";
+import { i as migrateBuiltWranglerConfig, n as prepareCfFrameworkBuildOutput, r as prepareCfStaticBuildOutput, t as prepareCfBuildOutput } from "./cf-build-output-CTdlo6Rt.mjs";
+import { n as getPackageDir } from "./agents-gni4eqBu.mjs";
+import { i as isExpiredTokenError, n as PlatformClient, o as parsePlatformErrorBody, r as isCliOutdatedError, s as platformErrorMessage, t as PlatformApiError } from "./client-PdAJ-F0t.mjs";
+import { a as resolveProjectCommand, i as hasBackendFiles, n as detectPreset, o as resolveWranglerArgv, r as formatProjectCommand, t as FRAMEWORK_PRESETS } from "./preset-Dowh9tTt.mjs";
+import { o as ensureCloudflareAuthentication, r as cloudflareAuthNeedsTerminal, t as CloudflareAuthenticationError } from "./cloudflare-auth-BCmTc1X_.mjs";
+import { n as writeVoidProjectConfig } from "./config-write-y3CBI_ux.mjs";
+import { r as discoverFrameworkWranglerFiles, t as migrateLegacyVoidConfig } from "./migrate-DcW8F2W8.mjs";
+import { a as createCloudflareEmptyDomainPublisher, i as createCloudflareEmptyCronPublisher } from "./cloudflare-operations-CPEdHYhM.mjs";
+import { t as formatCloudflareUserMessage } from "./cloudflare-user-output-Q-k0QoNQ.mjs";
+import { a as promptProjectSetupAction, i as promptProjectSelection, r as promptAndCreateProject } from "./create-project-C9lQhRzj.mjs";
+import { r as resolveProjectBySlug, t as getRequestedProjectSlug } from "./resolve-project-Xvis70DG.mjs";
 import { t as collectGitDeployMetadata } from "./git-metadata-D-gurjzG.mjs";
-import { n as promptForLoginToken } from "./login-WIjNc77c.mjs";
+import { t as promptForLoginToken } from "./login-CKk5NX4d.mjs";
 import { createRequire } from "node:module";
-import { copyFileSync, cpSync, createWriteStream, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, renameSync, rmSync, unlinkSync, writeFileSync } from "node:fs";
-import { fileURLToPath, pathToFileURL } from "node:url";
+import { copyFileSync, cpSync, createWriteStream, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, unlinkSync, writeFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
 import { createDeployArtifact, createDeployUploadPayload } from "@void/deploy-core";
 import { createHash, randomBytes } from "node:crypto";
-import { homedir } from "node:os";
+import { homedir, tmpdir } from "node:os";
 import { execFile, execSync, spawnSync } from "node:child_process";
 import { applyEdits, modify, parse } from "jsonc-parser";
+import { isDeepStrictEqual } from "node:util";
 import { build } from "vite";
 import { Minimatch } from "minimatch";
-import { isDeepStrictEqual } from "node:util";
-import { activateCloudflareVersion, assertCloudflareBindingsPreserved, assertCloudflareDurableObjectLifecycleSupported, assertExistingCloudflareConfig, createCloudflareMetadataRunner, encodeCloudflareVersionMessage, extractWorkersDevSubdomain, normalizeWorkersDevSubdomain, parseRootWranglerConfig, parseRootWranglerConfig as parseRootWranglerConfig$1, readBindingFieldPresence, readCloudflareTriggerConfig, readConfigEntryString, readExistingCloudflareWorker, readStoredResourceName, readWranglerTopLevelString, renderCloudflareStaticEntry, resolveD1MigrateTarget, stageCloudflareStaticAssets, writeCloudflareFrameworkDeployConfig, writeCloudflareStaticDeployConfig } from "@void/deploy-cloudflare";
-import { hash } from "blake3-jit";
+import { activateCloudflareVersion, assertCloudflareBindingsPreserved, assertCloudflareDurableObjectLifecycleSupported, assertExistingCloudflareConfig, encodeCloudflareVersionMessage, extractWorkersDevSubdomain, normalizeWorkersDevSubdomain, parseRootWranglerConfig, parseRootWranglerConfig as parseRootWranglerConfig$1, readBindingFieldPresence, readCloudflareTriggerConfig, readConfigEntryString, readExistingCloudflareWorker, readStoredResourceName, readWranglerTopLevelString, renderCloudflareStaticEntry, resolveD1MigrateTarget, stageCloudflareStaticAssets, writeCloudflareFrameworkDeployConfig, writeCloudflareStaticDeployConfig } from "@void/deploy-cloudflare";
+import { getWorkerConfigPath, readBuildOutput } from "@cloudflare/build-output-utils";
 import ignore from "ignore";
+import { hash } from "blake3-jit";
 //#region src/asset-routing.ts
 function isApiRoutePattern(pattern) {
 	return pattern === "/api" || pattern.startsWith("/api/");
@@ -96,7 +108,7 @@ function resolveAssetRoutingPolicy(inputs) {
 //#region src/cli/email-cloudflare.ts
 /** The `send_email` binding name Void provisions and the runtime reads. */
 const SEND_EMAIL_BINDING = "SEND_EMAIL";
-/** The root-config `vars` key carrying `void.json` `email.from` into the worker. */
+/** The root-config `vars` key carrying `void.config.ts` `email.from` into the worker. */
 const EMAIL_FROM_VAR = "__VOID_EMAIL_FROM";
 /** Cloudflare's public API base — the same one `wrangler` targets by default. */
 const CLOUDFLARE_API_BASE_URL = "https://api.cloudflare.com/client/v4";
@@ -133,17 +145,17 @@ function findEmailConfigConflicts(config) {
 		try {
 			owner = findBindingNameOwner(config, field, name);
 		} catch (err) {
-			conflicts.add(`wrangler.jsonc: ${err instanceof Error ? err.message : String(err)}`);
+			conflicts.add(`Cloudflare config: ${err instanceof Error ? err.message : String(err)}`);
 			return;
 		}
-		if (owner !== void 0) conflicts.add(`wrangler.jsonc already uses ${name} as a ${owner} binding; rename it (Void writes ${name} into ${field})`);
+		if (owner !== void 0) conflicts.add(`Cloudflare config already uses ${name} as a ${owner} binding; rename it in void.config.ts (Void writes ${name} into ${field})`);
 	};
 	check("send_email", SEND_EMAIL_BINDING);
 	check("vars", EMAIL_FROM_VAR);
 	return [...conflicts];
 }
 /**
-* Host part of `email.from`, lowercased; `null` when it is not `local@host`. `void.json`
+* Host part of `email.from`, lowercased; `null` when it is not `local@host`. `void.config.ts`
 * also accepts the display-name form (`Acme <noreply@mail.acme.com>`, see `config.ts`),
 * so the address inside `<…>` is read when present.
 *
@@ -663,7 +675,7 @@ async function preflightEmail(inputs) {
 			state: "foreign",
 			foreignName: names[0]
 		};
-		block("all", `wrangler.jsonc already has a send_email binding named ${JSON.stringify(names[0])}; rename it to ${SEND_EMAIL_BINDING} (a second binding would be silent)`);
+		block("all", `Cloudflare config already has a send_email binding named ${JSON.stringify(names[0])}; rename it to ${SEND_EMAIL_BINDING} in void.config.ts (a second binding would be silent)`);
 	}
 	if (inputs.existingAddresses !== void 0 && inputs.existingAddresses !== null) {
 		const existing = Array.isArray(inputs.existingAddresses) ? inputs.existingAddresses.map((a) => typeof a === "string" ? a.toLowerCase() : String(a)) : ["(not an array)"];
@@ -674,7 +686,7 @@ async function preflightEmail(inputs) {
 				state: "foreign",
 				foreign: unknown
 			};
-			block("all", `wrangler.jsonc addresses holds entries Void did not derive (${unknown.join(", ")}); remove ${unknown.map((a) => JSON.stringify(a)).join(", ")} from addresses, or manage addresses by hand and unset email.from — skipping email setup this deploy`);
+			block("all", `Cloudflare addresses holds entries Void did not derive (${unknown.join(", ")}); remove ${unknown.map((a) => JSON.stringify(a)).join(", ")} from cloudflare.addresses in void.config.ts, or manage addresses by hand and unset email.from — skipping email setup this deploy`);
 		} else {
 			pre.addressesOwnership = {
 				state: "mine",
@@ -710,7 +722,7 @@ function renderEmailChecklist(pre) {
 	const row = (label, value, note = "") => {
 		lines.push(`    ${pad(label, 10)}${note ? `${pad(value, 23)}${note}` : value}`);
 	};
-	row("domain", pre.domain, "(void.json email.from)");
+	row("domain", pre.domain, "(void.config.ts email.from)");
 	const session = [pre.session.accountName ? `account ${pre.session.accountName} (${shortId(pre.accountId)})` : `account ${shortId(pre.accountId)}`, pre.session.authType && pre.session.authType !== "OAuth Token" ? `session ${pre.session.email ? `${pre.session.email} ` : ""}(${pre.session.authType})` : pre.session.email ? `session ${pre.session.email}` : null].filter(Boolean).join(" · ");
 	row("zone", pre.zone.state === "found" ? apex : `${apex} ${pre.zone.state}`, session);
 	if (pre.mode === "subdomain") row("apex MX", pre.apexMx.exchanges[0] ?? (pre.apexMx.state === "unknown" ? "unknown" : "none"), "left alone — mail lives on the subdomain");
@@ -745,7 +757,7 @@ function renderEmailChecklist(pre) {
 	if (pre.binding.state !== "present") parts.push(`send_email: [{ name: "${SEND_EMAIL_BINDING}" }]`);
 	if (pre.addressesStale) parts.push(pre.addresses.length > 0 ? `addresses: ${JSON.stringify(pre.addresses)}` : "addresses: (removed)");
 	if (pre.sender.state !== "ready") parts.push(`vars.${EMAIL_FROM_VAR}: ${JSON.stringify(pre.from)}`);
-	if (parts.length > 0) change("wrangler.jsonc", parts.join(", "));
+	if (parts.length > 0) change("Cloudflare config", parts.join(", "));
 	for (const address of pre.rules.absent) change("routing rule (created on deploy)", `${address} → ${pre.workerName}`);
 	for (const foreign of pre.rules.foreign) warn(foreign.address, `already routed to ${foreign.owner}; left alone, not in addresses`);
 	for (const refused of pre.derived.refused) warn(refused.handler, refused.reason);
@@ -930,7 +942,7 @@ async function applyEmailSetup(pre, inputs) {
 		result.patch.addresses = null;
 		if (result.addressesWithheld && pre.addresses.length > 0) lines.push(`  ! config    addresses withheld this run (${bearerFailed ? "session-bearer step failed" : "routing not ready"}); no routing rule is created for ${pre.addresses.join(", ")}`);
 	}
-	if (result.patch.sendEmail || result.patch.addresses !== void 0) lines.push("  ✔ config    wrangler.jsonc updated");
+	if (result.patch.sendEmail || result.patch.addresses !== void 0) lines.push("  ✔ config    void.lock.json updated");
 	result.inboundReady = result.routingReady && result.subaddressingReady && !result.addressesWithheld;
 	return result;
 }
@@ -1643,9 +1655,7 @@ async function createCloudflarePrerenderRunner(options) {
 		voidStaging,
 		remoteMode
 	});
-	const wranglerUrl = import.meta.resolve("wrangler/package.json");
-	const miniflarePath = createRequire(wranglerUrl).resolve("miniflare");
-	const { Miniflare, convertV4MiniflareOptions } = await import(pathToFileURL(miniflarePath).href);
+	const { Miniflare, convertV4MiniflareOptions } = await import("miniflare");
 	const mfOptions = {
 		modules: collectPrerenderWorkerModules(workerDir, workerMain),
 		modulesRoot: workerDir,
@@ -1845,6 +1855,405 @@ async function prerenderPagesNode(options) {
 	return result;
 }
 //#endregion
+//#region src/cli/cf-version-runner.ts
+function failed(message) {
+	return {
+		status: 1,
+		stdout: "",
+		stderr: message
+	};
+}
+function flag(args, name) {
+	const index = args.indexOf(name);
+	return index < 0 ? void 0 : args[index + 1];
+}
+function parseJson(value) {
+	try {
+		return JSON.parse(value);
+	} catch {
+		return null;
+	}
+}
+function record(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function safePositional(value) {
+	return typeof value === "string" && value.length > 0 && !value.startsWith("-") && ![...value].some((character) => {
+		const code = character.charCodeAt(0);
+		return code < 32 || code === 127;
+	});
+}
+/** Prevent cf's prebuilt uploader from creating a resource as a side effect. */
+function createCfResourceVerifier(options) {
+	return async (directory) => {
+		const worker = parseJson(readFileSync(getWorkerConfigPath(directory), "utf8"));
+		if (!record(worker) || worker.env !== void 0 && !record(worker.env)) return failed("The Cloudflare Worker bindings were not readable.");
+		for (const [bindingName, value] of Object.entries(worker.env ?? {})) {
+			if (!record(value)) return failed(`Cloudflare binding ${bindingName} was not readable.`);
+			const identifier = (field) => safePositional(value[field]) ? value[field] : null;
+			if (value.type === "kv" || value.type === "d1" || value.type === "flagship") {
+				if (!identifier("id")) return failed(`Cloudflare binding ${bindingName} has no ID; refusing automatic provisioning.`);
+				continue;
+			}
+			if (value.type === "queue") {
+				const name = identifier("name");
+				if (!name) return failed(`Cloudflare Queue binding ${bindingName} has no name.`);
+				if (!options.verifyCompatibilityRunner()) return failed("The Cloudflare resource verifier changed during deployment.");
+				const found = await Promise.resolve(options.runWrangler([
+					"queues",
+					"info",
+					name,
+					"-c",
+					options.configPath,
+					"--env="
+				], { capture: true }));
+				if (found.status !== 0 || found.signal || found.error || found.stdout.trim() !== `Queue Name: ${name}`) return failed(`Cloudflare Queue ${name} is unavailable; refusing automatic provisioning.`);
+				continue;
+			}
+			const resource = value.type === "r2" ? {
+				kind: "R2 bucket",
+				field: "name",
+				command: [
+					"r2",
+					"buckets",
+					"get"
+				],
+				response: "name"
+			} : value.type === "dispatch-namespace" ? {
+				kind: "dispatch namespace",
+				field: "namespace",
+				command: [
+					"workers-for-platforms",
+					"dispatch-namespaces",
+					"get"
+				],
+				response: "namespace_name"
+			} : value.type === "ai-search-namespace" ? {
+				kind: "AI Search namespace",
+				field: "namespace",
+				command: [
+					"ai-search",
+					"namespace",
+					"get"
+				],
+				response: "name"
+			} : value.type === "agent-memory" ? {
+				kind: "Agent Memory namespace",
+				field: "namespace",
+				command: ["agent-memory", "get-namespace"],
+				response: "name"
+			} : null;
+			if (!resource) continue;
+			const name = identifier(resource.field);
+			if (!name) return failed(`Cloudflare ${resource.kind} binding ${bindingName} has no name.`);
+			const jurisdiction = value.type === "r2" ? value.jurisdiction : void 0;
+			if (jurisdiction !== void 0 && !safePositional(jurisdiction)) return failed(`Cloudflare R2 binding ${bindingName} has an invalid jurisdiction.`);
+			const result = options.runCf([
+				...resource.command,
+				name,
+				...jurisdiction ? ["--cf-r2-jurisdiction", jurisdiction] : []
+			], {
+				cwd: directory,
+				capture: true
+			});
+			const body = parseJson(result.stdout);
+			if (result.status !== 0 || result.signal || result.error || !record(body) || body[resource.response] !== name) return failed(`Cloudflare ${resource.kind} ${name} is unavailable; refusing automatic provisioning.`);
+		}
+		return {
+			status: 0,
+			stdout: "",
+			stderr: ""
+		};
+	};
+}
+/** Run the pinned package-local cf binary with Void's existing Cloudflare session. */
+function createCfCommand(options) {
+	const cf = join(dirname(fileURLToPath(import.meta.resolve("cf/package.json"))), "bin", "cf");
+	return (args, run) => {
+		if (!options.verifyUploader()) return failed("The Cloudflare uploader changed during deployment.");
+		const env = {
+			...options.env(options.accountId, options.apiBaseUrl),
+			CF_DELEGATION: "1"
+		};
+		if (env.HTTP_PROXY || env.HTTPS_PROXY || env.http_proxy || env.https_proxy) env.NODE_USE_ENV_PROXY = "1";
+		if (options.token) env.CLOUDFLARE_API_TOKEN = options.token;
+		const result = spawnSync(process.execPath, [cf, ...args], {
+			cwd: run.cwd,
+			env,
+			shell: false,
+			windowsHide: true,
+			encoding: "utf8",
+			maxBuffer: 268435456,
+			stdio: run.capture ? [
+				"ignore",
+				"pipe",
+				"pipe"
+			] : "inherit"
+		});
+		return {
+			status: typeof result.status === "number" ? result.status : 1,
+			stdout: result.stdout ?? "",
+			stderr: (result.stderr ?? "").replace(/\[(\d{4,})\]/g, "[code: $1]"),
+			signal: result.signal ?? null,
+			error: result.error?.message ?? null
+		};
+	};
+}
+/**
+* Adapt the stable activation protocol to cf's prebuilt and API commands.
+* The protocol keeps the existing preview, inheritance, traffic and rollback checks.
+*/
+function createCfVersionRunner(options) {
+	const { output, workerName, runCf } = options;
+	const run = (args, capture, cwd = output.directory) => runCf(args, {
+		cwd,
+		capture
+	});
+	const verifyResources = async (directory) => {
+		try {
+			return await options.verifyResources(directory);
+		} catch {
+			return failed("Cloudflare resources could not be verified before upload.");
+		}
+	};
+	return async (args, command) => {
+		if (args[0] === "deployments" && args[1] === "status") {
+			const result = run([
+				"workers",
+				"deployments",
+				"list",
+				"--worker",
+				workerName
+			], true);
+			if (result.status !== 0) return result;
+			const body = parseJson(result.stdout);
+			const deployments = record(body) ? body.deployments : void 0;
+			if (Array.isArray(deployments) && deployments.length === 0) return failed("The Cloudflare Worker has no deployments.");
+			if (!Array.isArray(deployments) || !record(deployments[0])) return failed("The Cloudflare Worker deployment was not readable.");
+			return {
+				...result,
+				stdout: JSON.stringify(deployments[0])
+			};
+		}
+		if (args[0] === "versions" && args[1] === "list") {
+			const pageSize = 10;
+			const readPage = (page) => {
+				const result = run([
+					"workers",
+					"versions",
+					"list",
+					"--worker-id",
+					workerName,
+					"--per-page",
+					String(pageSize),
+					"--page",
+					String(page)
+				], true);
+				const body = parseJson(result.stdout);
+				return {
+					result,
+					versions: Array.isArray(body) && body.length <= pageSize && body.every((item) => record(item) && typeof item.id === "string" && Number.isSafeInteger(item.number)) && new Set(body.map((item) => item.number)).size === body.length ? body : null
+				};
+			};
+			const first = readPage(1);
+			if (first.result.status !== 0) return first.result;
+			if (!first.versions) return failed("The Cloudflare Worker version list was not readable.");
+			const versions = [...first.versions];
+			if (versions.length === pageSize) {
+				const second = readPage(2);
+				if (second.result.status !== 0 || !second.versions) return failed("The Cloudflare Worker version history was not readable.");
+				if (second.versions.length > 0) {
+					const firstNumbers = versions.map((item) => item.number);
+					const secondNumbers = second.versions.map((item) => item.number);
+					if (Math.min(...secondNumbers) > Math.max(...firstNumbers)) {
+						versions.push(...second.versions);
+						let last = Math.max(...secondNumbers);
+						for (let page = 3; page <= 1e3 && second.versions.length === pageSize; page++) {
+							const next = readPage(page);
+							if (next.result.status !== 0 || !next.versions) return failed("The Cloudflare Worker version history was not readable.");
+							if (next.versions.length === 0) break;
+							const numbers = next.versions.map((item) => item.number);
+							if (Math.min(...numbers) <= last) return failed("The Cloudflare Worker version history changed during inspection.");
+							versions.push(...next.versions);
+							last = Math.max(...numbers);
+							if (next.versions.length < pageSize) break;
+							if (page === 1e3) return failed("The Cloudflare Worker version history is too large to verify.");
+						}
+					} else if (Math.max(...secondNumbers) >= Math.min(...firstNumbers)) return failed("The Cloudflare Worker version history changed during inspection.");
+				}
+			}
+			return {
+				...first.result,
+				stdout: JSON.stringify(versions.sort((a, b) => a.number - b.number).slice(-10))
+			};
+		}
+		if (args[0] === "versions" && args[1] === "view" && args[2]) {
+			const result = run([
+				"workers",
+				"versions",
+				"get",
+				args[2],
+				"--worker-id",
+				workerName
+			], true);
+			if (result.status !== 0) return result;
+			const version = parseJson(result.stdout);
+			if (!record(version) || version.id !== args[2] || !Array.isArray(version.bindings)) return failed("The Cloudflare Worker version was not readable.");
+			return {
+				...result,
+				stdout: JSON.stringify({
+					...version,
+					resources: { bindings: version.bindings }
+				})
+			};
+		}
+		if (args[0] === "versions" && args[1] === "upload") {
+			if (flag(args, "--name") !== workerName || args.includes("--assets") && flag(args, "--assets") !== output.assetsDirectory) return failed("The Cloudflare version upload target changed.");
+			const verified = await verifyResources(output.directory);
+			if (verified.status !== 0 || verified.signal || verified.error) return verified;
+			return run([
+				"workers",
+				"versions",
+				"create",
+				"--prebuilt",
+				...flag(args, "--message") ? ["--message", flag(args, "--message")] : [],
+				...flag(args, "--secrets-file") ? ["--secrets-file", flag(args, "--secrets-file")] : [],
+				...flag(args, "--preview-alias") ? ["--preview-alias", flag(args, "--preview-alias")] : []
+			], command.capture);
+		}
+		if (args[0] === "versions" && args[1] === "deploy") {
+			if (flag(args, "--name") !== workerName) return failed("The Cloudflare deployment target changed.");
+			const flagsStart = args.findIndex((item, index) => index >= 2 && item.startsWith("-"));
+			const versions = args.slice(2, flagsStart < 0 ? void 0 : flagsStart);
+			if (!versions.every((item) => /^[0-9a-f-]{36}@\d+(?:\.\d+)?$/i.test(item))) return failed("The Cloudflare deployment versions were invalid.");
+			const parsed = versions.map((item) => {
+				const [version_id, percentage] = item.split("@");
+				return {
+					version_id,
+					percentage: Number(percentage)
+				};
+			});
+			if (parsed.length === 0 || new Set(parsed.map((item) => item.version_id)).size !== parsed.length || parsed.some((item) => item.percentage < 0 || item.percentage > 100) || Math.abs(parsed.reduce((sum, item) => sum + item.percentage, 0) - 100) > .001) return failed("The Cloudflare deployment percentages were invalid.");
+			return run([
+				"workers",
+				"deployments",
+				"create",
+				"--worker",
+				workerName,
+				"--strategy",
+				"percentage",
+				"--versions",
+				JSON.stringify(parsed),
+				...flag(args, "--message") ? ["--body", JSON.stringify({
+					strategy: "percentage",
+					versions: parsed,
+					annotations: { "workers/message": flag(args, "--message") }
+				})] : []
+			], command.capture);
+		}
+		if (args[0] === "deploy") {
+			if (flag(args, "--name") !== workerName || args.includes("--assets") && flag(args, "--assets") !== output.assetsDirectory) return failed("The Cloudflare bootstrap target changed.");
+			const verified = await verifyResources(output.directory);
+			if (verified.status !== 0 || verified.signal || verified.error) return verified;
+			return run([
+				"deploy",
+				"--prebuilt",
+				...flag(args, "--message") ? ["--message", flag(args, "--message")] : [],
+				...flag(args, "--secrets-file") ? ["--secrets-file", flag(args, "--secrets-file")] : []
+			], command.capture);
+		}
+		if (args[0] === "triggers" && args[1] === "deploy") {
+			const configPath = flag(args, "-c");
+			if (!configPath || flag(args, "--name") !== workerName) return failed("The Cloudflare trigger target changed.");
+			const raw = parseJson(readFileSync(configPath, "utf8"));
+			if (!record(raw) || raw.name !== workerName) return failed("The Cloudflare trigger snapshot was not readable.");
+			const directory = mkdtempSync(join(tmpdir(), "void-cf-triggers-"));
+			try {
+				cpSync(join(output.directory, ".cloudflare"), join(directory, ".cloudflare"), { recursive: true });
+				const workerPath = getWorkerConfigPath(directory);
+				const worker = parseJson(readFileSync(workerPath, "utf8"));
+				if (!record(worker)) return failed("The private Cloudflare Worker config was not readable.");
+				const migrated = migrateBuiltWranglerConfig({
+					...raw,
+					compatibility_date: worker.compatibilityDate
+				}).worker;
+				if (!migrated) return failed("The Cloudflare trigger snapshot was not convertible.");
+				const next = migrated.triggers ?? [];
+				const previous = Array.isArray(worker.triggers) ? worker.triggers : [];
+				const preserveRoutes = raw.routes === void 0 && raw.route === void 0;
+				const preserveEmail = raw.addresses === void 0;
+				worker.triggers = [
+					...next,
+					...preserveRoutes ? previous.filter((trigger) => record(trigger) && trigger.type === "fetch") : [],
+					...preserveEmail ? previous.filter((trigger) => record(trigger) && trigger.type === "email") : []
+				];
+				for (const field of ["env", "exports"]) {
+					const previous = record(worker[field]) ? worker[field] : {};
+					worker[field] = {
+						...Object.fromEntries(Object.entries(previous).filter(([, value]) => !record(value) || value.type !== "workflow")),
+						...migrated[field]
+					};
+				}
+				if (!preserveRoutes) worker.domains = migrated.domains ?? [];
+				if (typeof raw.workers_dev === "boolean") worker.workersDev = raw.workers_dev;
+				if (typeof raw.preview_urls === "boolean") worker.previewUrls = raw.preview_urls;
+				writeFileSync(workerPath, JSON.stringify(worker), { mode: 384 });
+				await readBuildOutput(directory);
+				const verified = await verifyResources(directory);
+				if (verified.status !== 0 || verified.signal || verified.error) return verified;
+				return run([
+					"workers",
+					"triggers",
+					"deploy",
+					"--prebuilt"
+				], command.capture, directory);
+			} finally {
+				rmSync(directory, {
+					recursive: true,
+					force: true
+				});
+			}
+		}
+		if (args[0] === "queues" && args[1] === "consumer" && args[2] === "remove") {
+			const queueName = args[3];
+			if (!queueName || args[4] !== workerName) return failed("The Cloudflare Queue consumer target changed.");
+			const queues = run(["queues", "list"], true);
+			if (queues.status !== 0) return queues;
+			const allQueues = parseJson(queues.stdout);
+			if (!Array.isArray(allQueues)) return failed("The Cloudflare Queue list was not readable.");
+			const queue = allQueues.find((item) => record(item) && item.queue_name === queueName);
+			if (!record(queue) || typeof queue.queue_id !== "string") return failed(`Cloudflare Queue ${queueName} was not found.`);
+			const consumers = run([
+				"queues",
+				"consumers",
+				"list",
+				"--queue-id",
+				queue.queue_id
+			], true);
+			if (consumers.status !== 0) return consumers;
+			const allConsumers = parseJson(consumers.stdout);
+			if (!Array.isArray(allConsumers)) return failed("The Cloudflare Queue consumers were not readable.");
+			const matching = allConsumers.filter((item) => record(item) && item.script === workerName);
+			if (matching.length === 0) return {
+				status: 0,
+				stdout: "",
+				stderr: ""
+			};
+			if (matching.length !== 1 || !record(matching[0]) || typeof matching[0].consumer_id !== "string") return failed("The Cloudflare Queue consumer identity was ambiguous.");
+			return run([
+				"queues",
+				"consumers",
+				"delete",
+				matching[0].consumer_id,
+				"--queue-id",
+				queue.queue_id,
+				"--force"
+			], command.capture);
+		}
+		return failed(`Unsupported Cloudflare activation operation: ${args[0] ?? ""} ${args[1] ?? ""}`);
+	};
+}
+//#endregion
 //#region src/cli/cloudflare-deploy/classify.ts
 /**
 * Narrow native Cloudflare deploys to app shapes whose emitted Worker artifact
@@ -1860,14 +2269,14 @@ function classifyCloudflareDeployApp(root, voidConfig, options) {
 	if (framework) {
 		if (!FRAMEWORK_PRESETS[framework.name]) return unsupported(`deploy: --platform cloudflare has no deployment preset for framework ${framework.name}.`);
 	}
-	const staticPreset = detectPreset(root, {
+	const staticPreset = framework ? null : detectPreset(root, {
 		dir: options.dir,
 		spa: options.spa
 	});
 	const configuredStatic = voidConfig.inference?.appType === "static" || voidConfig.inference?.appType === "spa";
 	if (staticPreset || configuredStatic || options.dir || options.spa) return unsupported([
 		`deploy: --platform cloudflare could not resolve the ${staticPreset?.appType ?? (options.spa ? "spa" : "static")} output to deploy.`,
-		"Set inference.outputDir in void.json, pass --dir with an existing build directory,",
+		"Set inference.outputDir in void.config.ts, pass --dir with an existing build directory,",
 		"or add a supported build tool so Void can locate the generated static assets."
 	].join("\n"));
 	if (!framework && !hasBackendFiles(root)) return unsupported([
@@ -1910,7 +2319,7 @@ function approvedCloudflareIsrBinding(config, rootConfig) {
 /** Persist the migration decision in source configuration, not a temporary link marker. */
 async function chooseCloudflareIsr(root, config, options) {
 	if (config.routing?.isr !== void 0) return config.routing.isr;
-	if (!options.interactive) throw new Error("This migration needs an ISR caching choice. Set routing.isr to true in void.json to provision the KV cache, or false to keep rendering on each request, then rerun `void deploy`.");
+	if (!options.interactive) throw new Error("This migration needs an ISR caching choice. Set routing.isr to true in void.config.ts to provision the KV cache, or false to keep rendering on each request, then rerun `void deploy`.");
 	const enabled = await (options.confirm ?? (async (message) => {
 		const answer = await confirm({
 			message,
@@ -1918,18 +2327,27 @@ async function chooseCloudflareIsr(root, config, options) {
 		});
 		if (isCancel(answer)) throw new Error("ISR setup cancelled. Rerun `void deploy` to finish linking.");
 		return answer === true;
-	}))("Enable ISR caching for this app? Yes provisions a Cloudflare KV cache; No keeps caching disabled until you change void.json.");
-	const path = join(root, "void.json");
-	const source = existsSync(path) ? readFileSync(path, "utf8") : "{}\n";
-	writeFileSync(path, applyEdits(source, modify(source, ["routing", "isr"], enabled, { formattingOptions: {
-		insertSpaces: true,
-		tabSize: 2
-	} })));
+	}))("Enable ISR caching for this app? Yes provisions a Cloudflare KV cache; No keeps caching disabled until you change void.config.ts.");
+	if (existsSync(join(root, "void.config.ts"))) writeVoidProjectConfig(root, {
+		...config,
+		routing: {
+			...config.routing,
+			isr: enabled
+		}
+	});
+	else {
+		const path = join(root, "void.json");
+		const source = existsSync(path) ? readFileSync(path, "utf8") : "{}\n";
+		writeFileSync(path, applyEdits(source, modify(source, ["routing", "isr"], enabled, { formattingOptions: {
+			insertSpaces: true,
+			tabSize: 2
+		} })));
+	}
 	config.routing = {
 		...config.routing,
 		isr: enabled
 	};
-	log$1.info(`Saved routing.isr: ${String(enabled)} in void.json. ISR caching ${enabled ? "will be enabled in this deployment" : "stays disabled until you change this setting"}.`);
+	log$1.info(`Saved routing.isr: ${String(enabled)} in void.config.ts. ISR caching ${enabled ? "will be enabled in this deployment" : "stays disabled until you change this setting"}.`);
 	return enabled;
 }
 //#endregion
@@ -2014,22 +2432,25 @@ async function prepareExistingCloudflareDeploy(options) {
 		workerName: config.name
 	});
 	writeFileSync(options.configPath, updated);
+	persistCloudflareConfig(options.root);
 	return existing;
 }
 /** Offer the existing destination before the legacy hosted-platform fallback. */
 async function maybeLinkCloudflareDeploy(root, options = {}, deps = {}) {
 	if (options.platform || options.backend || options.projectSlug || process.env.VOID_PROJECT || readDeploymentPlatform(root) !== null) return null;
-	const files = [
+	const files = [.../* @__PURE__ */ new Set([...[
 		"wrangler.jsonc",
 		"wrangler.json",
 		"wrangler.toml"
-	].filter((name) => existsSync(join(root, name)));
-	if (!files.length) return null;
+	].filter((name) => existsSync(join(root, name))), ...discoverFrameworkWranglerFiles(root)])];
+	if (!files.length && !existsSync(join(root, "void.config.ts"))) return null;
 	if (files.length > 1) throw new Error("Multiple Wrangler config files were found. Keep one root configuration before linking to Cloudflare.");
-	const name = files[0];
+	const name = files[0] ?? ".void-wrangler.jsonc";
 	if (name.endsWith(".toml")) throw new Error("Found wrangler.toml. Direct Cloudflare deployment currently needs a root wrangler.jsonc or wrangler.json with the same settings. Convert the config before linking.");
 	const errors = [];
-	const config = parse(readFileSync(join(root, name), "utf8"), errors, { allowTrailingComma: true });
+	const configPath = files.length ? join(root, name) : materializeCloudflareConfig(root);
+	const config = parse(readFileSync(configPath, "utf8"), errors, { allowTrailingComma: true });
+	if (!files.length && (!config || typeof config.name !== "string" || !config.name.trim())) return null;
 	if (errors.length || !config || typeof config !== "object" || Array.isArray(config) || typeof config.name !== "string" || !config.name.trim()) throw new Error(`Set the existing Worker's name in a valid ${name} before linking to Cloudflare.`);
 	if (!(deps.interactive ?? Boolean(process.stdin.isTTY && process.stdout.isTTY))) throw new Error(`Found ${name} without a deployment destination. Run void deploy interactively to link the existing Worker, or use void deploy --platform cloudflare with Cloudflare credentials in CI.`);
 	log$1.info(`Found ${basename(name)} for Worker "${config.name}".`);
@@ -2084,6 +2505,44 @@ function readCloudflareLocalState(root) {
 	}
 }
 //#endregion
+//#region src/cli/installed-void.ts
+/** A global CLI still builds with the project's installed Vite plugin. */
+function assertInstalledVoidMatchesCli(root) {
+	const projectManifest = join(root, "package.json");
+	if (!existsSync(projectManifest)) return;
+	const project = JSON.parse(readFileSync(projectManifest, "utf8"));
+	if (![
+		"dependencies",
+		"devDependencies",
+		"optionalDependencies"
+	].some((key) => {
+		const dependencies = project[key];
+		return typeof dependencies === "object" && dependencies !== null && "void" in dependencies;
+	})) return;
+	const cliPackageDir = getPackageDir();
+	const cli = JSON.parse(readFileSync(join(cliPackageDir, "package.json"), "utf8"));
+	let installedVersion;
+	let installedPackageDir;
+	try {
+		const entry = createRequire(projectManifest).resolve("void");
+		let directory = dirname(entry);
+		for (let depth = 0; depth < 8; depth++) {
+			const manifest = join(directory, "package.json");
+			if (existsSync(manifest)) {
+				const installed = JSON.parse(readFileSync(manifest, "utf8"));
+				if (installed.name === "void") {
+					installedVersion = installed.version;
+					installedPackageDir = directory;
+					break;
+				}
+			}
+			directory = dirname(directory);
+		}
+	} catch {}
+	if (installedVersion !== cli.version) throw new Error(`deploy: this CLI is void@${cli.version}, but the project's installed Vite plugin is ${installedVersion ? `void@${installedVersion}` : "missing"}. Install the same Void version in the project (or link this development checkout) before deploying. The build imports the project package; mixing versions can rewrite legacy config and produce an unsafe Cloudflare deploy target.`);
+	if (installedPackageDir && existsSync(join(cliPackageDir, "src", "index.ts")) && realpathSync(installedPackageDir) !== realpathSync(cliPackageDir)) throw new Error("deploy: this development CLI and the project Vite plugin come from different Void builds, even though their package versions match. Link the same development checkout into the project before deploying.");
+}
+//#endregion
 //#region src/cli/deploy-errors.ts
 const BODY_SNIPPET_MAX = 200;
 function trimSnippet(body) {
@@ -3372,7 +3831,7 @@ function selectBundledEntryFilename(outFiles) {
 * Determine whether a wrapper is needed based on the features.
 */
 function needsWrapper(features) {
-	return features.crons.length > 0 || features.queues.length > 0 || !!features.hasMigrations || !!features.readiness;
+	return features.crons.length > 0 || features.queues.length > 0 || !!features.hasMigrations || !!features.readiness || !!features.isr;
 }
 /**
 * Generate a wrapper entry in-place in the worker directory.
@@ -3424,8 +3883,8 @@ async function generateWrapper(workerDir, workerMain, root, features) {
 	let migrations;
 	let migrationPlanBundle;
 	if (features.hasMigrations) {
-		const { collectMigrations } = await import("./validate-tBBN_dXH.mjs").then((n) => n.l);
-		const { buildMigrationPlanBundle } = await import("./validate-tBBN_dXH.mjs").then((n) => n.s);
+		const { collectMigrations } = await import("./collect-DAUItMDS.mjs");
+		const { buildMigrationPlanBundle } = await import("./plan-DpuOr14e.mjs");
 		const migrationsDir = readProjectPaths(root).migrationsDir;
 		migrations = collectMigrations(migrationsDir);
 		migrationPlanBundle = features.migrationDialect === "sqlite" ? buildMigrationPlanBundle(migrations) : void 0;
@@ -3438,6 +3897,7 @@ async function generateWrapper(workerDir, workerMain, root, features) {
 		if (!existsSync(handlerPath)) throw new Error(`Migration handler not found: ${handlerFilename_}. Run "pnpm -C packages/void build" first.`);
 		await bundleMigrationHandler(root, workerDir, handlerPath, features.migrationDialect ?? "sqlite");
 	}
+	if (features.isr) await bundleFrameworkIsr(root, workerDir);
 	const wrapperSource = generateWrapperSource(renamedName, handlerFilename, features, migrations, migrationPlanBundle);
 	const stagedPath = `${mainPath}.${crypto.randomUUID()}.tmp`;
 	try {
@@ -3448,6 +3908,33 @@ async function generateWrapper(workerDir, workerMain, root, features) {
 		rmSync(stagedPath, { force: true });
 	}
 }
+async function bundleFrameworkIsr(root, workerDir) {
+	const entry = fileURLToPath(import.meta.resolve("@void/isr/runtime"));
+	const tmpDir = join(root, ".void", "isr");
+	const outDir = join(tmpDir, "out");
+	mkdirSync(tmpDir, { recursive: true });
+	await build({
+		root: tmpDir,
+		logLevel: "silent",
+		ssr: { noExternal: true },
+		build: {
+			outDir,
+			emptyOutDir: true,
+			minify: false,
+			ssr: entry,
+			target: "esnext",
+			rollupOptions: {
+				input: entry,
+				external: [/^cloudflare:/, /^node:/],
+				output: {
+					entryFileNames: "__void_isr.mjs",
+					chunkFileNames: "__void_isr-[hash].mjs"
+				}
+			}
+		}
+	});
+	for (const file of readdirSync(outDir)) copyFileSync(join(outDir, file), join(workerDir, file));
+}
 async function bundleMigrationHandler(root, workerDir, handlerPath, dialect) {
 	const tmpDir = join(root, ".void", "migration-handler");
 	mkdirSync(tmpDir, { recursive: true });
@@ -3602,6 +4089,7 @@ function cleanupWrapper(root) {
 	for (const directory of [
 		"handlers",
 		"migration-handler",
+		"isr",
 		"bundle"
 	]) rmSync(join(voidDir, directory), {
 		recursive: true,
@@ -3612,6 +4100,14 @@ function generateWrapperSource(renamedEntry, handlersModule, features, migration
 	const lines = [];
 	lines.push(WRAPPER_MARKER);
 	lines.push(`import original from "./${renamedEntry}";`);
+	if (features.isr) {
+		lines.push("import { handleFrameworkIsr } from \"./__void_isr.mjs\";");
+		lines.push(`const __voidIsrDeploymentId = ${JSON.stringify(crypto.randomUUID())};`);
+		lines.push(`const __voidIsrPolicy = ${JSON.stringify({
+			revalidate: features.isr.revalidate,
+			queryAllowlist: features.isr.queryAllowlist
+		})};`);
+	}
 	if (features.crons.length > 0) lines.push(`import { handleScheduled } from "./${handlersModule}";`);
 	if (features.queues.length > 0) lines.push(`import { handleQueue, handleQueueRelay } from "./${handlersModule}";`);
 	if (migrations && migrations.length > 0) {
@@ -3621,10 +4117,14 @@ function generateWrapperSource(renamedEntry, handlersModule, features, migration
 		lines.push(`const __migrationDialect = ${JSON.stringify(features.migrationDialect ?? "sqlite")};`);
 	}
 	lines.push("");
-	const needsFetchWrap = features.readiness || features.crons.length > 0 || features.queues.length > 0 || migrations && migrations.length > 0;
+	const needsFetchWrap = features.readiness || features.crons.length > 0 || features.queues.length > 0 || migrations && migrations.length > 0 || !!features.isr;
 	if (needsFetchWrap) {
 		lines.push("async function wrappedFetch(request, env, ctx) {");
 		lines.push("  const url = new URL(request.url);");
+		if (features.isr) {
+			lines.push("  env.__VOID_ISR_DEPLOYMENT_ID ??= __voidIsrDeploymentId;");
+			lines.push("  env.__VOID_ISR_HOST = url.hostname;");
+		}
 		if (features.readiness || features.crons.length > 0 || features.queues.length > 0 || features.hasMigrations) {
 			lines.push("  if (request.method === \"GET\" && url.pathname === \"/__void/ready\") {");
 			lines.push("    return Response.json({ ready: true });");
@@ -3686,6 +4186,12 @@ function generateWrapperSource(renamedEntry, handlersModule, features, migration
 			lines.push("    }");
 			lines.push("  }");
 		}
+		if (features.isr) {
+			lines.push("  if (env.ISR_CACHE && request.headers.get(\"upgrade\")?.toLowerCase() !== \"websocket\") {");
+			lines.push("    const cached = await handleFrameworkIsr(request, env, ctx, { ...__voidIsrPolicy, deploymentId: __voidIsrDeploymentId }, (req) => original.fetch(req, env, ctx));");
+			lines.push("    if (cached) return cached;");
+			lines.push("  }");
+		}
 		lines.push("  return original.fetch(request, env, ctx);");
 		lines.push("}");
 		lines.push("");
@@ -3693,8 +4199,8 @@ function generateWrapperSource(renamedEntry, handlersModule, features, migration
 	lines.push("export default {");
 	if (needsFetchWrap) lines.push("  fetch: wrappedFetch,");
 	else lines.push("  fetch: original.fetch,");
-	if (features.crons.length > 0) lines.push("  scheduled: handleScheduled,");
-	if (features.queues.length > 0) lines.push("  queue: handleQueue,");
+	if (features.crons.length > 0) lines.push(features.isr ? "  scheduled(controller, env, ctx) { env.__VOID_ISR_DEPLOYMENT_ID ??= __voidIsrDeploymentId; return handleScheduled(controller, env, ctx); }," : "  scheduled: handleScheduled,");
+	if (features.queues.length > 0) lines.push(features.isr ? "  queue(batch, env, ctx) { env.__VOID_ISR_DEPLOYMENT_ID ??= __voidIsrDeploymentId; return handleQueue(batch, env, ctx); }," : "  queue: handleQueue,");
 	lines.push("};");
 	return lines.join("\n");
 }
@@ -3782,66 +4288,6 @@ export async function handleQueueRelay(payload, env, ctx) {
 }
 //#endregion
 //#region src/cli/deploy.ts
-var deploy_exports = /* @__PURE__ */ __exportAll({
-	CloudflareAuthSecretError: () => CloudflareAuthSecretError,
-	DEPLOY_PASSTHROUGH_ASSERT_FIELDS: () => DEPLOY_PASSTHROUGH_ASSERT_FIELDS,
-	DEPLOY_PASSTHROUGH_EXCLUDE_FIELDS: () => DEPLOY_PASSTHROUGH_EXCLUDE_FIELDS,
-	DEPLOY_WHOLE_OBJECT_PINNED_FIELDS: () => DEPLOY_WHOLE_OBJECT_PINNED_FIELDS,
-	applyDeployEvent: () => applyDeployEvent,
-	assembleVoidManifest: () => assembleVoidManifest,
-	assertManagedDurableStateSupported: () => assertManagedDurableStateSupported,
-	assertMigrationsProduceAuthSchema: () => assertMigrationsProduceAuthSchema,
-	assertNoConfigOverrideInProjectDotenv: () => assertNoConfigOverrideInProjectDotenv,
-	assertRemoteMigrationsDeployable: () => assertRemoteMigrationsDeployable,
-	assertWranglerUploaderUnchanged: () => assertWranglerUploaderUnchanged,
-	checkWranglerMigrationApplySet: () => checkWranglerMigrationApplySet,
-	compareWranglerMigrationPaths: () => compareWranglerMigrationPaths,
-	computeDesiredCloudflareResources: () => computeDesiredCloudflareResources,
-	createDeployWranglerRunner: () => createDeployWranglerRunner,
-	deployChildEnv: () => deployChildEnv,
-	deriveWorkerName: () => deriveWorkerName,
-	discoverRootWranglerConfig: () => discoverRootWranglerConfig,
-	ensureCloudflareAuthSecret: () => ensureCloudflareAuthSecret,
-	ensurePreviouslyDeployedLiveBindingConfig: () => ensurePreviouslyDeployedLiveBindingConfig,
-	formatCloudflareActivationError: () => formatCloudflareActivationError,
-	formatCloudflareSandboxUnavailable: () => formatCloudflareSandboxUnavailable,
-	generateDeployWrapperIfNeeded: () => generateDeployWrapperIfNeeded,
-	hasDeploySchemaDrift: () => hasDeploySchemaDrift,
-	hasNonPageBackend: () => hasNonPageBackend,
-	hasPrerenderSources: () => hasPrerenderSources,
-	hashWranglerUploader: () => hashWranglerUploader,
-	isWranglerNonInteractiveOrCI: () => isWranglerNonInteractiveOrCI,
-	loadProvisionModule: () => loadProvisionModule,
-	parseRootWranglerConfig: () => parseRootWranglerConfig$1,
-	prepareCloudflareFrameworkArtifact: () => prepareCloudflareFrameworkArtifact,
-	promptDeployProjectConfig: () => promptDeployProjectConfig,
-	reconstructExpectedContainers: () => reconstructExpectedContainers,
-	resolveCloudflareVoidStaticPreset: () => resolveCloudflareVoidStaticPreset,
-	resolveDeployLiveBindingConfig: () => resolveDeployLiveBindingConfig,
-	resolveDeployTransport: () => resolveDeployTransport,
-	resolveDeployWorkerMain: () => resolveDeployWorkerMain,
-	resolveDeployWranglerCompat: () => resolveDeployWranglerCompat,
-	resolveDeploymentPlatform: () => resolveDeploymentPlatform,
-	resolveDistDir: () => resolveDistDir,
-	resolveFullDeployBuildCommand: () => resolveFullDeployBuildCommand,
-	resolveStaticBuildCommand: () => resolveStaticBuildCommand,
-	resolveStaticDeployPreset: () => resolveStaticDeployPreset,
-	resolveWorkerDirName: () => resolveWorkerDirName,
-	resolveWranglerMigrationPattern: () => resolveWranglerMigrationPattern,
-	runCloudflareDeploy: () => runCloudflareDeploy,
-	runDeploy: () => runDeploy,
-	runStaticDeploy: () => runStaticDeploy,
-	runWranglerAuthToken: () => runWranglerAuthToken,
-	snapshotBindingIdentities: () => snapshotBindingIdentities,
-	snapshotPassthroughIdentities: () => snapshotPassthroughIdentities,
-	snapshotPassthroughRawFields: () => snapshotPassthroughRawFields,
-	streamDeployEvents: () => streamDeployEvents,
-	validateAuthMigrationSchema: () => validateAuthMigrationSchema,
-	verifyGeneratedDeployConfig: () => verifyGeneratedDeployConfig,
-	warnIgnoredNotFoundForFramework: () => warnIgnoredNotFoundForFramework,
-	warnRedundantForceOn3xx: () => warnRedundantForceOn3xx,
-	warnUnpublishedRouting: () => warnUnpublishedRouting
-});
 const drizzleKitBin = join(fileURLToPath(import.meta.resolve("drizzle-kit")), "..", "bin.cjs");
 const deployDriftCheckDir = join(".void", "deploy-drift-check");
 let loadedProvisionModule;
@@ -3851,7 +4297,7 @@ let loadedProvisionModule;
 * so a managed deploy never imports it — and thus never loads `proper-lockfile`.
 */
 async function loadProvisionModule() {
-	loadedProvisionModule ??= await import("./provision-CSJOjjQk.mjs").then((n) => n.a);
+	loadedProvisionModule ??= await import("./provision-CNgEBkVA.mjs");
 	return loadedProvisionModule;
 }
 /**
@@ -4438,6 +4884,34 @@ function hashWranglerUploader(root, resolveArgv = resolveWranglerArgv) {
 	if (typeof entry !== "string" || entry.length === 0 || !existsSync(entry)) return;
 	return hashDirectoryContents(dirname(entry));
 }
+/** Pin the cf uploader and prebuilt-artifact builders before project code runs. */
+function hashCfUploader() {
+	try {
+		const hash = createHash("sha256");
+		for (const name of [
+			"cf",
+			"@cloudflare/config",
+			"@cloudflare/build-output-utils",
+			"vite"
+		]) {
+			let path = dirname(fileURLToPath(import.meta.resolve(name)));
+			while (!existsSync(join(path, "package.json"))) {
+				const parent = dirname(path);
+				if (parent === path) return;
+				path = parent;
+			}
+			const contents = hashDirectoryContents(path);
+			if (!contents) return;
+			hash.update(name);
+			hash.update("\0");
+			hash.update(contents);
+			hash.update("\0");
+		}
+		return hash.digest("hex");
+	} catch {
+		return;
+	}
+}
 /**
 * sha256 over every file under `dir`, walked in a STABLE (name-sorted, depth-first) order with
 * each file's relative path folded into the digest, so the hash depends only on the directory's
@@ -4475,11 +4949,11 @@ function hashDirectoryContents(dir) {
 function assertWranglerUploaderUnchanged(before, after) {
 	if (before === void 0 || after === void 0) return {
 		ok: false,
-		reason: `could not resolve or hash the wrangler uploader to verify it across the build — refusing to run a deploy binary that cannot be verified.`
+		reason: `could not resolve or hash the Cloudflare uploader to verify it across the build — refusing to run a deploy binary that cannot be verified.`
 	};
 	if (before !== after) return {
 		ok: false,
-		reason: `the build modified the wrangler uploader (its bundle hash changed across the build) — refusing to run it with your Cloudflare credentials.`
+		reason: `the build modified the Cloudflare uploader (its bundle hash changed across the build) — refusing to run it with your Cloudflare credentials.`
 	};
 	return { ok: true };
 }
@@ -4732,14 +5206,12 @@ function resolveGeneratedDeployConfigPathDefault(root) {
 function readGeneratedDeployConfig(root) {
 	const redirectedPath = resolveGeneratedDeployConfigPathDefault(root);
 	try {
-		const config = JSON.parse(readFileSync(redirectedPath, "utf-8"));
-		if (config === null || typeof config !== "object" || Array.isArray(config)) throw new Error("malformed config");
 		return {
 			path: redirectedPath,
-			config
+			config: readGeneratedWranglerConfigFile(redirectedPath)
 		};
 	} catch {
-		throw new Error(`Generated Cloudflare deploy config ${redirectedPath} is missing or invalid JSON.`);
+		throw new Error(`Generated Cloudflare deploy config ${redirectedPath} is missing or invalid JSON/JSONC.`);
 	}
 }
 /** Older project plugins can repeat root flags; normalize only the generated artifact. */
@@ -4827,11 +5299,11 @@ function verifyGeneratedDeployConfig(root, expected) {
 	};
 	let generated;
 	try {
-		generated = JSON.parse(readFileSync(redirectedPath, "utf-8"));
+		generated = readGeneratedWranglerConfigFile(redirectedPath);
 	} catch {
 		return {
 			ok: false,
-			reason: `generated wrangler config ${redirectedPath} is not valid JSON.`
+			reason: `generated wrangler config ${redirectedPath} is not valid JSON/JSONC.`
 		};
 	}
 	if (generated.account_id !== expected.accountId) return {
@@ -5648,16 +6120,12 @@ function createDeployWranglerRunner(root, accountId, apiBaseUrl) {
 	const [command, ...prefix] = resolveWranglerArgv(root);
 	return (args, opts) => {
 		const childEnv = deployChildEnv(accountId, apiBaseUrl);
-		const keyringTerminal = cloudflareKeyringNeedsTerminal(args);
-		if (!opts.capture || keyringTerminal) childEnv.WRANGLER_LOG = "none";
+		const interactiveLogin = cloudflareAuthNeedsTerminal(args);
+		if (!opts.capture || interactiveLogin) childEnv.WRANGLER_LOG = "none";
 		if (opts.env) Object.assign(childEnv, opts.env);
 		const result = spawnSync(command, [...prefix, ...args], {
 			cwd: root,
-			stdio: keyringTerminal ? [
-				"inherit",
-				"inherit",
-				"ignore"
-			] : opts.input === void 0 ? opts.capture ? [
+			stdio: interactiveLogin ? "inherit" : opts.input === void 0 ? opts.capture ? [
 				"ignore",
 				"pipe",
 				"pipe"
@@ -5791,7 +6259,7 @@ async function runCloudflareEmailStep(input) {
 	};
 	const from = input.voidConfig.email?.from;
 	if (!from) {
-		log.warn(["deploy: this app uses email, but void.json names no sender.", "Add \"email\": { \"from\": \"you@mail.acme.com\" } to void.json — deploying without email."].join("\n"));
+		log.warn(["deploy: this app uses email, but void.config.ts names no sender.", "Set email.from to \"you@mail.acme.com\" in void.config.ts — deploying without email."].join("\n"));
 		return without;
 	}
 	const { rootConfig } = input;
@@ -5900,7 +6368,7 @@ async function runCloudflareEmailStep(input) {
 		};
 	};
 	if (pre.blockers.some((b) => b.scope === "all")) return leaveAccount(`email on ${pre.domain} cannot be set up from here.`);
-	if (input.nonInteractive) return leaveAccount([`email on ${pre.domain} is not ${shipsBinding ? "fully " : ""}set up, and this shell cannot ask.`, "Run `void email setup --platform cloudflare` once locally, commit wrangler.jsonc, then redeploy."].join("\n"));
+	if (input.nonInteractive) return leaveAccount([`email on ${pre.domain} is not ${shipsBinding ? "fully " : ""}set up, and this shell cannot ask.`, "Run `void email setup --platform cloudflare` once locally, commit void.lock.json, then redeploy."].join("\n"));
 	if (!await input.confirm(`Set up email on ${pre.domain}?`)) return leaveAccount("email setup skipped — run `void email setup --platform cloudflare` later.");
 	const out = await applyEmailSetup(pre, inputs);
 	if (out.lines.length > 0) log.message(out.lines.join("\n"));
@@ -5962,6 +6430,11 @@ async function ensureCloudflareAuthSecret(options) {
 	};
 	if ((await list(true)).includes(BETTER_AUTH_SECRET_NAME)) return { created: false };
 	const secret = randomBytes(32).toString("hex");
+	if (workerWasMissing) return {
+		created: true,
+		workerWasMissing: true,
+		candidateSecret: secret
+	};
 	beforeRun();
 	let put;
 	try {
@@ -5979,8 +6452,8 @@ async function ensureCloudflareAuthSecret(options) {
 	} catch {
 		throw new CloudflareAuthSecretError(`deploy: could not create the remote ${BETTER_AUTH_SECRET_NAME}. No worker was uploaded. Run \`void secret put ${BETTER_AUTH_SECRET_NAME}\` and retry.`, "put-failed");
 	}
-	if (!isCleanWranglerExit(put)) throw new CloudflareAuthSecretError(`deploy: could not create the remote ${BETTER_AUTH_SECRET_NAME} (wrangler exit ${String(put.status)}). No worker was uploaded. Run \`void secret put ${BETTER_AUTH_SECRET_NAME}\` and retry.`, "put-failed");
-	if (!(await list(false)).includes(BETTER_AUTH_SECRET_NAME)) throw new CloudflareAuthSecretError(`deploy: wrangler reported success but ${BETTER_AUTH_SECRET_NAME} was not present afterward. No worker was uploaded; retry once Cloudflare secret storage is available.`, "verification-failed");
+	if (!isCleanWranglerExit(put)) throw new CloudflareAuthSecretError(`deploy: could not create the remote ${BETTER_AUTH_SECRET_NAME} (Cloudflare command exit ${String(put.status)}). No worker was uploaded. Run \`void secret put ${BETTER_AUTH_SECRET_NAME}\` and retry.`, "put-failed");
+	if (!(await list(false)).includes(BETTER_AUTH_SECRET_NAME)) throw new CloudflareAuthSecretError(`deploy: Cloudflare reported success but ${BETTER_AUTH_SECRET_NAME} was not present afterward. No worker was uploaded; retry once Cloudflare secret storage is available.`, "verification-failed");
 	return {
 		created: true,
 		...workerWasMissing ? { workerWasMissing: true } : {}
@@ -6080,10 +6553,16 @@ async function runCloudflareDeploy(root, options, cliLog, deps = {}) {
 	}
 	const hashUploader = deps.hashWranglerUploader ?? hashWranglerUploader;
 	const wranglerUploaderHashBefore = hashUploader(root);
+	const cfUploaderHashBefore = deps.activateVersion || deps.runWrangler ? void 0 : hashCfUploader();
+	const cfUploaderIsPinned = () => {
+		const matched = cfUploaderHashBefore !== void 0 && cfUploaderHashBefore === hashCfUploader();
+		if (!matched) log.error("deploy: refusing to run a changed cf uploader with Cloudflare credentials.");
+		return matched;
+	};
 	const assertUploaderStillPinned = () => {
 		const check = assertWranglerUploaderUnchanged(wranglerUploaderHashBefore, hashUploader(root));
 		if (check.ok) return true;
-		log.error(["deploy: refusing to run the wrangler uploader with your Cloudflare credentials.", check.reason].filter(Boolean).join("\n"));
+		log.error(["deploy: refusing to run the Cloudflare uploader with your Cloudflare credentials.", check.reason].filter(Boolean).join("\n"));
 		return false;
 	};
 	let accountId = readWranglerTopLevelString(rootConfig, "account_id") ?? (process.env.CLOUDFLARE_ACCOUNT_ID?.trim() || void 0);
@@ -6148,10 +6627,10 @@ async function runCloudflareDeploy(root, options, cliLog, deps = {}) {
 		const staleAddresses = Array.isArray(rootConfig.addresses) ? rootConfig.addresses.filter((a) => typeof a === "string") : [];
 		const staleBinding = Array.isArray(rootConfig.send_email) && rootConfig.send_email.some((e) => e?.name === "SEND_EMAIL");
 		if (staleAddresses.length > 0 || staleBinding) log.warn([
-			"deploy: this app no longer declares email handlers or imports void/email, but wrangler.jsonc still carries the email setup Void wrote:",
+			"deploy: this app no longer declares email handlers or imports void/email, but the Cloudflare config still carries the email setup Void wrote:",
 			...staleAddresses.map((a) => `  • ${a} — still routed to worker "${workerName}", which no longer exports email(); inbound mail there will fail.`),
 			...staleBinding ? [`  • send_email ${SEND_EMAIL_BINDING} binding`] : [],
-			"Deploying as-is. To detach: remove `addresses`, `send_email` and `vars.__VOID_EMAIL_FROM` from wrangler.jsonc and delete the rules in the Cloudflare dashboard (Email → Email Routing → Routing rules), or set `addresses: []` and let `void deploy --platform cloudflare` ask before deleting every Void-owned rule."
+			"Deploying as-is. To detach: remove `addresses`, `send_email`, and `vars.__VOID_EMAIL_FROM` from `resolved` in void.lock.json (and any authored overrides in void.config.ts), then delete the rules in the Cloudflare dashboard (Email → Email Routing → Routing rules)."
 		].join("\n"));
 	}
 	const schemaProbeEnv = buildSchemaProbeEnv(accountId, apiBaseUrl);
@@ -6255,7 +6734,7 @@ async function runCloudflareDeploy(root, options, cliLog, deps = {}) {
 	const provisionAndVerify = async () => {
 		if (existingWorker) {
 			const { missing } = provisionModule.checkCloudflareProvisionDrift(configPath, desired);
-			throw new Error(missing.length > 0 ? formatCloudflareDriftMessage(missing, reasons, "Linking cannot provision these inferred resources:", `Check the existing Worker's binding names and resource IDs in ${basename(configPath)} and inference.bindings in void.json, then rerun \`void deploy\`. Keep new resources for a later deployment.`) : "Linking cannot provision resources. Remove --provision and rerun `void deploy` to reuse the existing Worker.");
+			throw new Error(missing.length > 0 ? formatCloudflareDriftMessage(missing, reasons, "Linking cannot provision these inferred resources:", `Check the existing Worker's binding names and resource IDs in void.config.ts and inference.bindings there, then rerun \`void deploy\`. Keep new resources for a later deployment.`) : "Linking cannot provision resources. Remove --provision and rerun `void deploy` to reuse the existing Worker.");
 		}
 		if (!assertUploaderStillPinned()) return exit(1);
 		const provision = deps.provision ?? provisionModule.provisionCloudflareResources;
@@ -6382,7 +6861,7 @@ async function runCloudflareDeploy(root, options, cliLog, deps = {}) {
 		return exit(getExitCode(err));
 	}
 	if (detectedFramework && frameworkPreset) try {
-		await (deps.prepareFrameworkArtifact ?? prepareCloudflareFrameworkArtifact)(root, configPath, accountId, workerName, voidConfig, detectedFramework, frameworkPreset, schemaFacts.requiredKeys);
+		await (deps.prepareFrameworkArtifact ?? prepareCloudflareFrameworkArtifact)(root, configPath, accountId, workerName, voidConfig, detectedFramework, frameworkPreset, schemaFacts.requiredKeys, needsAI ? { binding: aiBindingName } : void 0);
 	} catch (error) {
 		log.error(`deploy: could not prepare ${detectedFramework.name} for Cloudflare — ${getErrorMessage(error)}`);
 		return exit(1);
@@ -6541,7 +7020,22 @@ async function runCloudflareDeploy(root, options, cliLog, deps = {}) {
 			d1MigrateToken = migrateTarget.token;
 		}
 	}
+	const generatedConfigPath = (deps.resolveGeneratedConfigPath ?? resolveGeneratedDeployConfigPathDefault)(root);
+	const prepareBuildOutput = () => frameworkPreset?.cloudflareArtifact === "worker-output" ? prepareCfFrameworkBuildOutput({
+		projectRoot: root,
+		configPath: generatedConfigPath,
+		accountId
+	}) : prepareCfBuildOutput(dirname(generatedConfigPath), accountId);
+	if (!deps.activateVersion && !deps.runWrangler) {
+		const preflight = await prepareBuildOutput();
+		if (!preflight) {
+			log.error("deploy: cf could not prepare the built Worker for deployment.");
+			return exit(1);
+		}
+		preflight.dispose();
+	}
 	let workerWasMissingBeforeSecretProvisioning = false;
+	let initialAuthSecret;
 	if (authEnabled) {
 		const inheritance = (deps.verifyDeployConfig ?? verifyGeneratedDeployConfig)(root, {
 			accountId,
@@ -6570,6 +7064,7 @@ async function runCloudflareDeploy(root, options, cliLog, deps = {}) {
 				beforeWranglerRun: assertUploaderStillPinned
 			});
 			workerWasMissingBeforeSecretProvisioning ||= authSecret.workerWasMissing === true;
+			initialAuthSecret = authSecret.candidateSecret;
 			cliLog.info("cloudflare_auth_secret_ready", { created: authSecret.created });
 		} catch (error) {
 			if (error instanceof CloudflareAuthSecretError && error.reason === "uploader-changed") return exit(1);
@@ -6686,23 +7181,35 @@ async function runCloudflareDeploy(root, options, cliLog, deps = {}) {
 		].filter(Boolean).join("\n"));
 		return exit(1);
 	}
-	const generatedConfigPath = (deps.resolveGeneratedConfigPath ?? resolveGeneratedDeployConfigPathDefault)(root);
 	const queueConsumerCleanup = readWranglerManagedQueueCleanupCandidates(configPath);
 	if (existingWorker) assertCloudflareLinkUnchanged(root, pinnedHandoffLink);
 	const candidateReceipt = pinnedHandoffLink?.candidateReceipt;
-	const activationRunner = preBuildRootConfig.compliance_region ? runWrangler : createCloudflareMetadataRunner({
-		runWrangler,
+	if (!deps.activateVersion && !deps.runWrangler && !cfUploaderIsPinned()) return exit(1);
+	const cfOutput = deps.activateVersion || deps.runWrangler ? null : await prepareBuildOutput();
+	if (!cfOutput && !deps.activateVersion && !deps.runWrangler) {
+		log.error("deploy: cf could not prepare the built Worker for deployment.");
+		return exit(1);
+	}
+	const cfCommand = cfOutput ? createCfCommand({
 		accountId,
 		apiBaseUrl,
+		env: deployChildEnv,
+		verifyUploader: cfUploaderIsPinned
+	}) : null;
+	const activationRunner = cfOutput && cfCommand ? createCfVersionRunner({
+		output: cfOutput,
 		workerName,
-		configPath: generatedConfigPath,
-		fetch: deps.metadataFetch,
-		verifyUploader: assertUploaderStillPinned,
-		getToken: () => runWranglerAuthToken(runWrangler, generatedConfigPath)
-	});
+		runCf: cfCommand,
+		verifyResources: createCfResourceVerifier({
+			configPath: generatedConfigPath,
+			runCf: cfCommand,
+			runWrangler,
+			verifyCompatibilityRunner: assertUploaderStillPinned
+		})
+	}) : runWrangler;
 	const execution = await (deps.activateVersion ?? activateCloudflareVersion)({
 		runWrangler: activationRunner,
-		verifyUploader: assertUploaderStillPinned,
+		verifyUploader: cfOutput ? cfUploaderIsPinned : assertUploaderStillPinned,
 		workerName,
 		configPath: generatedConfigPath,
 		preserveTriggers: existingWorker !== null,
@@ -6734,10 +7241,18 @@ async function runCloudflareDeploy(root, options, cliLog, deps = {}) {
 			workerName,
 			runWrangler
 		}),
+		publishEmptyCrons: createCloudflareEmptyCronPublisher({
+			accountId,
+			apiBaseUrl,
+			configPath: generatedConfigPath,
+			workerName,
+			runWrangler
+		}),
 		previousTrafficConfig: readWranglerPublishedTrafficSnapshot(configPath),
 		queueConsumerCleanup,
-		verifyInheritedSecrets: true
-	});
+		verifyInheritedSecrets: true,
+		...initialAuthSecret ? { candidateSecrets: { [BETTER_AUTH_SECRET_NAME]: initialAuthSecret } } : {}
+	}).finally(() => cfOutput?.dispose());
 	if (!execution.ok) {
 		await reportCloudflareActivationFailure(cliLog, needsSandbox && execution.containersUnavailable ? formatCloudflareSandboxUnavailable() : formatCloudflareActivationError(execution));
 		return exit(1);
@@ -6765,11 +7280,7 @@ async function runCloudflareDeploy(root, options, cliLog, deps = {}) {
 */
 function discoverRootWranglerConfig(root) {
 	if (existsSync(join(root, "wrangler.toml"))) throw new Error("Found wrangler.toml. Direct Cloudflare deployment needs one root wrangler.jsonc or wrangler.json with the same settings. Convert the config before deploying.");
-	for (const name of ["wrangler.jsonc", "wrangler.json"]) {
-		const candidate = join(root, name);
-		if (existsSync(candidate)) return candidate;
-	}
-	return join(root, "wrangler.jsonc");
+	return materializeCloudflareConfig(root);
 }
 /** Avoid making Wrangler open a config path that Void has not created yet. */
 function existingWranglerConfigArgs(configPath) {
@@ -6819,6 +7330,7 @@ function formatCloudflareActivationError(result) {
 			"deploy: Cloudflare Access blocked the uploaded Worker Version readiness probe.",
 			"For CI, set CF_ACCESS_CLIENT_ID and CF_ACCESS_CLIENT_SECRET to an admitted service token.",
 			"For a local deploy, set CF_ACCESS_TOKEN to a short-lived user JWT from cloudflared.",
+			"If the response is error 1050, create an Access application for this hostname; a token alone cannot bypass account default-deny.",
 			`Then retry. ${formatCloudflareReadinessRestoration(result)}`
 		].join("\n");
 		case "bootstrap-failed": return `deploy: Cloudflare could not bootstrap the first Worker deployment${status}.${cloudflareCode}${diagnostic}`;
@@ -6832,6 +7344,7 @@ function formatCloudflareActivationError(result) {
 			"deploy: Cloudflare Access blocked the first Worker deployment readiness probe.",
 			"For CI, set CF_ACCESS_CLIENT_ID and CF_ACCESS_CLIENT_SECRET to an admitted service token;",
 			"for a local deploy, set CF_ACCESS_TOKEN to a short-lived user JWT from cloudflared.",
+			"If the response is error 1050, create an Access application for this hostname; a token alone cannot bypass account default-deny.",
 			"Then retry. Cloudflare requires the first deployment to be non-versioned, so the new",
 			"Worker is already active behind Access."
 		].join("\n");
@@ -6857,7 +7370,7 @@ function cloudflareWorkerReadinessHeaders() {
 	});
 }
 /** Build the trusted Wrangler pointer for a framework that emits Worker files directly. */
-async function prepareCloudflareFrameworkArtifact(root, configPath, accountId, workerName, voidConfig, framework, preset, requiredSecretNames = []) {
+async function prepareCloudflareFrameworkArtifact(root, configPath, accountId, workerName, voidConfig, framework, preset, requiredSecretNames = [], ai) {
 	const workerMain = join(root, preset.workerDir, preset.workerMain);
 	const assetsDirectory = join(root, preset.assetsDir);
 	if (!existsSync(workerMain)) throw new Error(`framework ${framework.name} did not emit its Worker entry at ${preset.workerDir}/${preset.workerMain}`);
@@ -6865,13 +7378,18 @@ async function prepareCloudflareFrameworkArtifact(root, configPath, accountId, w
 	const paths = resolveProjectPaths(root, voidConfig);
 	const crons = scanJobsSync(root, paths.cronsDir);
 	const queues = scanQueuesSync(root, paths.queuesDir);
+	const revalidate = collectRevalidate(voidConfig, null);
 	await generateDeployWrapperIfNeeded(root, join(root, preset.workerDir), preset.workerMain, {
 		auth: null,
 		crons,
 		queues,
 		hasMigrations: false,
 		migrationDialect: getDatabaseDialect(voidConfig),
-		readiness: true
+		readiness: true,
+		...hasRevalidate(revalidate) && { isr: {
+			revalidate,
+			queryAllowlist: voidConfig.routing?.revalidateQueryAllowlist
+		} }
 	});
 	if (preset.cloudflareArtifact === "vite-plugin") return;
 	const rootConfig = parseRootWranglerConfig(configPath);
@@ -6886,12 +7404,17 @@ async function prepareCloudflareFrameworkArtifact(root, configPath, accountId, w
 		compatibilityFlags: preset.cloudflareCompatibilityFlags,
 		crons: [...new Set(crons.flatMap((job) => job.crons))],
 		requiredSecrets: requiredSecretNames,
+		...ai ? { ai: {
+			...ai,
+			gateway: voidConfig.ai?.gateway
+		} } : {},
 		...preset.workerDir === preset.assetsDir ? { assetsIgnore: [
 			preset.workerMain,
 			"_routes.json",
 			"__original.js",
 			"__original.mjs",
 			"__void_handlers.mjs",
+			"__void_isr*.mjs",
 			"__void_migration_handler*.mjs"
 		] } : {}
 	});
@@ -6961,9 +7484,15 @@ async function runCloudflareStaticDeploy(root, options, voidConfig, preset, cliL
 	}
 	const hashUploader = deps.hashWranglerUploader ?? hashWranglerUploader;
 	const uploaderHash = hashUploader(root);
+	const cfUploaderHashBefore = deps.activateVersion || deps.runWrangler ? void 0 : hashCfUploader();
+	const cfUploaderIsPinned = () => {
+		const matched = cfUploaderHashBefore !== void 0 && cfUploaderHashBefore === hashCfUploader();
+		if (!matched) log.error("deploy: refusing to run a changed cf uploader with Cloudflare credentials.");
+		return matched;
+	};
 	const uploaderIsPinned = () => {
 		const result = assertWranglerUploaderUnchanged(uploaderHash, hashUploader(root));
-		if (!result.ok) log.error(["deploy: refusing to run the wrangler uploader with your Cloudflare credentials.", result.reason].filter(Boolean).join("\n"));
+		if (!result.ok) log.error(["deploy: refusing to run the Cloudflare uploader with your Cloudflare credentials.", result.reason].filter(Boolean).join("\n"));
 		return result.ok;
 	};
 	let accountId = readWranglerTopLevelString(rootConfig, "account_id") ?? (process.env.CLOUDFLARE_ACCOUNT_ID?.trim() || void 0);
@@ -7092,19 +7621,37 @@ async function runCloudflareStaticDeploy(root, options, voidConfig, preset, cliL
 	const queueConsumerCleanup = readWranglerManagedQueueCleanupCandidates(configPath);
 	if (existingWorker) assertCloudflareLinkUnchanged(root, pinnedHandoffLink);
 	const candidateReceipt = pinnedHandoffLink?.candidateReceipt;
-	const activationRunner = rootConfig.compliance_region ? runWrangler : createCloudflareMetadataRunner({
-		runWrangler,
+	if (!deps.activateVersion && !deps.runWrangler && !cfUploaderIsPinned()) return exit(1);
+	const cfOutput = deps.activateVersion || deps.runWrangler ? null : await prepareCfStaticBuildOutput({
+		projectRoot: root,
+		configPath: staticConfigPath,
+		assetsDirectory: stagedAssetsDirectory,
+		accountId
+	});
+	if (!cfOutput && !deps.activateVersion && !deps.runWrangler) {
+		log.error("deploy: cf could not prepare the static Worker for deployment.");
+		return exit(1);
+	}
+	const cfCommand = cfOutput ? createCfCommand({
 		accountId,
 		apiBaseUrl,
+		env: deployChildEnv,
+		verifyUploader: cfUploaderIsPinned
+	}) : null;
+	const activationRunner = cfOutput && cfCommand ? createCfVersionRunner({
+		output: cfOutput,
 		workerName,
-		configPath: staticConfigPath,
-		fetch: deps.metadataFetch,
-		verifyUploader: uploaderIsPinned,
-		getToken: () => runWranglerAuthToken(runWrangler, staticConfigPath)
-	});
+		runCf: cfCommand,
+		verifyResources: createCfResourceVerifier({
+			configPath: staticConfigPath,
+			runCf: cfCommand,
+			runWrangler,
+			verifyCompatibilityRunner: uploaderIsPinned
+		})
+	}) : runWrangler;
 	const execution = await (deps.activateVersion ?? activateCloudflareVersion)({
 		runWrangler: activationRunner,
-		verifyUploader: uploaderIsPinned,
+		verifyUploader: cfOutput ? cfUploaderIsPinned : uploaderIsPinned,
 		configPath: staticConfigPath,
 		preserveTriggers: existingWorker !== null,
 		expectedPreviousVersionId: existingWorker?.versionId,
@@ -7136,9 +7683,16 @@ async function runCloudflareStaticDeploy(root, options, voidConfig, preset, cliL
 			workerName,
 			runWrangler
 		}),
+		publishEmptyCrons: createCloudflareEmptyCronPublisher({
+			accountId,
+			apiBaseUrl,
+			configPath: staticConfigPath,
+			workerName,
+			runWrangler
+		}),
 		previousTrafficConfig: readWranglerPublishedTrafficSnapshot(configPath),
 		queueConsumerCleanup
-	});
+	}).finally(() => cfOutput?.dispose());
 	if (!execution.ok) {
 		await reportCloudflareActivationFailure(cliLog, formatCloudflareActivationError(execution));
 		return exit(1);
@@ -7189,6 +7743,8 @@ const deployTargets = {
 		},
 		async deploy(root, options, cliLog) {
 			if (options.projectSlug !== void 0) throw new Error("deploy: --project is not supported with platform cloudflare — this platform deploys to your own Cloudflare account and no Void project is involved.");
+			assertInstalledVoidMatchesCli(root);
+			if (migrateLegacyVoidConfig(root)) log.success("Migrated project configuration to void.config.ts. Commit void.config.ts and void.lock.json.");
 			return runCloudflareDeploy(root, options, cliLog);
 		}
 	},
@@ -7239,7 +7795,11 @@ async function runDeployInner(root, options, cliLog) {
 	const targetLabel = platform === "cloudflare" ? "Cloudflare" : "Void";
 	log.info(`Deployment target: ${targetLabel}`);
 	cliLog.info("deploy_target", { target: platform });
-	return deployTargets[platform].deploy(root, options ?? {}, cliLog);
+	try {
+		return await deployTargets[platform].deploy(root, options ?? {}, cliLog);
+	} finally {
+		if (existsSync(join(root, "void.config.ts"))) stashCloudflareDeployPointer(root);
+	}
 }
 async function runManagedDeploy(root, options, cliLog) {
 	let reauthenticated = false;
@@ -7301,6 +7861,7 @@ async function runManagedDeploy(root, options, cliLog) {
 			projectId: config.projectId,
 			slug: config.slug
 		});
+		if (migrateLegacyVoidConfig(root)) log.success("Migrated project configuration to void.config.ts. Commit void.config.ts and void.lock.json.");
 		const voidConfig = readConfig(root);
 		cliLog.info("config_resolved", {
 			target: voidConfig.target,
@@ -7418,7 +7979,7 @@ function resolveFullDeployBuildCommand(root, buildOverride) {
 * (`router/compile.ts`) emits a `paths.push(...)` for:
 *   1. `scan.pages.pages` — static patterns + dynamic pages' `getPrerenderPaths()`
 *   2. the custom SSR entry's top-level `getPrerenderPaths()` (`ssr` argument)
-*   3. `options.explicitPrerenderPaths` — void.json `routing.prerender`
+*   3. `options.explicitPrerenderPaths` — void.config.ts `routing.prerender`
 * With none of them present the collector is a generated function whose body
 * returns `[...new Set([])]`, so skipping is result-identical.
 *
@@ -7831,7 +8392,7 @@ function warnRedundantForceOn3xx(count) {
 */
 function warnIgnoredNotFoundForFramework(notFound, frameworkName) {
 	if (notFound === void 0) return;
-	log.warn(`"routing.notFound" in void.json is ignored for ${frameworkName} deploys (not_found_handling is pinned to "none" — the framework's own worker owns unmatched HTML).`);
+	log.warn(`"routing.notFound" in void.config.ts is ignored for ${frameworkName} deploys (not_found_handling is pinned to "none" — the framework's own worker owns unmatched HTML).`);
 }
 /**
 * Class B/C framework deploy: build with framework CLI, package with preset output paths.
@@ -7911,7 +8472,7 @@ async function runFrameworkDeploy(root, config, client, detected, fwPreset, void
 		} catch {}
 		if (resources) {
 			if (!resources.some((resource) => resource.type === "hyperdrive")) {
-				const { text: promptText, isCancel: isCancelPrompt } = await import("./output-B0cfNSx5.mjs").then((n) => n.T);
+				const { text: promptText, isCancel: isCancelPrompt } = await import("./dist-C5fND3R0.mjs");
 				const connectionString = await promptText({
 					message: `Your project uses ${dialect === "mysql" ? "MySQL" : "PostgreSQL"}. Enter your connection string:`,
 					placeholder: dialect === "mysql" ? "mysql://user:pass@host:3306/dbname" : "postgresql://user:pass@host:5432/dbname",
@@ -7953,8 +8514,8 @@ async function runFrameworkDeploy(root, config, client, detected, fwPreset, void
 		log.info("Wrapper generated");
 	}
 	const wranglerCompat = resolveDeployWranglerCompat(root, voidConfig, workerDir, { dialect });
-	const revalidate = voidConfig.routing?.revalidate;
-	const prerender = voidConfig.routing?.prerender;
+	const revalidate = collectRevalidate(voidConfig, null);
+	const prerender = voidConfig.routing?.isr === false ? void 0 : voidConfig.routing?.prerender;
 	const schedules = rawJobs.flatMap((job) => job.crons.map((cron) => ({
 		name: job.name,
 		cron
@@ -8157,7 +8718,7 @@ async function runFullDeploy(root, config, client, voidConfig, fwPreset, skipBui
 		} catch {}
 		if (resources) {
 			if (!resources.some((resource) => resource.type === "hyperdrive")) {
-				const { text: promptText, isCancel: isCancelPrompt } = await import("./output-B0cfNSx5.mjs").then((n) => n.T);
+				const { text: promptText, isCancel: isCancelPrompt } = await import("./dist-C5fND3R0.mjs");
 				const connectionString = await promptText({
 					message: `Your project uses ${dialect === "mysql" ? "MySQL" : "PostgreSQL"}. Enter your connection string:`,
 					placeholder: dialect === "mysql" ? "mysql://user:pass@host:3306/dbname" : "postgresql://user:pass@host:5432/dbname",
@@ -8604,4 +9165,4 @@ function resolveWorkerDirName(distDir, fwPreset, buildCommand) {
 	throw new Error("deploy: Worker output not found. Expected dist/ssr/ or dist/rsc/.");
 }
 //#endregion
-export { renderAddressMap as C, resolveAssetRoutingPolicy as D, hasDocumentRoutes as E, preflightEmail as S, hasApiRoutes as T, scanDurableObjectModules as _, isWranglerNonInteractiveOrCI as a, createNodeEmailDns as b, resolveDistDir as c, generateQueueResolverSource as d, prerenderPages as f, hasRevalidate as g, collectRevalidate as h, discoverRootWranglerConfig as i, resolveWorkerDirName as l, collectPages as m, deploy_exports as n, loadProvisionModule as o, prerenderPagesNode as p, deriveWorkerName as r, resolveDeployTransport as s, createDeployWranglerRunner as t, runWranglerAuthToken as u, SEND_EMAIL_BINDING as v, renderEmailChecklist as w, findEmailConfigConflicts as x, applyEmailSetup as y };
+export { streamDeployEvents as $, parseRootWranglerConfig$1 as A, resolveDistDir as B, generateDeployWrapperIfNeeded as C, resolveAssetRoutingPolicy as Ct, hashWranglerUploader as D, hasPrerenderSources as E, resolveDeployLiveBindingConfig as F, resolveWranglerMigrationPattern as G, resolveStaticBuildCommand as H, resolveDeployTransport as I, runStaticDeploy as J, runCloudflareDeploy as K, resolveDeployWorkerMain as L, promptDeployProjectConfig as M, reconstructExpectedContainers as N, isWranglerNonInteractiveOrCI as O, resolveCloudflareVoidStaticPreset as P, snapshotPassthroughRawFields as Q, resolveDeployWranglerCompat as R, formatCloudflareSandboxUnavailable as S, resolveAssetConfig as St, hasNonPageBackend as T, resolveStaticDeployPreset as U, resolveFullDeployBuildCommand as V, resolveWorkerDirName as W, snapshotBindingIdentities as X, runWranglerAuthToken as Y, snapshotPassthroughIdentities as Z, deriveWorkerName as _, preflightEmail as _t, applyDeployEvent as a, generateQueueResolverSource as at, ensurePreviouslyDeployedLiveBindingConfig as b, hasApiRoutes as bt, assertMigrationsProduceAuthSchema as c, buildEnv as ct, assertWranglerUploaderUnchanged as d, hasRevalidate as dt, validateAuthMigrationSchema as et, checkWranglerMigrationApplySet as f, scanDurableObjectModules as ft, deployChildEnv as g, findEmailConfigConflicts as gt, createDeployWranglerRunner as h, createNodeEmailDns as ht, DEPLOY_WHOLE_OBJECT_PINNED_FIELDS as i, warnUnpublishedRouting as it, prepareCloudflareFrameworkArtifact as j, loadProvisionModule as k, assertNoConfigOverrideInProjectDotenv as l, collectPages as lt, computeDesiredCloudflareResources as m, applyEmailSetup as mt, DEPLOY_PASSTHROUGH_ASSERT_FIELDS as n, warnIgnoredNotFoundForFramework as nt, assembleVoidManifest as o, prerenderPages as ot, compareWranglerMigrationPaths as p, SEND_EMAIL_BINDING as pt, runDeploy as q, DEPLOY_PASSTHROUGH_EXCLUDE_FIELDS as r, warnRedundantForceOn3xx as rt, assertManagedDurableStateSupported as s, prerenderPagesNode as st, CloudflareAuthSecretError as t, verifyGeneratedDeployConfig as tt, assertRemoteMigrationsDeployable as u, collectRevalidate as ut, discoverRootWranglerConfig as v, renderAddressMap as vt, hasDeploySchemaDrift as w, formatCloudflareActivationError as x, hasDocumentRoutes as xt, ensureCloudflareAuthSecret as y, renderEmailChecklist as yt, resolveDeploymentPlatform as z };