void 0.21.2 → 0.21.4

package/dist/{deploy-Bsymb0_c.mjs → deploy-F1exK5F4.mjs}

@@ -1,58 +1,60 @@
 import { n as __toESM, t as __commonJSMin } from "./rolldown-runtime-DXIUcv95.mjs";
-import { a as join, l as relative, n as dirname, o as normalize, r as extname, t as basename, u as resolve } from "./dist-4WkAWhWx.mjs";
+import { a as join, l as relative, n as dirname, o as normalize, r as extname, t as basename, u as resolve } from "./dist-BVqXeR_h.mjs";
 import { c as import_picocolors$1, d as require_picocolors, i as createSpinner, r as cliTitle } from "./output-CCH48AMM.mjs";
-import { i as resolveProjectPaths, n as readProjectPaths, t as assertNoRootSourceConventionConflicts } from "./project-paths-CKQ-Q5JS.mjs";
-import { t as findVoidAuthConfig } from "./config-uP7ZDtVZ.mjs";
+import { i as resolveProjectPaths, n as readProjectPaths, t as assertNoRootSourceConventionConflicts } from "./project-paths-GgcMozYz.mjs";
+import { t as findVoidAuthConfig } from "./config-DPByhVck.mjs";
 import { i as trustedCloudflareWorkerAccessHeaders, r as scopedAccessCredentials, t as cfAccessHeaders } from "./cf-access-DRsQRe6k.mjs";
-import { a as getApiUrl, c as getToken, l as getTokenSource, o as getProxyUrl, u as isStagingMode } from "./auth-B9_D6ygs.mjs";
-import { r as ensurePlatformProxyAccess, t as ensureCloudflaredToken } from "./cf-access-rAZxzMkL.mjs";
-import { d as writeProjectConfig, i as readDeploymentPlatform, l as writeDeploymentPlatform, o as readProjectConfig, t as attachSelectedPlatform } from "./project-CWNIPoXc.mjs";
-import { d as isNodeTarget, h as resolveBindingNames, m as readConfig, u as getDatabaseDialect } from "./config-Dxr6cTXn.mjs";
-import { A as writeWranglerPublishedTrafficSnapshot, D as syncWranglerWebSockets, E as syncWranglerDurableObjects, L as materializeCloudflareConfig, M as isSandboxEnabled, N as requiresSandboxPlatformImage, P as resolveSandboxConfig, R as persistCloudflareConfig, S as readWranglerPublishedTrafficSnapshot, T as syncWranglerBindings, V as stashCloudflareDeployPointer, a as LIVE_MIGRATION_TAG, c as bindingEntriesForField, f as findBindingNameOwner, g as readExistingLiveBindingConfig, h as normalizeWranglerCompatibilityFlags, k as writeProvisionedWranglerConfig, l as ensureWranglerCompat, o as acknowledgeWranglerManagedQueueRemovals, r as FRIENDLY_BINDING_NAMES, w as resolveLiveBindingConfig, x as readWranglerManagedQueueCleanupCandidates } from "./wrangler-D01qs6VB.mjs";
+import { a as getApiUrl, c as getToken, l as getTokenSource, o as getProxyUrl, u as isStagingMode } from "./auth-DLNN0D3Z.mjs";
+import { r as ensurePlatformProxyAccess, t as ensureCloudflaredToken } from "./cf-access-P0iZnu0q.mjs";
+import { d as writeProjectConfig, i as readDeploymentPlatform, l as writeDeploymentPlatform, o as readProjectConfig, t as attachSelectedPlatform } from "./project-C0Fqu05O.mjs";
+import { d as isNodeTarget, h as resolveBindingNames, m as readConfig, u as getDatabaseDialect } from "./config-CafTW6Cz.mjs";
+import { A as writeWranglerPublishedTrafficSnapshot, D as syncWranglerWebSockets, E as syncWranglerDurableObjects, L as materializeCloudflareConfig, M as isSandboxEnabled, N as requiresSandboxPlatformImage, P as resolveSandboxConfig, R as persistCloudflareConfig, S as readWranglerPublishedTrafficSnapshot, T as syncWranglerBindings, V as stashCloudflareDeployPointer, a as LIVE_MIGRATION_TAG, c as bindingEntriesForField, f as findBindingNameOwner, g as readExistingLiveBindingConfig, h as normalizeWranglerCompatibilityFlags, j as SANDBOX_MIGRATION_TAG, k as writeProvisionedWranglerConfig, l as ensureWranglerCompat, m as nextDurableObjectMigrationTag, o as acknowledgeWranglerManagedQueueRemovals, p as hasDurableObjectSqliteMigration, r as FRIENDLY_BINDING_NAMES, w as resolveLiveBindingConfig, x as readWranglerManagedQueueCleanupCandidates } from "./wrangler-BymcxrRa.mjs";
 import { i as voidWarn, r as voidLog } from "./log-ChfPKsVd.mjs";
-import { n as lintDuplicateSources, r as mergeRoutingRules, t as lintDestinationSplats } from "./headers-B_HBMgi0.mjs";
-import { a as scanQueuesSync, i as scanWebSocketRoutesSync, o as scanJobsSync, r as scanRoutes } from "./scan-DdDvRCU1.mjs";
-import { i as inferProjectBindings, n as FRAMEWORK_SCAN_DIRS, r as detectFramework } from "./plugin-inference-DsvtJLll.mjs";
-import { o as validateSsrEntry } from "./entry-DdRFGK0y.mjs";
-import { t as collectMigrations } from "./collect-DXHNWHcT.mjs";
+import { n as lintDuplicateSources, r as mergeRoutingRules, t as lintDestinationSplats } from "./headers-BOg_velo.mjs";
+import { n as isIdentifier, r as isLiteral } from "./ast-CPGPjb0V.mjs";
+import { t as scanPages } from "./scan-4tfN-PSn.mjs";
+import { a as scanJobsSync, i as scanQueuesSync, r as scanRoutes } from "./scan-ClYmX3sa.mjs";
+import { i as inferProjectBindings, n as FRAMEWORK_SCAN_DIRS, r as detectFramework, s as scanWebSocketRoutesSync } from "./plugin-inference-BMfKRSqE.mjs";
+import { t as collectMigrations } from "./collect-DiTn9yr6.mjs";
 import { r as buildMigrationPlanBundle } from "./plan-BEZ8VJW0.mjs";
 import { r as scanWranglerDotenvKeys } from "./dotenv-VQxupEUv.mjs";
-import { t as discoverSchema } from "./discover-C4O6YxVS.mjs";
-import { t as findEnvFile } from "./env-types-CWDtqHgw.mjs";
-import { d as formatEnvReport, f as listSelfHostSecretNames, g as validateProdEnv, h as selfHostSchemaFailureMessage, i as SelfHostSecretListError, l as dischargeSelfHostEnvContext, n as SelfHostFirstDeployError, p as readEmittedWorkerVars, r as SelfHostSchemaError, s as deriveSelfHostEnvContextFromVars, t as SelfHostEnvValidationError, u as fetchRemoteSecretNames, v as readGeneratedWranglerConfigFile } from "./env-validation-BsFEXps5.mjs";
-import { n as CLOUDFLARE_DEPLOY_BUILD_ENV, o as resolveRemoteMode, s as stripInternalEnvKeys } from "./env-DX_v-Q-v.mjs";
+import { t as discoverSchema } from "./discover-BcPPiF1o.mjs";
+import { t as MagicString } from "./dist-BR1quN_w.mjs";
+import { t as findEnvFile } from "./env-types-C2_bIk_b.mjs";
+import { d as formatEnvReport, f as listSelfHostSecretNames, g as validateProdEnv, h as selfHostSchemaFailureMessage, i as SelfHostSecretListError, l as dischargeSelfHostEnvContext, n as SelfHostFirstDeployError, p as readEmittedWorkerVars, r as SelfHostSchemaError, s as deriveSelfHostEnvContextFromVars, t as SelfHostEnvValidationError, u as fetchRemoteSecretNames, v as readGeneratedWranglerConfigFile } from "./env-validation-BB4GkLxn.mjs";
+import { n as CLOUDFLARE_DEPLOY_BUILD_ENV, o as resolveRemoteMode, s as stripInternalEnvKeys } from "./env-_v349JBd.mjs";
+import { o as validateSsrEntry } from "./entry-CF5wvH4w.mjs";
 import { E as confirm, I as select, N as note, O as intro, P as outro, W as isCancel, j as log$1 } from "./dist-Dn6nn2IU.mjs";
-import { t as writeDrizzleConfig } from "./config-BSe70f4T.mjs";
-import { i as runMySqlMigrations } from "./runner-mysql-BhwMk2Bm.mjs";
-import { i as runPgMigrations } from "./runner-pg-CJ_JeGF6.mjs";
+import { t as writeDrizzleConfig } from "./config-D8MOgiQV.mjs";
+import { i as runMySqlMigrations } from "./runner-mysql-DmWchSWJ.mjs";
+import { i as runPgMigrations } from "./runner-pg-D4OPlil-.mjs";
 import { n as openMigrationValidationDatabase, t as SqliteMigrationError } from "./sqlite-validation-BzKMWnO4.mjs";
-import { i as validateMigrations, t as assertJournalCoherence } from "./validate-qNhV00PD.mjs";
-import { t as scanPages } from "./scan-DJbooZm2.mjs";
-import { t as renderPrerenderPaths } from "./prerender-render-Cf_WDE9W.mjs";
-import { a as scanEmailHandlersSync, r as hasEmailHandlers } from "./email-C5kaZXzJ.mjs";
-import { i as migrateBuiltWranglerConfig, n as prepareCfFrameworkBuildOutput, r as prepareCfStaticBuildOutput, t as prepareCfBuildOutput } from "./cf-build-output-CTdlo6Rt.mjs";
-import { n as getPackageDir } from "./agents-gni4eqBu.mjs";
-import { i as isExpiredTokenError, n as PlatformClient, o as parsePlatformErrorBody, r as isCliOutdatedError, s as platformErrorMessage, t as PlatformApiError } from "./client-PdAJ-F0t.mjs";
-import { a as resolveProjectCommand, i as hasBackendFiles, n as detectPreset, o as resolveWranglerArgv, r as formatProjectCommand, t as FRAMEWORK_PRESETS } from "./preset-Dowh9tTt.mjs";
-import { o as ensureCloudflareAuthentication, r as cloudflareAuthNeedsTerminal, t as CloudflareAuthenticationError } from "./cloudflare-auth-BCmTc1X_.mjs";
-import { n as writeVoidProjectConfig } from "./config-write-y3CBI_ux.mjs";
-import { r as discoverFrameworkWranglerFiles, t as migrateLegacyVoidConfig } from "./migrate-BV8qHiCb.mjs";
-import { a as createCloudflareEmptyDomainPublisher, i as createCloudflareEmptyCronPublisher } from "./cloudflare-operations-CPEdHYhM.mjs";
+import { i as validateMigrations, t as assertJournalCoherence } from "./validate-CIUwFpjB.mjs";
+import { t as renderPrerenderPaths } from "./prerender-render-D9qbLs2f.mjs";
+import { a as scanEmailHandlersSync, r as hasEmailHandlers } from "./email--tEtMoj_.mjs";
+import { i as migrateBuiltWranglerConfig, n as prepareCfFrameworkBuildOutput, r as prepareCfStaticBuildOutput, t as prepareCfBuildOutput } from "./cf-build-output-CGT03qCD.mjs";
+import { n as getPackageDir } from "./agents-B_pX_HmQ.mjs";
+import { i as isExpiredTokenError, n as PlatformClient, o as parsePlatformErrorBody, r as isCliOutdatedError, s as platformErrorMessage, t as PlatformApiError } from "./client-QTl6ko_D.mjs";
+import { a as resolveProjectCommand, i as hasBackendFiles, n as detectPreset, o as resolveWranglerArgv, r as formatProjectCommand, t as FRAMEWORK_PRESETS } from "./preset-UHj9ARyP.mjs";
+import { o as ensureCloudflareAuthentication, r as cloudflareAuthNeedsTerminal, t as CloudflareAuthenticationError } from "./cloudflare-auth-B9jPCkV2.mjs";
+import { n as writeVoidProjectConfig } from "./config-write-BSduPMY8.mjs";
+import { r as discoverFrameworkWranglerFiles, t as migrateLegacyVoidConfig } from "./migrate-B8KuoYsO.mjs";
+import { a as createCloudflareEmptyDomainPublisher, i as createCloudflareEmptyCronPublisher } from "./cloudflare-operations-sMZXpk_S.mjs";
 import { t as formatCloudflareUserMessage } from "./cloudflare-user-output-Q-k0QoNQ.mjs";
-import { a as promptProjectSetupAction, i as promptProjectSelection, r as promptAndCreateProject } from "./create-project-BZBl_gQ0.mjs";
-import { r as resolveProjectBySlug, t as getRequestedProjectSlug } from "./resolve-project-Xvis70DG.mjs";
+import { a as promptProjectSetupAction, i as promptProjectSelection, r as promptAndCreateProject } from "./create-project-DBfFSZKY.mjs";
+import { t as getRequestedProjectSlug } from "./resolve-project-BG5ORGID.mjs";
 import { t as collectGitDeployMetadata } from "./git-metadata-D-gurjzG.mjs";
-import { t as promptForLoginToken } from "./login-BgQJzxAl.mjs";
+import { t as promptForLoginToken } from "./login-BQyISZuW.mjs";
 import { createRequire } from "node:module";
-import { copyFileSync, cpSync, createWriteStream, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, realpathSync, renameSync, rmSync, unlinkSync, writeFileSync } from "node:fs";
+import { copyFileSync, cpSync, createWriteStream, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, readlinkSync, realpathSync, renameSync, rmSync, statSync, unlinkSync, writeFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { createDeployArtifact, createDeployUploadPayload } from "@void/deploy-core";
+import { build, parseSync } from "vite";
 import { createHash, randomBytes } from "node:crypto";
 import { homedir, tmpdir } from "node:os";
 import { execFile, execSync, spawn, spawnSync } from "node:child_process";
 import { applyEdits, modify, parse } from "jsonc-parser";
 import { isDeepStrictEqual } from "node:util";
-import { build } from "vite";
 import { Minimatch } from "minimatch";
 import { activateCloudflareVersion, assertCloudflareBindingsPreserved, assertCloudflareDurableObjectLifecycleSupported, assertExistingCloudflareConfig, encodeCloudflareVersionMessage, extractWorkersDevSubdomain, normalizeWorkersDevSubdomain, parseRootWranglerConfig, parseRootWranglerConfig as parseRootWranglerConfig$1, readBindingFieldPresence, readCloudflareTriggerConfig, readConfigEntryString, readExistingCloudflareWorker, readStoredResourceName, readWranglerTopLevelString, renderCloudflareStaticEntry, resolveD1MigrateTarget, stageCloudflareStaticAssets, writeCloudflareFrameworkDeployConfig, writeCloudflareStaticDeployConfig } from "@void/deploy-cloudflare";
 import { getWorkerConfigPath, readBuildOutput } from "@cloudflare/build-output-utils";
@@ -1883,6 +1885,44 @@ function safePositional(value) {
 		return code < 32 || code === 127;
 	});
 }
+/** Pin opaque secrets to the live version in the private, disposable Build Output. */
+async function pinActiveWorkerSecrets(options) {
+	const { activeVersionId, bindings, requiredNames, explicitNames = [] } = options;
+	if (!/^[0-9a-f]{8}-(?:[0-9a-f]{4}-){3}[0-9a-f]{12}$/i.test(activeVersionId)) return false;
+	const secretNames = new Set(bindings.map((binding) => binding.name));
+	const explicit = new Set(explicitNames);
+	if (bindings.some((binding) => !safePositional(binding.name)) || secretNames.size !== bindings.length) return false;
+	if (requiredNames.some((name) => !secretNames.has(name) && !explicit.has(name))) return false;
+	const path = getWorkerConfigPath(options.output.directory);
+	const worker = parseJson(readFileSync(path, "utf8"));
+	if (!record(worker) || worker.env !== void 0 && !record(worker.env)) return false;
+	const env = { ...worker.env ?? {} };
+	for (const name of explicit) delete env[name];
+	for (const [name, value] of Object.entries(env)) if (record(value) && (value.type === "secret" || value.type === "inherit" || value.type === "unsafe:inherit") && !secretNames.has(name) && !explicit.has(name)) return false;
+	for (const { name } of bindings) {
+		if (explicit.has(name)) continue;
+		const current = env[name];
+		if (current !== void 0 && (!record(current) || current.type !== "secret" && current.type !== "inherit" && current.type !== "unsafe:inherit")) return false;
+		env[name] = {
+			type: "unsafe:inherit",
+			version_id: activeVersionId
+		};
+	}
+	const unsafe = record(worker.unsafe) ? { ...worker.unsafe } : {};
+	const metadata = record(unsafe.metadata) ? { ...unsafe.metadata } : {};
+	if (metadata.bindings !== void 0) return false;
+	if (metadata.keep_bindings !== void 0 && (!Array.isArray(metadata.keep_bindings) || !metadata.keep_bindings.every((type) => typeof type === "string"))) return false;
+	metadata.keep_bindings = (metadata.keep_bindings ?? []).filter((type) => type !== "secret_text" && type !== "secret_key");
+	unsafe.metadata = metadata;
+	const next = {
+		...worker,
+		env,
+		unsafe
+	};
+	writeFileSync(path, JSON.stringify(next), { mode: 384 });
+	await readBuildOutput(options.output.directory);
+	return true;
+}
 /** Prevent cf's prebuilt uploader from creating a resource as a side effect. */
 function createCfResourceVerifier(options) {
 	return async (directory) => {
@@ -2275,6 +2315,48 @@ function createCfVersionRunner(options) {
 	};
 }
 //#endregion
+//#region src/cli/cloudflare-candidate.ts
+const CANDIDATE_FILE = ".void/cloudflare-candidate.json";
+/** A failed normal deploy keeps its locally verified upload chain across retries. */
+function readCloudflareCandidate(root) {
+	const path = join(root, CANDIDATE_FILE);
+	if (!existsSync(path)) return null;
+	let value;
+	try {
+		value = JSON.parse(readFileSync(path, "utf8"));
+	} catch {
+		throw new Error("The saved Cloudflare candidate receipt is invalid. Restore or remove .void/cloudflare-candidate.json before retrying.");
+	}
+	if (typeof value !== "object" || value === null || Array.isArray(value) || !("accountId" in value) || typeof value.accountId !== "string" || !value.accountId || !("workerName" in value) || typeof value.workerName !== "string" || !value.workerName || !("parentVersionId" in value) || typeof value.parentVersionId !== "string" || !value.parentVersionId || !("versionIds" in value) || !Array.isArray(value.versionIds) || !value.versionIds.length || !value.versionIds.every((id) => typeof id === "string" && id.length > 0) || new Set(value.versionIds).size !== value.versionIds.length) throw new Error("The saved Cloudflare candidate receipt is invalid. Restore or remove .void/cloudflare-candidate.json before retrying.");
+	return value;
+}
+function assertCloudflareCandidateUnchanged(root, expected) {
+	if (JSON.stringify(readCloudflareCandidate(root)) !== JSON.stringify(expected)) throw new Error("The Cloudflare candidate receipt changed while project code was running. Retry from a trusted checkout.");
+}
+function recordCloudflareCandidateUpload(root, expected, accountId, workerName, parentVersionId, versionId) {
+	assertCloudflareCandidateUnchanged(root, expected);
+	if (expected && (expected.accountId !== accountId || expected.workerName !== workerName || expected.parentVersionId !== parentVersionId)) throw new Error("The saved Cloudflare candidate belongs to a different Worker or live version. Inspect the deployment before retrying.");
+	const versionIds = [...expected?.versionIds ?? [], versionId];
+	mkdirSync(join(root, ".void"), { recursive: true });
+	const path = join(root, CANDIDATE_FILE);
+	const temp = `${path}.${process.pid}.tmp`;
+	try {
+		writeFileSync(temp, `${JSON.stringify({
+			accountId,
+			workerName,
+			parentVersionId,
+			versionIds
+		})}\n`, { mode: 384 });
+		renameSync(temp, path);
+	} finally {
+		if (existsSync(temp)) unlinkSync(temp);
+	}
+}
+function clearCloudflareCandidate(root) {
+	const path = join(root, CANDIDATE_FILE);
+	if (existsSync(path)) unlinkSync(path);
+}
+//#endregion
 //#region src/cli/cloudflare-deploy/classify.ts
 /**
 * Narrow native Cloudflare deploys to app shapes whose emitted Worker artifact
@@ -3837,6 +3919,69 @@ function __resolveQueueIndex(queueName) {
 }`;
 }
 //#endregion
+//#region src/cli/pg-bundle-transform.ts
+function nodes(root) {
+	const found = [];
+	const pending = [root];
+	while (pending.length > 0) {
+		const node = pending.pop();
+		found.push(node);
+		for (const value of Object.values(node)) if (Array.isArray(value)) {
+			for (const child of value) if (child && typeof child === "object" && typeof child.type === "string") pending.push(child);
+		} else if (value && typeof value === "object" && typeof value.type === "string") pending.push(value);
+	}
+	return found;
+}
+/** Rewrite the two CommonJS constructs emitted by the PG migration bundle. */
+function transformPgWorkerBundle(code, filename, requireShim) {
+	if (!code.includes("createRequire") && !code.includes("pgpass")) return code;
+	const program = parseSync(filename, code).program;
+	const edits = [];
+	let hasRequireBinding = false;
+	let pgpassCalls = 0;
+	for (const statement of program.body ?? []) {
+		if (statement.type === "ImportDeclaration" && statement.source?.value === "node:module") {
+			const specifiers = statement.specifiers;
+			if (specifiers?.length !== 1 || !isIdentifier(specifiers[0]?.imported) || specifiers[0].imported.name !== "createRequire") throw new Error(`deploy: Unsupported node:module import in PostgreSQL bundle ${filename}.`);
+			edits.push({
+				start: statement.start,
+				end: statement.end,
+				replacement: ""
+			});
+		}
+		if (statement.type === "VariableDeclaration") {
+			const declarations = statement.declarations;
+			if (declarations?.some((declaration) => isIdentifier(declaration.id) && declaration.id.name === "__require")) {
+				if (declarations.length !== 1 || hasRequireBinding) throw new Error(`deploy: Unsupported require binding in PostgreSQL bundle ${filename}.`);
+				hasRequireBinding = true;
+				edits.push({
+					start: statement.start,
+					end: statement.end,
+					replacement: requireShim
+				});
+			}
+		}
+	}
+	for (const node of nodes(program)) {
+		if (node.type !== "CallExpression" || !isIdentifier(node.callee) || node.callee.name !== "__require") continue;
+		const args = node.arguments;
+		if (args?.length !== 1 || !isLiteral(args[0]) || args[0].value !== "pgpass") continue;
+		pgpassCalls++;
+		edits.push({
+			start: node.start,
+			end: node.end,
+			replacement: "__voidPgpassNoop"
+		});
+	}
+	if (code.includes("createRequire") && !hasRequireBinding) throw new Error(`deploy: Could not locate the generated require binding in PostgreSQL bundle ${filename}.`);
+	if (code.includes("pgpass") && pgpassCalls === 0 && code.includes("__require")) throw new Error(`deploy: Could not locate the pgpass require in PostgreSQL bundle ${filename}.`);
+	const ms = new MagicString(code);
+	for (const edit of edits.sort((a, b) => b.start - a.start)) ms.overwrite(edit.start, edit.end, edit.replacement);
+	const transformed = ms.toString();
+	if (transformed.includes("createRequire") || transformed.includes("__require(\"pgpass\")")) throw new Error(`deploy: PostgreSQL bundle ${filename} still contains an unsupported require.`);
+	return pgpassCalls > 0 ? `const __voidPgpassNoop = Object.assign(function pgpass(_connectionInfo, callback) { callback(undefined); }, { warnTo() {} });\n${transformed}` : transformed;
+}
+//#endregion
 //#region src/cli/wrapper.ts
 const BUNDLED_ENTRY_RE = /^index\.(?:m?js|cjs)$/;
 const WRAPPER_MARKER = "// Generated by Void: deployment wrapper.";
@@ -3904,7 +4049,7 @@ async function generateWrapper(workerDir, workerMain, root, features) {
 	let migrations;
 	let migrationPlanBundle;
 	if (features.hasMigrations) {
-		const { collectMigrations } = await import("./collect-DAUItMDS.mjs");
+		const { collectMigrations } = await import("./collect-DLyFDiKW.mjs");
 		const { buildMigrationPlanBundle } = await import("./plan-DpuOr14e.mjs");
 		const migrationsDir = readProjectPaths(root).migrationsDir;
 		migrations = collectMigrations(migrationsDir);
@@ -4017,11 +4162,9 @@ function patchPgWorkerBundle(outDir) {
 	for (const file of readdirSync(outDir)) {
 		if (!file.endsWith(".mjs") && !file.endsWith(".js")) continue;
 		const path = join(outDir, file);
-		let code = readFileSync(path, "utf-8");
-		if (!code.includes("__require(\"pgpass\")") && !code.includes("createRequire(import.meta.url)")) continue;
-		code = code.replaceAll("__require(\"pgpass\")", "__voidPgpassNoop").replace("import { createRequire } from \"node:module\";", "").replace("var __require = /* @__PURE__ */ createRequire(import.meta.url);", pgWorkerRequireShim()).replace("var __require = /* #__PURE__ */ (() => createRequire(import.meta.url))();", pgWorkerRequireShim());
-		code = `const __voidPgpassNoop = Object.assign(function pgpass(_connectionInfo, callback) { callback(undefined); }, { warnTo() {} });\n` + code;
-		writeFileSync(path, code);
+		const code = readFileSync(path, "utf-8");
+		const transformed = transformPgWorkerBundle(code, file, pgWorkerRequireShim());
+		if (transformed !== code) writeFileSync(path, transformed);
 	}
 }
 function createPgPackageRequire(fromPath) {
@@ -4318,7 +4461,7 @@ let loadedProvisionModule;
 * so a managed deploy never imports it — and thus never loads `proper-lockfile`.
 */
 async function loadProvisionModule() {
-	loadedProvisionModule ??= await import("./provision-CNgEBkVA.mjs");
+	loadedProvisionModule ??= await import("./provision-DNtrtaVD.mjs");
 	return loadedProvisionModule;
 }
 /**
@@ -4884,6 +5027,47 @@ function reconstructExpectedContainers(config, root, rootConfig, needsSandbox) {
 	}
 	return expected;
 }
+/** Reconstruct the Durable Object state emitted after the pre-build root config is synced. */
+function reconstructExpectedDurableObjectState(config, root, rootConfig, options) {
+	const bindings = bindingEntriesForField("durable_objects", rootConfig.durable_objects).map(({ entry }) => entry);
+	const migrations = Array.isArray(rootConfig.migrations) ? [...rootConfig.migrations] : [];
+	const sandbox = options.needsSandbox ? resolveSandboxConfig(config, root) : void 0;
+	if (sandbox) {
+		if (!bindings.some((binding) => binding.name === sandbox.binding)) bindings.push({
+			name: sandbox.binding,
+			class_name: sandbox.className
+		});
+		if (!migrations.some((migration) => migration.tag === "void-sandbox-v1" || Array.isArray(migration.new_sqlite_classes) && migration.new_sqlite_classes.includes(sandbox.className))) migrations.push({
+			tag: SANDBOX_MIGRATION_TAG,
+			new_sqlite_classes: [sandbox.className]
+		});
+	}
+	const paths = resolveProjectPaths(root, config);
+	const websocketRoutes = scanWebSocketRoutesSync(root, paths);
+	const durableObjects = scanDurableObjectModules(root);
+	const live = options.needsLive ? resolveLiveBindingConfig(root, {
+		reservedBindings: [...websocketRoutes.map((route) => route.bindingName), ...durableObjects.map((module) => module.bindingName)],
+		reservedClasses: [
+			...websocketRoutes.map((route) => route.className),
+			...durableObjects.map((module) => module.className),
+			sandbox?.className
+		]
+	}) : readExistingLiveBindingConfig(root);
+	if (live) {
+		if (!bindings.some((binding) => binding.name === live.bindingName)) bindings.push({
+			name: live.bindingName,
+			class_name: live.className
+		});
+		if (!hasDurableObjectSqliteMigration(migrations, live.className)) migrations.push({
+			tag: nextDurableObjectMigrationTag(migrations, LIVE_MIGRATION_TAG),
+			new_sqlite_classes: [live.className]
+		});
+	}
+	return {
+		bindings,
+		migrations
+	};
+}
 /**
 * Deterministic sha256 over the wrangler uploader BUNDLE the credentialed deploy executes — the
 * resolved `wrangler-dist/cli.js` PLUS every sibling file in its directory. `cli.js` loads sibling
@@ -4941,17 +5125,39 @@ function hashCfUploader() {
 function hashDirectoryContents(dir) {
 	try {
 		const hash = createHash("sha256");
+		const visiting = /* @__PURE__ */ new Set();
 		const walk = (rel) => {
-			const entries = readdirSync(join(dir, rel), { withFileTypes: true }).sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
-			for (const entry of entries) {
-				const childRel = rel ? `${rel}/${entry.name}` : entry.name;
-				if (entry.isDirectory()) walk(childRel);
-				else {
+			const real = realpathSync(join(dir, rel));
+			if (visiting.has(real)) throw new Error(`Cyclic symlink in uploader: ${rel}`);
+			visiting.add(real);
+			try {
+				const entries = readdirSync(join(dir, rel), { withFileTypes: true }).sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
+				for (const entry of entries) {
+					const childRel = rel ? `${rel}/${entry.name}` : entry.name;
+					const childPath = join(dir, childRel);
+					if (entry.isDirectory()) {
+						walk(childRel);
+						continue;
+					}
 					hash.update(childRel);
 					hash.update("\0");
-					hash.update(readFileSync(join(dir, childRel)));
+					if (entry.isSymbolicLink()) {
+						hash.update(readlinkSync(childPath));
+						hash.update("\0");
+						try {
+							const target = statSync(childPath);
+							if (target.isDirectory()) walk(childRel);
+							else if (target.isFile()) hash.update(readFileSync(childPath));
+							else throw new Error(`Unsupported uploader symlink target: ${childRel}`);
+						} catch (error) {
+							if (error.code !== "ENOENT") throw error;
+							hash.update("missing");
+						}
+					} else hash.update(readFileSync(childPath));
 					hash.update("\0");
 				}
+			} finally {
+				visiting.delete(real);
 			}
 		};
 		walk("");
@@ -5452,6 +5658,32 @@ function verifyGeneratedDeployConfig(root, expected) {
 		const destructiveMigration = verifyNoInjectedDestructiveMigration(generated.migrations, raw.get("migrations"));
 		if (!destructiveMigration.ok) return destructiveMigration;
 	}
+	if (expected.expectedDurableObjectBindings) {
+		let emittedBindings;
+		try {
+			emittedBindings = bindingEntriesForField("durable_objects", generated.durable_objects).map(({ entry }) => entry);
+		} catch {
+			return {
+				ok: false,
+				reason: "generated config durable_objects bindings could not be verified."
+			};
+		}
+		const byName = (left, right) => String(left.name).localeCompare(String(right.name));
+		if (!deepEqual([...emittedBindings].sort(byName), [...expected.expectedDurableObjectBindings].sort(byName))) return {
+			ok: false,
+			reason: "generated config durable_objects bindings differ from the pre-build binding set — refusing to deploy a binding the build added, removed, or retargeted."
+		};
+	}
+	if (expected.expectedMigrations) {
+		if (generated.migrations !== void 0 && !Array.isArray(generated.migrations)) return {
+			ok: false,
+			reason: "generated config migrations could not be verified."
+		};
+		if (!deepEqual(Array.isArray(generated.migrations) ? generated.migrations : [], expected.expectedMigrations)) return {
+			ok: false,
+			reason: "generated config migrations differ from the pre-build migration sequence — refusing to deploy a migration the build added, removed, or retargeted."
+		};
+	}
 	if (expected.expectedContainers) {
 		const emittedContainers = Array.isArray(generated.containers) ? generated.containers : [];
 		const expectedContainers = expected.expectedContainers;
@@ -5695,7 +5927,8 @@ async function computeDesiredCloudflareResources(root, voidConfig, configPath) {
 	const inferenceOptions = voidConfig.inference?.bindings ? { bindings: voidConfig.inference.bindings } : void 0;
 	const bindings = inferProjectBindings(root, {
 		...inferenceOptions,
-		paths
+		paths,
+		environment: "prod"
 	}, scanDirs);
 	const authEnabled = bindings.needsAuth || findVoidAuthConfig(root, paths) !== null || voidConfig.auth !== void 0;
 	const dialect = getDatabaseDialect(voidConfig);
@@ -5714,9 +5947,10 @@ async function computeDesiredCloudflareResources(root, voidConfig, configPath) {
 		const binding = bindingNames?.d1 ?? "DB";
 		const storedName = readStoredResourceName(config, "d1_databases", binding, "database_name");
 		const storedId = readStoredResourceName(config, "d1_databases", binding, "database_id");
+		const authoredName = voidConfig.cloudflare?.d1_databases?.find((entry) => entry.binding === binding)?.database_name;
 		desired.d1 = {
 			binding,
-			name: storedName != null && isRealD1Id(storedId) ? storedName : suffixedResourceName(workerName, "db"),
+			name: storedName != null && isRealD1Id(storedId) ? storedName : authoredName?.trim() || (basename(configPath) !== ".void-wrangler.jsonc" && storedName !== "default" ? storedName : void 0) || suffixedResourceName(workerName, "db"),
 			migrationsDir: migrationsDirRelative
 		};
 		reasons.set(binding, databaseReason);
@@ -5732,9 +5966,10 @@ async function computeDesiredCloudflareResources(root, voidConfig, configPath) {
 	if (bindings.needsR2) {
 		const binding = bindingNames?.r2 ?? "STORAGE";
 		const storedName = readStoredResourceName(config, "r2_buckets", binding, "bucket_name");
+		const generatedDefault = storedName === "default" && basename(configPath) === ".void-wrangler.jsonc" && !voidConfig.cloudflare?.r2_buckets?.some((entry) => entry.binding === binding && entry.bucket_name === "default");
 		desired.r2 = {
 			binding,
-			bucketName: storedName && storedName !== "default" ? storedName : suffixedResourceName(workerName, "storage")
+			bucketName: storedName && !generatedDefault ? storedName : suffixedResourceName(workerName, "storage")
 		};
 		reasons.set(binding, "app uses env.STORAGE (R2)");
 	}
@@ -5774,7 +6009,8 @@ async function computeDesiredCloudflareResources(root, voidConfig, configPath) {
 		expectedCrons,
 		needsEmail: bindings.needsEmail === true || hasEmailHandlers(emailHandlers),
 		emailHandlers,
-		needsSandbox: isSandboxEnabled(voidConfig) || bindings.needsSandbox
+		needsSandbox: isSandboxEnabled(voidConfig) || bindings.needsSandbox,
+		needsLive: bindings.needsLive === true
 	};
 }
 /**
@@ -6481,56 +6717,8 @@ async function ensureCloudflareAuthSecret(options) {
 		...workerWasMissing ? { workerWasMissing: true } : {}
 	};
 }
-/**
-* Deploy to the user's OWN Cloudflare account (no Void platform).
-*
-* Orchestrates the existing units — it does NOT re-implement provisioning
-* (`cli/provision.ts`), the config writer (`cli/wrangler.ts`), or the self-host
-* secret preflight (`cli/env-validation.ts`). Flow:
-*
-*   app-class guard → desired set (from source, pre-build) → preflight (auth +
-*   account pin) → automatically ensure resources → ensure worker name →
-*   remote D1 migrate → secrets (warn + gate) → clean-env build → wrangler deploy
-*
-* ORDERING DECISION (documented): the secrets GATE runs AFTER provision + remote
-* migrations resolve but BEFORE build + deploy — the brief's recommended default.
-* Provision and D1 migrations are idempotent (read-first / tracked in wrangler's
-* `d1_migrations` table), so re-running them after a gate failure is safe, while
-* build + `wrangler deploy` (the non-idempotent worker upload) is what the gate
-* protects. The warning is emitted first (non-fatal); a first-deploy secret-list
-* failure (worker not yet created) renders actionable `wrangler secret put`
-* bootstrap guidance rather than dead-ending.
-*
-* Every wrangler / provisioner / secret-unit call is an injected seam
-* ({@link CloudflareDeployDeps}) so the whole orchestration is unit-testable with
-* no real wrangler, network, or Cloudflare account.
-*/
-async function runCloudflareDeploy(root, options, cliLog, deps = {}) {
-	const initialCloudflareLink = readCloudflareLink(root);
-	const exit = deps.exit ?? ((code) => process.exit(code));
-	const voidConfig = readConfig(root);
-	const detectedFramework = detectFramework(root);
-	const frameworkPreset = detectedFramework ? FRAMEWORK_PRESETS[detectedFramework.name] : void 0;
-	cliLog.info("cloudflare_deploy_start", { provision: options.provision === true ? true : void 0 });
-	if (isNodeTarget(voidConfig.target)) {
-		log.error([
-			`deploy: --platform cloudflare is not supported for the "${voidConfig.target}" target.`,
-			"This backend deploys Cloudflare Workers only. Deploy a node/bun/deno build with its",
-			"own host/runtime, or use the default Cloudflare target for --platform cloudflare."
-		].join("\n"));
-		return exit(1);
-	}
-	if (detectedFramework?.class === "a" && hasConfiguredVoidWorkerRoutingRules(voidConfig.routing)) {
-		log.error([
-			`deploy: native Cloudflare deployment cannot apply Void routing redirects, rewrites, fallbacks, or headers to ${detectedFramework.name}.`,
-			"This framework owns its Worker request handler, so these rules would otherwise be ignored.",
-			"Move the rules into the framework or its Cloudflare Worker, then retry."
-		].join("\n"));
-		return exit(1);
-	}
-	const provisionModule = await loadProvisionModule();
-	const staticPreset = resolveCloudflareStaticPreset(root, voidConfig, options) ?? await resolveCloudflareVoidStaticPreset(root, voidConfig);
-	if (staticPreset) return runCloudflareStaticDeploy(root, options, voidConfig, staticPreset, cliLog, deps, initialCloudflareLink);
+/** Validate source-level native deploy inputs before account operations or project code. */
+async function prepareCloudflareDeploySource(root, options, voidConfig) {
 	if (options.skipBuild) {
 		log.error([
 			"deploy: --skip-build is not supported with --platform cloudflare.",
@@ -6540,15 +6728,16 @@ async function runCloudflareDeploy(root, options, cliLog, deps = {}) {
 			"are about to upload. Drop --skip-build, or deploy with `void deploy` (the managed",
 			"platform), which supports it."
 		].join("\n"));
-		return exit(1);
+		return null;
 	}
 	const classification = classifyCloudflareDeployApp(root, voidConfig, options);
 	if (!classification.supported) {
 		log.error(classification.reason);
-		return exit(1);
+		return null;
 	}
 	const configPath = discoverRootWranglerConfig(root);
-	const { desired, reasons, authEnabled, dialect, migrationsDir, migrations: preBuildMigrations, needsAI, aiBindingName, needsSandbox, expectedCrons, needsEmail, emailHandlers } = await computeDesiredCloudflareResources(root, voidConfig, configPath);
+	const facts = await computeDesiredCloudflareResources(root, voidConfig, configPath);
+	const { desired, dialect, migrations: preBuildMigrations, migrationsDir } = facts;
 	if (dialect !== "sqlite" && preBuildMigrations.length > 0 && !process.env.DATABASE_URL) {
 		log.error([
 			`deploy: ${dialect === "mysql" ? "MySQL" : "PostgreSQL"} migrations require DATABASE_URL for --platform cloudflare.`,
@@ -6556,15 +6745,204 @@ async function runCloudflareDeploy(root, options, cliLog, deps = {}) {
 			"provision Hyperdrive and apply checked-in migrations before uploading the Worker; it is",
 			"never written to wrangler.jsonc or the generated Worker config."
 		].join("\n"));
-		return exit(1);
+		return null;
 	}
 	if (desired.d1) {
 		const migrationsPattern = resolveWranglerMigrationPattern(parseRootWranglerConfig(configPath), desired.d1.binding, desired.d1.migrationsDir ?? relative(dirname(configPath), migrationsDir));
 		if (!migrationsPattern.ok) {
 			log.error(migrationsPattern.reason);
+			return null;
+		}
+	}
+	return {
+		configPath,
+		...facts
+	};
+}
+/** Apply remote D1 changes and prove no migrations remain pending. */
+async function applyAndVerifyRemoteD1Migrations(d1MigrateToken, configPath, runWrangler, assertUploaderStillPinned) {
+	if (d1MigrateToken) {
+		log.step("Applying D1 migrations...");
+		if (!assertUploaderStillPinned()) return false;
+		const migrate = await Promise.resolve(runWrangler([
+			"d1",
+			"migrations",
+			"apply",
+			d1MigrateToken,
+			"--remote",
+			"-c",
+			configPath,
+			"--env="
+		], { capture: false }));
+		if (!isCleanWranglerExit(migrate)) {
+			log.error(`deploy: remote D1 migrations failed for "${d1MigrateToken}" (exit ${String(migrate.status)}). Fix the migration and rerun. Note: D1 always enforces foreign_keys=ON — a Drizzle table-rebuild using PRAGMA foreign_keys=OFF must use PRAGMA defer_foreign_keys instead.`);
+			return false;
+		}
+		if (!assertUploaderStillPinned()) return false;
+		const migrateList = await Promise.resolve(runWrangler([
+			"d1",
+			"migrations",
+			"list",
+			d1MigrateToken,
+			"--remote",
+			"-c",
+			configPath,
+			"--env="
+		], { capture: true }));
+		if (!isCleanWranglerExit(migrateList)) {
+			log.error(`deploy: could not verify the remote migration state for "${d1MigrateToken}" (\`d1 migrations list\` exit ${String(migrateList.status)}). Refusing to deploy against an unverified schema — rerun once wrangler can reach your account.`);
+			return false;
+		}
+		if (migrateList.stdout.includes("Migrations to be applied:")) {
+			log.error([
+				`deploy: remote D1 still has UNAPPLIED migrations for "${d1MigrateToken}" after apply.`,
+				"`wrangler d1 migrations apply` exits 0 even when its confirmation is declined, so",
+				"the schema may be un-migrated while the code that needs it is about to deploy.",
+				"Re-run and confirm the migration (or apply it non-interactively), then rerun."
+			].join("\n"));
+			return false;
+		}
+		if (!migrateList.stdout.includes("No migrations to apply!")) {
+			log.error([
+				`deploy: could not confirm the remote migration state for "${d1MigrateToken}".`,
+				"`wrangler d1 migrations list` printed neither the \"no migrations to apply\" nor the",
+				"\"migrations to be applied\" marker (WRANGLER_LOG is pinned so they are never",
+				"suppressed) — refusing to deploy against an unverified schema. Rerun once wrangler",
+				"can reach your account."
+			].join("\n"));
+			return false;
+		}
+	}
+	return true;
+}
+/** Check the built Worker against the pinned deployment target before upload. */
+function verifyCloudflareDeployArtifact(root, deps, options) {
+	const verification = (deps.verifyDeployConfig ?? verifyGeneratedDeployConfig)(root, options);
+	if (!verification.ok) {
+		log.error([
+			"deploy: the generated deploy config does not match the pinned target — refusing to deploy.",
+			verification.reason,
+			"This typically means CLOUDFLARE_ENV / CLOUDFLARE_VITE_WRANGLER_CONFIG_PATH (in the",
+			"environment or a production `.env`) selected a different named environment or config",
+			"at build time. This backend always deploys the canonical top-level config — remove",
+			"them and rebuild."
+		].filter(Boolean).join("\n"));
+		return false;
+	}
+	return true;
+}
+/** Validate emitted Worker vars and required secrets against post-build ground truth. */
+async function validateCloudflarePostBuildEnv(root, configPath, accountId, apiBaseUrl, workerName, schemaFacts, authEnabled, existingWorker, approvedHandoffKv, deps, assertUploaderStillPinned) {
+	const emitted = (deps.readEmittedWorkerVars ?? readEmittedWorkerVarsDefault)(root);
+	if (existingWorker) {
+		const generated = readGeneratedDeployConfig(root);
+		assertExistingCloudflareConfig(existingWorker, generated.config, true, approvedHandoffKv);
+	}
+	if (!emitted.ok) {
+		log.error([
+			"deploy: could not read the worker vars the build emitted — refusing to validate secrets.",
+			`  ${emitted.reason}`,
+			"The build must emit dist/ssr/wrangler.json for this backend. Rerun the build, or deploy",
+			"this app with `void deploy` (the managed platform)."
+		].join("\n"));
+		return false;
+	}
+	const emittedVars = emitted.vars;
+	if (authEnabled && Object.prototype.hasOwnProperty.call(emittedVars, BETTER_AUTH_SECRET_NAME)) {
+		log.error([
+			`deploy: ${BETTER_AUTH_SECRET_NAME} must be stored as a Cloudflare Worker secret, not a plaintext worker var.`,
+			"Remove it from Worker vars and rerun. This deploy command preserves an",
+			"existing remote value or creates a persistent one automatically when it is missing."
+		].join("\n"));
+		return false;
+	}
+	const plaintextServerKeys = schemaFacts.serverKeys.filter((key) => key in emittedVars);
+	if (plaintextServerKeys.length > 0) {
+		log.error([
+			"deploy: server env keys cannot ship as plaintext Worker vars:",
+			...plaintextServerKeys.map((key) => `  • ${key}`),
+			"Remove them from Worker vars and set them with `void secret put <NAME>`."
+		].join("\n"));
+		return false;
+	}
+	const envContext = deriveSelfHostEnvContextFromVars(emittedVars, schemaFacts);
+	if (schemaFacts.hasSchema) {
+		let validateResult;
+		try {
+			validateResult = await (deps.validateEmittedVars ?? validateEmittedVarsDefault)({ root }, buildSchemaProbeEnv(accountId, apiBaseUrl));
+		} catch (err) {
+			log.error(`deploy: could not validate the emitted worker vars against the env schema — ${getErrorMessage(err)}`);
+			return false;
+		}
+		if (validateResult.kind === "schema-error") {
+			log.error(`deploy: ${selfHostSchemaFailureMessage(validateResult.reason)}`);
+			return false;
+		}
+		envContext.invalidKeys = validateResult.invalidKeys;
+	}
+	if (authEnabled) {
+		envContext.absentRequired = envContext.absentRequired.filter((key) => key !== BETTER_AUTH_SECRET_NAME);
+		envContext.invalidKeys = envContext.invalidKeys.filter((key) => key !== BETTER_AUTH_SECRET_NAME);
+	}
+	if (!assertUploaderStillPinned()) return false;
+	try {
+		await (deps.dischargeSelfHostEnv ?? dischargeSelfHostEnvContext)(envContext, {
+			root,
+			configPath,
+			accountId,
+			workerName
+		});
+	} catch (err) {
+		if (err instanceof SelfHostFirstDeployError || err instanceof SelfHostSecretListError || err instanceof SelfHostEnvValidationError || err instanceof SelfHostSchemaError) {
+			log.error(err.message);
+			return false;
+		}
+		throw err;
+	}
+	return true;
+}
+/** Deploy to the user's own Cloudflare account through the guarded native Worker flow. */
+async function runCloudflareDeploy(root, options, cliLog, deps = {}) {
+	const initialCloudflareLink = readCloudflareLink(root);
+	const initialCloudflareCandidate = readCloudflareCandidate(root);
+	const exit = deps.exit ?? ((code) => process.exit(code));
+	const voidConfig = readConfig(root);
+	const atomic = options.atomic === true || voidConfig.deploy?.cloudflare?.mode === "atomic";
+	if (atomic && (options.reuseExistingWorker || initialCloudflareLink)) {
+		log.error("deploy: atomic deployment is unavailable during the existing Worker handoff. Complete the handoff first.");
+		return exit(1);
+	}
+	const detectedFramework = detectFramework(root);
+	const frameworkPreset = detectedFramework ? FRAMEWORK_PRESETS[detectedFramework.name] : void 0;
+	cliLog.info("cloudflare_deploy_start", { provision: options.provision === true ? true : void 0 });
+	if (isNodeTarget(voidConfig.target)) {
+		log.error([
+			`deploy: --platform cloudflare is not supported for the "${voidConfig.target}" target.`,
+			"This backend deploys Cloudflare Workers only. Deploy a node/bun/deno build with its",
+			"own host/runtime, or use the default Cloudflare target for --platform cloudflare."
+		].join("\n"));
+		return exit(1);
+	}
+	if (detectedFramework?.class === "a" && hasConfiguredVoidWorkerRoutingRules(voidConfig.routing)) {
+		log.error([
+			`deploy: native Cloudflare deployment cannot apply Void routing redirects, rewrites, fallbacks, or headers to ${detectedFramework.name}.`,
+			"This framework owns its Worker request handler, so these rules would otherwise be ignored.",
+			"Move the rules into the framework or its Cloudflare Worker, then retry."
+		].join("\n"));
+		return exit(1);
+	}
+	const provisionModule = await loadProvisionModule();
+	const staticPreset = resolveCloudflareStaticPreset(root, voidConfig, options) ?? await resolveCloudflareVoidStaticPreset(root, voidConfig);
+	if (staticPreset) {
+		if (atomic) {
+			log.error("deploy: atomic deployment is only for Workers with Durable Objects.");
 			return exit(1);
 		}
+		return runCloudflareStaticDeploy(root, options, voidConfig, staticPreset, cliLog, deps, initialCloudflareLink, initialCloudflareCandidate);
 	}
+	const source = await prepareCloudflareDeploySource(root, options, voidConfig);
+	if (!source) return exit(1);
+	const { configPath, desired, reasons, authEnabled, dialect, migrationsDir, migrations: preBuildMigrations, needsAI, aiBindingName, needsSandbox, needsLive, expectedCrons, needsEmail, emailHandlers } = source;
 	let rootConfig = parseRootWranglerConfig(configPath);
 	let apiBaseUrl;
 	try {
@@ -6862,6 +7240,10 @@ async function runCloudflareDeploy(root, options, cliLog, deps = {}) {
 	const passthroughIdentitySnapshot = snapshotPassthroughIdentities(preBuildRootConfig);
 	const passthroughRawFields = snapshotPassthroughRawFields(preBuildRootConfig);
 	const expectedContainers = reconstructExpectedContainers(voidConfig, root, preBuildRootConfig, needsSandbox);
+	const expectedDurableObjectState = reconstructExpectedDurableObjectState(voidConfig, root, preBuildRootConfig, {
+		needsSandbox,
+		needsLive
+	});
 	removeDeployPointer(root);
 	const buildChildEnv = scrubManagedDeployBuildMarkers(scrubWranglerAuthCredentials(deployChildEnv(accountId, apiBaseUrl)));
 	requireProvisionModule().deleteEnvVarCaseAware(buildChildEnv, CLOUDFLARE_DEPLOY_BUILD_ENV);
@@ -6897,6 +7279,10 @@ async function runCloudflareDeploy(root, options, cliLog, deps = {}) {
 		return exit(1);
 	}
 	const lifecycleConfigPath = (deps.resolveGeneratedConfigPath ?? ((projectRoot) => readGeneratedDeployConfig(projectRoot).path))(root);
+	if (atomic && !Array.isArray(parseRootWranglerConfig(lifecycleConfigPath).migrations)) {
+		log.error("deploy: atomic deployment is only for Workers with Durable Object migration history.");
+		return exit(1);
+	}
 	try {
 		deduplicateGeneratedCompatibilityFlags(lifecycleConfigPath, configPath);
 		const lifecycleOptions = {
@@ -6906,77 +7292,15 @@ async function runCloudflareDeploy(root, options, cliLog, deps = {}) {
 			accountId,
 			apiBaseUrl
 		};
-		await (deps.assertDurableObjectLifecycle ?? assertCloudflareDurableObjectLifecycleSupported)(lifecycleOptions);
+		await (deps.assertDurableObjectLifecycle ?? assertCloudflareDurableObjectLifecycleSupported)({
+			...lifecycleOptions,
+			allowPendingAtomicMigration: atomic
+		});
 	} catch (error) {
 		log.error(getErrorMessage(error));
 		return exit(1);
 	}
-	const emitted = (deps.readEmittedWorkerVars ?? readEmittedWorkerVarsDefault)(root);
-	if (existingWorker) {
-		const generated = readGeneratedDeployConfig(root);
-		assertExistingCloudflareConfig(existingWorker, generated.config, true, approvedHandoffKv);
-	}
-	if (!emitted.ok) {
-		log.error([
-			"deploy: could not read the worker vars the build emitted — refusing to validate secrets.",
-			`  ${emitted.reason}`,
-			"The build must emit dist/ssr/wrangler.json for this backend. Rerun the build, or deploy",
-			"this app with `void deploy` (the managed platform)."
-		].join("\n"));
-		return exit(1);
-	}
-	const emittedVars = emitted.vars;
-	if (authEnabled && Object.prototype.hasOwnProperty.call(emittedVars, BETTER_AUTH_SECRET_NAME)) {
-		log.error([
-			`deploy: ${BETTER_AUTH_SECRET_NAME} must be stored as a Cloudflare Worker secret, not a plaintext worker var.`,
-			"Remove it from Worker vars and rerun. This deploy command preserves an",
-			"existing remote value or creates a persistent one automatically when it is missing."
-		].join("\n"));
-		return exit(1);
-	}
-	const plaintextServerKeys = schemaFacts.serverKeys.filter((key) => key in emittedVars);
-	if (plaintextServerKeys.length > 0) {
-		log.error([
-			"deploy: server env keys cannot ship as plaintext Worker vars:",
-			...plaintextServerKeys.map((key) => `  • ${key}`),
-			"Remove them from Worker vars and set them with `void secret put <NAME>`."
-		].join("\n"));
-		return exit(1);
-	}
-	const envContext = deriveSelfHostEnvContextFromVars(emittedVars, schemaFacts);
-	if (schemaFacts.hasSchema) {
-		let validateResult;
-		try {
-			validateResult = await (deps.validateEmittedVars ?? validateEmittedVarsDefault)({ root }, buildSchemaProbeEnv(accountId, apiBaseUrl));
-		} catch (err) {
-			log.error(`deploy: could not validate the emitted worker vars against the env schema — ${getErrorMessage(err)}`);
-			return exit(1);
-		}
-		if (validateResult.kind === "schema-error") {
-			log.error(`deploy: ${selfHostSchemaFailureMessage(validateResult.reason)}`);
-			return exit(1);
-		}
-		envContext.invalidKeys = validateResult.invalidKeys;
-	}
-	if (authEnabled) {
-		envContext.absentRequired = envContext.absentRequired.filter((key) => key !== BETTER_AUTH_SECRET_NAME);
-		envContext.invalidKeys = envContext.invalidKeys.filter((key) => key !== BETTER_AUTH_SECRET_NAME);
-	}
-	if (!assertUploaderStillPinned()) return exit(1);
-	try {
-		await (deps.dischargeSelfHostEnv ?? dischargeSelfHostEnvContext)(envContext, {
-			root,
-			configPath,
-			accountId,
-			workerName
-		});
-	} catch (err) {
-		if (err instanceof SelfHostFirstDeployError || err instanceof SelfHostSecretListError || err instanceof SelfHostEnvValidationError || err instanceof SelfHostSchemaError) {
-			log.error(err.message);
-			return exit(1);
-		}
-		throw err;
-	}
+	if (!await validateCloudflarePostBuildEnv(root, configPath, accountId, apiBaseUrl, workerName, schemaFacts, authEnabled, existingWorker, approvedHandoffKv, deps, assertUploaderStillPinned)) return exit(1);
 	if (authEnabled && dialect === "sqlite") try {
 		await (deps.validateAuthMigrations ?? validateAuthMigrationSchema)(root, migrations);
 	} catch (err) {
@@ -7071,6 +7395,8 @@ async function runCloudflareDeploy(root, options, cliLog, deps = {}) {
 			aiBindingName,
 			authEnabled,
 			expectedContainers,
+			expectedDurableObjectBindings: expectedDurableObjectState.bindings,
+			expectedMigrations: expectedDurableObjectState.migrations,
 			expectedCrons
 		});
 		if (!inheritance.ok) {
@@ -7128,59 +7454,8 @@ async function runCloudflareDeploy(root, options, cliLog, deps = {}) {
 			return exit(1);
 		}
 	}
-	if (d1MigrateToken) {
-		log.step("Applying D1 migrations...");
-		if (!assertUploaderStillPinned()) return exit(1);
-		const migrate = await Promise.resolve(runWrangler([
-			"d1",
-			"migrations",
-			"apply",
-			d1MigrateToken,
-			"--remote",
-			"-c",
-			configPath,
-			"--env="
-		], { capture: false }));
-		if (!isCleanWranglerExit(migrate)) {
-			log.error(`deploy: remote D1 migrations failed for "${d1MigrateToken}" (exit ${String(migrate.status)}). Fix the migration and rerun. Note: D1 always enforces foreign_keys=ON — a Drizzle table-rebuild using PRAGMA foreign_keys=OFF must use PRAGMA defer_foreign_keys instead.`);
-			return exit(1);
-		}
-		if (!assertUploaderStillPinned()) return exit(1);
-		const migrateList = await Promise.resolve(runWrangler([
-			"d1",
-			"migrations",
-			"list",
-			d1MigrateToken,
-			"--remote",
-			"-c",
-			configPath,
-			"--env="
-		], { capture: true }));
-		if (!isCleanWranglerExit(migrateList)) {
-			log.error(`deploy: could not verify the remote migration state for "${d1MigrateToken}" (\`d1 migrations list\` exit ${String(migrateList.status)}). Refusing to deploy against an unverified schema — rerun once wrangler can reach your account.`);
-			return exit(1);
-		}
-		if (migrateList.stdout.includes("Migrations to be applied:")) {
-			log.error([
-				`deploy: remote D1 still has UNAPPLIED migrations for "${d1MigrateToken}" after apply.`,
-				"`wrangler d1 migrations apply` exits 0 even when its confirmation is declined, so",
-				"the schema may be un-migrated while the code that needs it is about to deploy.",
-				"Re-run and confirm the migration (or apply it non-interactively), then rerun."
-			].join("\n"));
-			return exit(1);
-		}
-		if (!migrateList.stdout.includes("No migrations to apply!")) {
-			log.error([
-				`deploy: could not confirm the remote migration state for "${d1MigrateToken}".`,
-				"`wrangler d1 migrations list` printed neither the \"no migrations to apply\" nor the",
-				"\"migrations to be applied\" marker (WRANGLER_LOG is pinned so they are never",
-				"suppressed) — refusing to deploy against an unverified schema. Rerun once wrangler",
-				"can reach your account."
-			].join("\n"));
-			return exit(1);
-		}
-	}
-	const verification = (deps.verifyDeployConfig ?? verifyGeneratedDeployConfig)(root, {
+	if (!await applyAndVerifyRemoteD1Migrations(d1MigrateToken, configPath, runWrangler, assertUploaderStillPinned)) return exit(1);
+	if (!verifyCloudflareDeployArtifact(root, deps, {
 		accountId,
 		workerName,
 		desired,
@@ -7192,21 +7467,14 @@ async function runCloudflareDeploy(root, options, cliLog, deps = {}) {
 		authEnabled,
 		requiredSecretNames: schemaFacts.requiredKeys,
 		expectedContainers,
+		expectedDurableObjectBindings: expectedDurableObjectState.bindings,
+		expectedMigrations: expectedDurableObjectState.migrations,
 		expectedCrons
-	});
-	if (!verification.ok) {
-		log.error([
-			"deploy: the generated deploy config does not match the pinned target — refusing to deploy.",
-			verification.reason,
-			"This typically means CLOUDFLARE_ENV / CLOUDFLARE_VITE_WRANGLER_CONFIG_PATH (in the",
-			"environment or a production `.env`) selected a different named environment or config",
-			"at build time. This backend always deploys the canonical top-level config — remove",
-			"them and rebuild."
-		].filter(Boolean).join("\n"));
-		return exit(1);
-	}
+	})) return exit(1);
 	const queueConsumerCleanup = readWranglerManagedQueueCleanupCandidates(configPath);
 	if (existingWorker) assertCloudflareLinkUnchanged(root, pinnedHandoffLink);
+	assertCloudflareCandidateUnchanged(root, initialCloudflareCandidate);
+	if (initialCloudflareCandidate && (initialCloudflareCandidate.accountId !== accountId || initialCloudflareCandidate.workerName !== workerName)) throw new Error("The saved Cloudflare candidate belongs to a different account or Worker. Inspect its receipt before retrying.");
 	const candidateReceipt = pinnedHandoffLink?.candidateReceipt;
 	if (!deps.activateVersion && !deps.runWrangler && !cfUploaderIsPinned()) return exit(1);
 	const cfOutput = deps.activateVersion || deps.runWrangler ? null : await prepareBuildOutput();
@@ -7238,7 +7506,7 @@ async function runCloudflareDeploy(root, options, cliLog, deps = {}) {
 		configPath: generatedConfigPath,
 		preserveTriggers: existingWorker !== null,
 		expectedPreviousVersionId: existingWorker?.versionId,
-		trustedInheritanceVersionIds: existingWorker && candidateReceipt?.parentVersionId === existingWorker.versionId ? candidateReceipt.versionIds : void 0,
+		trustedInheritanceVersionIds: existingWorker ? candidateReceipt?.parentVersionId === existingWorker.versionId ? candidateReceipt.versionIds : void 0 : initialCloudflareCandidate?.versionIds,
 		validateUploadedVersion: existingWorker ? async (versionId) => {
 			if (!assertUploaderStillPinned()) throw new Error("The deployment uploader changed.");
 			const uploaded = await (deps.readExistingWorker ?? readExistingCloudflareWorker)({
@@ -7249,7 +7517,9 @@ async function runCloudflareDeploy(root, options, cliLog, deps = {}) {
 			});
 			assertCloudflareBindingsPreserved(existingWorker, uploaded, approvedHandoffKv);
 		} : void 0,
-		recordVerifiedCandidate: existingWorker ? (versionId) => recordCloudflareCandidate(root, pinnedHandoffLink, existingWorker.versionId, versionId) : void 0,
+		recordVerifiedCandidate: existingWorker ? (versionId) => recordCloudflareCandidate(root, pinnedHandoffLink, existingWorker.versionId, versionId) : (versionId, parentVersionId) => {
+			if (parentVersionId) recordCloudflareCandidateUpload(root, initialCloudflareCandidate, accountId, workerName, parentVersionId, versionId);
+		},
 		message: encodeCloudflareVersionMessage(migrations.map((migration) => migration.name), {
 			...readCloudflareTriggerConfig(generatedConfigPath, configPath),
 			...existingWorker ? { preserve: true } : {}
@@ -7275,12 +7545,22 @@ async function runCloudflareDeploy(root, options, cliLog, deps = {}) {
 		previousTrafficConfig: readWranglerPublishedTrafficSnapshot(configPath),
 		queueConsumerCleanup,
 		verifyInheritedSecrets: true,
+		...cfOutput && existingWorker && !pinnedHandoffLink ? { pinActiveSecrets: (activeVersionId, bindings) => pinActiveWorkerSecrets({
+			output: cfOutput,
+			activeVersionId,
+			bindings,
+			requiredNames: schemaFacts.requiredKeys,
+			...initialAuthSecret ? { explicitNames: [BETTER_AUTH_SECRET_NAME] } : {}
+		}) } : {},
+		atomic,
 		...initialAuthSecret ? { candidateSecrets: { [BETTER_AUTH_SECRET_NAME]: initialAuthSecret } } : {}
 	}).finally(() => cfOutput?.dispose());
 	if (!execution.ok) {
+		if (execution.reason === "atomic-readiness-failed" || execution.reason === "atomic-readiness-access-denied") clearCloudflareCandidate(root);
 		await reportCloudflareActivationFailure(cliLog, needsSandbox && execution.containersUnavailable ? formatCloudflareSandboxUnavailable() : formatCloudflareActivationError(execution));
 		return exit(1);
 	}
+	clearCloudflareCandidate(root);
 	if (existingWorker) completeCloudflareLink(root);
 	acknowledgeWranglerManagedQueueRemovals(configPath, queueConsumerCleanup);
 	rememberCloudflareWorkersDevSubdomain(root, accountId, execution.previewUrl);
@@ -7319,12 +7599,16 @@ async function activateCloudflareVersionWithProgress(activate, options) {
 	const progress = createSpinner();
 	progress.start("Checking the current Worker deployment...");
 	try {
-		return await activate({
+		const result = await activate({
 			...options,
 			onProgress: (message) => progress.message(message)
 		});
-	} finally {
-		progress.stop();
+		if (result.ok) progress.stop("Worker version is ready.");
+		else progress.error("Worker deployment stopped.");
+		return result;
+	} catch (error) {
+		progress.error("Worker deployment stopped.");
+		throw error;
 	}
 }
 function formatCloudflareActivationError(result) {
@@ -7342,9 +7626,8 @@ function formatCloudflareActivationError(result) {
 		case "deployment-changed": return result.triggerRepair === "succeeded" ? `deploy: another Cloudflare operation superseded this deployment. Void restored triggers for the active version ${result.activeVersionId ?? "(unknown)"}; retry from fresh deployment status.` : `deploy: another Cloudflare operation superseded this deployment, but its trigger state could not be verified. Inspect the active Worker version ${result.activeVersionId ?? "(unknown)"} immediately.`;
 		case "inheritance-source-unavailable": return "deploy: could not verify which Worker Version would supply inherited secrets; production traffic is unchanged.";
 		case "inheritance-source-changed": return [
-			"deploy: the active Worker Version is not the latest upload, so inherited secrets cannot be pinned safely.",
-			"Supply explicit local values for every schema-marked text secret and retry. If the Worker has",
-			"non-text secret bindings, inspect its active and latest versions in Cloudflare before proceeding.",
+			"deploy: the active Worker Version is not the latest upload, and its secrets could not be pinned safely.",
+			"Inspect the active and latest Worker versions in Cloudflare before retrying.",
 			"No version was uploaded; production traffic is unchanged."
 		].join("\n");
 		case "traffic-preservation-unavailable": return ["deploy: the existing Worker has dashboard-managed routes or visibility that Void cannot safely republish.", "Add its current routes, workers_dev, and preview_urls values to the root Wrangler config, then retry; no version was uploaded."].join("\n");
@@ -7360,7 +7643,11 @@ function formatCloudflareActivationError(result) {
 			"Set CLOUDFLARE_WORKERS_SUBDOMAIN to your account subdomain (for example \"my-team\")",
 			"and retry. Void caches it after a successful workers.dev deployment; production traffic is unchanged."
 		].join("\n");
-		case "readiness-staging-failed": return `deploy: Cloudflare could not stage the uploaded Worker Version at zero-percent traffic${status}; production traffic is unchanged.`;
+		case "readiness-staging-failed": return `deploy: Cloudflare could not stage the uploaded Worker Version at zero-percent traffic${status}; production traffic is unchanged.${cloudflareCode}${diagnostic}${result.cloudflareErrorCode === 10210 && /Durable Object migration/i.test(result.diagnostic ?? "") ? "\n\nReview the Durable Object migration, then run `void deploy --platform cloudflare --atomic`. For future deploys, set deploy.cloudflare.mode to \"atomic\" in void.config.ts." : ""}`;
+		case "atomic-failed": return `deploy: Cloudflare could not publish the Worker atomically${status}; inspect production status before retrying.${cloudflareCode}${diagnostic}`;
+		case "atomic-output-invalid": return "deploy: Cloudflare published atomically but did not report a version id or URL. Inspect `void project status` immediately.";
+		case "atomic-readiness-failed":
+		case "atomic-readiness-access-denied": return "deploy: the atomic Worker deployment is live, but /__void/ready could not be verified. Inspect `void project status` and Worker logs immediately.";
 		case "readiness-failed": return ["deploy: the uploaded Worker Version did not pass /__void/ready.", formatCloudflareReadinessRestoration(result)].join("\n");
 		case "readiness-access-denied": return [
 			"deploy: Cloudflare Access blocked the uploaded Worker Version readiness probe.",
@@ -7491,7 +7778,10 @@ async function resolveCloudflareVoidStaticPreset(root, voidConfig) {
 		paths
 	});
 	if (pageScan.pages.length === 0 || !pageScan.pages.every((page) => page.shouldPrerender && (page.params.length === 0 && !page.catchAll || page.hasGetPrerenderPaths))) return null;
-	const bindings = inferProjectBindings(root, { paths });
+	const bindings = inferProjectBindings(root, {
+		paths,
+		environment: "prod"
+	});
 	const authEnabled = bindings.needsAuth || findVoidAuthConfig(root, paths) !== null || voidConfig.auth !== void 0;
 	if (hasNonPageBackend({
 		hasRoutes: routeScan.routes.length > 0,
@@ -7507,7 +7797,7 @@ async function resolveCloudflareVoidStaticPreset(root, voidConfig) {
 		appType: "static"
 	};
 }
-async function runCloudflareStaticDeploy(root, options, voidConfig, preset, cliLog, deps, initialCloudflareLink) {
+async function runCloudflareStaticDeploy(root, options, voidConfig, preset, cliLog, deps, initialCloudflareLink, initialCloudflareCandidate) {
 	const exit = deps.exit ?? ((code) => process.exit(code));
 	const configPath = discoverRootWranglerConfig(root);
 	let rootConfig = parseRootWranglerConfig(configPath);
@@ -7657,6 +7947,8 @@ async function runCloudflareStaticDeploy(root, options, voidConfig, preset, cliL
 	});
 	const queueConsumerCleanup = readWranglerManagedQueueCleanupCandidates(configPath);
 	if (existingWorker) assertCloudflareLinkUnchanged(root, pinnedHandoffLink);
+	assertCloudflareCandidateUnchanged(root, initialCloudflareCandidate);
+	if (initialCloudflareCandidate && (initialCloudflareCandidate.accountId !== accountId || initialCloudflareCandidate.workerName !== workerName)) throw new Error("The saved Cloudflare candidate belongs to a different account or Worker. Inspect its receipt before retrying.");
 	const candidateReceipt = pinnedHandoffLink?.candidateReceipt;
 	if (!deps.activateVersion && !deps.runWrangler && !cfUploaderIsPinned()) return exit(1);
 	const cfOutput = deps.activateVersion || deps.runWrangler ? null : await prepareCfStaticBuildOutput({
@@ -7692,7 +7984,7 @@ async function runCloudflareStaticDeploy(root, options, voidConfig, preset, cliL
 		configPath: staticConfigPath,
 		preserveTriggers: existingWorker !== null,
 		expectedPreviousVersionId: existingWorker?.versionId,
-		trustedInheritanceVersionIds: existingWorker && candidateReceipt?.parentVersionId === existingWorker.versionId ? candidateReceipt.versionIds : void 0,
+		trustedInheritanceVersionIds: existingWorker ? candidateReceipt?.parentVersionId === existingWorker.versionId ? candidateReceipt.versionIds : void 0 : initialCloudflareCandidate?.versionIds,
 		validateUploadedVersion: existingWorker ? async (versionId) => {
 			if (!uploaderIsPinned()) throw new Error("The deployment uploader changed.");
 			const uploaded = await (deps.readExistingWorker ?? readExistingCloudflareWorker)({
@@ -7703,7 +7995,9 @@ async function runCloudflareStaticDeploy(root, options, voidConfig, preset, cliL
 			});
 			assertCloudflareBindingsPreserved(existingWorker, uploaded, [], { staticAssetsBinding: "ASSETS" });
 		} : void 0,
-		recordVerifiedCandidate: existingWorker ? (versionId) => recordCloudflareCandidate(root, pinnedHandoffLink, existingWorker.versionId, versionId) : void 0,
+		recordVerifiedCandidate: existingWorker ? (versionId) => recordCloudflareCandidate(root, pinnedHandoffLink, existingWorker.versionId, versionId) : (versionId, parentVersionId) => {
+			if (parentVersionId) recordCloudflareCandidateUpload(root, initialCloudflareCandidate, accountId, workerName, parentVersionId, versionId);
+		},
 		workerName,
 		message: encodeCloudflareVersionMessage([], {
 			...readCloudflareTriggerConfig(staticConfigPath, configPath),
@@ -7734,6 +8028,7 @@ async function runCloudflareStaticDeploy(root, options, voidConfig, preset, cliL
 		await reportCloudflareActivationFailure(cliLog, formatCloudflareActivationError(execution));
 		return exit(1);
 	}
+	clearCloudflareCandidate(root);
 	if (existingWorker) completeCloudflareLink(root);
 	acknowledgeWranglerManagedQueueRemovals(configPath, queueConsumerCleanup);
 	rememberCloudflareWorkersDevSubdomain(root, accountId, execution.previewUrl);
@@ -7828,6 +8123,7 @@ async function runDeployInner(root, options, cliLog) {
 		reuseExistingWorker: true
 	};
 	const platform = resolveDeploymentPlatform(root, options);
+	if (options?.atomic && platform !== "cloudflare") throw new Error("deploy: --atomic is available only for Cloudflare Workers.");
 	if (platform === "none") throw new Error("deploy: deployment setup was skipped during `void init`. Pass `--platform cloudflare` or `--platform void` to choose a destination.");
 	const targetLabel = platform === "cloudflare" ? "Cloudflare" : "Void";
 	log.info(`Deployment target: ${targetLabel}`);
@@ -7863,11 +8159,16 @@ async function runManagedDeploy(root, options, cliLog) {
 			cliLog
 		});
 		const requestedProjectSlug = getRequestedProjectSlug(options);
+		const linkedProject = readProjectConfig(root);
 		let config = null;
 		if (requestedProjectSlug) {
-			const projects = await client.listProjects();
-			assertProjectDeployAccess(projects.find((project) => project.slug === requestedProjectSlug));
-			config = resolveProjectBySlug(projects, requestedProjectSlug);
+			const linked = linkedProject?.slug === requestedProjectSlug ? await client.getProject(linkedProject.projectId) : null;
+			const project = linked?.slug === requestedProjectSlug ? linked : await client.findProjectBySlug(requestedProjectSlug);
+			assertProjectDeployAccess(project ?? void 0);
+			config = project ? {
+				projectId: project.id,
+				slug: project.slug
+			} : null;
 			if (!config) {
 				if (!process.stdin.isTTY) config = await createProjectFromSlug(root, client, requestedProjectSlug, cliLog);
 				else {
@@ -7880,11 +8181,10 @@ async function runManagedDeploy(root, options, cliLog) {
 				}
 			}
 		} else {
-			config = readProjectConfig(root);
+			config = linkedProject;
 			if (config) {
-				const projects = await client.listProjects();
 				const { projectId, slug } = config;
-				const project = projects.find((project) => project.id === projectId);
+				const project = await client.getProject(projectId);
 				if (!project) throw new Error(`deploy: The linked project "${slug}" is unavailable or you no longer have access. Ask a project admin or owner to restore access, or choose another project with \`--project <slug>\`.`);
 				assertProjectDeployAccess(project);
 			}
@@ -7956,7 +8256,7 @@ function assertProjectDeployAccess(project) {
 	if (project?.role === "reader") throw new Error(`deploy: You have reader access to "${project.slug}" and cannot deploy. Ask a project admin or owner to grant collaborator access, or choose another project with \`--project <slug>\`.`);
 }
 async function promptDeployProjectConfig(root, client, cliLog) {
-	const projects = await client.listProjects();
+	const projects = await client.listProjectChoices();
 	const deployableProjects = projects.filter((project) => project.role !== "reader");
 	if (deployableProjects.length !== projects.length) log.warn("Projects with reader access are hidden from deploy selection. Ask a project admin or owner to grant collaborator access to deploy to them.");
 	if (await promptProjectSetupAction("Set up a Void project for deploy:", { includeLink: deployableProjects.length > 0 }) === "create") return promptAndCreateProject(root, client);
@@ -8475,7 +8775,8 @@ async function runFrameworkDeploy(root, config, client, detected, fwPreset, void
 	const scanDirs = voidConfig.inference?.scanDirs ?? FRAMEWORK_SCAN_DIRS;
 	const bindings = inferProjectBindings(root, {
 		...inferenceOptions,
-		paths
+		paths,
+		environment: "prod"
 	}, scanDirs);
 	if (bindings.needsAuth || findVoidAuthConfig(root, paths) !== null || voidConfig.auth !== void 0) {
 		log.error("deploy: Void-managed Better Auth is only supported in Void apps. Use Better Auth's official integration for this framework instead.");
@@ -8696,7 +8997,10 @@ async function runFullDeploy(root, config, client, voidConfig, fwPreset, skipBui
 	const paths = resolveProjectPaths(root, deployConfig);
 	const dialect = getDatabaseDialect(deployConfig);
 	const deployScanDirs = deployConfig.inference?.scanDirs ?? (isFrameworkMode ? FRAMEWORK_SCAN_DIRS : void 0);
-	const bindings = inferProjectBindings(root, { paths }, deployScanDirs);
+	const bindings = inferProjectBindings(root, {
+		paths,
+		environment: "prod"
+	}, deployScanDirs);
 	if (isSandboxEnabled(deployConfig)) bindings.needsSandbox = true;
 	const authEnabled = bindings.needsAuth || findVoidAuthConfig(root, paths) !== null || deployConfig.auth !== void 0;
 	const effectiveBindings = authEnabled ? {
@@ -9202,4 +9506,4 @@ function resolveWorkerDirName(distDir, fwPreset, buildCommand) {
 	throw new Error("deploy: Worker output not found. Expected dist/ssr/ or dist/rsc/.");
 }
 //#endregion
-export { streamDeployEvents as $, parseRootWranglerConfig$1 as A, resolveDistDir as B, generateDeployWrapperIfNeeded as C, resolveAssetRoutingPolicy as Ct, hashWranglerUploader as D, hasPrerenderSources as E, resolveDeployLiveBindingConfig as F, resolveWranglerMigrationPattern as G, resolveStaticBuildCommand as H, resolveDeployTransport as I, runStaticDeploy as J, runCloudflareDeploy as K, resolveDeployWorkerMain as L, promptDeployProjectConfig as M, reconstructExpectedContainers as N, isWranglerNonInteractiveOrCI as O, resolveCloudflareVoidStaticPreset as P, snapshotPassthroughRawFields as Q, resolveDeployWranglerCompat as R, formatCloudflareSandboxUnavailable as S, resolveAssetConfig as St, hasNonPageBackend as T, resolveStaticDeployPreset as U, resolveFullDeployBuildCommand as V, resolveWorkerDirName as W, snapshotBindingIdentities as X, runWranglerAuthToken as Y, snapshotPassthroughIdentities as Z, deriveWorkerName as _, preflightEmail as _t, applyDeployEvent as a, generateQueueResolverSource as at, ensurePreviouslyDeployedLiveBindingConfig as b, hasApiRoutes as bt, assertMigrationsProduceAuthSchema as c, buildEnv as ct, assertWranglerUploaderUnchanged as d, hasRevalidate as dt, validateAuthMigrationSchema as et, checkWranglerMigrationApplySet as f, scanDurableObjectModules as ft, deployChildEnv as g, findEmailConfigConflicts as gt, createDeployWranglerRunner as h, createNodeEmailDns as ht, DEPLOY_WHOLE_OBJECT_PINNED_FIELDS as i, warnUnpublishedRouting as it, prepareCloudflareFrameworkArtifact as j, loadProvisionModule as k, assertNoConfigOverrideInProjectDotenv as l, collectPages as lt, computeDesiredCloudflareResources as m, applyEmailSetup as mt, DEPLOY_PASSTHROUGH_ASSERT_FIELDS as n, warnIgnoredNotFoundForFramework as nt, assembleVoidManifest as o, prerenderPages as ot, compareWranglerMigrationPaths as p, SEND_EMAIL_BINDING as pt, runDeploy as q, DEPLOY_PASSTHROUGH_EXCLUDE_FIELDS as r, warnRedundantForceOn3xx as rt, assertManagedDurableStateSupported as s, prerenderPagesNode as st, CloudflareAuthSecretError as t, verifyGeneratedDeployConfig as tt, assertRemoteMigrationsDeployable as u, collectRevalidate as ut, discoverRootWranglerConfig as v, renderAddressMap as vt, hasDeploySchemaDrift as w, formatCloudflareActivationError as x, hasDocumentRoutes as xt, ensureCloudflareAuthSecret as y, renderEmailChecklist as yt, resolveDeploymentPlatform as z };
+export { snapshotPassthroughRawFields as $, parseRootWranglerConfig$1 as A, resolveDeploymentPlatform as B, generateDeployWrapperIfNeeded as C, resolveAssetConfig as Ct, hashWranglerUploader as D, hasPrerenderSources as E, resolveCloudflareVoidStaticPreset as F, resolveWorkerDirName as G, resolveFullDeployBuildCommand as H, resolveDeployLiveBindingConfig as I, runDeploy as J, resolveWranglerMigrationPattern as K, resolveDeployTransport as L, promptDeployProjectConfig as M, reconstructExpectedContainers as N, isWranglerNonInteractiveOrCI as O, reconstructExpectedDurableObjectState as P, snapshotPassthroughIdentities as Q, resolveDeployWorkerMain as R, formatCloudflareSandboxUnavailable as S, hasDocumentRoutes as St, hasNonPageBackend as T, resolveStaticBuildCommand as U, resolveDistDir as V, resolveStaticDeployPreset as W, runWranglerAuthToken as X, runStaticDeploy as Y, snapshotBindingIdentities as Z, deriveWorkerName as _, findEmailConfigConflicts as _t, applyDeployEvent as a, warnUnpublishedRouting as at, ensurePreviouslyDeployedLiveBindingConfig as b, renderEmailChecklist as bt, assertMigrationsProduceAuthSchema as c, prerenderPagesNode as ct, assertWranglerUploaderUnchanged as d, collectRevalidate as dt, streamDeployEvents as et, checkWranglerMigrationApplySet as f, hasRevalidate as ft, deployChildEnv as g, createNodeEmailDns as gt, createDeployWranglerRunner as h, applyEmailSetup as ht, DEPLOY_WHOLE_OBJECT_PINNED_FIELDS as i, warnRedundantForceOn3xx as it, prepareCloudflareFrameworkArtifact as j, loadProvisionModule as k, assertNoConfigOverrideInProjectDotenv as l, buildEnv as lt, computeDesiredCloudflareResources as m, SEND_EMAIL_BINDING as mt, DEPLOY_PASSTHROUGH_ASSERT_FIELDS as n, verifyGeneratedDeployConfig as nt, assembleVoidManifest as o, generateQueueResolverSource as ot, compareWranglerMigrationPaths as p, scanDurableObjectModules as pt, runCloudflareDeploy as q, DEPLOY_PASSTHROUGH_EXCLUDE_FIELDS as r, warnIgnoredNotFoundForFramework as rt, assertManagedDurableStateSupported as s, prerenderPages as st, CloudflareAuthSecretError as t, validateAuthMigrationSchema as tt, assertRemoteMigrationsDeployable as u, collectPages as ut, discoverRootWranglerConfig as v, preflightEmail as vt, hasDeploySchemaDrift as w, resolveAssetRoutingPolicy as wt, formatCloudflareActivationError as x, hasApiRoutes as xt, ensureCloudflareAuthSecret as y, renderAddressMap as yt, resolveDeployWranglerCompat as z };