void 0.22.0 → 0.23.0

package/dist/{deploy-CH-o2CaZ.mjs → deploy-DzAIwqNU.mjs}

@@ -1,51 +1,52 @@
 import { n as __toESM, t as __commonJSMin } from "./rolldown-runtime-DXIUcv95.mjs";
 import { a as join, l as relative, n as dirname, o as normalize, r as extname, t as basename, u as resolve } from "./dist-BVqXeR_h.mjs";
 import { t as require_picocolors } from "./picocolors-BTps1_gs.mjs";
-import { i as resolveProjectPaths, n as readProjectPaths, t as assertNoRootSourceConventionConflicts } from "./project-paths-GgcMozYz.mjs";
-import { t as findVoidAuthConfig } from "./config-DPByhVck.mjs";
+import { m as needsApplicationDatabase, r as detectFramework } from "./plugin-inference-CXWnn79A.mjs";
+import { n as readProjectPaths, t as assertNoRootSourceConventionConflicts } from "./project-paths-GgcMozYz.mjs";
+import { d as isNodeTarget, h as resolveBindingNames, m as readConfig } from "./config-Br_JZD6u.mjs";
+import { n as isIdentifier, r as isLiteral } from "./ast-CPGPjb0V.mjs";
+import { o as scanDurableObjectModules, t as analyzeApplicationSync } from "./application-analysis-BVsVqc11.mjs";
+import { t as collectMigrations } from "./collect-DiTn9yr6.mjs";
+import { o as validateSsrEntry } from "./entry-CF5wvH4w.mjs";
+import { r as hasEmailHandlers } from "./email--tEtMoj_.mjs";
+import { a as hasSandboxSqliteMigration, c as resolveSandboxConfig, i as assertSandboxNamespaceConfig, l as sandboxContainerConfig, r as SANDBOX_MIGRATION_TAG, s as requiresSandboxPlatformImage } from "./config-C_XRIPx2.mjs";
 import { i as trustedCloudflareWorkerAccessHeaders, r as scopedAccessCredentials, t as cfAccessHeaders } from "./cf-access-DRsQRe6k.mjs";
-import { a as getApiUrl, c as getToken, l as getTokenSource, o as getProxyUrl, u as isStagingMode } from "./auth-DLNN0D3Z.mjs";
+import { a as getApiUrl, c as getToken, l as getTokenSource, o as getProxyUrl, u as isStagingMode } from "./auth-CSkdO2Bb.mjs";
 import { r as ensurePlatformProxyAccess, t as ensureCloudflaredToken } from "./cf-access-P0iZnu0q.mjs";
 import { d as writeProjectConfig, i as readDeploymentPlatform, l as writeDeploymentPlatform, o as readProjectConfig, t as attachSelectedPlatform } from "./project-C0Fqu05O.mjs";
-import { d as isNodeTarget, h as resolveBindingNames, m as readConfig, u as getDatabaseDialect } from "./config-Br_JZD6u.mjs";
-import { A as writeWranglerPublishedTrafficSnapshot, B as materializeCloudflareConfig, D as syncWranglerWebSockets, E as syncWranglerDurableObjects, F as requiresSandboxPlatformImage, I as resolveSandboxConfig, L as sandboxContainerConfig, M as SANDBOX_MIGRATION_TAG, P as isSandboxEnabled, S as readWranglerPublishedTrafficSnapshot, T as syncWranglerBindings, V as persistCloudflareConfig, W as stashCloudflareDeployPointer, a as LIVE_MIGRATION_TAG, c as bindingEntriesForField, f as findBindingNameOwner, g as readExistingLiveBindingConfig, h as normalizeWranglerCompatibilityFlags, k as writeProvisionedWranglerConfig, l as ensureWranglerCompat, m as nextDurableObjectMigrationTag, o as acknowledgeWranglerManagedQueueRemovals, p as hasDurableObjectSqliteMigration, r as FRIENDLY_BINDING_NAMES, w as resolveLiveBindingConfig, x as readWranglerManagedQueueCleanupCandidates } from "./wrangler-DQF1vKyf.mjs";
+import { i as persistCloudflareConfig, r as materializeCloudflareConfig, s as stashCloudflareDeployPointer } from "./cloudflare-config-Bktvwtpf.mjs";
+import { A as writeProvisionedWranglerConfig, C as readWranglerPublishedTrafficSnapshot, D as syncWranglerDurableObjects, E as syncWranglerBindings, O as syncWranglerWebSockets, S as readWranglerManagedQueueCleanupCandidates, T as resolveLiveBindingConfig, _ as readExistingLiveBindingConfig, a as LIVE_MIGRATION_TAG, c as bindingEntriesForField, g as normalizeWranglerCompatibilityFlags, h as nextDurableObjectMigrationTag, j as writeWranglerPublishedTrafficSnapshot, l as bindingNamesForField, m as hasDurableObjectSqliteMigration, o as acknowledgeWranglerManagedQueueRemovals, p as findBindingNameOwner, r as FRIENDLY_BINDING_NAMES, u as ensureWranglerCompat } from "./wrangler-7K-bW_DL.mjs";
 import { i as voidWarn, r as voidLog } from "./log-ChfPKsVd.mjs";
 import { n as lintDuplicateSources, r as mergeRoutingRules, t as lintDestinationSplats } from "./headers-DWi2IXWx.mjs";
-import { n as isIdentifier, r as isLiteral } from "./ast-CPGPjb0V.mjs";
-import { t as scanPages } from "./scan-4tfN-PSn.mjs";
-import { a as scanJobsSync, i as scanQueuesSync, r as scanRoutes } from "./scan-ClYmX3sa.mjs";
-import { i as inferProjectBindings, n as FRAMEWORK_SCAN_DIRS, r as detectFramework, s as scanWebSocketRoutesSync } from "./plugin-inference-BMfKRSqE.mjs";
-import { t as collectMigrations } from "./collect-DiTn9yr6.mjs";
-import { r as buildMigrationPlanBundle } from "./plan-BEZ8VJW0.mjs";
+import { n as buildMigrationPlanBundle } from "./plan-NPpwZ_kc.mjs";
 import { r as scanWranglerDotenvKeys } from "./dotenv-VQxupEUv.mjs";
 import { t as discoverSchema } from "./discover-BcPPiF1o.mjs";
 import { t as MagicString } from "./dist-AoCzRTJE.mjs";
 import { t as findEnvFile } from "./env-types-C2_bIk_b.mjs";
-import { d as formatEnvReport, f as listSelfHostSecretNames, g as validateProdEnv, h as selfHostSchemaFailureMessage, i as SelfHostSecretListError, l as dischargeSelfHostEnvContext, n as SelfHostFirstDeployError, p as readEmittedWorkerVars, r as SelfHostSchemaError, s as deriveSelfHostEnvContextFromVars, t as SelfHostEnvValidationError, u as fetchRemoteSecretNames, v as readGeneratedWranglerConfigFile } from "./env-validation-BB4GkLxn.mjs";
+import { d as formatEnvReport, f as listSelfHostSecretNames, g as validateProdEnv, h as selfHostSchemaFailureMessage, i as SelfHostSecretListError, l as dischargeSelfHostEnvContext, n as SelfHostFirstDeployError, p as readEmittedWorkerVars, r as SelfHostSchemaError, s as deriveSelfHostEnvContextFromVars, t as SelfHostEnvValidationError, u as fetchRemoteSecretNames, v as readGeneratedWranglerConfigFile } from "./env-validation-BPn7vk-V.mjs";
 import { n as CLOUDFLARE_DEPLOY_BUILD_ENV, o as resolveRemoteMode, s as stripInternalEnvKeys } from "./env-_v349JBd.mjs";
-import { o as validateSsrEntry } from "./entry-CF5wvH4w.mjs";
 import { E as confirm, I as select, N as note, O as intro, P as outro, W as isCancel, j as log$1 } from "./dist-CTBk70IR.mjs";
+import { n as completeApplicationAnalysis, t as analyzeApplication } from "./application-routing-B7QEjqSR.mjs";
 import { t as writeDrizzleConfig } from "./config-D8MOgiQV.mjs";
 import { i as runMySqlMigrations } from "./runner-mysql-DmWchSWJ.mjs";
 import { i as runPgMigrations } from "./runner-pg-D4OPlil-.mjs";
 import { n as openMigrationValidationDatabase, t as SqliteMigrationError } from "./sqlite-validation-BzKMWnO4.mjs";
-import { i as validateMigrations, t as assertJournalCoherence } from "./validate-CIUwFpjB.mjs";
+import { i as validateMigrations, t as assertJournalCoherence } from "./validate-ctOrgiS3.mjs";
 import { t as renderPrerenderPaths } from "./prerender-render-D9qbLs2f.mjs";
-import { a as scanEmailHandlersSync, r as hasEmailHandlers } from "./email--tEtMoj_.mjs";
-import { i as migrateBuiltWranglerConfig, n as prepareCfFrameworkBuildOutput, r as prepareCfStaticBuildOutput, t as prepareCfBuildOutput } from "./cf-build-output-BJ6yGEIS.mjs";
+import { i as migrateBuiltWranglerConfig, n as prepareCfFrameworkBuildOutput, r as prepareCfStaticBuildOutput, t as prepareCfBuildOutput } from "./cf-build-output-BPqOT964.mjs";
 import { n as getPackageDir } from "./agents-B_pX_HmQ.mjs";
-import { i as isExpiredTokenError, n as PlatformClient, o as parsePlatformErrorBody, r as isCliOutdatedError, s as platformErrorMessage, t as PlatformApiError } from "./client-BTZ3XkrB.mjs";
-import { a as resolveProjectCommand, i as hasBackendFiles, n as detectPreset, o as resolveWranglerArgv, r as formatProjectCommand, t as FRAMEWORK_PRESETS } from "./preset-UHj9ARyP.mjs";
-import { a as ensureCloudflareAuthentication, n as cloudflareAuthNeedsTerminal, o as parseCloudflareAuthSession, r as cloudflareCredentialOverrides, t as CloudflareAuthenticationError } from "./cloudflare-auth-DQkqoMYa.mjs";
+import { i as isExpiredTokenError, n as PlatformClient, o as parsePlatformErrorBody, r as isCliOutdatedError, s as platformErrorMessage, t as PlatformApiError } from "./client-RV8NVeB8.mjs";
+import { a as detectPreset, c as resolveCloudflareOperationArgv, i as FRAMEWORK_PRESETS, l as resolveProjectCommand, o as formatProjectCommand, s as hasBackendFiles, t as createCloudflareProcessRunner } from "./cloudflare-process-B-wekeR6.mjs";
+import { a as parseCloudflareAuthSession, i as ensureCloudflareAuthentication, n as cloudflareCredentialOverrides, t as CloudflareAuthenticationError } from "./cloudflare-auth-Qdc7tw8F.mjs";
 import { n as writeVoidProjectConfig } from "./config-write-B1f88wJA.mjs";
-import { r as discoverFrameworkWranglerFiles, t as migrateLegacyVoidConfig } from "./migrate-BPITvDJN.mjs";
-import { a as createCloudflareEmptyDomainPublisher, i as createCloudflareEmptyCronPublisher } from "./cloudflare-operations-B9tzgjmf.mjs";
+import { r as discoverFrameworkWranglerFiles, t as migrateLegacyVoidConfig } from "./migrate-DHul7PRV.mjs";
+import { a as createCloudflareEmptyDomainPublisher, i as createCloudflareEmptyCronPublisher } from "./cloudflare-operations-fxHb-byx.mjs";
 import { t as formatCloudflareUserMessage } from "./cloudflare-user-output-Q-k0QoNQ.mjs";
 import { c as import_picocolors$1, i as createSpinner, r as cliTitle } from "./output-Dm_A4Tbv.mjs";
-import { a as promptProjectSelection, i as reportProjectCreationWarnings, o as promptProjectSetupAction, r as promptAndCreateProject } from "./create-project-l9J7pbtm.mjs";
+import { a as promptProjectSelection, i as reportProjectCreationWarnings, o as promptProjectSetupAction, r as promptAndCreateProject } from "./create-project-bMf6ffLZ.mjs";
 import { t as getRequestedProjectSlug } from "./resolve-project-BG5ORGID.mjs";
 import { t as collectGitDeployMetadata } from "./git-metadata-D-gurjzG.mjs";
-import { t as promptForLoginToken } from "./login-CAsAsQ-_.mjs";
+import { t as promptForLoginToken } from "./login-UZKFM_u7.mjs";
 import { createRequire } from "node:module";
 import { copyFileSync, cpSync, createWriteStream, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, readlinkSync, realpathSync, renameSync, rmSync, statSync, unlinkSync, writeFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
@@ -60,6 +61,7 @@ import { Minimatch } from "minimatch";
 import { CloudflareWorkerInspectionError, activateCloudflareVersion, assertCloudflareBindingsPreserved, assertCloudflareDurableObjectLifecycleSupported, assertExistingCloudflareConfig, encodeCloudflareVersionMessage, extractWorkersDevSubdomain, normalizeWorkersDevSubdomain, parseRootWranglerConfig, parseRootWranglerConfig as parseRootWranglerConfig$1, readBindingFieldPresence, readCloudflareTriggerConfig, readConfigEntryString, readExistingCloudflareWorker, readStoredResourceName, readWranglerTopLevelString, renderCloudflareStaticEntry, resolveD1MigrateTarget, stageCloudflareStaticAssets, writeCloudflareFrameworkDeployConfig, writeCloudflareStaticDeployConfig } from "@void/deploy-cloudflare";
 import { getWorkerAssetsDir, getWorkerBundleDir, getWorkerConfigPath, readBuildOutput } from "@cloudflare/build-output-utils";
 import ignore from "ignore";
+import { setTimeout as setTimeout$1 } from "node:timers/promises";
 import mime from "mime";
 import { hash } from "blake3-jit";
 //#region src/asset-routing.ts
@@ -240,127 +242,84 @@ function deriveAddresses(handlers, domain, mode) {
 		routes
 	};
 }
-function parseWhoamiJson(stdout) {
-	const start = stdout.indexOf("{");
-	if (start < 0) return null;
-	try {
-		const parsed = JSON.parse(stdout.slice(start));
-		if (!parsed || typeof parsed !== "object" || typeof parsed.loggedIn !== "boolean") return null;
-		return parsed;
-	} catch {
-		return null;
-	}
+function parseWhoamiJson(data) {
+	if (!isRecord(data) || typeof data.loggedIn !== "boolean") return null;
+	if (data.tokenPermissions !== void 0 && (!Array.isArray(data.tokenPermissions) || data.tokenPermissions.some((scope) => typeof scope !== "string"))) return null;
+	if (data.accounts !== void 0 && (!Array.isArray(data.accounts) || data.accounts.some((account) => !isRecord(account) || typeof account.id !== "string" || typeof account.name !== "string"))) return null;
+	return data;
 }
-function parseRoutingSettings(stdout) {
-	const name = /^Email Routing for (\S+):\s*$/m.exec(stdout)?.[1];
-	const enabled = /^\s*Enabled:\s+(true|false)\s*$/m.exec(stdout)?.[1];
-	const status = /^\s*Status:\s+(\S+)\s*$/m.exec(stdout)?.[1];
-	const tag = /^\s*Tag:\s+([0-9a-f]{32})\s*$/m.exec(stdout)?.[1];
-	if (!name || !enabled || !status || !tag) return null;
-	return {
-		name,
-		enabled: enabled === "true",
-		status,
-		tag
-	};
+function isRecord(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
-/**
-* `wrangler email routing rules list <zone>` stdout (4.131 `src/email-routing/rules/list.ts`):
-*
-*   Rule: <id>
-*     Name:     <name|(none)>
-*     Enabled:  true
-*     Matchers: to:support@void.cloud
-*     Actions:  worker:acme-support
-*     Priority: 0
-*
-*   Catch-all rule: disabled, action: drop
-*     (use `wrangler email routing rules get catch-all` to view details)
-*
-* With no rule at all: `No routing rules found.` / no custom rule: `No custom routing
-* rules found.`. Both forms are pinned by fixture.
-*/
-function parseRoutingRules(stdout) {
-	const lines = stdout.split(/\r?\n/);
+function readRoutingSettings(data) {
+	return isRecord(data) && typeof data.name === "string" && data.name.length > 0 && typeof data.enabled === "boolean" && typeof data.status === "string" && data.status.length > 0 && typeof data.tag === "string" && /^[0-9a-f]{32}$/.test(data.tag) ? {
+		name: data.name,
+		enabled: data.enabled,
+		status: data.status,
+		tag: data.tag
+	} : null;
+}
+function readRoutingRules(data) {
+	if (!Array.isArray(data)) return null;
 	const rules = [];
 	let catchAll = null;
-	let sawSentinel = false;
-	let current = null;
-	for (const raw of lines) {
-		const line = raw.trimEnd();
-		if (/^No (custom )?routing rules found\.$/.test(line)) {
-			sawSentinel = true;
-			continue;
-		}
-		const catchAllMatch = /^Catch-all rule: (enabled|disabled), action: (.*)$/.exec(line);
-		if (catchAllMatch) {
+	for (const entry of data) {
+		if (!isRecord(entry) || typeof entry.enabled !== "boolean" || !Array.isArray(entry.actions) || entry.actions.length === 0 || !Array.isArray(entry.matchers) || entry.matchers.length === 0) return null;
+		const actions = [];
+		for (const action of entry.actions) {
+			if (!isRecord(action) || typeof action.type !== "string") return null;
+			if (action.type === "drop") actions.push("drop");
+			else if (action.type === "worker" || action.type === "forward") {
+				const values = typeof action.value === "string" ? [action.value] : action.value;
+				if (!Array.isArray(values) || values.length === 0 || !values.every((value) => typeof value === "string" && value.length > 0)) return null;
+				if (action.type === "worker") actions.push("worker:" + values.join(","));
+				else actions.push("forward:" + values.join(","));
+			} else return null;
+		}
+		const to = [];
+		let all = false;
+		for (const matcher of entry.matchers) {
+			if (!isRecord(matcher)) return null;
+			if (matcher.type === "all") all = true;
+			else if (matcher.type === "literal" && matcher.field === "to" || matcher.type === "to") {
+				if (typeof matcher.value !== "string" || matcher.value.length === 0) return null;
+				to.push(matcher.value.toLowerCase());
+			} else return null;
+		}
+		if (all) {
+			if (catchAll || entry.matchers.length !== 1) return null;
 			catchAll = {
-				enabled: catchAllMatch[1] === "enabled",
-				actions: splitActionList(catchAllMatch[2] ?? "")
+				enabled: entry.enabled,
+				actions
 			};
-			current = null;
-			continue;
-		}
-		const ruleMatch = /^Rule: (\S+)$/.exec(line);
-		if (ruleMatch) {
-			current = {
-				id: ruleMatch[1],
-				name: "",
-				enabled: false,
-				to: [],
-				actions: []
-			};
-			rules.push(current);
-			continue;
-		}
-		if (!current) continue;
-		const field = /^\s{2}(Name|Enabled|Matchers|Actions|Priority):\s*(.*)$/.exec(line);
-		if (!field) continue;
-		const value = (field[2] ?? "").trim();
-		switch (field[1]) {
-			case "Name":
-				current.name = value;
-				break;
-			case "Enabled":
-				current.enabled = value === "true";
-				break;
-			case "Matchers":
-				current.to = value.split(", ").filter((m) => m.startsWith("to:")).map((m) => m.slice(3).toLowerCase());
-				break;
-			case "Actions": current.actions = splitActionList(value);
+		} else {
+			if (typeof entry.id !== "string" || entry.id.length === 0 || entry.name !== void 0 && typeof entry.name !== "string") return null;
+			rules.push({
+				id: entry.id,
+				name: entry.name ?? "",
+				enabled: entry.enabled,
+				to,
+				actions
+			});
 		}
 	}
-	if (!sawSentinel && rules.length === 0 && !catchAll) return null;
 	return {
 		rules,
 		catchAll
 	};
 }
-function splitActionList(value) {
-	return value.split(", ").map((a) => a.trim()).filter(Boolean);
-}
-function parseSendingSettings(stdout) {
-	const name = /^Email Sending for (\S+):\s*$/m.exec(stdout)?.[1];
-	const enabled = /^\s*Enabled:\s+(true|false)\s*$/m.exec(stdout)?.[1];
-	const tag = /^\s*Tag:\s+([0-9a-f]{32})\s*$/m.exec(stdout)?.[1];
-	if (!name || !enabled || !tag) return null;
-	return {
-		name,
-		enabled: enabled === "true",
+function readSendingSettings(data) {
+	if (!isRecord(data)) return null;
+	const tag = data.tag ?? data.id;
+	return typeof data.name === "string" && data.name.length > 0 && typeof data.enabled === "boolean" && typeof tag === "string" && /^[0-9a-f]{32}$/.test(tag) ? {
+		name: data.name,
+		enabled: data.enabled,
 		tag
-	};
-}
-/** wrangler renders an `APIError` note as `<message> [code: <n>]`; extract the code. */
-function wranglerApiErrorCode(text) {
-	const match = /\[code:\s*(\d+)\]/.exec(stripAnsi(text));
-	return match ? Number(match[1]) : null;
+	} : null;
 }
-const ANSI_SGR_RE = new RegExp(`${String.fromCharCode(27)}\\[[0-9;]*m`, "g");
-function stripAnsi(text) {
-	return text.replace(ANSI_SGR_RE, "");
+function providerErrorCode(result) {
+	return result.errorCode ?? result.errors?.find((error) => error.code !== void 0)?.code ?? null;
 }
-const ZONE_NOT_FOUND_RE = /Could not find (?:a )?zone for `([^`]+)`/;
-const SENDING_NOT_FOUND_RE = /No sending subdomain found for `([^`]+)`/;
 function isHardFailure(result) {
 	return Boolean(result.signal) || Boolean(result.error);
 }
@@ -417,8 +376,10 @@ async function preflightEmail(inputs) {
 	const domain = emailFromDomain(inputs.from);
 	if (!domain) throw new Error(`email.from must be an address like you@mail.example.com (got ${JSON.stringify(inputs.from)})`);
 	const apiBaseUrl = inputs.apiBaseUrl ?? "https://api.cloudflare.com/client/v4";
-	const extra = inputs.wranglerArgs ?? [];
-	const run = async (args) => inputs.runWrangler([...args, ...extra], { capture: true });
+	const run = async (operation) => inputs.runWrangler({
+		...operation,
+		...inputs.configPath ? { configPath: inputs.configPath } : {}
+	}, { capture: true });
 	const usageHandlers = [...inputs.handlers.addresses.map((d) => `email/${d.filePath}`), ...inputs.handlers.defaultHandler ? [`email/${inputs.handlers.defaultHandler}`] : []];
 	const pre = {
 		from: inputs.from,
@@ -481,8 +442,8 @@ async function preflightEmail(inputs) {
 		});
 	};
 	for (const conflict of inputs.configConflicts ?? []) block("all", conflict);
-	const whoami = await run(["whoami", "--json"]);
-	const who = isHardFailure(whoami) || whoami.status !== 0 ? null : parseWhoamiJson(whoami.stdout);
+	const whoami = await run({ type: "auth.whoami" });
+	const who = isHardFailure(whoami) || whoami.status !== 0 ? null : parseWhoamiJson(whoami.data);
 	if (!who) {
 		pre.session.state = "unknown";
 		block("all", "could not read the Cloudflare session — run `void cloudflare login`");
@@ -509,22 +470,20 @@ async function preflightEmail(inputs) {
 	let settings = null;
 	let settingsMiss = false;
 	if (pre.session.state === "ok") for (const candidate of zoneCandidates(domain)) {
-		const result = await run([
-			"email",
-			"routing",
-			"settings",
-			candidate
-		]);
+		const result = await run({
+			type: "email.routing.settings",
+			domain: candidate
+		});
 		if (isHardFailure(result)) {
 			settingsMiss = true;
 			break;
 		}
+		if (result.status === 0 && result.data === null) continue;
 		if (result.status !== 0) {
-			if (ZONE_NOT_FOUND_RE.test(stripAnsi(result.stderr))) continue;
 			settingsMiss = true;
 			break;
 		}
-		settings = parseRoutingSettings(result.stdout);
+		settings = readRoutingSettings(result.data);
 		if (!settings) settingsMiss = true;
 		break;
 	}
@@ -621,14 +580,11 @@ async function preflightEmail(inputs) {
 		else if (pre.domainMx.state === "unknown") block("all", `could not read the MX records of ${domain} — unknown — run \`void email setup --platform cloudflare\``);
 	}
 	pre.derived = deriveAddresses(inputs.handlers, domain, mode);
-	const rulesResult = await run([
-		"email",
-		"routing",
-		"rules",
-		"list",
-		apex
-	]);
-	const rules = isHardFailure(rulesResult) || rulesResult.status !== 0 ? null : parseRoutingRules(rulesResult.stdout);
+	const rulesResult = await run({
+		type: "email.routing.rules.list",
+		domain: apex
+	});
+	const rules = isHardFailure(rulesResult) || rulesResult.status !== 0 ? null : readRoutingRules(rulesResult.data);
 	if (!rules) {
 		pre.rules.state = "unknown";
 		block("all", `could not read Email Routing rules — unknown — run \`void email setup --platform cloudflare\`${tokenHint}`);
@@ -658,18 +614,16 @@ async function preflightEmail(inputs) {
 	}
 	const foreign = new Set(pre.rules.foreign.map((f) => f.address));
 	pre.addresses = pre.derived.addresses.filter((a) => !foreign.has(a));
-	const sendingResult = await run([
-		"email",
-		"sending",
-		"settings",
+	const sendingResult = await run({
+		type: "email.sending.settings",
 		domain
-	]);
+	});
 	if (isHardFailure(sendingResult)) pre.sending.state = "unknown";
+	else if (sendingResult.status === 0 && sendingResult.data === null) pre.sending.state = "pending";
 	else if (sendingResult.status === 0) {
-		const parsed = parseSendingSettings(sendingResult.stdout);
+		const parsed = readSendingSettings(sendingResult.data);
 		pre.sending.state = parsed ? parsed.enabled ? "ready" : "pending" : "unknown";
-	} else if (SENDING_NOT_FOUND_RE.test(stripAnsi(sendingResult.stderr))) pre.sending.state = "pending";
-	else pre.sending.state = "unknown";
+	} else pre.sending.state = "unknown";
 	if (pre.sending.state === "unknown") block("sending", `could not read Email Sending settings — unknown — run \`void email setup --platform cloudflare\`${tokenHint}`);
 	else if (pre.sending.state === "pending" && pre.sending.dnsConflicts.length > 0) block("sending", `${pre.sending.dnsConflicts.join(", ")} already exists; onboarding writes its own _dmarc (p=reject) and DKIM records and would conflict — remove them or keep sending off`);
 	const names = (inputs.existingSendEmail ?? []).map((e) => typeof e?.name === "string" ? e.name : "");
@@ -849,8 +803,10 @@ async function applyEmailSetup(pre, inputs) {
 	}
 	const apex = pre.apex;
 	const apiBaseUrl = inputs.apiBaseUrl ?? "https://api.cloudflare.com/client/v4";
-	const extra = inputs.wranglerArgs ?? [];
-	const run = async (args) => inputs.runWrangler([...args, ...extra], { capture: true });
+	const run = async (operation) => inputs.runWrangler({
+		...operation,
+		...inputs.configPath ? { configPath: inputs.configPath } : {}
+	}, { capture: true });
 	let bearer;
 	let bearerFailed = false;
 	let bearerObtained = false;
@@ -879,17 +835,15 @@ async function applyEmailSetup(pre, inputs) {
 	const apexRoutingOff = pre.mode === "subdomain" && pre.routing.enabled !== true;
 	if (!result.routingReady) {
 		if (pre.mode === "apex") {
-			const enable = await run([
-				"email",
-				"routing",
-				"enable",
-				apex
-			]);
+			const enable = await run({
+				type: "email.routing.enable",
+				domain: apex
+			});
 			if (!isHardFailure(enable) && enable.status === 0) {
 				result.routingReady = true;
 				lines.push(`  ✔ routing   ${apex} enabled`);
 			} else {
-				const code = wranglerApiErrorCode(enable.stderr);
+				const code = providerErrorCode(enable);
 				lines.push(`  ✘ routing   could not enable Email Routing on ${apex}${code ? ` [code: ${code}]${CF_EMAIL_ERROR_CODES[code] ? ` — ${CF_EMAIL_ERROR_CODES[code]}` : ""}` : ""}`);
 			}
 		} else if (apexRoutingOff) {
@@ -920,13 +874,11 @@ async function applyEmailSetup(pre, inputs) {
 	const sendingBlocked = pre.blockers.filter((b) => b.scope === "sending");
 	if (!result.sendingReady && sendingBlocked.length > 0) for (const b of sendingBlocked) lines.push(`  ! sending   ${b.message}`);
 	else if (!result.sendingReady) {
-		const enable = await run([
-			"email",
-			"sending",
-			"enable",
-			pre.domain
-		]);
-		const code = isHardFailure(enable) ? null : wranglerApiErrorCode(enable.stderr);
+		const enable = await run({
+			type: "email.sending.enable",
+			domain: pre.domain
+		});
+		const code = isHardFailure(enable) ? null : providerErrorCode(enable);
 		if (!isHardFailure(enable) && (enable.status === 0 || code === 2040)) {
 			result.sendingReady = true;
 			lines.push(`  ✔ sending   ${pre.domain} onboarded`);
@@ -976,37 +928,6 @@ async function createNodeEmailDns() {
 	};
 }
 //#endregion
-//#region src/durable/scan.ts
-const MODULE_PATTERN = /\.(?:[cm]?[jt]s)$/;
-function words(value) {
-	return value.split(/[^a-zA-Z0-9]+/).filter(Boolean);
-}
-function scanDurableObjectModules(root) {
-	const directory = join(root, "durable-objects");
-	if (!existsSync(directory)) return [];
-	const modules = readdirSync(directory, { withFileTypes: true }).filter((entry) => entry.isFile() && MODULE_PATTERN.test(entry.name) && !entry.name.endsWith(".d.ts")).sort((a, b) => a.name.localeCompare(b.name)).map((entry) => {
-		const parts = words(entry.name.replace(MODULE_PATTERN, ""));
-		if (parts.length === 0) throw new Error(`durable: cannot derive a name from durable-objects/${entry.name}.`);
-		const classBase = parts.map((part) => part[0].toUpperCase() + part.slice(1)).join("");
-		const bindingName = parts.join("_").toUpperCase();
-		const slug = parts.join("-").toLowerCase();
-		return {
-			filePath: join(directory, entry.name),
-			bindingName,
-			className: `${classBase}DurableObject`,
-			migrationTag: `void-durable-${slug}-v1`
-		};
-	});
-	const bindings = /* @__PURE__ */ new Set();
-	const classes = /* @__PURE__ */ new Set();
-	for (const module of modules) {
-		if (bindings.has(module.bindingName) || classes.has(module.className)) throw new Error(`durable: duplicate generated name for '${module.filePath}'. Rename one of the durable-objects files.`);
-		bindings.add(module.bindingName);
-		classes.add(module.className);
-	}
-	return modules;
-}
-//#endregion
 //#region ../../node_modules/.pnpm/ci-info@4.4.0/node_modules/ci-info/vendors.json
 var require_vendors = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	module.exports = [
@@ -1859,7 +1780,38 @@ async function prerenderPagesNode(options) {
 	return result;
 }
 //#endregion
+//#region src/shared/version-metadata.ts
+/** Build-only marker: an existing-site handoff must not add Worker bindings. */
+const CLOUDFLARE_PRESERVE_BINDINGS_BUILD_ENV = "VOID_CLOUDFLARE_PRESERVE_BINDINGS";
+const DEFAULT_VERSION_METADATA_BINDING = "__VOID_VERSION_METADATA";
+/** Keep the authored singleton name, and reject a cross-type binding collision. */
+function readVersionMetadataBinding(config) {
+	const name = bindingNamesForField("version_metadata", config.version_metadata)[0];
+	if (!name) return;
+	const owner = findBindingNameOwner(config, "version_metadata", name);
+	if (owner) throw new Error(`Cloudflare version metadata binding ${name} conflicts with ${owner}.`);
+	return name;
+}
+/** Self-metadata adds no remote resource or plan entitlement. */
+function selectNativeVersionMetadataBinding(config, options) {
+	if (!options.nativeBuild) return;
+	const authored = readVersionMetadataBinding(config);
+	if (authored || options.preserveBindings) return authored;
+	const owner = findBindingNameOwner(config, "version_metadata", DEFAULT_VERSION_METADATA_BINDING);
+	if (owner) throw new Error(`Cloudflare version metadata binding ${DEFAULT_VERSION_METADATA_BINDING} conflicts with ${owner}.`);
+	return DEFAULT_VERSION_METADATA_BINDING;
+}
+//#endregion
 //#region src/cli/cf-version-api.ts
+var CloudflareApiError = class extends Error {
+	status;
+	code;
+	constructor(message, status, code) {
+		super(message);
+		this.status = status;
+		this.code = code;
+	}
+};
 function object(value) {
 	return value && typeof value === "object" && !Array.isArray(value) ? value : null;
 }
@@ -1959,38 +1911,181 @@ function bindingsFromOutput(env, workerName, activeSecrets, explicitSecrets) {
 					...value.worker !== workerName ? { script_name: requiredString(value.worker, name) } : {}
 				});
 				break;
+			case "unsafe:durable_object_namespace":
+				if (Object.keys(value).some((key) => ![
+					"type",
+					"class_name",
+					"dev"
+				].includes(key))) throw new Error(`Cloudflare binding ${name} is not a verified local Durable Object.`);
+				bindings.push({
+					name,
+					type: "durable_object_namespace",
+					class_name: requiredString(value.class_name, name)
+				});
+				break;
+			case "queue":
+				bindings.push({
+					name,
+					type: "queue",
+					queue_name: requiredString(value.name, name),
+					...value.deliveryDelay === void 0 ? {} : { delivery_delay: value.deliveryDelay }
+				});
+				break;
+			case "ai":
+			case "browser":
+			case "images":
+				bindings.push({
+					name,
+					type: value.type
+				});
+				break;
+			case "hyperdrive":
+				bindings.push({
+					name,
+					type: "hyperdrive",
+					id: requiredString(value.id, name)
+				});
+				break;
+			case "worker":
+				bindings.push({
+					name,
+					type: "service",
+					service: requiredString(value.worker, name),
+					...value.exportName === void 0 ? {} : { entrypoint: value.exportName },
+					...value.props === void 0 ? {} : { props: value.props }
+				});
+				break;
+			case "workflow":
+				bindings.push({
+					name,
+					type: "workflow",
+					workflow_name: requiredString(value.name, name),
+					...value.worker === workerName ? { class_name: requiredString(value.exportName, name) } : { script_name: requiredString(value.worker, name) }
+				});
+				break;
+			case "send-email":
+				bindings.push({
+					name,
+					type: "send_email",
+					...value.destinationAddress === void 0 ? {} : { destination_address: value.destinationAddress },
+					...value.allowedDestinationAddresses === void 0 ? {} : { allowed_destination_addresses: value.allowedDestinationAddresses },
+					...value.allowedSenderAddresses === void 0 ? {} : { allowed_sender_addresses: value.allowedSenderAddresses }
+				});
+				break;
+			case "analytics-engine-dataset":
+				bindings.push({
+					name,
+					type: "analytics_engine",
+					...value.name === void 0 ? {} : { dataset: value.name }
+				});
+				break;
+			case "vectorize":
+				bindings.push({
+					name,
+					type: "vectorize",
+					index_name: requiredString(value.name, name)
+				});
+				break;
+			case "dispatch-namespace": {
+				const outbound = object(value.outbound);
+				bindings.push({
+					name,
+					type: "dispatch_namespace",
+					namespace: requiredString(value.namespace, name),
+					...outbound ? { outbound: {
+						worker: { service: requiredString(outbound.worker, name) },
+						...Array.isArray(outbound.parameters) ? { params: outbound.parameters.map((parameter) => ({ name: parameter })) } : {}
+					} } : {}
+				});
+				break;
+			}
 			case "assets":
 				bindings.push({
 					name,
 					type: "assets"
 				});
 				break;
+			case "version-metadata":
+				bindings.push({
+					name,
+					type: "version_metadata"
+				});
+				break;
 			default: throw new Error(`Cloudflare binding ${name} cannot be uploaded with pinned secrets.`);
 		}
 	}
 	return bindings;
 }
-function exportsFromOutput(exports) {
+function exportsFromOutput(exports, bindings) {
 	if (exports === void 0) return;
 	const entries = object(exports);
 	if (!entries) throw new Error("Cloudflare Durable Object exports were not readable.");
 	const result = {};
+	const workflows = /* @__PURE__ */ new Map();
 	for (const [name, raw] of Object.entries(entries)) {
 		const value = object(raw);
+		if (value?.type === "workflow") {
+			const workflowName = requiredString(value.name, `Workflow export ${name} name`);
+			if (workflows.has(workflowName)) throw new Error(`Cloudflare Workflow ${workflowName} has multiple local exports.`);
+			workflows.set(workflowName, name);
+			result[name] = {
+				type: "workflow",
+				name: workflowName
+			};
+			continue;
+		}
+		if (value?.type === "worker") {
+			result[name] = {
+				type: "worker",
+				...value.cache === void 0 ? {} : { cache: value.cache }
+			};
+			continue;
+		}
 		if (!value || value.type !== "durable-object") throw new Error(`Cloudflare export ${name} cannot be uploaded with pinned secrets.`);
 		if (value.state === "deleted") result[name] = {
 			type: "durable-object",
 			state: "deleted"
 		};
-		else if (value.storage === "sqlite" || value.storage === "legacy-kv") result[name] = {
-			type: "durable-object",
-			storage: value.storage,
-			state: "created"
-		};
-		else throw new Error(`Cloudflare Durable Object export ${name} has no storage type.`);
+		else if (value.state === "renamed" || value.state === "transferred") {
+			const renamed = value.state === "renamed";
+			result[name] = {
+				type: "durable-object",
+				state: value.state,
+				[renamed ? "renamed_to" : "transferred_to"]: requiredString(value[renamed ? "renamedTo" : "transferredTo"], name)
+			};
+		} else if (value.storage === "sqlite" || value.storage === "legacy-kv") {
+			if (value.state !== void 0 && !["created", "expecting-transfer"].includes(String(value.state))) throw new Error(`Cloudflare Durable Object export ${name} has an unsupported state.`);
+			result[name] = {
+				type: "durable-object",
+				storage: value.storage,
+				state: value.state ?? "created",
+				...value.container === void 0 ? {} : { container: requiredString(value.container, name) },
+				...value.state === "expecting-transfer" ? { transfer_from: requiredString(value.transferFrom, name) } : {}
+			};
+		} else throw new Error(`Cloudflare Durable Object export ${name} has no storage type.`);
+	}
+	for (const binding of bindings) {
+		if (binding.type !== "workflow") continue;
+		const localExport = workflows.get(String(binding.workflow_name));
+		if (localExport !== void 0 && (binding.script_name !== void 0 || binding.class_name !== localExport)) throw new Error(`Cloudflare Workflow binding ${binding.name} conflicts with its local export.`);
 	}
 	return result;
 }
+async function preflightWorkflowExports(options) {
+	for (const raw of Object.values(options.exports ?? {})) {
+		const entry = object(raw);
+		if (entry?.type !== "workflow") continue;
+		const name = requiredString(entry.name, "Workflow name");
+		let workflow;
+		try {
+			workflow = await apiResult(`${options.accountUrl}/workflows/${encodeURIComponent(name)}`, options.token, "GET", void 0, options.verifyUploader);
+		} catch (cause) {
+			if (cause instanceof CloudflareApiError && cause.status === 404 && cause.code === 10200) continue;
+			throw cause;
+		}
+		if (workflow.name !== name || workflow.script_name !== options.workerName || typeof workflow.class_name !== "string" || !workflow.class_name) throw new Error(`Cloudflare Workflow ${name} is not owned by this Worker.`);
+	}
+}
 function assetConfigFromOutput(value) {
 	if (value === void 0) return;
 	const config = object(value);
@@ -2027,11 +2122,211 @@ async function apiResult(url, token, method, body, verifyUploader, timeout = 12e
 	if (!response.ok || parsed?.success !== true || !result) {
 		const error = Array.isArray(parsed?.errors) ? object(parsed.errors[0]) : null;
 		const code = Number.isSafeInteger(error?.code) ? ` [code: ${error.code}]` : "";
-		const message = typeof error?.message === "string" ? ` ${error.message}` : "";
-		throw new Error(`Cloudflare version upload failed (${response.status})${code}.${message}`);
+		throw new CloudflareApiError(`Cloudflare version upload failed (${response.status})${code}.`, response.status, typeof error?.code === "number" ? error.code : void 0);
 	}
 	return result;
 }
+function assertContainerApplicationIdentity(application, plan, namespace) {
+	if (application.id !== namespace || application.name !== plan.name || application.scheduling_policy !== "durable_object" || object(application.durable_objects)?.namespace_id !== namespace) throw new Error(`Cloudflare Container ${plan.name} application identity does not match the uploaded namespace.`);
+}
+function assertContainerApplicationSettings(application, plan) {
+	const desired = object(plan.settings.configuration) ?? {};
+	const current = object(application.configuration) ?? {};
+	const changedConfiguration = Object.entries(desired).some(([key, value]) => {
+		if (key === "wrangler_ssh") {
+			const ssh = object(current.wrangler_ssh) ?? {};
+			const expected = object(value) ?? {};
+			return !isDeepStrictEqual(ssh.enabled ?? false, expected.enabled) || expected.enabled === true && expected.port !== void 0 && !isDeepStrictEqual(ssh.port, expected.port);
+		}
+		if (key === "experimental_flags" && Array.isArray(value)) {
+			const flags = current.experimental_flags ?? [];
+			return !Array.isArray(flags) || !isDeepStrictEqual([...flags].sort(), [...value].sort());
+		}
+		return !isDeepStrictEqual(current[key] ?? [], value);
+	});
+	const logs = object(object(plan.settings.observability)?.logs);
+	const currentLogs = object(object(application.observability)?.logs);
+	if (changedConfiguration || logs !== null && !isDeepStrictEqual(currentLogs?.enabled ?? false, logs.enabled)) throw new Error(`Cloudflare Container ${plan.name} settings differ from the live application. Version-aware deployment cannot safely change these shared settings. Keep the existing Container settings in your configuration, or update this Container explicitly in the Cloudflare dashboard before retrying.`);
+}
+async function preflightContainerApplications(plans, bindings, accountUrl, workerName, token, verifyUploader) {
+	for (const plan of plans) {
+		const matches = bindings.map(object).filter((binding) => binding?.type === "durable_object_namespace" && binding.class_name === plan.className && (binding.script_name === void 0 || binding.script_name === workerName) && binding.environment === void 0 && binding.dispatch_namespace === void 0 && binding.namespace_id !== void 0);
+		const namespaces = new Set(matches.map((binding) => binding.namespace_id));
+		if (namespaces.size > 1) throw new Error(`Cloudflare Container ${plan.name} active namespace was ambiguous.`);
+		const namespace = [...namespaces][0];
+		if (namespace === void 0) {
+			if (Object.keys(plan.images).length === 0) throw new Error(`Cloudflare Container ${plan.name} has no images and no verified existing namespace application.`);
+			continue;
+		}
+		if (typeof namespace !== "string" || !/^[a-f0-9]{32}$/.test(namespace)) throw new Error("The active Container namespace ID was invalid.");
+		try {
+			const application = await apiResult(`${accountUrl}/containers/applications/${encodeURIComponent(namespace)}`, token, "GET", void 0, verifyUploader);
+			assertContainerApplicationIdentity(application, plan, namespace);
+			assertContainerApplicationSettings(application, plan);
+		} catch (cause) {
+			if (!(cause instanceof CloudflareApiError) || cause.status !== 404 || Object.keys(plan.images).length === 0) throw cause;
+		}
+	}
+}
+function containerPlansFromOutput(containers, exports, bindings) {
+	const plans = [];
+	for (const { config } of containers) {
+		if (config.schedulingPolicy !== "durable-object") throw new Error("Scheduler-managed Cloudflare Containers cannot be uploaded with pinned secrets.");
+		const classes = Object.entries(exports ?? {}).filter(([, value]) => object(value)?.container === config.name);
+		if (classes.length !== 1) throw new Error(`Cloudflare Container ${config.name} needs exactly one local SQLite export.`);
+		const [className, raw] = classes[0];
+		const declaration = object(raw);
+		const localBindings = bindings.filter((binding) => binding.type === "durable_object_namespace" && binding.class_name === className && binding.script_name === void 0);
+		if (declaration.storage !== "sqlite" || localBindings.length === 0) throw new Error(`Cloudflare Container ${config.name} needs a local SQLite Durable Object binding.`);
+		const unsafe = object(config.unsafe);
+		const configuration = object(unsafe?.configuration);
+		if (unsafe && Object.keys(unsafe).some((key) => key !== "configuration") || configuration && Object.keys(configuration).some((key) => key !== "experimental_flags")) throw new Error(`Cloudflare Container ${config.name} has an unsupported setting.`);
+		const settings = {
+			...configuration || config.ssh || config.authorizedKeys ? { configuration: {
+				...configuration ?? {},
+				...config.ssh ? { wrangler_ssh: config.ssh } : {},
+				...config.authorizedKeys ? { authorized_keys: config.authorizedKeys.map(({ name, publicKey }) => ({
+					name,
+					public_key: publicKey
+				})) } : {}
+			} } : {},
+			...config.observability ? { observability: { logs: { enabled: config.observability.enabled === true || config.observability.logs?.enabled === true } } } : {}
+		};
+		plans.push({
+			name: config.name,
+			className,
+			images: config.images ?? {},
+			settings
+		});
+	}
+	for (const [name, raw] of Object.entries(exports ?? {})) {
+		const container = object(raw)?.container;
+		if (container !== void 0 && !plans.some((plan) => plan.name === container && plan.className === name)) throw new Error(`Cloudflare export ${name} references a Container outside the verified output.`);
+	}
+	return plans;
+}
+async function dockerImageDigest(image, timeout, verifyUploader) {
+	if (!verifyUploader()) throw new Error("The Cloudflare uploader changed during deployment.");
+	const stdout = await new Promise((resolve, reject) => {
+		execFile(process.env.WRANGLER_DOCKER_BIN ?? "docker", [
+			"image",
+			"inspect",
+			"--format",
+			"{{json .RepoDigests}}",
+			image
+		], {
+			encoding: "utf8",
+			timeout,
+			maxBuffer: 1048576,
+			windowsHide: true
+		}, (error, stdout) => error ? reject(/* @__PURE__ */ new Error("Cloudflare Container image digest could not be verified after push.")) : resolve(stdout));
+	});
+	const digests = JSON.parse(stdout);
+	const repository = image.replace(/:[^/:]+$/, "");
+	const matching = Array.isArray(digests) ? digests.filter((digest) => typeof digest === "string" && digest.startsWith(`${repository}@sha256:`) && /^[a-f0-9]{64}$/.test(digest.slice(digest.lastIndexOf(":") + 1))) : [];
+	if (matching.length !== 1) throw new Error("Cloudflare Container image digest could not be verified after push.");
+	return matching[0];
+}
+async function prepareContainerMetadata(options) {
+	if (options.plans.length === 0) return [];
+	const deadline = Date.now() + 9e5;
+	const remaining = () => {
+		const duration = deadline - Date.now();
+		if (duration <= 0) throw new Error("Cloudflare Container image preparation timed out.");
+		return duration;
+	};
+	const prepared = /* @__PURE__ */ new Map();
+	const result = [];
+	for (const plan of options.plans) {
+		const images = {};
+		for (const [name, raw] of Object.entries(plan.images)) {
+			const source = object(raw);
+			const reference = requiredString(source.localReference ?? source.reference, `Container ${plan.name} image`);
+			let image = prepared.get(reference);
+			if (!image) {
+				image = reference;
+				if (source.localReference !== void 0) {
+					if (!options.runCf || !options.verifyUploader()) throw new Error("The verified Cloudflare Container image uploader is unavailable.");
+					const pushed = await options.runCf([
+						"containers",
+						"push",
+						"--tag",
+						reference
+					], {
+						cwd: options.directory,
+						capture: true,
+						timeoutMs: remaining(),
+						maxOutputBytes: 16777216
+					});
+					if (pushed.status !== 0 || pushed.signal || pushed.error) throw new Error("Cloudflare Container image push failed.");
+					const matches = [...pushed.stdout.matchAll(/Pushed image:\s*(\S+)/g)];
+					const remote = matches.length === 1 ? matches[0][1] : "";
+					if (!remote.startsWith(`registry.cloudflare.com/${options.accountId}/`) || [...remote].some((character) => character.charCodeAt(0) <= 32 || character.charCodeAt(0) === 127)) throw new Error("Cloudflare Container image push did not return the verified account registry.");
+					image = await dockerImageDigest(remote, Math.min(12e4, remaining()), options.verifyUploader);
+				}
+				for (;;) {
+					const ready = await apiResult(`${options.accountUrl}/containers/image-preparations`, options.token, "POST", { image }, options.verifyUploader, Math.min(12e4, remaining()));
+					if (ready.image !== image) throw new Error("Cloudflare Container image preparation returned another image.");
+					if (ready.status === "ready") break;
+					if (ready.status !== "pending") throw new Error("Cloudflare Container image preparation failed or returned an unsupported state.");
+					await setTimeout$1(Math.min(2e3, remaining()));
+				}
+				prepared.set(reference, image);
+			}
+			images[name] = image;
+		}
+		result.push({
+			name: plan.name,
+			class_name: plan.className,
+			...Object.keys(images).length ? { images } : {}
+		});
+	}
+	return result;
+}
+async function ensureContainerApplications(options) {
+	if (options.plans.length === 0) return;
+	const deadline = Date.now() + 6e4;
+	let version;
+	for (;;) try {
+		version = await apiResult(`${options.accountUrl}/workers/scripts/${encodeURIComponent(options.workerName)}/versions/${encodeURIComponent(options.versionId)}`, options.token, "GET", void 0, options.verifyUploader, Math.max(1, Math.min(3e4, deadline - Date.now())));
+		break;
+	} catch (cause) {
+		if (!(cause instanceof CloudflareApiError) || cause.code !== 100146 || Date.now() >= deadline) throw cause;
+		await setTimeout$1(Math.min(2e3, deadline - Date.now()));
+	}
+	const versionBindings = object(version.resources)?.bindings;
+	if (version.id !== options.versionId || !Array.isArray(versionBindings)) throw new Error("The uploaded Container namespace could not be verified.");
+	const metadata = object(object(version.resources)?.script_runtime)?.containers;
+	if (!Array.isArray(metadata) || metadata.length !== options.containers.length || options.containers.some((expected) => {
+		const matching = metadata.map(object).filter((entry) => entry !== null && entry.name === expected.name && entry.class_name === expected.class_name);
+		return matching.length !== 1 || !isDeepStrictEqual(matching[0].images ?? {}, expected.images ?? {});
+	})) throw new Error("The uploaded Worker version did not retain the verified Container image metadata.");
+	for (const plan of options.plans) {
+		const matches = versionBindings.map(object).filter((binding) => binding?.type === "durable_object_namespace" && binding.class_name === plan.className && (binding.script_name === void 0 || binding.script_name === options.workerName) && binding.environment === void 0 && binding.dispatch_namespace === void 0);
+		const namespaces = new Set(matches.map((binding) => binding.namespace_id));
+		if (matches.length === 0 || namespaces.size !== 1) throw new Error(`Cloudflare Container ${plan.name} has no unambiguous uploaded local namespace.`);
+		const namespace = requiredString([...namespaces][0], `Container ${plan.name} namespace`);
+		if (!/^[a-f0-9]{32}$/.test(namespace)) throw new Error("The uploaded Container namespace ID was invalid.");
+		const url = `${options.accountUrl}/containers/applications/${encodeURIComponent(namespace)}`;
+		let application;
+		try {
+			application = await apiResult(url, options.token, "GET", void 0, options.verifyUploader);
+		} catch (cause) {
+			if (!(cause instanceof CloudflareApiError) || cause.status !== 404) throw cause;
+			application = await apiResult(`${options.accountUrl}/containers/applications`, options.token, "POST", {
+				name: plan.name,
+				scheduling_policy: "durable_object",
+				durable_objects: { namespace_id: namespace },
+				...plan.settings
+			}, options.verifyUploader);
+		}
+		assertContainerApplicationIdentity(application, plan, namespace);
+		assertContainerApplicationSettings(application, plan);
+		const confirmed = await apiResult(url, options.token, "GET", void 0, options.verifyUploader);
+		assertContainerApplicationIdentity(confirmed, plan, namespace);
+		assertContainerApplicationSettings(confirmed, plan);
+	}
+}
 async function uploadAssets(options) {
 	if (!options.output.assetsDirectory) return;
 	const directory = getWorkerAssetsDir(options.output.directory);
@@ -2094,7 +2389,8 @@ async function uploadAssets(options) {
 async function uploadPinnedCloudflareVersion(options) {
 	const activeSecrets = options.output.activeSecrets;
 	if (!activeSecrets) throw new Error("The active Worker secret source was not verified.");
-	const config = (await readBuildOutput(options.output.directory)).workers.default.config;
+	const built = await readBuildOutput(options.output.directory);
+	const config = built.workers.default.config;
 	if (config.name !== options.workerName || !config.manifest || config.manifest.type !== "complete") throw new Error("The verified Cloudflare Worker output changed before upload.");
 	const unsupported = Object.keys(config).filter((key) => !(/* @__PURE__ */ new Set([
 		"name",
@@ -2118,6 +2414,8 @@ async function uploadPinnedCloudflareVersion(options) {
 	const explicitSecrets = options.secretsFilePath ? object(JSON.parse(readFileSync(options.secretsFilePath, "utf8"))) : {};
 	if (!explicitSecrets) throw new Error("The explicit Cloudflare secrets file was not readable.");
 	const bindings = bindingsFromOutput(config.env ?? {}, options.workerName, activeSecrets, explicitSecrets);
+	const exports = exportsFromOutput(config.exports, bindings);
+	const containerPlans = containerPlansFromOutput(built.containers, exports, bindings);
 	const active = await apiResult(`${options.apiBaseUrl.replace(/\/$/, "")}/accounts/${encodeURIComponent(options.accountId)}/workers/workers/${encodeURIComponent(options.workerName)}/versions/${encodeURIComponent(activeSecrets.versionId)}`, options.token, "GET", void 0, options.verifyUploader);
 	if (active.id !== activeSecrets.versionId || !Array.isArray(active.bindings)) throw new Error("The active Cloudflare Worker bindings could not be verified.");
 	const activeBindingNames = /* @__PURE__ */ new Set();
@@ -2137,7 +2435,6 @@ async function uploadPinnedCloudflareVersion(options) {
 		}
 	}
 	if (activeSecrets.bindings.some(({ name }) => !activeBindingNames.has(name))) throw new Error("The active Cloudflare Worker secrets changed before upload.");
-	const exports = exportsFromOutput(config.exports);
 	const assetConfig = assetConfigFromOutput(config.assets);
 	if (bindings.some((binding) => binding.type === "assets") && !options.output.assetsDirectory) throw new Error("The Cloudflare Worker has an assets binding without verified assets.");
 	const modules = [];
@@ -2151,6 +2448,23 @@ async function uploadPinnedCloudflareVersion(options) {
 		});
 	}
 	const accountUrl = `${options.apiBaseUrl.replace(/\/$/, "")}/accounts/${encodeURIComponent(options.accountId)}`;
+	await preflightWorkflowExports({
+		exports,
+		accountUrl,
+		workerName: options.workerName,
+		token: options.token,
+		verifyUploader: options.verifyUploader
+	});
+	await preflightContainerApplications(containerPlans, active.bindings, accountUrl, options.workerName, options.token, options.verifyUploader);
+	const containers = await prepareContainerMetadata({
+		plans: containerPlans,
+		directory: options.output.directory,
+		accountUrl,
+		accountId: options.accountId,
+		token: options.token,
+		verifyUploader: options.verifyUploader,
+		runCf: options.runCf
+	});
 	const jwt = await uploadAssets({
 		output: options.output,
 		accountUrl,
@@ -2165,14 +2479,30 @@ async function uploadPinnedCloudflareVersion(options) {
 		compatibility_flags: config.compatibilityFlags,
 		bindings,
 		...exports ? { exports } : {},
+		...containers.length ? { containers } : {},
 		...jwt ? { assets: {
 			jwt,
 			...assetConfig ? { config: assetConfig } : {}
 		} } : {},
 		annotations: { "workers/message": options.message ?? "" }
 	}, options.verifyUploader);
+	const versionId = uploaded.id;
+	if (typeof versionId !== "string" || !/^[0-9a-f]{8}-(?:[0-9a-f]{4}-){3}[0-9a-f]{12}$/i.test(versionId)) throw new Error("Cloudflare accepted the Worker upload but returned an invalid version identity. Read back the Worker deployment before retrying.");
+	try {
+		await ensureContainerApplications({
+			plans: containerPlans,
+			containers,
+			accountUrl,
+			workerName: options.workerName,
+			versionId,
+			token: options.token,
+			verifyUploader: options.verifyUploader
+		});
+	} catch {
+		throw new Error(`Cloudflare Worker version ${versionId} was uploaded${options.atomic ? " and may already be published" : ""}, but its Container applications could not be verified. Read back the Worker deployment and Container identities before retrying.`);
+	}
 	return {
-		id: requiredString(uploaded.id, "Worker Version ID"),
+		id: versionId,
 		urls: Array.isArray(uploaded.urls) ? uploaded.urls.filter((url) => typeof url === "string") : []
 	};
 }
@@ -2185,10 +2515,6 @@ function failed(message) {
 		stderr: message
 	};
 }
-function flag(args, name) {
-	const index = args.indexOf(name);
-	return index < 0 ? void 0 : args[index + 1];
-}
 function parseJson(value) {
 	try {
 		return JSON.parse(value);
@@ -2257,15 +2583,12 @@ function createCfResourceVerifier(options) {
 				const name = identifier("name");
 				if (!name) return failed(`Cloudflare Queue binding ${bindingName} has no name.`);
 				if (!options.verifyCompatibilityRunner()) return failed("The Cloudflare resource verifier changed during deployment.");
-				const found = await Promise.resolve(options.runWrangler([
-					"queues",
-					"info",
+				const found = await Promise.resolve(options.runWrangler({
+					type: "queues.info",
 					name,
-					"-c",
-					options.configPath,
-					"--env="
-				], { capture: true }));
-				if (found.status !== 0 || found.signal || found.error || found.stdout.trim() !== `Queue Name: ${name}`) return failed(`Cloudflare Queue ${name} is unavailable; refusing automatic provisioning.`);
+					configPath: options.configPath
+				}, { capture: true }));
+				if (found.status !== 0 || found.signal || found.error || !record(found.data) || found.data.name !== name) return failed(`Cloudflare Queue ${name} is unavailable; refusing automatic provisioning.`);
 				continue;
 			}
 			const resource = value.type === "r2" ? {
@@ -2314,7 +2637,7 @@ function createCfResourceVerifier(options) {
 				cwd: directory,
 				capture: true
 			});
-			const body = parseJson(result.stdout);
+			const body = result.data ?? parseJson(result.stdout);
 			if (result.status !== 0 || result.signal || result.error || !record(body) || body[resource.response] !== name) return failed(`Cloudflare ${resource.kind} ${name} is unavailable; refusing automatic provisioning.`);
 		}
 		return {
@@ -2339,6 +2662,8 @@ function createCfCommand(options) {
 		if (env.HTTP_PROXY || env.HTTPS_PROXY || env.http_proxy || env.https_proxy) env.NODE_USE_ENV_PROXY = "1";
 		if (options.token) env.CLOUDFLARE_API_TOKEN = options.token;
 		return await new Promise((resolve) => {
+			const bounded = run.timeoutMs !== void 0;
+			const processGroup = bounded && process.platform !== "win32";
 			const child = spawn(process.execPath, [cf, ...args], {
 				cwd: run.cwd,
 				env,
@@ -2348,17 +2673,49 @@ function createCfCommand(options) {
 					"ignore",
 					"pipe",
 					"pipe"
-				]
+				],
+				detached: processGroup
 			});
 			const stdout = [];
 			const stderr = [];
 			let bytes = 0;
 			let error = null;
+			const stop = () => {
+				if (processGroup && child.pid) try {
+					process.kill(-child.pid, "SIGKILL");
+				} catch (cause) {
+					if (cause.code !== "ESRCH") child.kill("SIGKILL");
+				}
+				else if (bounded && process.platform === "win32" && child.pid) execFile("taskkill", [
+					"/PID",
+					String(child.pid),
+					"/T",
+					"/F"
+				], {
+					windowsHide: true,
+					timeout: 1e4
+				}, (cause) => {
+					if (cause) child.kill("SIGKILL");
+				});
+				else child.kill("SIGKILL");
+			};
+			const interrupted = () => {
+				error = "Cloudflare command interrupted.";
+				stop();
+			};
+			if (bounded) {
+				process.on("SIGINT", interrupted);
+				process.on("SIGTERM", interrupted);
+			}
+			const timer = run.timeoutMs === void 0 ? void 0 : setTimeout(() => {
+				error = "Cloudflare command timed out.";
+				stop();
+			}, run.timeoutMs);
 			const collect = (chunks, chunk) => {
 				bytes += chunk.length;
-				if (bytes > 268435456) {
-					error = "Cloudflare command output exceeded 256 MiB.";
-					child.kill();
+				if (bytes > (run.maxOutputBytes ?? 268435456)) {
+					error = "Cloudflare command output exceeded its verified limit.";
+					stop();
 				} else chunks.push(chunk);
 			};
 			child.stdout.on("data", (chunk) => collect(stdout, chunk));
@@ -2367,10 +2724,23 @@ function createCfCommand(options) {
 				error = cause.message;
 			});
 			child.on("close", (status, signal) => {
+				clearTimeout(timer);
+				if (bounded) {
+					process.off("SIGINT", interrupted);
+					process.off("SIGTERM", interrupted);
+				}
+				const output = Buffer.concat(stdout).toString("utf8");
+				const diagnostic = Buffer.concat(stderr).toString("utf8");
+				const completed = typeof status === "number" && signal == null && error == null;
+				const code = completed ? (output + "\n" + diagnostic).match(/\[(?:code:\s*)?(\d{4,})\]/)?.[1] : void 0;
+				const missingUploadTarget = completed && status !== 0 && code === void 0 && args[0] === "workers" && args[1] === "versions" && args[2] === "create" && (output + "\n" + diagnostic).replace(/\s+/g, " ").includes("You cannot upload a new version of a Worker that does not yet exist.");
 				resolve({
 					status: typeof status === "number" ? status : 1,
-					stdout: Buffer.concat(stdout).toString("utf8"),
-					stderr: Buffer.concat(stderr).toString("utf8").replace(/\[(\d{4,})\]/g, "[code: $1]"),
+					stdout: output,
+					stderr: diagnostic,
+					...code ? { errorCode: Number(code) } : {},
+					...missingUploadTarget ? { failure: "not-found" } : {},
+					...completed && status !== 0 ? { errors: [{ message: output + "\n" + diagnostic }] } : {},
 					signal,
 					error
 				});
@@ -2384,10 +2754,31 @@ function createCfCommand(options) {
 */
 function createCfVersionRunner(options) {
 	const { output, workerName, runCf } = options;
-	const run = async (args, capture, cwd = output.directory) => await runCf(args, {
-		cwd,
-		capture
-	});
+	const run = async (args, capture, cwd = output.directory) => {
+		const result = await runCf(args, {
+			cwd,
+			capture
+		});
+		return {
+			...result,
+			data: result.data ?? parseJson(result.stdout)
+		};
+	};
+	const uploadedResult = (result) => {
+		if (result.status !== 0 || result.signal || result.error) return result;
+		if (record(result.data) && typeof result.data.versionId === "string") return result;
+		const versionId = result.stdout.match(/(?:Worker|Current) Version ID:\s*([0-9a-f]{8}-[0-9a-f-]{27})/i)?.[1];
+		const previewUrl = result.stdout.match(/Version Preview(?: Alias)? URL:\s*(https:\/\/\S+)/i)?.[1];
+		const workersDevUrl = result.stdout.match(/(https:\/\/[a-z0-9.-]+\.workers\.dev(?:\/[^\s]*)?)/i)?.[1];
+		return {
+			...result,
+			data: versionId ? {
+				versionId,
+				...previewUrl ? { previewUrl } : {},
+				...workersDevUrl ? { workersDevUrl } : {}
+			} : void 0
+		};
+	};
 	const verifyResources = async (directory) => {
 		try {
 			return await options.verifyResources(directory);
@@ -2395,7 +2786,7 @@ function createCfVersionRunner(options) {
 			return failed("Cloudflare resources could not be verified before upload.");
 		}
 	};
-	const uploadPinnedVersion = async (args, atomic) => {
+	const uploadPinnedVersion = async (operation, atomic) => {
 		if (!options.pinnedUpload || !options.pinnedUpload.verifyUploader()) return failed("The version-aware Cloudflare uploader is unavailable.");
 		const token = await options.pinnedUpload.getToken();
 		if (!token) return failed("Cloudflare session has no bearer for version-aware upload.");
@@ -2406,23 +2797,28 @@ function createCfVersionRunner(options) {
 				apiBaseUrl: options.pinnedUpload.apiBaseUrl,
 				workerName,
 				token,
-				...flag(args, "--message") ? { message: flag(args, "--message") } : {},
-				...flag(args, "--secrets-file") ? { secretsFilePath: flag(args, "--secrets-file") } : {},
+				...operation.message ? { message: operation.message } : {},
+				...operation.secretsFilePath ? { secretsFilePath: operation.secretsFilePath } : {},
 				atomic,
-				verifyUploader: options.pinnedUpload.verifyUploader
+				verifyUploader: options.pinnedUpload.verifyUploader,
+				runCf
 			});
 			const preview = version.urls.find((url) => /^https:\/\//.test(url));
 			return {
 				status: 0,
-				stdout: `Worker Version ID: ${version.id}\n${preview ? `Version Preview URL: ${preview}\n` : ""}`,
+				stdout: "",
+				data: {
+					versionId: version.id,
+					...preview ? { previewUrl: preview } : {}
+				},
 				stderr: ""
 			};
 		} catch (cause) {
 			return failed(cause instanceof Error ? cause.message : "Cloudflare version upload failed.");
 		}
 	};
-	return async (args, command) => {
-		if (args[0] === "deployments" && args[1] === "status") {
+	return async (operation, command) => {
+		if (operation.type === "deployments.status") {
 			const result = await run([
 				"workers",
 				"deployments",
@@ -2430,17 +2826,20 @@ function createCfVersionRunner(options) {
 				"--worker",
 				workerName
 			], true);
-			if (result.status !== 0) return result;
-			const body = parseJson(result.stdout);
+			if (result.status !== 0 || result.signal || result.error) return result;
+			const body = result.data;
 			const deployments = record(body) ? body.deployments : void 0;
-			if (Array.isArray(deployments) && deployments.length === 0) return failed("The Cloudflare Worker has no deployments.");
+			if (Array.isArray(deployments) && deployments.length === 0) return {
+				...failed("The Cloudflare Worker has no deployments."),
+				errorCode: 10007
+			};
 			if (!Array.isArray(deployments) || !record(deployments[0])) return failed("The Cloudflare Worker deployment was not readable.");
 			return {
 				...result,
-				stdout: JSON.stringify(deployments[0])
+				data: deployments[0]
 			};
 		}
-		if (args[0] === "versions" && args[1] === "list") {
+		if (operation.type === "versions.list") {
 			const pageSize = 10;
 			const readPage = async (page) => {
 				const result = await run([
@@ -2454,19 +2853,20 @@ function createCfVersionRunner(options) {
 					"--page",
 					String(page)
 				], true);
-				const body = parseJson(result.stdout);
+				const body = result.data;
 				return {
 					result,
 					versions: Array.isArray(body) && body.length <= pageSize && body.every((item) => record(item) && typeof item.id === "string" && Number.isSafeInteger(item.number)) && new Set(body.map((item) => item.number)).size === body.length ? body : null
 				};
 			};
 			const first = await readPage(1);
-			if (first.result.status !== 0) return first.result;
+			if (first.result.status !== 0 || first.result.signal || first.result.error) return first.result;
 			if (!first.versions) return failed("The Cloudflare Worker version list was not readable.");
 			const versions = [...first.versions];
 			if (versions.length === pageSize) {
 				const second = await readPage(2);
-				if (second.result.status !== 0 || !second.versions) return failed("The Cloudflare Worker version history was not readable.");
+				if (second.result.status !== 0 || second.result.signal || second.result.error) return second.result;
+				if (!second.versions) return failed("The Cloudflare Worker version history was not readable.");
 				if (second.versions.length > 0) {
 					const firstNumbers = versions.map((item) => item.number);
 					const secondNumbers = second.versions.map((item) => item.number);
@@ -2475,7 +2875,8 @@ function createCfVersionRunner(options) {
 						let last = Math.max(...secondNumbers);
 						for (let page = 3; page <= 1e3 && second.versions.length === pageSize; page++) {
 							const next = await readPage(page);
-							if (next.result.status !== 0 || !next.versions) return failed("The Cloudflare Worker version history was not readable.");
+							if (next.result.status !== 0 || next.result.signal || next.result.error) return next.result;
+							if (!next.versions) return failed("The Cloudflare Worker version history was not readable.");
 							if (next.versions.length === 0) break;
 							const numbers = next.versions.map((item) => item.number);
 							if (Math.min(...numbers) <= last) return failed("The Cloudflare Worker version history changed during inspection.");
@@ -2489,56 +2890,51 @@ function createCfVersionRunner(options) {
 			}
 			return {
 				...first.result,
-				stdout: JSON.stringify(versions.sort((a, b) => a.number - b.number).slice(-10))
+				data: versions.sort((a, b) => a.number - b.number).slice(-10)
 			};
 		}
-		if (args[0] === "versions" && args[1] === "view" && args[2]) {
+		if (operation.type === "versions.view") {
 			const result = await run([
 				"workers",
 				"versions",
 				"get",
-				args[2],
+				operation.versionId,
 				"--worker-id",
 				workerName
 			], true);
-			if (result.status !== 0) return result;
-			const version = parseJson(result.stdout);
-			if (!record(version) || version.id !== args[2] || !Array.isArray(version.bindings)) return failed("The Cloudflare Worker version was not readable.");
+			if (result.status !== 0 || result.signal || result.error) return result;
+			const version = result.data;
+			if (!record(version) || version.id !== operation.versionId || !Array.isArray(version.bindings)) return failed("The Cloudflare Worker version was not readable.");
 			return {
 				...result,
-				stdout: JSON.stringify({
+				data: {
 					...version,
 					resources: { bindings: version.bindings }
-				})
+				}
 			};
 		}
-		if (args[0] === "versions" && args[1] === "upload") {
-			if (flag(args, "--name") !== workerName || args.includes("--assets") && flag(args, "--assets") !== output.assetsDirectory) return failed("The Cloudflare version upload target changed.");
+		if (operation.type === "versions.upload") {
+			if (operation.workerName !== workerName || operation.assetsDirectory !== void 0 && operation.assetsDirectory !== output.assetsDirectory) return failed("The Cloudflare version upload target changed.");
 			const verified = await verifyResources(output.directory);
 			if (verified.status !== 0 || verified.signal || verified.error) return verified;
-			if (output.activeSecrets) return uploadPinnedVersion(args, false);
-			return run([
+			if (output.activeSecrets) return uploadPinnedVersion(operation, false);
+			return uploadedResult(await run([
 				"workers",
 				"versions",
 				"create",
 				"--prebuilt",
-				...flag(args, "--message") ? ["--message", flag(args, "--message")] : [],
-				...flag(args, "--secrets-file") ? ["--secrets-file", flag(args, "--secrets-file")] : [],
-				...flag(args, "--preview-alias") ? ["--preview-alias", flag(args, "--preview-alias")] : []
-			], command.capture);
-		}
-		if (args[0] === "versions" && args[1] === "deploy") {
-			if (flag(args, "--name") !== workerName) return failed("The Cloudflare deployment target changed.");
-			const flagsStart = args.findIndex((item, index) => index >= 2 && item.startsWith("-"));
-			const versions = args.slice(2, flagsStart < 0 ? void 0 : flagsStart);
-			if (!versions.every((item) => /^[0-9a-f-]{36}@\d+(?:\.\d+)?$/i.test(item))) return failed("The Cloudflare deployment versions were invalid.");
-			const parsed = versions.map((item) => {
-				const [version_id, percentage] = item.split("@");
-				return {
-					version_id,
-					percentage: Number(percentage)
-				};
-			});
+				...operation.message ? ["--message", operation.message] : [],
+				...operation.secretsFilePath ? ["--secrets-file", operation.secretsFilePath] : [],
+				...operation.previewAlias ? ["--preview-alias", operation.previewAlias] : []
+			], command.capture));
+		}
+		if (operation.type === "versions.deploy") {
+			if (operation.workerName !== workerName) return failed("The Cloudflare deployment target changed.");
+			const parsed = operation.versions.map(({ versionId, percentage }) => ({
+				version_id: versionId,
+				percentage
+			}));
+			if (!parsed.every((version) => /^[0-9a-f-]{36}$/i.test(version.version_id) && Number.isFinite(version.percentage))) return failed("The Cloudflare deployment versions were invalid.");
 			if (parsed.length === 0 || new Set(parsed.map((item) => item.version_id)).size !== parsed.length || parsed.some((item) => item.percentage < 0 || item.percentage > 100) || Math.abs(parsed.reduce((sum, item) => sum + item.percentage, 0) - 100) > .001) return failed("The Cloudflare deployment percentages were invalid.");
 			return run([
 				"workers",
@@ -2550,28 +2946,28 @@ function createCfVersionRunner(options) {
 				"percentage",
 				"--versions",
 				JSON.stringify(parsed),
-				...flag(args, "--message") ? ["--body", JSON.stringify({
+				...operation.message ? ["--body", JSON.stringify({
 					strategy: "percentage",
 					versions: parsed,
-					annotations: { "workers/message": flag(args, "--message") }
+					annotations: { "workers/message": operation.message }
 				})] : []
 			], command.capture);
 		}
-		if (args[0] === "deploy") {
-			if (flag(args, "--name") !== workerName || args.includes("--assets") && flag(args, "--assets") !== output.assetsDirectory) return failed("The Cloudflare bootstrap target changed.");
+		if (operation.type === "worker.deploy") {
+			if (operation.workerName !== workerName || operation.assetsDirectory !== void 0 && operation.assetsDirectory !== output.assetsDirectory) return failed("The Cloudflare bootstrap target changed.");
 			const verified = await verifyResources(output.directory);
 			if (verified.status !== 0 || verified.signal || verified.error) return verified;
-			if (output.activeSecrets) return uploadPinnedVersion(args, true);
-			return run([
+			if (output.activeSecrets) return uploadPinnedVersion(operation, true);
+			return uploadedResult(await run([
 				"deploy",
 				"--prebuilt",
-				...flag(args, "--message") ? ["--message", flag(args, "--message")] : [],
-				...flag(args, "--secrets-file") ? ["--secrets-file", flag(args, "--secrets-file")] : []
-			], command.capture);
+				...operation.message ? ["--message", operation.message] : [],
+				...operation.secretsFilePath ? ["--secrets-file", operation.secretsFilePath] : []
+			], command.capture));
 		}
-		if (args[0] === "triggers" && args[1] === "deploy") {
-			const configPath = flag(args, "-c");
-			if (!configPath || flag(args, "--name") !== workerName) return failed("The Cloudflare trigger target changed.");
+		if (operation.type === "triggers.deploy") {
+			const configPath = operation.configPath;
+			if (!configPath || operation.workerName !== workerName) return failed("The Cloudflare trigger target changed.");
 			const raw = parseJson(readFileSync(configPath, "utf8"));
 			if (!record(raw) || raw.name !== workerName) return failed("The Cloudflare trigger snapshot was not readable.");
 			const directory = mkdtempSync(join(tmpdir(), "void-cf-triggers-"));
@@ -2621,12 +3017,12 @@ function createCfVersionRunner(options) {
 				});
 			}
 		}
-		if (args[0] === "queues" && args[1] === "consumer" && args[2] === "remove") {
-			const queueName = args[3];
-			if (!queueName || args[4] !== workerName) return failed("The Cloudflare Queue consumer target changed.");
+		if (operation.type === "queues.consumer.remove") {
+			const queueName = operation.queueName;
+			if (!queueName || operation.workerName !== workerName) return failed("The Cloudflare Queue consumer target changed.");
 			const queues = await run(["queues", "list"], true);
-			if (queues.status !== 0) return queues;
-			const allQueues = parseJson(queues.stdout);
+			if (queues.status !== 0 || queues.signal || queues.error) return queues;
+			const allQueues = queues.data;
 			if (!Array.isArray(allQueues)) return failed("The Cloudflare Queue list was not readable.");
 			const queue = allQueues.find((item) => record(item) && item.queue_name === queueName);
 			if (!record(queue) || typeof queue.queue_id !== "string") return failed(`Cloudflare Queue ${queueName} was not found.`);
@@ -2637,16 +3033,22 @@ function createCfVersionRunner(options) {
 				"--queue-id",
 				queue.queue_id
 			], true);
-			if (consumers.status !== 0) return consumers;
-			const allConsumers = parseJson(consumers.stdout);
+			if (consumers.status !== 0 || consumers.signal || consumers.error) return consumers;
+			const allConsumers = consumers.data;
 			if (!Array.isArray(allConsumers)) return failed("The Cloudflare Queue consumers were not readable.");
-			const matching = allConsumers.filter((item) => record(item) && item.script === workerName);
+			const matching = [];
+			for (const item of allConsumers) {
+				if (!record(item)) return failed("The Cloudflare Queue consumers were not readable.");
+				const name = item.script_name ?? item.script;
+				if (item.script_name !== void 0 && !safePositional(item.script_name) || item.script !== void 0 && !safePositional(item.script) || item.script_name !== void 0 && item.script !== void 0 && item.script_name !== item.script || item.type === "worker" && name === void 0) return failed("The Cloudflare Queue consumer Worker identity was ambiguous.");
+				if (name === workerName) matching.push(item);
+			}
 			if (matching.length === 0) return {
 				status: 0,
 				stdout: "",
 				stderr: ""
 			};
-			if (matching.length !== 1 || !record(matching[0]) || typeof matching[0].consumer_id !== "string") return failed("The Cloudflare Queue consumer identity was ambiguous.");
+			if (matching.length !== 1 || !safePositional(matching[0].consumer_id) || matching[0].type !== void 0 && matching[0].type !== "worker") return failed("The Cloudflare Queue consumer identity was ambiguous.");
 			return run([
 				"queues",
 				"consumers",
@@ -2657,7 +3059,7 @@ function createCfVersionRunner(options) {
 				"--force"
 			], command.capture);
 		}
-		return failed(`Unsupported Cloudflare activation operation: ${args[0] ?? ""} ${args[1] ?? ""}`);
+		return failed(`Unsupported Cloudflare activation operation: ${operation.type}`);
 	};
 }
 //#endregion
@@ -2708,13 +3110,13 @@ function clearCloudflareCandidate(root) {
 * Narrow native Cloudflare deploys to app shapes whose emitted Worker artifact
 * the current verifier understands. This runs before any account operation.
 */
-function classifyCloudflareDeployApp(root, voidConfig, options) {
+function classifyCloudflareDeployApp(root, voidConfig, options, application) {
 	if (isNodeTarget(voidConfig.target)) return unsupported([
 		`deploy: --platform cloudflare is not supported for the "${voidConfig.target}" target.`,
 		"This backend deploys Cloudflare Workers only. Deploy a node/bun/deno build with its",
 		"own host/runtime, or use the default Cloudflare target for --platform cloudflare."
 	].join("\n"));
-	const framework = detectFramework(root);
+	const framework = application?.framework ?? detectFramework(root);
 	if (framework) {
 		if (!FRAMEWORK_PRESETS[framework.name]) return unsupported(`deploy: --platform cloudflare has no deployment preset for framework ${framework.name}.`);
 	}
@@ -2733,13 +3135,16 @@ function classifyCloudflareDeployApp(root, voidConfig, options) {
 		"A full Void app has at least one of: routes/, pages/, middleware, crons/, queues/,",
 		"email/, or an SSR entry. Add your server code, or use `void deploy` for a static site."
 	].join("\n"));
-	const paths = resolveProjectPaths(root, voidConfig);
 	try {
+		const analysis = application ?? analyzeApplicationSync(root, {
+			config: voidConfig,
+			environment: "prod"
+		});
+		const paths = analysis.paths;
 		assertNoRootSourceConventionConflicts(paths);
 		validateSsrEntry(root, paths);
-		scanJobsSync(root, paths.cronsDir);
-		syncWranglerDurableObjects(root, scanDurableObjectModules(root));
-		syncWranglerWebSockets(root, scanWebSocketRoutesSync(root, paths, "prod"));
+		syncWranglerDurableObjects(root, analysis.durableObjects);
+		syncWranglerWebSockets(root, analysis.websockets);
 	} catch (error) {
 		return unsupported(`deploy: ${getErrorMessage$1(error)}`);
 	}
@@ -2886,7 +3291,7 @@ async function prepareExistingCloudflareDeploy(options) {
 }
 /** Offer the existing destination before the legacy hosted-platform fallback. */
 async function maybeLinkCloudflareDeploy(root, options = {}, deps = {}) {
-	if (options.platform || options.backend || options.projectSlug || process.env.VOID_PROJECT || readDeploymentPlatform(root) !== null) return null;
+	if (options.platform || options.projectSlug || process.env.VOID_PROJECT || readDeploymentPlatform(root) !== null) return null;
 	const files = [.../* @__PURE__ */ new Set([...[
 		"wrangler.jsonc",
 		"wrangler.json",
@@ -4029,8 +4434,7 @@ function buildVoidManifest(opts) {
 	};
 	if (opts.hasEmailHandlers) manifest.emailProtocolVersion = 1;
 	if (bindings.needsAuth) manifest.auth = true;
-	const hasMigrations = migrations && migrations.length > 0;
-	if (bindings.needsD1 || bindings.needsAuth || hasMigrations) {
+	if (needsApplicationDatabase(bindings, migrations?.length ?? 0)) {
 		if (resolvedDialect !== "sqlite") manifest.bindings.hyperdrive = ["HYPERDRIVE"];
 		else manifest.bindings.d1 = [options?.bindingNames?.d1 ?? "DB"];
 	}
@@ -4145,8 +4549,7 @@ function buildFrameworkManifest(opts) {
 		assetManifestVersion: 2,
 		bindings: {}
 	};
-	const hasMigrations = opts.migrations && opts.migrations.length > 0;
-	if (opts.bindings.needsD1 || opts.bindings.needsAuth || hasMigrations) {
+	if (needsApplicationDatabase(opts.bindings, opts.migrations?.length ?? 0)) {
 		if (dialect !== "sqlite") manifest.bindings.hyperdrive = ["HYPERDRIVE"];
 		else manifest.bindings.d1 = [po?.bindingNames?.d1 ?? "DB"];
 	}
@@ -4395,7 +4798,7 @@ async function generateWrapper(workerDir, workerMain, root, features) {
 	let migrationPlanBundle;
 	if (features.hasMigrations) {
 		const { collectMigrations } = await import("./collect-DLyFDiKW.mjs");
-		const { buildMigrationPlanBundle } = await import("./plan-DpuOr14e.mjs");
+		const { buildMigrationPlanBundle } = await import("./plan-D1Q5rf-r.mjs");
 		const migrationsDir = readProjectPaths(root).migrationsDir;
 		migrations = collectMigrations(migrationsDir);
 		migrationPlanBundle = features.migrationDialect === "sqlite" ? buildMigrationPlanBundle(migrations) : void 0;
@@ -4636,7 +5039,7 @@ function generateWrapperSource(renamedEntry, handlersModule, features, migration
 		}
 		if (features.readiness || features.crons.length > 0 || features.queues.length > 0 || features.hasMigrations) {
 			lines.push("  if (request.method === \"GET\" && url.pathname === \"/__void/ready\") {");
-			lines.push("    return Response.json({ ready: true });");
+			lines.push(`    return Response.json({ ready: true${features.versionMetadataBinding ? `, versionId: env[${JSON.stringify(features.versionMetadataBinding)}]?.id` : ""} }${features.versionMetadataBinding ? ", { headers: { \"cache-control\": \"no-store\" } }" : ""});`);
 			lines.push("  }");
 		}
 		if (features.queues.length > 0) {
@@ -4806,7 +5209,7 @@ let loadedProvisionModule;
 * so a managed deploy never imports it — and thus never loads `proper-lockfile`.
 */
 async function loadProvisionModule() {
-	loadedProvisionModule ??= await import("./provision-Fr9pRqce.mjs");
+	loadedProvisionModule ??= await import("./provision-C4ORE7G7.mjs");
 	return loadedProvisionModule;
 }
 /**
@@ -4829,7 +5232,7 @@ const log = {
 };
 var DeployEventError = class extends Error {};
 function resolveDeploymentPlatform(root, options) {
-	return options?.platform ?? options?.backend ?? readDeploymentPlatform(root) ?? "void";
+	return options?.platform ?? readDeploymentPlatform(root) ?? "void";
 }
 async function generateDeployWrapperIfNeeded(root, workerDir, workerMain, features) {
 	if (!needsWrapper(features)) return false;
@@ -4965,7 +5368,7 @@ async function runDeploy(root, options) {
 * `VOID_DEPLOY_PROJECT_ID` is, so it cannot leak into an unrelated child process or a
 * later `void dev` in the same shell.
 *
-* Deliberately NOT set by `runCloudflareDeploy` (`--backend cloudflare`): that flow
+* Deliberately NOT set by `runCloudflareDeploy` (`--platform cloudflare`): that flow
 * hands the built output to `wrangler deploy` against the user's own account and IS the
 * self-host path the warning is about. (It rejects framework SSR outright today, so no
 * Class A build reaches it either way.)
@@ -4975,6 +5378,7 @@ const MANAGED_DEPLOY_BUILD_ENV = { VOID_DEPLOY_BUILD: "1" };
 function scrubManagedDeployBuildMarkers(env) {
 	const { deleteEnvVarCaseAware } = requireProvisionModule();
 	deleteEnvVarCaseAware(env, "VOID_DEPLOY_PROJECT_ID");
+	deleteEnvVarCaseAware(env, CLOUDFLARE_PRESERVE_BINDINGS_BUILD_ENV);
 	for (const name of Object.keys(MANAGED_DEPLOY_BUILD_ENV)) deleteEnvVarCaseAware(env, name);
 	return env;
 }
@@ -5391,14 +5795,14 @@ function reconstructExpectedDurableObjectState(config, root, rootConfig, options
 			name: sandbox.binding,
 			class_name: sandbox.className
 		});
-		if (!migrations.some((migration) => migration.tag === "void-sandbox-v2" || Array.isArray(migration.new_sqlite_classes) && migration.new_sqlite_classes.includes(sandbox.className))) migrations.push({
+		if (!hasSandboxSqliteMigration(migrations, sandbox.className)) migrations.push({
 			tag: SANDBOX_MIGRATION_TAG,
 			new_sqlite_classes: [sandbox.className]
 		});
 	}
-	const paths = resolveProjectPaths(root, config);
-	const websocketRoutes = scanWebSocketRoutesSync(root, paths);
-	const durableObjects = scanDurableObjectModules(root);
+	const analysis = options.analysis ?? analyzeApplicationSync(root, { config });
+	const websocketRoutes = analysis.allWebsockets;
+	const durableObjects = analysis.durableObjects;
 	const live = options.needsLive ? resolveLiveBindingConfig(root, {
 		reservedBindings: [...websocketRoutes.map((route) => route.bindingName), ...durableObjects.map((module) => module.bindingName)],
 		reservedClasses: [
@@ -5428,11 +5832,11 @@ function reconstructExpectedDurableObjectState(config, root, rootConfig, options
 * chunks from its own `__dirname` (the proxy workers, the experimental-config module), so the
 * whole directory is the trust surface, not just the entry file. Content hash of the bytes, NOT
 * mtime. Resolves the SAME entry {@link createDeployWranglerRunner} spawns (via
-* {@link resolveWranglerArgv}, whose launcher's LAST argv element is the JS entry). Returns
+* {@link resolveCloudflareOperationArgv}, whose launcher's LAST argv element is the JS entry). Returns
 * `undefined` when the entry cannot be resolved or a file cannot be read, so the caller FAILS
 * CLOSED — it never deploys a binary it could not verify. The resolver is injectable for tests.
 */
-function hashWranglerUploader(root, resolveArgv = resolveWranglerArgv) {
+function hashWranglerUploader(root, resolveArgv = resolveCloudflareOperationArgv) {
 	let entry;
 	try {
 		const argv = resolveArgv(root);
@@ -6261,42 +6665,30 @@ function assertDistinctKvNamespaces(kvNamespaces, config, configPath, isRealKvId
 /**
 * Compute the DESIRED id/name-bearing Cloudflare resources from SOURCE
 * (pre-build, fail-fast) — the single set shared by the provision and drift
-* paths. Reuses the deploy-time inference primitives directly
-* (`inferProjectBindings` + the scanners + the pg-dialect / `hasRevalidate`
-* signals) rather than `assembleVoidManifest`, which runs only inside the
-* managed `runFullDeploy` branches that need a `PlatformClient`.
+* paths. Consumes the same application analysis as the plugin and managed
+* packaging; provider identities and stored resource names are resolved here.
 *
 * Resource NAMES prefer the value already stored in the root wrangler config
 * (so a re-provision reuses the same database/bucket and the provisioner's
 * stored-name identity check passes); otherwise they default off the worker
 * name. Returns a per-binding REASON map used to explain drift.
 */
-async function computeDesiredCloudflareResources(root, voidConfig, configPath) {
+async function computeDesiredCloudflareResources(root, voidConfig, configPath, application) {
 	const { isRealD1Id, isRealKvId } = await loadProvisionModule();
-	const paths = resolveProjectPaths(root, voidConfig);
+	const analysis = application ? await completeApplicationAnalysis(application) : await analyzeApplication(root, {
+		config: voidConfig,
+		environment: "prod"
+	});
+	const { paths, bindings, authEnabled, dialect, bindingNames, migrations, needsDatabase } = analysis;
 	const config = parseRootWranglerConfig(configPath);
 	const workerName = readWranglerTopLevelString(config, "name") ?? deriveWorkerName(root);
-	const isFrameworkMode = detectFramework(root) != null;
-	const scanDirs = voidConfig.inference?.scanDirs ?? (isFrameworkMode ? FRAMEWORK_SCAN_DIRS : void 0);
-	const inferenceOptions = voidConfig.inference?.bindings ? { bindings: voidConfig.inference.bindings } : void 0;
-	const bindings = inferProjectBindings(root, {
-		...inferenceOptions,
-		paths,
-		environment: "prod"
-	}, scanDirs);
-	const authEnabled = bindings.needsAuth || findVoidAuthConfig(root, paths) !== null || voidConfig.auth !== void 0;
-	const dialect = getDatabaseDialect(voidConfig);
-	const bindingNames = resolveBindingNames(voidConfig.inference?.bindings);
-	const migrations = collectMigrations(paths.migrationsDir);
-	const hasMigrations = migrations.length > 0;
 	const migrationsDirRelative = paths.sourceDir ? `./${paths.sourceDir}/db/migrations` : "./db/migrations";
 	const desired = {
 		kvNamespaces: [],
 		queues: []
 	};
 	const reasons = /* @__PURE__ */ new Map();
-	const needsDatabase = bindings.needsD1 || authEnabled || hasMigrations;
-	const databaseReason = bindings.needsD1 ? "app uses env.DB (D1)" : authEnabled ? "auth requires a D1 database" : "checked-in migrations need a D1 database";
+	const databaseReason = analysis.reasons.database[0];
 	if (needsDatabase && dialect === "sqlite") {
 		const binding = bindingNames?.d1 ?? "DB";
 		const storedName = readStoredResourceName(config, "d1_databases", binding, "database_name");
@@ -6315,7 +6707,7 @@ async function computeDesiredCloudflareResources(root, voidConfig, configPath) {
 			binding,
 			title: suffixedResourceName(workerName, "kv")
 		});
-		reasons.set(binding, "app uses env.KV");
+		reasons.set(binding, analysis.reasons.kv[0]);
 	}
 	if (bindings.needsR2) {
 		const binding = bindingNames?.r2 ?? "STORAGE";
@@ -6325,9 +6717,9 @@ async function computeDesiredCloudflareResources(root, voidConfig, configPath) {
 			binding,
 			bucketName: storedName && !generatedDefault ? storedName : suffixedResourceName(workerName, "storage")
 		};
-		reasons.set(binding, "app uses env.STORAGE (R2)");
+		reasons.set(binding, analysis.reasons.r2[0]);
 	}
-	desired.queues = scanQueuesSync(root, paths.queuesDir).map((q) => q.name);
+	desired.queues = analysis.queues.map((q) => q.name);
 	if (needsDatabase && dialect !== "sqlite") {
 		const binding = "HYPERDRIVE";
 		desired.hyperdrive = {
@@ -6337,10 +6729,8 @@ async function computeDesiredCloudflareResources(root, voidConfig, configPath) {
 		};
 		reasons.set(binding, `app uses ${dialect === "mysql" ? "MySQL" : "PostgreSQL"} (needs a Hyperdrive config)`);
 	}
-	if (hasRevalidate(collectRevalidate(voidConfig, existsSync(paths.pagesDir) ? await scanPages(root, {
-		output: voidConfig.output,
-		paths
-	}) : null))) {
+	const pageScan = analysis.scan.pages;
+	if (hasRevalidate(collectRevalidate(voidConfig, pageScan))) {
 		const binding = "ISR_CACHE";
 		desired.kvNamespaces.push({
 			binding,
@@ -6349,9 +6739,10 @@ async function computeDesiredCloudflareResources(root, voidConfig, configPath) {
 		reasons.set(binding, "routes use `revalidate` (ISR) — needs an ISR_CACHE KV namespace");
 	}
 	assertDistinctKvNamespaces(desired.kvNamespaces, config, configPath, isRealKvId);
-	const expectedCrons = [...new Set(scanJobsSync(root, paths.cronsDir).flatMap((job) => job.crons))];
-	const emailHandlers = scanEmailHandlersSync(paths.sourceRoot);
+	const expectedCrons = [...new Set(analysis.jobs.flatMap((job) => job.crons))];
+	const emailHandlers = analysis.email;
 	return {
+		analysis,
 		desired,
 		reasons,
 		authEnabled,
@@ -6363,7 +6754,7 @@ async function computeDesiredCloudflareResources(root, voidConfig, configPath) {
 		expectedCrons,
 		needsEmail: bindings.needsEmail === true || hasEmailHandlers(emailHandlers),
 		emailHandlers,
-		needsSandbox: isSandboxEnabled(voidConfig) || bindings.needsSandbox,
+		needsSandbox: bindings.needsSandbox,
 		needsLive: bindings.needsLive === true
 	};
 }
@@ -6717,49 +7108,15 @@ async function checkWranglerMigrationApplySet(configPath, config, binding, migra
 	};
 	return { ok: true };
 }
-/**
-* Default {@link DeployWranglerRun}: spawns the project-local wrangler REAL CLI
-* (via {@link resolveWranglerArgv}, shell-free) with ONE pinned transport in the
-* child env (via {@link deployChildEnv} — reused provisioner scrub/pin: CF Access +
-* every transport selector incl. `CLOUDFLARE_ENV` + the deploy config-override vars
-* scrubbed, one account + API base pinned), so `whoami`/`migrate`/`deploy` can never
-* consult a different ambient account or endpoint. Noninteractive output is captured so Void
-* controls the terminal; browser login still inherits stdio. `opts.env` layers one more pin
-* over the child env for a single spawn (`auth token` gets
-* `WRANGLER_WRITE_LOGS=false`, see {@link runWranglerAuthToken}).
-*/
+/** Run typed provider operations in the pinned account and API context. */
 function createDeployWranglerRunner(root, accountId, apiBaseUrl) {
-	const [command, ...prefix] = resolveWranglerArgv(root);
-	return (args, opts) => {
-		const childEnv = deployChildEnv(accountId, apiBaseUrl);
-		const interactiveLogin = cloudflareAuthNeedsTerminal(args);
-		if (!opts.capture || interactiveLogin) childEnv.WRANGLER_LOG = "none";
-		if (opts.env) Object.assign(childEnv, opts.env);
-		const result = spawnSync(command, [...prefix, ...args], {
-			cwd: root,
-			stdio: interactiveLogin ? "inherit" : opts.input === void 0 ? [
-				"ignore",
-				"pipe",
-				"pipe"
-			] : [
-				"pipe",
-				"pipe",
-				"pipe"
-			],
-			input: opts.input,
-			encoding: "utf-8",
-			env: childEnv,
-			shell: false,
-			windowsHide: true
-		});
-		return {
-			status: typeof result.status === "number" ? result.status : 1,
-			stdout: result.stdout ?? "",
-			stderr: result.stderr ?? "",
-			signal: result.signal ?? null,
-			error: result.error ? result.error.message : null
-		};
-	};
+	const runner = createCloudflareProcessRunner({
+		root,
+		accountId,
+		apiBaseUrl,
+		env: () => deployChildEnv(accountId, apiBaseUrl)
+	});
+	return (operation, opts) => runner(operation, opts);
 }
 /** Retry an existing-Worker read only when a fresh identity check proves the session is gone. */
 async function prepareExistingCloudflareDeployWithAuth(options, beforeRun) {
@@ -6768,18 +7125,17 @@ async function prepareExistingCloudflareDeployWithAuth(options, beforeRun) {
 	} catch (error) {
 		if (!(error instanceof CloudflareWorkerInspectionError)) throw error;
 		if (!beforeRun()) throw new CloudflareAuthenticationError("The Cloudflare uploader changed during Worker verification.", "uploader-changed");
-		const whoamiArgs = [...existingWranglerConfigArgs(options.configPath), "--env="];
-		const identity = await options.runWrangler([
-			"whoami",
-			"--json",
-			...whoamiArgs
-		], { capture: true });
-		const session = isCleanWranglerExit(identity) ? parseCloudflareAuthSession(identity.stdout) : null;
+		const configPath = existsSync(options.configPath) ? options.configPath : void 0;
+		const identity = await options.runWrangler({
+			type: "auth.whoami",
+			configPath
+		}, { capture: true });
+		const session = isCleanWranglerExit(identity) ? parseCloudflareAuthSession(identity.data) : null;
 		const wrongAccount = session !== null && session.accounts.length > 0 && !session.accounts.some((account) => account.id === options.accountId);
 		if (session && !wrongAccount) throw error;
 		let loggedOut = false;
 		try {
-			loggedOut = JSON.parse(identity.stdout).loggedIn === false;
+			loggedOut = identity.data?.loggedIn === false;
 		} catch {}
 		if (!(loggedOut || wrongAccount || /authentication is required|not authenticated|no api token|invalid.*token|expired.*token|unauthorized/i.test(identity.stderr)) || identity.signal || identity.error) throw new Error("Could not verify the Cloudflare session after the Worker check failed. Run `void cloudflare status` and retry.");
 		const overrides = cloudflareCredentialOverrides();
@@ -6790,8 +7146,8 @@ async function prepareExistingCloudflareDeployWithAuth(options, beforeRun) {
 			forceLogin: true,
 			requireAccounts: true,
 			beforeRun,
-			runWrangler: (args, capture) => options.runWrangler([...args], { capture }),
-			whoamiArgs
+			runWrangler: (operation, capture) => options.runWrangler(operation, { capture }),
+			configPath
 		})).accounts.some((account) => account.id === options.accountId)) throw new Error(`The signed-in Cloudflare user cannot access account ${options.accountId}. Sign in with a user who can access it, then retry.`);
 		if (!beforeRun()) throw new CloudflareAuthenticationError("The Cloudflare uploader changed during sign-in.", "uploader-changed");
 		return await prepareExistingCloudflareDeploy(options);
@@ -6801,8 +7157,8 @@ async function chooseCloudflareDeployAccount(options) {
 	const accounts = (await ensureCloudflareAuthentication({
 		beforeRun: options.beforeWranglerRun,
 		requireAccounts: true,
-		runWrangler: (args, capture) => options.runWrangler([...args], { capture }),
-		whoamiArgs: [...existingWranglerConfigArgs(options.configPath), "--env="]
+		runWrangler: (operation, capture) => options.runWrangler(operation, { capture }),
+		configPath: existsSync(options.configPath) ? options.configPath : void 0
 	})).accounts;
 	let account = accounts[0];
 	if (accounts.length > 1) {
@@ -6848,14 +7204,10 @@ function isWranglerNonInteractiveOrCI() {
 async function runWranglerAuthToken(runWrangler, configPath) {
 	let result;
 	try {
-		result = await Promise.resolve(runWrangler([
-			"auth",
-			"token",
-			"--json",
-			"-c",
-			configPath,
-			"--env="
-		], {
+		result = await Promise.resolve(runWrangler({
+			type: "auth.token",
+			configPath
+		}, {
 			capture: true,
 			env: { WRANGLER_WRITE_LOGS: "false" }
 		}));
@@ -6863,15 +7215,7 @@ async function runWranglerAuthToken(runWrangler, configPath) {
 		return null;
 	}
 	if (!isCleanWranglerExit(result)) return null;
-	const start = result.stdout.indexOf("{");
-	const end = result.stdout.lastIndexOf("}");
-	if (start === -1 || end <= start) return null;
-	let parsed;
-	try {
-		parsed = JSON.parse(result.stdout.slice(start, end + 1));
-	} catch {
-		return null;
-	}
+	const parsed = result.data;
 	const type = parsed?.type;
 	const token = parsed?.token;
 	return (type === "oauth" || type === "api_token") && typeof token === "string" && token.length > 0 ? token : null;
@@ -6921,11 +7265,7 @@ async function runCloudflareEmailStep(input) {
 		existingAddresses: rootConfig.addresses,
 		existingVars: rootConfig.vars && typeof rootConfig.vars === "object" && !Array.isArray(rootConfig.vars) ? rootConfig.vars : void 0,
 		configConflicts: findEmailConfigConflicts(rootConfig),
-		wranglerArgs: [
-			"-c",
-			input.configPath,
-			"--env="
-		],
+		configPath: input.configPath,
 		apiBaseUrl: input.apiBaseUrl,
 		runWrangler: input.runWrangler,
 		getSessionBearer: () => runWranglerAuthToken(input.runWrangler, input.configPath),
@@ -7086,14 +7426,12 @@ async function ensureCloudflareAuthSecret(options) {
 	beforeRun();
 	let put;
 	try {
-		put = await Promise.resolve(options.runWrangler([
-			"secret",
-			"put",
-			BETTER_AUTH_SECRET_NAME,
-			"-c",
-			options.configPath,
-			"--env="
-		], {
+		put = await Promise.resolve(options.runWrangler({
+			type: "secret.put",
+			name: BETTER_AUTH_SECRET_NAME,
+			configPath: options.configPath,
+			workerName: options.workerName
+		}, {
 			capture: true,
 			input: `${secret}\n`
 		}));
@@ -7120,13 +7458,23 @@ async function prepareCloudflareDeploySource(root, options, voidConfig) {
 		].join("\n"));
 		return null;
 	}
-	const classification = classifyCloudflareDeployApp(root, voidConfig, options);
+	let application;
+	try {
+		application = analyzeApplicationSync(root, {
+			config: voidConfig,
+			environment: "prod"
+		});
+	} catch (error) {
+		log.error(`deploy: ${getErrorMessage(error)}`);
+		return null;
+	}
+	const classification = classifyCloudflareDeployApp(root, voidConfig, options, application);
 	if (!classification.supported) {
 		log.error(classification.reason);
 		return null;
 	}
 	const configPath = discoverRootWranglerConfig(root);
-	const facts = await computeDesiredCloudflareResources(root, voidConfig, configPath);
+	const facts = await computeDesiredCloudflareResources(root, voidConfig, configPath, application);
 	const { desired, dialect, migrations: preBuildMigrations, migrationsDir } = facts;
 	if (dialect !== "sqlite" && preBuildMigrations.length > 0 && !process.env.DATABASE_URL) {
 		log.error([
@@ -7154,51 +7502,35 @@ async function applyAndVerifyRemoteD1Migrations(d1MigrateToken, configPath, runW
 	if (d1MigrateToken) {
 		log.step("Applying D1 migrations...");
 		if (!assertUploaderStillPinned()) return false;
-		const migrate = await Promise.resolve(runWrangler([
-			"d1",
-			"migrations",
-			"apply",
-			d1MigrateToken,
-			"--remote",
-			"-c",
-			configPath,
-			"--env="
-		], { capture: false }));
+		const migrate = await Promise.resolve(runWrangler({
+			type: "d1.migrations.apply",
+			database: d1MigrateToken,
+			configPath
+		}, { capture: false }));
 		if (!isCleanWranglerExit(migrate)) {
 			log.error(`deploy: remote D1 migrations failed for "${d1MigrateToken}" (exit ${String(migrate.status)}). Fix the migration and rerun. Note: D1 always enforces foreign_keys=ON — a Drizzle table-rebuild using PRAGMA foreign_keys=OFF must use PRAGMA defer_foreign_keys instead.`);
 			return false;
 		}
 		if (!assertUploaderStillPinned()) return false;
-		const migrateList = await Promise.resolve(runWrangler([
-			"d1",
-			"migrations",
-			"list",
-			d1MigrateToken,
-			"--remote",
-			"-c",
-			configPath,
-			"--env="
-		], { capture: true }));
+		const migrateList = await Promise.resolve(runWrangler({
+			type: "d1.migrations.list",
+			database: d1MigrateToken,
+			configPath
+		}, { capture: true }));
 		if (!isCleanWranglerExit(migrateList)) {
 			log.error(`deploy: could not verify the remote migration state for "${d1MigrateToken}" (\`d1 migrations list\` exit ${String(migrateList.status)}). Refusing to deploy against an unverified schema — rerun once wrangler can reach your account.`);
 			return false;
 		}
-		if (migrateList.stdout.includes("Migrations to be applied:")) {
-			log.error([
-				`deploy: remote D1 still has UNAPPLIED migrations for "${d1MigrateToken}" after apply.`,
-				"`wrangler d1 migrations apply` exits 0 even when its confirmation is declined, so",
-				"the schema may be un-migrated while the code that needs it is about to deploy.",
-				"Re-run and confirm the migration (or apply it non-interactively), then rerun."
-			].join("\n"));
+		const migrationState = migrateList.data;
+		if (Array.isArray(migrationState?.pending) && migrationState.pending.length > 0) {
+			log.error([`deploy: remote D1 still has UNAPPLIED migrations for "${d1MigrateToken}" after apply.`, "The schema is not current for this deployment. Fix or apply the pending migrations, then retry."].join("\n"));
 			return false;
 		}
-		if (!migrateList.stdout.includes("No migrations to apply!")) {
+		if (!Array.isArray(migrationState?.pending) || !migrationState.pending.every((name) => typeof name === "string")) {
 			log.error([
 				`deploy: could not confirm the remote migration state for "${d1MigrateToken}".`,
-				"`wrangler d1 migrations list` printed neither the \"no migrations to apply\" nor the",
-				"\"migrations to be applied\" marker (WRANGLER_LOG is pinned so they are never",
-				"suppressed) — refusing to deploy against an unverified schema. Rerun once wrangler",
-				"can reach your account."
+				"Cloudflare returned an invalid pending migration set. Refusing to deploy against an unverified schema.",
+				"Retry once the database migration state can be read."
 			].join("\n"));
 			return false;
 		}
@@ -7334,6 +7666,12 @@ async function runCloudflareDeploy(root, options, cliLog, deps = {}) {
 	if (!source) return exit(1);
 	const { configPath, desired, reasons, authEnabled, dialect, migrationsDir, migrations: preBuildMigrations, needsAI, aiBindingName, needsSandbox, needsLive, expectedCrons, needsEmail, emailHandlers } = source;
 	let rootConfig = parseRootWranglerConfig(configPath);
+	if (needsSandbox) try {
+		assertSandboxNamespaceConfig(rootConfig, resolveSandboxConfig(voidConfig, root));
+	} catch (error) {
+		log.error(`deploy: ${getErrorMessage(error)}`);
+		return exit(1);
+	}
 	let apiBaseUrl;
 	try {
 		apiBaseUrl = resolveDeployTransport(root, rootConfig);
@@ -7449,8 +7787,8 @@ async function runCloudflareDeploy(root, options, cliLog, deps = {}) {
 		await ensureCloudflareAuthentication({
 			acceptApiToken: true,
 			beforeRun: assertUploaderStillPinned,
-			runWrangler: (args, capture) => runWrangler([...args], { capture }),
-			whoamiArgs: [...existingWranglerConfigArgs(configPath), "--env="]
+			runWrangler: (operation, capture) => runWrangler(operation, { capture }),
+			configPath: existsSync(configPath) ? configPath : void 0
 		});
 	} catch (error) {
 		if (error instanceof CloudflareAuthenticationError && error.reason === "uploader-changed") return exit(1);
@@ -7509,13 +7847,10 @@ async function runCloudflareDeploy(root, options, cliLog, deps = {}) {
 	}
 	if (needsSandbox) {
 		if (!assertUploaderStillPinned()) return exit(1);
-		if (!isCleanWranglerExit(await Promise.resolve(runWrangler([
-			"containers",
-			"list",
-			"--json",
-			...existingWranglerConfigArgs(configPath),
-			"--env="
-		], { capture: true })))) {
+		if (!isCleanWranglerExit(await Promise.resolve(runWrangler({
+			type: "containers.list",
+			configPath: existsSync(configPath) ? configPath : void 0
+		}, { capture: true })))) {
 			log.error(formatCloudflareSandboxUnavailable({ preflight: true }));
 			return exit(1);
 		}
@@ -7594,19 +7929,16 @@ async function runCloudflareDeploy(root, options, cliLog, deps = {}) {
 		}
 		const absentQueues = [];
 		for (const name of desired.queues) {
-			const info = await Promise.resolve(runWrangler([
-				"queues",
-				"info",
+			const info = await Promise.resolve(runWrangler({
+				type: "queues.info",
 				name,
-				"-c",
-				configPath,
-				"--env="
-			], { capture: true }));
+				configPath
+			}, { capture: true }));
 			if (provisionModule.isQueueConfirmedAbsent(info, name)) absentQueues.push(name);
 		}
 		if (absentQueues.length > 0) await provisionAndVerify();
 	}
-	const frameworkQueues = detectedFramework ? scanQueuesSync(root, resolveProjectPaths(root, voidConfig).queuesDir) : [];
+	const frameworkQueues = detectedFramework ? source.analysis.queues : [];
 	writeProvisionedWranglerConfig(root, {
 		name: workerName,
 		accountId,
@@ -7632,12 +7964,15 @@ async function runCloudflareDeploy(root, options, cliLog, deps = {}) {
 	const expectedContainers = reconstructExpectedContainers(voidConfig, root, preBuildRootConfig, needsSandbox);
 	const expectedDurableObjectState = reconstructExpectedDurableObjectState(voidConfig, root, preBuildRootConfig, {
 		needsSandbox,
-		needsLive
+		needsLive,
+		analysis: source.analysis
 	});
 	removeDeployPointer(root);
 	const buildChildEnv = scrubManagedDeployBuildMarkers(scrubWranglerAuthCredentials(deployChildEnv(accountId, apiBaseUrl)));
 	requireProvisionModule().deleteEnvVarCaseAware(buildChildEnv, CLOUDFLARE_DEPLOY_BUILD_ENV);
 	buildChildEnv[CLOUDFLARE_DEPLOY_BUILD_ENV] = "1";
+	requireProvisionModule().deleteEnvVarCaseAware(buildChildEnv, CLOUDFLARE_PRESERVE_BINDINGS_BUILD_ENV);
+	if (existingWorker) buildChildEnv[CLOUDFLARE_PRESERVE_BINDINGS_BUILD_ENV] = "1";
 	requireProvisionModule().deleteEnvVarCaseAware(buildChildEnv, "NODE_ENV");
 	buildChildEnv.NODE_ENV = "production";
 	const runBuild = deps.runBuild ?? ((env) => {
@@ -7656,7 +7991,7 @@ async function runCloudflareDeploy(root, options, cliLog, deps = {}) {
 	}
 	log.step("Preparing deployment...");
 	if (detectedFramework && frameworkPreset) try {
-		await (deps.prepareFrameworkArtifact ?? prepareCloudflareFrameworkArtifact)(root, configPath, accountId, workerName, voidConfig, detectedFramework, frameworkPreset, schemaFacts.requiredKeys, needsAI ? { binding: aiBindingName } : void 0);
+		await (deps.prepareFrameworkArtifact ?? prepareCloudflareFrameworkArtifact)(root, configPath, accountId, workerName, voidConfig, detectedFramework, frameworkPreset, schemaFacts.requiredKeys, needsAI ? { binding: aiBindingName } : void 0, existingWorker !== null);
 	} catch (error) {
 		log.error(`deploy: could not prepare ${detectedFramework.name} for Cloudflare — ${getErrorMessage(error)}`);
 		return exit(1);
@@ -7907,6 +8242,8 @@ async function runCloudflareDeploy(root, options, cliLog, deps = {}) {
 		workerName,
 		configPath: generatedConfigPath,
 		preserveTriggers: existingWorker !== null,
+		requireVersionMetadata: existingWorker === null || readVersionMetadataBinding(parseRootWranglerConfig(generatedConfigPath)) !== void 0,
+		requirePreviewForReadiness: existingWorker !== null && readVersionMetadataBinding(parseRootWranglerConfig(generatedConfigPath)) === void 0,
 		expectedPreviousVersionId: existingWorker?.versionId,
 		trustedInheritanceVersionIds: existingWorker ? candidateReceipt?.parentVersionId === existingWorker.versionId ? candidateReceipt.versionIds : void 0 : initialCloudflareCandidate?.versionIds,
 		validateUploadedVersion: existingWorker ? async (versionId) => {
@@ -7982,10 +8319,6 @@ function discoverRootWranglerConfig(root) {
 	if (existsSync(join(root, "wrangler.toml"))) throw new Error("Found wrangler.toml. Direct Cloudflare deployment needs one root wrangler.jsonc or wrangler.json with the same settings. Convert the config before deploying.");
 	return materializeCloudflareConfig(root);
 }
-/** Avoid making Wrangler open a config path that Void has not created yet. */
-function existingWranglerConfigArgs(configPath) {
-	return existsSync(configPath) ? ["-c", configPath] : [];
-}
 async function reportCloudflareActivationFailure(cliLog, message) {
 	cliLog.error("cloudflare_deploy_failed", new Error(message));
 	await cliLog.close().catch(() => {});
@@ -8018,7 +8351,9 @@ function formatCloudflareActivationError(result) {
 			if (result.rollback === "failed") return "deploy: the verified Wrangler uploader changed after version activation, and automatic traffic restoration failed. Inspect `void project status` immediately.";
 			if (result.rollback === "unsafe") return "deploy: the verified Wrangler uploader changed after version activation. Void did not invoke the changed binary to restore traffic; reinstall Wrangler from a trusted lockfile and inspect `void project status` immediately.";
 			return "deploy: the verified Wrangler uploader changed before version activation.";
-		case "status-failed": return `deploy: could not snapshot the current Cloudflare deployment${status}; no version was uploaded.`;
+		case "status-failed":
+			if (result.versionId) return `deploy: Worker version ${result.versionId} was published, but current deployment status could not be verified${status}. Inspect \`void project status\` before retrying.`;
+			return `deploy: could not snapshot the current Cloudflare deployment${status}; no version was uploaded.`;
 		case "deployment-changed": return result.triggerRepair === "succeeded" ? `deploy: another Cloudflare operation superseded this deployment. Void restored triggers for the active version ${result.activeVersionId ?? "(unknown)"}; retry from fresh deployment status.` : `deploy: another Cloudflare operation superseded this deployment, but its trigger state could not be verified. Inspect the active Worker version ${result.activeVersionId ?? "(unknown)"} immediately.`;
 		case "inheritance-source-unavailable": return "deploy: could not verify which Worker Version would supply inherited secrets; production traffic is unchanged.";
 		case "inheritance-source-changed": return [
@@ -8034,16 +8369,18 @@ function formatCloudflareActivationError(result) {
 		].join("\n");
 		case "upload-failed": return `deploy: Cloudflare Worker Version upload failed${status}; production traffic is unchanged.${cloudflareCode}${diagnostic}`;
 		case "upload-output-invalid": return "deploy: Wrangler uploaded a version but did not report its version id; production traffic is unchanged.";
-		case "preview-unavailable": return [
-			"deploy: the uploaded Worker Version has no preview URL, so Void cannot verify readiness.",
-			"Set CLOUDFLARE_WORKERS_SUBDOMAIN to your account subdomain (for example \"my-team\")",
-			"and retry. Void caches it after a successful workers.dev deployment; production traffic is unchanged."
-		].join("\n");
+		case "preview-unavailable":
+			if (result.diagnostic) return `deploy: candidate readiness cannot be verified.\n\n${result.diagnostic}`;
+			return [
+				"deploy: the uploaded Worker Version has no preview URL, so Void cannot verify readiness.",
+				"Set CLOUDFLARE_WORKERS_SUBDOMAIN to your account subdomain (for example \"my-team\")",
+				"and retry. Void caches it after a successful workers.dev deployment; production traffic is unchanged."
+			].join("\n");
 		case "readiness-staging-failed": return `deploy: Cloudflare could not stage the uploaded Worker Version at zero-percent traffic${status}; production traffic is unchanged.${cloudflareCode}${diagnostic}${result.cloudflareErrorCode === 10210 && /Durable Object migration/i.test(result.diagnostic ?? "") ? "\n\nReview the Durable Object migration, then run `void deploy --platform cloudflare --atomic`. For future deploys, set deploy.cloudflare.mode to \"atomic\" in void.config.ts." : ""}`;
 		case "atomic-failed": return `deploy: Cloudflare could not publish the Worker atomically${status}; inspect production status before retrying.${cloudflareCode}${diagnostic}`;
 		case "atomic-output-invalid": return "deploy: Cloudflare published atomically but did not report a version id or URL. Inspect `void project status` immediately.";
 		case "atomic-readiness-failed":
-		case "atomic-readiness-access-denied": return "deploy: the atomic Worker deployment is live, but /__void/ready could not be verified. Inspect `void project status` and Worker logs immediately.";
+		case "atomic-readiness-access-denied": return `deploy: the atomic Worker deployment is live, but /__void/ready could not be verified. Inspect \`void project status\` and Worker logs immediately.${diagnostic}`;
 		case "readiness-failed": return ["deploy: the uploaded Worker Version did not pass /__void/ready.", formatCloudflareReadinessRestoration(result)].join("\n");
 		case "readiness-access-denied": return [
 			"deploy: Cloudflare Access blocked the uploaded Worker Version readiness probe.",
@@ -8058,7 +8395,7 @@ function formatCloudflareActivationError(result) {
 			"deploy: the first Worker deployment did not pass /__void/ready.",
 			"Cloudflare requires this bootstrap to be non-versioned, so the new Worker is already active;",
 			"inspect its logs and `void project status` before retrying."
-		].join("\n");
+		].join("\n") + diagnostic;
 		case "bootstrap-readiness-access-denied": return [
 			"deploy: Cloudflare Access blocked the first Worker deployment readiness probe.",
 			"For CI, set CF_ACCESS_CLIENT_ID and CF_ACCESS_CLIENT_SECRET to an admitted service token;",
@@ -8068,7 +8405,7 @@ function formatCloudflareActivationError(result) {
 			"Worker is already active behind Access."
 		].join("\n");
 		case "activation-failed": return `deploy: the ready Worker Version could not be activated${status}; production traffic is unchanged.`;
-		case "triggers-failed": return `deploy: the Worker activated, but Cloudflare trigger synchronization failed${status}. ${result.rollback === "succeeded" ? "Traffic was restored to the previous version." : result.rollback === "unavailable" ? result.previousVersionId === null ? "This was the first deployment, so no previous version was available to restore." : "Traffic was restored to the previous version, but its trigger configuration was unavailable. Inspect its routes, schedules, queues, and workflows in Cloudflare before retrying." : "Automatic traffic restoration failed; inspect `void project status` immediately."}`;
+		case "triggers-failed": return `deploy: the Worker activated, but Cloudflare trigger synchronization failed${status}. ${result.rollback === "succeeded" ? "Traffic was restored to the previous version." : result.rollback === "unavailable" ? result.previousVersionId === null ? "This was the first deployment, so no previous version was available to restore." : "Traffic or trigger restoration could not be completed. Inspect its routes, schedules, queues, and workflows in Cloudflare before retrying." : "Automatic traffic restoration failed; inspect `void project status` immediately."}`;
 	}
 }
 function formatCloudflareReadinessRestoration(result) {
@@ -8089,29 +8426,36 @@ function cloudflareWorkerReadinessHeaders() {
 	});
 }
 /** Build the trusted Wrangler pointer for a framework that emits Worker files directly. */
-async function prepareCloudflareFrameworkArtifact(root, configPath, accountId, workerName, voidConfig, framework, preset, requiredSecretNames = [], ai) {
+async function prepareCloudflareFrameworkArtifact(root, configPath, accountId, workerName, voidConfig, framework, preset, requiredSecretNames = [], ai, preserveBindings = false) {
 	const workerMain = join(root, preset.workerDir, preset.workerMain);
 	const assetsDirectory = join(root, preset.assetsDir);
 	if (!existsSync(workerMain)) throw new Error(`framework ${framework.name} did not emit its Worker entry at ${preset.workerDir}/${preset.workerMain}`);
 	if (!existsSync(assetsDirectory)) throw new Error(`framework ${framework.name} did not emit its asset directory at ${preset.assetsDir}`);
-	const paths = resolveProjectPaths(root, voidConfig);
-	const crons = scanJobsSync(root, paths.cronsDir);
-	const queues = scanQueuesSync(root, paths.queuesDir);
+	const analysis = analyzeApplicationSync(root, {
+		config: voidConfig,
+		environment: "prod"
+	});
+	const crons = analysis.jobs;
+	const queues = analysis.queues;
 	const revalidate = collectRevalidate(voidConfig, null);
+	const rootConfig = parseRootWranglerConfig(configPath);
+	const versionMetadataBinding = selectNativeVersionMetadataBinding(rootConfig, {
+		nativeBuild: true,
+		preserveBindings
+	});
 	await generateDeployWrapperIfNeeded(root, join(root, preset.workerDir), preset.workerMain, {
-		auth: null,
 		crons,
 		queues,
 		hasMigrations: false,
-		migrationDialect: getDatabaseDialect(voidConfig),
+		migrationDialect: analysis.dialect,
 		readiness: true,
+		versionMetadataBinding,
 		...hasRevalidate(revalidate) && { isr: {
 			revalidate,
 			queryAllowlist: voidConfig.routing?.revalidateQueryAllowlist
 		} }
 	});
 	if (preset.cloudflareArtifact === "vite-plugin") return;
-	const rootConfig = parseRootWranglerConfig(configPath);
 	writeCloudflareFrameworkDeployConfig({
 		configPath,
 		deployPointerPath: deployPointerPath(root),
@@ -8123,6 +8467,7 @@ async function prepareCloudflareFrameworkArtifact(root, configPath, accountId, w
 		compatibilityFlags: preset.cloudflareCompatibilityFlags,
 		crons: [...new Set(crons.flatMap((job) => job.crons))],
 		requiredSecrets: requiredSecretNames,
+		versionMetadataBinding,
 		...ai ? { ai: {
 			...ai,
 			gateway: voidConfig.ai?.gateway
@@ -8162,23 +8507,14 @@ function resolveCloudflareStaticPreset(root, voidConfig, options) {
 */
 async function resolveCloudflareVoidStaticPreset(root, voidConfig) {
 	if (voidConfig.output !== "static") return null;
-	const paths = resolveProjectPaths(root, voidConfig);
-	if (!existsSync(paths.pagesDir) || validateSsrEntry(root, paths) !== null) return null;
-	const routeScan = await scanRoutes(root, {
-		output: voidConfig.output,
-		paths,
+	const analysis = await analyzeApplication(root, {
+		config: voidConfig,
 		environment: "prod"
 	});
-	const pageScan = routeScan.pages.pages.length > 0 ? routeScan.pages : await scanPages(root, {
-		output: voidConfig.output,
-		paths
-	});
+	const { paths, authEnabled, bindings, scan: routeScan } = analysis;
+	if (!existsSync(paths.pagesDir) || validateSsrEntry(root, paths) !== null) return null;
+	const pageScan = routeScan.pages;
 	if (pageScan.pages.length === 0 || !pageScan.pages.every((page) => page.shouldPrerender && (page.params.length === 0 && !page.catchAll || page.hasGetPrerenderPaths))) return null;
-	const bindings = inferProjectBindings(root, {
-		paths,
-		environment: "prod"
-	});
-	const authEnabled = bindings.needsAuth || findVoidAuthConfig(root, paths) !== null || voidConfig.auth !== void 0;
 	if (hasNonPageBackend({
 		hasRoutes: routeScan.routes.length > 0,
 		hasMiddleware: routeScan.middleware.length > 0,
@@ -8186,7 +8522,7 @@ async function resolveCloudflareVoidStaticPreset(root, voidConfig) {
 		hasEmail: routeScan.email !== void 0 && hasEmailHandlers(routeScan.email),
 		authEnabled,
 		hasLive: bindings.needsLive === true
-	}) || scanJobsSync(root, paths.cronsDir).length > 0 || scanQueuesSync(root, paths.queuesDir).length > 0) return null;
+	}) || analysis.jobs.length > 0 || analysis.queues.length > 0) return null;
 	return {
 		buildCommand: resolveFullDeployBuildCommand(root, voidConfig.inference?.build).command,
 		outputDir: join(root, "dist", "client"),
@@ -8247,8 +8583,8 @@ async function runCloudflareStaticDeploy(root, options, voidConfig, preset, cliL
 		await ensureCloudflareAuthentication({
 			acceptApiToken: true,
 			beforeRun: uploaderIsPinned,
-			runWrangler: (args, capture) => runWrangler([...args], { capture }),
-			whoamiArgs: [...existingWranglerConfigArgs(configPath), "--env="]
+			runWrangler: (operation, capture) => runWrangler(operation, { capture }),
+			configPath: existsSync(configPath) ? configPath : void 0
 		});
 	} catch (error) {
 		if (error instanceof CloudflareAuthenticationError && error.reason === "uploader-changed") return exit(1);
@@ -8316,12 +8652,6 @@ async function runCloudflareStaticDeploy(root, options, voidConfig, preset, cliL
 	});
 	const entryPath = join(root, ".void", "deploy", "cloudflare", "static-edge.mjs");
 	mkdirSync(dirname(entryPath), { recursive: true });
-	writeFileSync(entryPath, renderCloudflareStaticEntry({
-		runtimeImport: "void/edge",
-		headerRules: manifest.headerRules,
-		redirectRules: manifest.redirectRules,
-		fallbackRules: manifest.fallbackRules
-	}));
 	const workerName = readWranglerTopLevelString(rootConfig, "name") ?? deriveWorkerName(root);
 	const staticConfigPath = join(dirname(entryPath), "wrangler-static.json");
 	writeFileSync(staticConfigPath, `${JSON.stringify(rootConfig, null, 2)}\n`, { mode: 384 });
@@ -8335,6 +8665,22 @@ async function runCloudflareStaticDeploy(root, options, voidConfig, preset, cliL
 		assetConfig: manifest.assetConfig ?? { not_found_handling: "none" }
 	});
 	deduplicateGeneratedCompatibilityFlags(staticConfigPath, configPath);
+	const staticConfig = parseRootWranglerConfig(staticConfigPath);
+	const versionMetadataBinding = selectNativeVersionMetadataBinding(staticConfig, {
+		nativeBuild: true,
+		preserveBindings: existingWorker !== null
+	});
+	if (versionMetadataBinding && staticConfig.version_metadata === void 0) writeFileSync(staticConfigPath, `${JSON.stringify({
+		...staticConfig,
+		version_metadata: { binding: versionMetadataBinding }
+	}, null, 2)}\n`, { mode: 384 });
+	writeFileSync(entryPath, renderCloudflareStaticEntry({
+		runtimeImport: "void/edge",
+		headerRules: manifest.headerRules,
+		redirectRules: manifest.redirectRules,
+		fallbackRules: manifest.fallbackRules,
+		versionMetadataBinding
+	}));
 	if (existingWorker) assertExistingCloudflareConfig(existingWorker, parseRootWranglerConfig(staticConfigPath), true);
 	const stagedAssetsDirectory = join(root, ".void", "deploy", "cloudflare", "assets");
 	stageCloudflareStaticAssets({
@@ -8385,6 +8731,8 @@ async function runCloudflareStaticDeploy(root, options, voidConfig, preset, cliL
 		verifyUploader: cfOutput ? cfUploaderIsPinned : uploaderIsPinned,
 		configPath: staticConfigPath,
 		preserveTriggers: existingWorker !== null,
+		requireVersionMetadata: existingWorker === null || versionMetadataBinding !== void 0,
+		requirePreviewForReadiness: existingWorker !== null && versionMetadataBinding === void 0,
 		expectedPreviousVersionId: existingWorker?.versionId,
 		trustedInheritanceVersionIds: existingWorker ? candidateReceipt?.parentVersionId === existingWorker.versionId ? candidateReceipt.versionIds : void 0 : initialCloudflareCandidate?.versionIds,
 		validateUploadedVersion: existingWorker ? async (versionId) => {
@@ -9142,7 +9490,6 @@ async function runFrameworkDeploy(root, config, client, detected, fwPreset, void
 		mode: "framework",
 		framework: detected.name
 	});
-	const dialect = getDatabaseDialect(voidConfig);
 	const buildCmd = voidConfig.inference?.build ?? formatProjectCommand(root, fwPreset.buildCommand);
 	if (!skipBuild) {
 		log.step(`Building (${buildCmd})...`);
@@ -9172,15 +9519,12 @@ async function runFrameworkDeploy(root, config, client, detected, fwPreset, void
 		log.error(`deploy: Worker output '${fwPreset.workerDir}' not found. Run '${buildCmd}' first.`);
 		process.exit(1);
 	}
-	const inferenceOptions = voidConfig.inference?.bindings ? { bindings: voidConfig.inference.bindings } : void 0;
-	const paths = resolveProjectPaths(root, voidConfig);
-	const scanDirs = voidConfig.inference?.scanDirs ?? FRAMEWORK_SCAN_DIRS;
-	const bindings = inferProjectBindings(root, {
-		...inferenceOptions,
-		paths,
+	const analysis = analyzeApplicationSync(root, {
+		config: voidConfig,
 		environment: "prod"
-	}, scanDirs);
-	if (bindings.needsAuth || findVoidAuthConfig(root, paths) !== null || voidConfig.auth !== void 0) {
+	});
+	const { paths, bindings, authEnabled, dialect } = analysis;
+	if (authEnabled) {
 		log.error("deploy: Void-managed Better Auth is only supported in Void apps. Use Better Auth's official integration for this framework instead.");
 		process.exit(1);
 	}
@@ -9190,7 +9534,7 @@ async function runFrameworkDeploy(root, config, client, detected, fwPreset, void
 	}
 	const migrationsDir = paths.migrationsDir;
 	assertDeploySchemaDriftFree(root, dialect);
-	const rawMigrations = collectMigrations(migrationsDir);
+	const rawMigrations = analysis.migrations;
 	let validatedMigrations;
 	try {
 		assertJournalCoherence(migrationsDir, rawMigrations);
@@ -9205,7 +9549,7 @@ async function runFrameworkDeploy(root, config, client, detected, fwPreset, void
 		log.error(getErrorMessage(err));
 		process.exit(1);
 	}
-	if (dialect !== "sqlite" && (bindings.needsD1 || rawMigrations.length > 0)) {
+	if (dialect !== "sqlite" && analysis.needsDatabase) {
 		let resources = null;
 		try {
 			resources = await client.getResources(config.projectId);
@@ -9229,11 +9573,10 @@ async function runFrameworkDeploy(root, config, client, detected, fwPreset, void
 			}
 		}
 	}
-	const rawJobs = scanJobsSync(root, paths.cronsDir);
-	const rawQueues = scanQueuesSync(root, paths.queuesDir);
+	const rawJobs = analysis.jobs;
+	const rawQueues = analysis.queues;
 	const originalEntry = join(workerDir, fwPreset.workerMain);
 	const wrapperFeatures = {
-		auth: null,
 		crons: rawJobs,
 		queues: rawQueues,
 		hasMigrations: validatedMigrations != null && validatedMigrations.length > 0,
@@ -9289,7 +9632,7 @@ async function runFrameworkDeploy(root, config, client, detected, fwPreset, void
 	const packageStartedAt = Date.now();
 	const neededSet = skipped > 0 ? new Set(needed) : null;
 	const packageOptions = {
-		bindingNames: resolveBindingNames(voidConfig.inference?.bindings),
+		bindingNames: analysis.bindingNames,
 		workerMain: actualWorkerMain,
 		compatibilityDate: wranglerCompat?.compatibilityDate,
 		compatibilityFlags: wranglerCompat?.compatibilityFlags,
@@ -9396,20 +9739,12 @@ async function runFullDeploy(root, config, client, voidConfig, fwPreset, skipBui
 		if (result.paths.length === 0) log.info("No pages to prerender");
 		else if (result.failed.length > 0) voidWarn(`${result.failed.length} page(s) failed to prerender`);
 	}
-	const paths = resolveProjectPaths(root, deployConfig);
-	const dialect = getDatabaseDialect(deployConfig);
-	const deployScanDirs = deployConfig.inference?.scanDirs ?? (isFrameworkMode ? FRAMEWORK_SCAN_DIRS : void 0);
-	const bindings = inferProjectBindings(root, {
-		paths,
+	const analysis = await analyzeApplication(root, {
+		config: deployConfig,
 		environment: "prod"
-	}, deployScanDirs);
-	if (isSandboxEnabled(deployConfig)) bindings.needsSandbox = true;
-	const authEnabled = bindings.needsAuth || findVoidAuthConfig(root, paths) !== null || deployConfig.auth !== void 0;
-	const effectiveBindings = authEnabled ? {
-		...bindings,
-		needsAuth: true,
-		needsD1: true
-	} : bindings;
+	});
+	const { paths, dialect, bindings, authEnabled, scan: routeScan } = analysis;
+	const effectiveBindings = bindings;
 	if (isFrameworkMode && authEnabled) {
 		log.error("Void-managed Better Auth is only supported in Void apps. Use Better Auth's official integration for this framework instead.");
 		process.exit(1);
@@ -9439,7 +9774,7 @@ async function runFullDeploy(root, config, client, voidConfig, fwPreset, skipBui
 	lintDestinationSplats(fallbackRules, "fallbacks (post-asset)");
 	const migrationsDir = paths.migrationsDir;
 	assertDeploySchemaDriftFree(root, dialect);
-	const rawMigrations = collectMigrations(migrationsDir);
+	const rawMigrations = analysis.migrations;
 	let validatedMigrations;
 	try {
 		assertJournalCoherence(migrationsDir, rawMigrations);
@@ -9454,7 +9789,7 @@ async function runFullDeploy(root, config, client, voidConfig, fwPreset, skipBui
 		log.error(getErrorMessage(err));
 		process.exit(1);
 	}
-	if (dialect !== "sqlite" && (effectiveBindings.needsD1 || rawMigrations.length > 0)) {
+	if (dialect !== "sqlite" && analysis.needsDatabase) {
 		let resources = null;
 		try {
 			resources = await client.getResources(config.projectId);
@@ -9478,18 +9813,13 @@ async function runFullDeploy(root, config, client, voidConfig, fwPreset, skipBui
 			}
 		}
 	}
-	const rawJobs = scanJobsSync(root, paths.cronsDir);
-	const rawQueues = scanQueuesSync(root, paths.queuesDir);
+	const rawJobs = analysis.jobs;
+	const rawQueues = analysis.queues;
 	const schedules = rawJobs.flatMap((job) => job.crons.map((cron) => ({
 		name: job.name,
 		cron
 	})));
-	const routeScan = await scanRoutes(root, {
-		output: deployConfig.output,
-		paths,
-		environment: "prod"
-	});
-	const webSockets = routeScan.websockets ?? scanWebSocketRoutesSync(root, paths, "prod");
+	const webSockets = analysis.websockets;
 	const liveConfig = await resolveDeployLiveBindingConfig(root, client, config.projectId, {
 		isFrameworkMode,
 		needsLive: effectiveBindings.needsLive,
@@ -9511,10 +9841,7 @@ async function runFullDeploy(root, config, client, voidConfig, fwPreset, skipBui
 	const hasWebSockets = webSockets.length > 0;
 	const ssrEntry = isFrameworkMode ? null : validateSsrEntry(root, paths);
 	const isSsr = isFrameworkMode ? true : Boolean(ssrEntry) || hasPages && deployConfig.output !== "static";
-	const pageScan = existsSync(paths.pagesDir) ? routeScan.pages.pages.length > 0 ? routeScan.pages : await scanPages(root, {
-		output: deployConfig.output,
-		paths
-	}) : null;
+	const pageScan = hasPages ? routeScan.pages : null;
 	const revalidate = collectRevalidate(deployConfig, pageScan);
 	if (deployConfig.output === "static" && pageScan && !isSsr) {
 		const allPrerenderable = pageScan.pages.every((p) => p.shouldPrerender && (p.params.length === 0 && !p.catchAll || p.hasGetPrerenderPaths));
@@ -9638,7 +9965,6 @@ async function runFullDeploy(root, config, client, voidConfig, fwPreset, skipBui
 	const workerDir = join(distDir, workerDirName);
 	if (isFrameworkMode) {
 		const wrapperFeatures = {
-			auth: null,
 			crons: rawJobs,
 			queues: rawQueues,
 			hasMigrations: validatedMigrations != null && validatedMigrations.length > 0,
@@ -9909,4 +10235,4 @@ function resolveWorkerDirName(distDir, fwPreset, buildCommand) {
 	throw new Error("deploy: Worker output not found. Expected dist/ssr/ or dist/rsc/.");
 }
 //#endregion
-export { snapshotPassthroughRawFields as $, parseRootWranglerConfig$1 as A, resolveDeploymentPlatform as B, generateDeployWrapperIfNeeded as C, resolveAssetConfig as Ct, hashWranglerUploader as D, hasPrerenderSources as E, resolveCloudflareVoidStaticPreset as F, resolveWorkerDirName as G, resolveFullDeployBuildCommand as H, resolveDeployLiveBindingConfig as I, runDeploy as J, resolveWranglerMigrationPattern as K, resolveDeployTransport as L, promptDeployProjectConfig as M, reconstructExpectedContainers as N, isWranglerNonInteractiveOrCI as O, reconstructExpectedDurableObjectState as P, snapshotPassthroughIdentities as Q, resolveDeployWorkerMain as R, formatCloudflareSandboxUnavailable as S, hasDocumentRoutes as St, hasNonPageBackend as T, resolveStaticBuildCommand as U, resolveDistDir as V, resolveStaticDeployPreset as W, runWranglerAuthToken as X, runStaticDeploy as Y, snapshotBindingIdentities as Z, deriveWorkerName as _, findEmailConfigConflicts as _t, applyDeployEvent as a, warnUnpublishedRouting as at, ensurePreviouslyDeployedLiveBindingConfig as b, renderEmailChecklist as bt, assertMigrationsProduceAuthSchema as c, prerenderPagesNode as ct, assertWranglerUploaderUnchanged as d, collectRevalidate as dt, streamDeployEvents as et, checkWranglerMigrationApplySet as f, hasRevalidate as ft, deployChildEnv as g, createNodeEmailDns as gt, createDeployWranglerRunner as h, applyEmailSetup as ht, DEPLOY_WHOLE_OBJECT_PINNED_FIELDS as i, warnRedundantForceOn3xx as it, prepareCloudflareFrameworkArtifact as j, loadProvisionModule as k, assertNoConfigOverrideInProjectDotenv as l, buildEnv as lt, computeDesiredCloudflareResources as m, SEND_EMAIL_BINDING as mt, DEPLOY_PASSTHROUGH_ASSERT_FIELDS as n, verifyGeneratedDeployConfig as nt, assembleVoidManifest as o, generateQueueResolverSource as ot, compareWranglerMigrationPaths as p, scanDurableObjectModules as pt, runCloudflareDeploy as q, DEPLOY_PASSTHROUGH_EXCLUDE_FIELDS as r, warnIgnoredNotFoundForFramework as rt, assertManagedDurableStateSupported as s, prerenderPages as st, CloudflareAuthSecretError as t, validateAuthMigrationSchema as tt, assertRemoteMigrationsDeployable as u, collectPages as ut, discoverRootWranglerConfig as v, preflightEmail as vt, hasDeploySchemaDrift as w, resolveAssetRoutingPolicy as wt, formatCloudflareActivationError as x, hasApiRoutes as xt, ensureCloudflareAuthSecret as y, renderAddressMap as yt, resolveDeployWranglerCompat as z };
+export { snapshotPassthroughRawFields as $, parseRootWranglerConfig$1 as A, resolveDeploymentPlatform as B, generateDeployWrapperIfNeeded as C, hasDocumentRoutes as Ct, hashWranglerUploader as D, hasPrerenderSources as E, resolveCloudflareVoidStaticPreset as F, resolveWorkerDirName as G, resolveFullDeployBuildCommand as H, resolveDeployLiveBindingConfig as I, runDeploy as J, resolveWranglerMigrationPattern as K, resolveDeployTransport as L, promptDeployProjectConfig as M, reconstructExpectedContainers as N, isWranglerNonInteractiveOrCI as O, reconstructExpectedDurableObjectState as P, snapshotPassthroughIdentities as Q, resolveDeployWorkerMain as R, formatCloudflareSandboxUnavailable as S, hasApiRoutes as St, hasNonPageBackend as T, resolveAssetRoutingPolicy as Tt, resolveStaticBuildCommand as U, resolveDistDir as V, resolveStaticDeployPreset as W, runWranglerAuthToken as X, runStaticDeploy as Y, snapshotBindingIdentities as Z, deriveWorkerName as _, createNodeEmailDns as _t, applyDeployEvent as a, warnUnpublishedRouting as at, ensurePreviouslyDeployedLiveBindingConfig as b, renderAddressMap as bt, assertMigrationsProduceAuthSchema as c, selectNativeVersionMetadataBinding as ct, assertWranglerUploaderUnchanged as d, buildEnv as dt, streamDeployEvents as et, checkWranglerMigrationApplySet as f, collectPages as ft, deployChildEnv as g, applyEmailSetup as gt, createDeployWranglerRunner as h, SEND_EMAIL_BINDING as ht, DEPLOY_WHOLE_OBJECT_PINNED_FIELDS as i, warnRedundantForceOn3xx as it, prepareCloudflareFrameworkArtifact as j, loadProvisionModule as k, assertNoConfigOverrideInProjectDotenv as l, prerenderPages as lt, computeDesiredCloudflareResources as m, hasRevalidate as mt, DEPLOY_PASSTHROUGH_ASSERT_FIELDS as n, verifyGeneratedDeployConfig as nt, assembleVoidManifest as o, generateQueueResolverSource as ot, compareWranglerMigrationPaths as p, collectRevalidate as pt, runCloudflareDeploy as q, DEPLOY_PASSTHROUGH_EXCLUDE_FIELDS as r, warnIgnoredNotFoundForFramework as rt, assertManagedDurableStateSupported as s, CLOUDFLARE_PRESERVE_BINDINGS_BUILD_ENV as st, CloudflareAuthSecretError as t, validateAuthMigrationSchema as tt, assertRemoteMigrationsDeployable as u, prerenderPagesNode as ut, discoverRootWranglerConfig as v, findEmailConfigConflicts as vt, hasDeploySchemaDrift as w, resolveAssetConfig as wt, formatCloudflareActivationError as x, renderEmailChecklist as xt, ensureCloudflareAuthSecret as y, preflightEmail as yt, resolveDeployWranglerCompat as z };