void 0.27.0 → 0.28.0

package/dist/deploy-managed-static-CGswbcay.mjs

@@ -0,0 +1,2277 @@
+import { a as join, c as resolve, n as dirname, r as extname, s as relative } from "./dist-ipQi0Q8y.mjs";
+import { h as needsApplicationDatabase } from "./plugin-inference-DsARdQKE.mjs";
+import { n as readProjectPaths } from "./project-paths-DMvEeSau.mjs";
+import { c as isNodeTarget } from "./config-Bx_1SpnO.mjs";
+import { n as isIdentifier, r as isLiteral } from "./ast-CPGPjb0V.mjs";
+import { p as scanDurableObjectModules, t as analyzeApplicationSync } from "./application-analysis-D72ZQfMZ.mjs";
+import { t as collectMigrations } from "./collect-xjffdCdk.mjs";
+import { t as MagicString } from "./dist-Cegxq8gs.mjs";
+import { i as collectFiles, n as collectRevalidate, s as generateQueueResolverSource, t as collectPages } from "./isr-config-DPjXM8J2.mjs";
+import { n as mergeRoutingRules, t as lintRoutingPhases } from "./headers-Di1FsD3e.mjs";
+import { s as shouldLinkDeployProject, t as attachSelectedPlatform, u as writeProjectConfig } from "./project-rqDnVsJN.mjs";
+import { D as syncWranglerBindings, E as resolveLiveBindingConfig, a as LIVE_MIGRATION_TAG, g as normalizeWranglerCompatibilityFlags, u as ensureWranglerCompat, v as readExistingLiveBindingConfig } from "./wrangler-BYs07Rxy.mjs";
+import { n as buildMigrationPlanBundle } from "./plan-BhLO2p4w.mjs";
+import { l as getTokenSource } from "./auth-B6iOCjKI.mjs";
+import { L as log$1, N as intro, X as text, tt as isCancel } from "./dist-D3m88sjf.mjs";
+import { f as import_picocolors, h as sanitizeTerminalText, m as printSuccess, o as formatCount, p as note, r as createSpinner, u as getErrorMessage } from "./output-FNHKw5Ac.mjs";
+import { t as discoverSchema } from "./discover-D2PGT63u.mjs";
+import { t as findEnvFile } from "./env-types-DS2_y4X8.mjs";
+import { a as buildEnv } from "./version-metadata-DIrqEHQo.mjs";
+import { r as writeDrizzleConfig, t as PLACEHOLDER_DB_URL } from "./config-BEm9vRvS.mjs";
+import { i as validateMigrations, r as listDrizzleArtifacts, t as assertJournalCoherence } from "./validate-CheZGRE7.mjs";
+import { t as formatCloudflareUserMessage } from "./cloudflare-user-output-Q-k0QoNQ.mjs";
+import { c as platformErrorMessage, i as isCliOutdatedError, n as PlatformApiError, o as isHeadersTimeoutError, s as parsePlatformErrorBody } from "./client-DM9Kcf4e.mjs";
+import { a as promptProjectSelection, i as reportProjectCreationWarnings, o as promptProjectSetupAction, r as promptAndCreateProject } from "./create-project-D4APeBwX.mjs";
+import { o as detectPreset, s as formatProjectCommand, u as resolveProjectCommand } from "./cloudflare-process-CeDWJRhj.mjs";
+import { d as formatEnvReport, g as validateProdEnv, u as fetchRemoteSecretNames } from "./env-validation-cE0zcmzO.mjs";
+import { n as drizzleKitBin } from "./yarn-pnp-DLbEFMT0.mjs";
+import { t as MANAGED_DEPLOY_BUILD_ENV } from "./deploy-transport-BiicfoQW.mjs";
+import { createRequire } from "node:module";
+import { copyFileSync, cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { build, parseSync } from "vite";
+import { createDeployArtifact, createDeployUploadPayload } from "@void/deploy-core";
+import { createHash } from "node:crypto";
+import { execSync, spawnSync } from "node:child_process";
+import { getContentType } from "@void/edge";
+import { hash } from "blake3-jit";
+import ignore from "ignore";
+//#region src/cli/pg-bundle-transform.ts
+function nodes(root) {
+	const found = [];
+	const pending = [root];
+	while (pending.length > 0) {
+		const node = pending.pop();
+		found.push(node);
+		for (const value of Object.values(node)) if (Array.isArray(value)) {
+			for (const child of value) if (child && typeof child === "object" && typeof child.type === "string") pending.push(child);
+		} else if (value && typeof value === "object" && typeof value.type === "string") pending.push(value);
+	}
+	return found;
+}
+/** Rewrite the two CommonJS constructs emitted by the PG migration bundle. */
+function transformPgWorkerBundle(code, filename, requireShim) {
+	if (!code.includes("createRequire") && !code.includes("pgpass")) return code;
+	const program = parseSync(filename, code).program;
+	const edits = [];
+	let hasRequireBinding = false;
+	let pgpassCalls = 0;
+	for (const statement of program.body ?? []) {
+		if (statement.type === "ImportDeclaration" && statement.source?.value === "node:module") {
+			const specifiers = statement.specifiers;
+			if (specifiers?.length !== 1 || !isIdentifier(specifiers[0]?.imported) || specifiers[0].imported.name !== "createRequire") throw new Error(`deploy: Unsupported node:module import in PostgreSQL bundle ${filename}.`);
+			edits.push({
+				start: statement.start,
+				end: statement.end,
+				replacement: ""
+			});
+		}
+		if (statement.type === "VariableDeclaration") {
+			const declarations = statement.declarations;
+			if (declarations?.some((declaration) => isIdentifier(declaration.id) && declaration.id.name === "__require")) {
+				if (declarations.length !== 1 || hasRequireBinding) throw new Error(`deploy: Unsupported require binding in PostgreSQL bundle ${filename}.`);
+				hasRequireBinding = true;
+				edits.push({
+					start: statement.start,
+					end: statement.end,
+					replacement: requireShim
+				});
+			}
+		}
+	}
+	for (const node of nodes(program)) {
+		if (node.type !== "CallExpression" || !isIdentifier(node.callee) || node.callee.name !== "__require") continue;
+		const args = node.arguments;
+		if (args?.length !== 1 || !isLiteral(args[0]) || args[0].value !== "pgpass") continue;
+		pgpassCalls++;
+		edits.push({
+			start: node.start,
+			end: node.end,
+			replacement: "__voidPgpassNoop"
+		});
+	}
+	if (code.includes("createRequire") && !hasRequireBinding) throw new Error(`deploy: Could not locate the generated require binding in PostgreSQL bundle ${filename}.`);
+	if (code.includes("pgpass") && pgpassCalls === 0 && code.includes("__require")) throw new Error(`deploy: Could not locate the pgpass require in PostgreSQL bundle ${filename}.`);
+	const ms = new MagicString(code);
+	for (const edit of edits.sort((a, b) => b.start - a.start)) ms.overwrite(edit.start, edit.end, edit.replacement);
+	const transformed = ms.toString();
+	if (transformed.includes("createRequire") || transformed.includes("__require(\"pgpass\")")) throw new Error(`deploy: PostgreSQL bundle ${filename} still contains an unsupported require.`);
+	return pgpassCalls > 0 ? `const __voidPgpassNoop = Object.assign(function pgpass(_connectionInfo, callback) { callback(undefined); }, { warnTo() {} });\n${transformed}` : transformed;
+}
+//#endregion
+//#region src/cli/wrapper.ts
+const BUNDLED_ENTRY_RE = /^index\.(?:m?js|cjs)$/;
+const WRAPPER_MARKER = "// Generated by Void: deployment wrapper.";
+function isGeneratedWrapper(source, originalName) {
+	return source.startsWith(WRAPPER_MARKER) || source.startsWith(`import original from "./${originalName}";\n`);
+}
+function selectBundledEntryFilename(outFiles) {
+	const entryFilename = outFiles.find((file) => BUNDLED_ENTRY_RE.test(file));
+	if (!entryFilename) throw new Error(`deploy: Bundled worker entry not found. Expected index.js, index.mjs, or index.cjs in bundle output. Found: ${outFiles.join(", ") || "(none)"}`);
+	return entryFilename;
+}
+/**
+* Determine whether a wrapper is needed based on the features.
+*/
+function needsWrapper(features) {
+	return features.crons.length > 0 || features.queues.length > 0 || !!features.hasMigrations || !!features.readiness || !!features.isr;
+}
+/**
+* Generate a wrapper entry in-place in the worker directory.
+*
+* - Preserves the original entry (e.g. `index.js` → `__original.js`)
+* - Compiles cron/queue handlers via a small Vite build
+* - Writes a wrapper module as the original entry name that imports
+*   the renamed original + compiled handlers
+*
+* The original worker code is never re-bundled.
+*/
+async function generateWrapper(workerDir, workerMain, root, features) {
+	const renamedName = `__original${extname(workerMain) || ".js"}`;
+	const mainPath = join(workerDir, workerMain);
+	const originalPath = join(workerDir, renamedName);
+	const alreadyWrapped = isGeneratedWrapper(readFileSync(mainPath, "utf8"), renamedName);
+	if (alreadyWrapped && (!existsSync(originalPath) || isGeneratedWrapper(readFileSync(originalPath, "utf8"), renamedName))) throw new Error("deploy: Original framework entry is missing or already wrapped. Rebuild the application before deploying.");
+	let handlerFilename = "__void_handlers.mjs";
+	if (features.crons.length > 0 || features.queues.length > 0) {
+		const tmpDir = join(root, ".void", "handlers");
+		mkdirSync(tmpDir, { recursive: true });
+		const handlersSource = generateHandlersSource(root, features);
+		const handlersEntry = join(tmpDir, "handlers.ts");
+		writeFileSync(handlersEntry, handlersSource);
+		const outDir = join(tmpDir, "out");
+		await build({
+			root: tmpDir,
+			logLevel: "silent",
+			resolve: { alias: [{
+				find: /^void$/,
+				replacement: fileURLToPath(import.meta.resolve("void/handler"))
+			}] },
+			build: {
+				outDir,
+				emptyOutDir: true,
+				lib: {
+					entry: handlersEntry,
+					formats: ["es"],
+					fileName: "__void_handlers"
+				},
+				rollupOptions: { external: [/^cloudflare:/, /^node:/] },
+				minify: false,
+				target: "esnext"
+			}
+		});
+		handlerFilename = readdirSync(outDir).filter((f) => f.startsWith("__void_handlers"))[0] ?? "__void_handlers.mjs";
+		copyFileSync(join(outDir, handlerFilename), join(workerDir, handlerFilename));
+	}
+	let migrations;
+	let migrationPlanBundle;
+	if (features.hasMigrations) {
+		const { collectMigrations } = await import("./collect-NUlJMpLY.mjs");
+		const { buildMigrationPlanBundle } = await import("./plan-CH2G51je.mjs");
+		const migrationsDir = readProjectPaths(root).migrationsDir;
+		migrations = collectMigrations(migrationsDir);
+		migrationPlanBundle = features.migrationDialect === "sqlite" ? buildMigrationPlanBundle(migrations) : void 0;
+		const handlerName = features.migrationDialect === "postgresql" ? "migration-handler-pg" : features.migrationDialect === "mysql" ? "migration-handler-mysql" : "migration-handler";
+		const handlerFilename_ = `${handlerName}.mjs`;
+		let handlerPath = join(import.meta.dirname, "..", "runtime", `${handlerName}.ts`);
+		if (!existsSync(handlerPath)) handlerPath = join(import.meta.dirname, "runtime", handlerFilename_);
+		if (!existsSync(handlerPath)) handlerPath = join(import.meta.dirname, "..", "runtime", handlerFilename_);
+		if (!existsSync(handlerPath)) throw new Error(`Migration handler not found: ${handlerFilename_}. Run "pnpm -C packages/void build" first.`);
+		await bundleMigrationHandler(root, workerDir, handlerPath, features.migrationDialect ?? "sqlite");
+	}
+	if (features.isr) await bundleFrameworkIsr(root, workerDir);
+	const wrapperSource = generateWrapperSource(renamedName, handlerFilename, features, migrations, migrationPlanBundle);
+	const stagedPath = `${mainPath}.${crypto.randomUUID()}.tmp`;
+	try {
+		writeFileSync(stagedPath, wrapperSource);
+		if (!alreadyWrapped) copyFileSync(mainPath, originalPath);
+		renameSync(stagedPath, mainPath);
+	} finally {
+		rmSync(stagedPath, { force: true });
+	}
+}
+async function bundleFrameworkIsr(root, workerDir) {
+	const entry = fileURLToPath(import.meta.resolve("@void/isr/runtime"));
+	const tmpDir = join(root, ".void", "isr");
+	const outDir = join(tmpDir, "out");
+	mkdirSync(tmpDir, { recursive: true });
+	await build({
+		root: tmpDir,
+		logLevel: "silent",
+		ssr: { noExternal: true },
+		build: {
+			outDir,
+			emptyOutDir: true,
+			minify: false,
+			ssr: entry,
+			target: "esnext",
+			rollupOptions: {
+				input: entry,
+				external: [/^cloudflare:/, /^node:/],
+				output: {
+					entryFileNames: "__void_isr.mjs",
+					chunkFileNames: "__void_isr-[hash].mjs"
+				}
+			}
+		}
+	});
+	for (const file of readdirSync(outDir)) copyFileSync(join(outDir, file), join(workerDir, file));
+}
+async function bundleMigrationHandler(root, workerDir, handlerPath, dialect) {
+	const tmpDir = join(root, ".void", "migration-handler");
+	mkdirSync(tmpDir, { recursive: true });
+	const outDir = join(tmpDir, "out");
+	const isPostgresql = dialect === "postgresql";
+	const isMysql = dialect === "mysql";
+	await build({
+		root: tmpDir,
+		logLevel: "silent",
+		resolve: isPostgresql ? {
+			alias: {
+				"pg-cloudflare": resolvePgCloudflareWorkerdEntry(handlerPath),
+				"pg-pool": resolvePgCjsDependency(handlerPath, "pg-pool")
+			},
+			conditions: [
+				"workerd",
+				"worker",
+				"browser",
+				"module",
+				"import",
+				"default"
+			]
+		} : void 0,
+		ssr: isPostgresql ? {
+			noExternal: ["pg", "pg-cloudflare"],
+			resolve: { conditions: [
+				"workerd",
+				"worker",
+				"browser",
+				"module",
+				"import",
+				"default"
+			] }
+		} : isMysql ? { noExternal: ["mysql2"] } : void 0,
+		build: {
+			outDir,
+			emptyOutDir: true,
+			minify: false,
+			ssr: handlerPath,
+			target: "esnext",
+			rollupOptions: {
+				input: handlerPath,
+				external: [
+					/^cloudflare:/,
+					/^node:/,
+					/^pgpass$/
+				],
+				output: {
+					entryFileNames: "__void_migration_handler.mjs",
+					chunkFileNames: "__void_migration_handler-[hash].mjs"
+				}
+			}
+		}
+	});
+	if (isPostgresql) patchPgWorkerBundle(outDir);
+	for (const file of readdirSync(outDir)) copyFileSync(join(outDir, file), join(workerDir, file));
+}
+function patchPgWorkerBundle(outDir) {
+	for (const file of readdirSync(outDir)) {
+		if (!file.endsWith(".mjs") && !file.endsWith(".js")) continue;
+		const path = join(outDir, file);
+		const code = readFileSync(path, "utf-8");
+		const transformed = transformPgWorkerBundle(code, file, pgWorkerRequireShim());
+		if (transformed !== code) writeFileSync(path, transformed);
+	}
+}
+function createPgPackageRequire(fromPath) {
+	const fromRequire = createRequire(fromPath);
+	return createRequire(fromRequire.resolve("pg/package.json"));
+}
+function resolvePgCjsDependency(fromPath, specifier) {
+	return createPgPackageRequire(fromPath).resolve(specifier);
+}
+function resolvePgCloudflareWorkerdEntry(fromPath) {
+	const packageJsonPath = createPgPackageRequire(fromPath).resolve("pg-cloudflare/package.json");
+	return join(dirname(packageJsonPath), "dist", "index.js");
+}
+function pgWorkerRequireShim() {
+	return [
+		"import * as __voidNodeCrypto from \"node:crypto\";",
+		"import * as __voidNodeDns from \"node:dns\";",
+		"import * as __voidNodeEvents from \"node:events\";",
+		"import * as __voidNodeFs from \"node:fs\";",
+		"import * as __voidNodeNet from \"node:net\";",
+		"import * as __voidNodeTls from \"node:tls\";",
+		"import * as __voidNodeUtil from \"node:util\";",
+		"import * as __voidNodeUtilTypes from \"node:util/types\";",
+		"var __voidNodeRequireModules = {",
+		"  crypto: __voidNodeCrypto,",
+		"  dns: __voidNodeDns,",
+		"  events: __voidNodeEvents,",
+		"  fs: __voidNodeFs,",
+		"  net: __voidNodeNet,",
+		"  tls: __voidNodeTls,",
+		"  util: __voidNodeUtil,",
+		"  \"util/types\": __voidNodeUtilTypes,",
+		"};",
+		"var __require = (id) => {",
+		"  if (id.startsWith(\"node:\")) id = id.slice(5);",
+		"  const mod = __voidNodeRequireModules[id];",
+		"  if (mod) return mod;",
+		"  throw new Error(`Unsupported require(\"${id}\") in Void PG migration bundle`);",
+		"};"
+	].join("\n");
+}
+/**
+* Bundle a worker entry into a self-contained module.
+*
+* Used for frameworks whose build output has unbundled bare imports
+* (e.g. SvelteKit's `_worker.js` imports from `@sveltejs/kit`).
+*/
+async function bundleEntry(root, entry) {
+	const tmpDir = join(root, ".void", "bundle");
+	mkdirSync(tmpDir, { recursive: true });
+	const outDir = join(tmpDir, "out");
+	await build({
+		root: tmpDir,
+		logLevel: "silent",
+		build: {
+			outDir,
+			emptyOutDir: true,
+			lib: {
+				entry,
+				formats: ["es"],
+				fileName: "index"
+			},
+			rollupOptions: {
+				external: [/^cloudflare:/, /^node:/],
+				output: { banner: [
+					"const __noopCache = {",
+					"  match() { return Promise.resolve(undefined); },",
+					"  put() { return Promise.resolve(); },",
+					"  delete() { return Promise.resolve(false); },",
+					"};",
+					"globalThis.caches = { default: __noopCache, open() { return Promise.resolve(__noopCache); } };"
+				].join("\n") }
+			},
+			minify: false,
+			target: "esnext"
+		}
+	});
+	return {
+		entryFilename: selectBundledEntryFilename(readdirSync(outDir)),
+		outputDir: outDir
+	};
+}
+/** Clean up the temporary directories created while generating a deploy wrapper. */
+function cleanupWrapper(root) {
+	const voidDir = join(root, ".void");
+	for (const directory of [
+		"handlers",
+		"migration-handler",
+		"isr",
+		"bundle"
+	]) rmSync(join(voidDir, directory), {
+		recursive: true,
+		force: true
+	});
+}
+function generateWrapperSource(renamedEntry, handlersModule, features, migrations, migrationPlanBundle) {
+	const lines = [];
+	lines.push(WRAPPER_MARKER);
+	lines.push(`import original from "./${renamedEntry}";`);
+	if (features.isr) {
+		lines.push("import { handleFrameworkIsr } from \"./__void_isr.mjs\";");
+		lines.push(`const __voidIsrDeploymentId = ${JSON.stringify(crypto.randomUUID())};`);
+		lines.push(`const __voidIsrPolicy = ${JSON.stringify({
+			revalidate: features.isr.revalidate,
+			queryAllowlist: features.isr.queryAllowlist
+		})};`);
+	}
+	if (features.crons.length > 0) lines.push(`import { handleScheduled } from "./${handlersModule}";`);
+	if (features.queues.length > 0) lines.push(`import { handleQueue, handleQueueRelay } from "./${handlersModule}";`);
+	if (migrations && migrations.length > 0) {
+		lines.push(`import { createMigrationHandler } from "./__void_migration_handler.mjs";`);
+		lines.push(`const __migrations = ${JSON.stringify(migrations)};`);
+		lines.push(`const __migrationPlanBundle = ${JSON.stringify(migrationPlanBundle)};`);
+	}
+	lines.push("");
+	const needsFetchWrap = features.readiness || features.crons.length > 0 || features.queues.length > 0 || migrations && migrations.length > 0 || !!features.isr;
+	if (needsFetchWrap) {
+		lines.push("async function wrappedFetch(request, env, ctx) {");
+		lines.push("  const url = new URL(request.url);");
+		if (features.isr) {
+			lines.push("  env.__VOID_ISR_DEPLOYMENT_ID ??= __voidIsrDeploymentId;");
+			lines.push("  env.__VOID_ISR_HOST = url.hostname;");
+		}
+		if (features.readiness || features.crons.length > 0 || features.queues.length > 0 || features.hasMigrations) {
+			lines.push("  if (request.method === \"GET\" && url.pathname === \"/__void/ready\") {");
+			lines.push("    if (typeof original?.fetch !== \"function\") {");
+			lines.push("      return Response.json({ ready: false, error: \"worker entry has no fetch handler\" }, { status: 503, headers: { \"cache-control\": \"no-store\" } });");
+			lines.push("    }");
+			lines.push(`    return Response.json({ ready: true${features.versionMetadataBinding ? `, versionId: env[${JSON.stringify(features.versionMetadataBinding)}]?.id` : ""} }${features.versionMetadataBinding ? ", { headers: { \"cache-control\": \"no-store\" } }" : ""});`);
+			lines.push("  }");
+		}
+		if (features.queues.length > 0) {
+			lines.push("  if (request.method === \"POST\" && url.pathname === \"/__void/queue\") {");
+			lines.push("    const expected = env?.__VOID_PROXY_TOKEN;");
+			lines.push("    if (!expected || request.headers.get(\"x-void-internal\") !== expected) {");
+			lines.push("      return Response.json({ error: \"unauthorized\" }, { status: 401 });");
+			lines.push("    }");
+			lines.push("    try {");
+			lines.push("      return Response.json(await handleQueueRelay(await request.json(), env, ctx));");
+			lines.push("    } catch {");
+			lines.push("      return Response.json({ error: \"Invalid queue payload\" }, { status: 400 });");
+			lines.push("    }");
+			lines.push("  }");
+		}
+		if (migrations && migrations.length > 0) {
+			lines.push("  if (request.method === \"POST\" && url.pathname === \"/__void/migrate\") {");
+			lines.push("    const handler = createMigrationHandler(env, __migrations);");
+			lines.push("    return handler(request);");
+			lines.push("  }");
+			lines.push("  if (request.method === \"GET\" && url.pathname === \"/__void/migrate/capabilities\") {");
+			lines.push("    const handler = createMigrationHandler(env, __migrations, undefined, __migrationPlanBundle);");
+			lines.push("    return handler(request);");
+			lines.push("  }");
+			lines.push("  if (request.method === \"POST\" && url.pathname === \"/__void/migrate/app\") {");
+			lines.push("    const handler = createMigrationHandler(env, __migrations, undefined, __migrationPlanBundle);");
+			lines.push("    return handler(request);");
+			lines.push("  }");
+			lines.push("  if (request.method === \"GET\" && url.pathname.startsWith(\"/__void/migrate/app/attempt/\")) {");
+			lines.push("    const handler = createMigrationHandler(env, __migrations, undefined, __migrationPlanBundle);");
+			lines.push("    return handler(request);");
+			lines.push("  }");
+		}
+		if (features.crons.length > 0) {
+			lines.push("  if (request.method === \"POST\" && url.pathname === \"/__void/scheduled\") {");
+			lines.push("    const __token = request.headers.get(\"x-void-internal\");");
+			lines.push("    const __expected = env?.__VOID_PROXY_TOKEN || env?.CRON_SECRET;");
+			lines.push("    if (!__expected || __token !== __expected) {");
+			lines.push("      return new Response(JSON.stringify({ error: 'unauthorized' }), {");
+			lines.push("        status: 401,");
+			lines.push("        headers: { \"Content-Type\": \"application/json\" },");
+			lines.push("      });");
+			lines.push("    }");
+			lines.push("    try {");
+			lines.push("      const { cron, scheduledTime } = await request.json();");
+			lines.push("      const controller = { cron, scheduledTime, noRetry() {} };");
+			lines.push("      await handleScheduled(controller, env, ctx);");
+			lines.push("      return new Response(JSON.stringify({ ok: true }), {");
+			lines.push("        headers: { \"Content-Type\": \"application/json\" },");
+			lines.push("      });");
+			lines.push("    } catch (err) {");
+			lines.push("      return new Response(JSON.stringify({ error: String(err) }), {");
+			lines.push("        status: 500,");
+			lines.push("        headers: { \"Content-Type\": \"application/json\" },");
+			lines.push("      });");
+			lines.push("    }");
+			lines.push("  }");
+		}
+		if (features.isr) {
+			lines.push("  if (env.ISR_CACHE && request.headers.get(\"upgrade\")?.toLowerCase() !== \"websocket\") {");
+			lines.push("    const cached = await handleFrameworkIsr(request, env, ctx, { ...__voidIsrPolicy, deploymentId: __voidIsrDeploymentId }, (req) => original.fetch(req, env, ctx));");
+			lines.push("    if (cached) return cached;");
+			lines.push("  }");
+		}
+		lines.push("  return original.fetch(request, env, ctx);");
+		lines.push("}");
+		lines.push("");
+	}
+	lines.push("export default {");
+	if (needsFetchWrap) lines.push("  fetch: wrappedFetch,");
+	else lines.push("  fetch: original.fetch,");
+	if (features.crons.length > 0) lines.push(features.isr ? "  scheduled(controller, env, ctx) { env.__VOID_ISR_DEPLOYMENT_ID ??= __voidIsrDeploymentId; return handleScheduled(controller, env, ctx); }," : "  scheduled: handleScheduled,");
+	if (features.queues.length > 0) lines.push(features.isr ? "  queue(batch, env, ctx) { env.__VOID_ISR_DEPLOYMENT_ID ??= __voidIsrDeploymentId; return handleQueue(batch, env, ctx); }," : "  queue: handleQueue,");
+	lines.push("};");
+	return lines.join("\n");
+}
+function generateHandlersSource(root, features) {
+	const lines = [];
+	const paths = readProjectPaths(root);
+	if (features.crons.length > 0) {
+		for (let i = 0; i < features.crons.length; i++) {
+			const absPath = join(paths.cronsDir, features.crons[i].filePath);
+			lines.push(`import cronHandler${i} from "${absPath}";`);
+		}
+		lines.push("");
+		lines.push("export async function handleScheduled(controller, env, ctx) {");
+		lines.push("  const tasks = [];");
+		for (let i = 0; i < features.crons.length; i++) {
+			lines.push(`  if (${JSON.stringify(features.crons[i].crons)}.includes(controller.cron)) {`);
+			lines.push("    tasks.push((async () => {");
+			lines.push(`      if (typeof cronHandler${i} === "function") {`);
+			lines.push(`        await cronHandler${i}(controller, env, ctx);`);
+			lines.push(`      } else if (cronHandler${i} && typeof cronHandler${i}.default === "function") {`);
+			lines.push(`        await cronHandler${i}.default(controller, env, ctx);`);
+			lines.push("      }");
+			lines.push("    })());");
+			lines.push("  }");
+		}
+		lines.push("  const results = await Promise.allSettled(tasks);");
+		lines.push("  const errors = results.filter(result => result.status === \"rejected\").map(result => result.reason);");
+		lines.push("  if (errors.length) throw new AggregateError(errors, \"Scheduled jobs failed\");");
+		lines.push("}");
+	}
+	if (features.queues.length > 0) {
+		lines.push("");
+		for (let i = 0; i < features.queues.length; i++) {
+			const absPath = join(paths.queuesDir, features.queues[i].filePath);
+			lines.push(`import queueHandler${i} from "${absPath}";`);
+		}
+		lines.push("");
+		lines.push(generateQueueResolverSource(features.queues.map((queue) => queue.name)));
+		lines.push("");
+		lines.push("export async function handleQueue(batch, env, ctx) {");
+		lines.push("  const queueSuffix = batch.queue;");
+		lines.push("  const __queueIndex = __resolveQueueIndex(queueSuffix);");
+		lines.push("  if (__queueIndex === -1) {");
+		lines.push("    batch.retryAll();");
+		lines.push("    throw new Error(`No unambiguous queue handler matches \"${String(queueSuffix)}\"`);");
+		lines.push("  }");
+		lines.push("  switch (__queueIndex) {");
+		for (let i = 0; i < features.queues.length; i++) {
+			lines.push(`    case ${i}:`);
+			lines.push(`      if (typeof queueHandler${i} === "function") {`);
+			lines.push(`        await queueHandler${i}(batch, env);`);
+			lines.push(`      } else if (queueHandler${i} && typeof queueHandler${i}.default === "function") {`);
+			lines.push(`        await queueHandler${i}.default(batch, env);`);
+			lines.push(`      }`);
+			lines.push(`      return;`);
+		}
+		lines.push("  }");
+		lines.push("}");
+		lines.push(`
+export async function handleQueueRelay(payload, env, ctx) {
+  if (!payload || typeof payload.queue !== "string" || !Array.isArray(payload.messages) ||
+    payload.messages.some(m => !m || typeof m.id !== "string" || typeof m.timestamp !== "string" || !Number.isFinite(Date.parse(m.timestamp)))) {
+    throw new Error("Invalid queue payload");
+  }
+  const decisions = new Map();
+  const messages = payload.messages.map(m => {
+    const decide = (decision) => { if (!decisions.has(m.id)) decisions.set(m.id, decision); };
+    return {
+      id: m.id, timestamp: new Date(m.timestamp), body: m.body, attempts: m.attempts,
+      ack() { decide({ action: "ack" }); },
+      retry(options) { decide({ action: "retry", ...(options?.delaySeconds != null ? { delaySeconds: options.delaySeconds } : {}) }); },
+    };
+  });
+  const batch = {
+    queue: payload.queue, messages,
+    ackAll() { for (const message of messages) message.ack(); },
+    retryAll(options) { for (const message of messages) message.retry(options); },
+  };
+  let ok = true;
+  try { await handleQueue(batch, env, ctx); } catch { ok = false; }
+  return { ok, ...(decisions.size ? { decisions: Object.fromEntries(decisions) } : {}) };
+}`);
+	}
+	return lines.join("\n");
+}
+//#endregion
+//#region src/cli/deploy-helpers.ts
+const log = {
+	error: (message) => log$1.error(formatCloudflareUserMessage(message)),
+	info: (message) => log$1.info(formatCloudflareUserMessage(message)),
+	message: (message) => log$1.message(formatCloudflareUserMessage(message)),
+	step: (message) => log$1.step(formatCloudflareUserMessage(message)),
+	warn: (message) => log$1.warn(formatCloudflareUserMessage(message))
+};
+var DeployEventError = class extends Error {};
+async function generateDeployWrapperIfNeeded(root, workerDir, workerMain, features) {
+	if (!needsWrapper(features)) return false;
+	await generateWrapper(workerDir, workerMain, root, features);
+	return true;
+}
+const EMPTY_BINDINGS = {
+	needsD1: false,
+	needsKV: false,
+	needsR2: false,
+	needsAuth: false,
+	needsQueues: false,
+	needsAI: false,
+	needsSandbox: false
+};
+function readLiveBindingConfigFromDeployment(deployment) {
+	if (!deployment?.manifest) return;
+	let manifest;
+	try {
+		manifest = JSON.parse(deployment.manifest);
+	} catch {
+		return;
+	}
+	if (typeof manifest.live?.bindingName !== "string" || typeof manifest.live.className !== "string") return;
+	return {
+		bindingName: manifest.live.bindingName,
+		className: manifest.live.className
+	};
+}
+async function ensurePreviouslyDeployedLiveBindingConfig(root, client, projectId, cliLog) {
+	if (readExistingLiveBindingConfig(root)) return false;
+	const { deployments, activeDeploymentId } = await client.listDeployments(projectId);
+	const live = readLiveBindingConfigFromDeployment(deployments.find((deployment) => deployment.id === activeDeploymentId));
+	if (!live) return false;
+	const synced = syncWranglerBindings(root, {
+		...EMPTY_BINDINGS,
+		needsLive: true
+	}, { live });
+	if (synced) cliLog?.info("live_binding_restored", {
+		bindingName: live.bindingName,
+		className: live.className
+	});
+	return synced;
+}
+async function resolveDeployLiveBindingConfig(root, client, projectId, opts) {
+	if (opts.isFrameworkMode || !opts.needsLive) return;
+	await ensurePreviouslyDeployedLiveBindingConfig(root, client, projectId, opts.cliLog);
+	return resolveLiveBindingConfig(root, {
+		reservedBindings: opts.webSockets.map((route) => route.bindingName),
+		reservedClasses: [...opts.webSockets.map((route) => route.className), opts.sandboxClassName]
+	});
+}
+function getExitCode(error) {
+	if (typeof error === "object" && error !== null && "status" in error && typeof error.status === "number") return error.status;
+	return 1;
+}
+function resolveDeployWranglerCompat(root, config, buildOutputDir, requirements) {
+	if (isNodeTarget(config.target)) return;
+	const compat = ensureWranglerCompat(root, config, buildOutputDir);
+	const compatibilityFlags = normalizeWranglerCompatibilityFlags(compat.compatibilityFlags, { needsNodejsCompat: requirements?.authEnabled === true || requirements?.dialect !== void 0 && requirements.dialect !== "sqlite" || requirements?.needsSandbox === true });
+	return compatibilityFlags === compat.compatibilityFlags ? compat : {
+		...compat,
+		compatibilityFlags
+	};
+}
+function resolveDeployWorkerMain(config, buildOutputDir) {
+	if (isNodeTarget(config.target)) return;
+	try {
+		const wrangler = JSON.parse(readFileSync(join(buildOutputDir, "wrangler.json"), "utf-8"));
+		return typeof wrangler.main === "string" && wrangler.main.length > 0 ? wrangler.main : void 0;
+	} catch {
+		return;
+	}
+}
+function assertWorkerMainUploaded(workerFiles, workerMain) {
+	if (!workerMain || workerFiles.size === 0) return;
+	if (!workerFiles.has(workerMain)) throw new Error(`deploy: Worker entry '${workerMain}' from wrangler.json was not found in uploaded worker modules.`);
+}
+function assertProjectDeployAccess(project) {
+	if (project?.role === "reader") throw new Error(`deploy: You have reader access to "${project.slug}" and cannot deploy. Ask a project admin or owner to grant collaborator access, or choose another project with \`--project <slug>\`.`);
+}
+async function promptDeployProjectConfig(root, client, cliLog) {
+	const projects = await client.listProjectChoices();
+	const link = shouldLinkDeployProject(root, client.apiUrl);
+	const deployableProjects = projects.filter((project) => project.role !== "reader");
+	if (deployableProjects.length !== projects.length) log.warn("Projects with reader access are hidden from deploy selection. Ask a project admin or owner to grant collaborator access to deploy to them.");
+	if (await promptProjectSetupAction("Set up a Void project for deploy:", {
+		includeLink: deployableProjects.length > 0,
+		...link ? {} : { link: false }
+	}) === "create") return promptAndCreateProject(root, client, { link });
+	const result = await promptProjectSelection(deployableProjects, "Select a project to deploy to:", root, {
+		confirmExisting: true,
+		includeCreate: false,
+		...link ? {} : { link: false }
+	});
+	if (result.action === "create") throw new Error("Unexpected project selection result.");
+	const config = {
+		projectId: result.project.id,
+		slug: result.project.slug
+	};
+	if (link) {
+		writeProjectConfig(root, attachSelectedPlatform(config, client.apiUrl));
+		log.step(`Linked to ${import_picocolors.default.blue(config.slug)}`);
+		cliLog?.info("project_linked", {
+			projectId: config.projectId,
+			slug: config.slug
+		});
+	} else log.step(`Using ${import_picocolors.default.blue(config.slug)} for this deployment. Saved destination unchanged.`);
+	return config;
+}
+function resolveStaticBuildCommand(preset, buildOverride, hasExplicitDir = false) {
+	if (hasExplicitDir) return null;
+	return buildOverride ?? preset.buildCommand;
+}
+/**
+* Resolve the build command for a FULL (Class A / Void app) deploy.
+*
+* `inference.build` wins when set, matching `runFrameworkDeploy` and the static
+* path's `resolveStaticBuildCommand`, so an app that needs more than one build
+* step (an SSG that emits the site, then Void's build packaging it via
+* `publicDir` alongside the worker) can express it.
+*
+* The two returned strings are deliberately different for the FALLBACK: `label`
+* goes to the user (`formatProjectCommand` rewrites `vite` → `vp` without
+* expanding an absolute bin path), `command` is what actually runs
+* (`resolveProjectCommand` expands to the local bin). A configured command is
+* the user's own text and is used verbatim for both, so what is printed is
+* exactly what is executed.
+*/
+function resolveFullDeployBuildCommand(root, buildOverride) {
+	if (buildOverride) return {
+		label: buildOverride,
+		command: buildOverride
+	};
+	return {
+		label: formatProjectCommand(root, "vite build"),
+		command: resolveProjectCommand(root, "vite build")
+	};
+}
+/**
+* Whether the built worker's `__voidCollectPrerenderPaths` can return anything
+* at all. When it cannot, booting it is pure cost and the deploy skips it.
+*
+* These three are exactly — and only — the sources `compilePrerenderCollector`
+* (`router/compile.ts`) emits a `paths.push(...)` for:
+*   1. `scan.pages.pages` — static patterns + dynamic pages' `getPrerenderPaths()`
+*   2. the custom SSR entry's top-level `getPrerenderPaths()` (`ssr` argument)
+*   3. `options.explicitPrerenderPaths` — void.config.ts `routing.prerender`
+* With none of them present the collector is a generated function whose body
+* returns `[...new Set([])]`, so skipping is result-identical.
+*
+* Skipping matters beyond speed. `collectPrerenderPaths` boots the worker in
+* Miniflare without remote production secrets, and the generated fetch handler
+* validates `env.ts` at boot. An app with nothing to prerender should not fail
+* merely because that unnecessary worker boot cannot access the remote store.
+*/
+function hasPrerenderSources(inputs) {
+	return inputs.hasPages || inputs.hasSsrEntry || (inputs.explicitPrerenderPaths?.length ?? 0) > 0;
+}
+/**
+* Whether the project needs a worker for something other than its pages.
+*
+* An `output: "static"` project whose pages all prerender takes the static-site
+* path, which uploads assets and NO worker script. Every worker surface that is
+* not a page has to be listed here, because a missing one is not a failed
+* deploy — it is a successful deploy with that feature silently absent.
+*
+* `email` belongs here for the same reason `hasRoutes` does: an `email/`
+* handler compiles to the worker's `email()` export (`router/compile.ts`), and
+* the platform dispatches inbound mail through that export. With no worker, the
+* mail bounces at the proxy with `project has no email handler`.
+*
+* Schedules and queues are deliberately NOT folded in. They are checked at the
+* call site against their own resolved lists, not against a scan flag.
+*/
+function hasNonPageBackend(inputs) {
+	return inputs.hasRoutes || inputs.hasMiddleware || inputs.hasWebSockets || inputs.hasEmail || inputs.authEnabled || inputs.hasLive;
+}
+function resolveStaticDeployPreset(root, voidConfig, options) {
+	if (options?.dir) return detectPreset(root, {
+		dir: options.dir,
+		spa: options.spa
+	});
+	const appType = voidConfig.inference?.appType;
+	if (appType === "static" || appType === "spa") {
+		const outputDir = voidConfig.inference?.outputDir;
+		const preset = {
+			buildCommand: null,
+			outputDir: outputDir ? resolve(root, outputDir) : join(root, "dist"),
+			appType
+		};
+		const detectedPreset = detectPreset(root, { spa: options?.spa });
+		if (detectedPreset) {
+			preset.buildCommand = detectedPreset.buildCommand;
+			if (!outputDir) preset.outputDir = detectedPreset.outputDir;
+		}
+		return preset;
+	}
+	return null;
+}
+async function createProjectFromSlug(root, client, slug, cliLog) {
+	log.step(`Creating project ${import_picocolors.default.blue(slug)}...`);
+	cliLog?.info("project_create_start", { slug });
+	const project = await client.createProject(slug);
+	const config = {
+		projectId: project.id,
+		slug: project.slug
+	};
+	if (shouldLinkDeployProject(root, client.apiUrl)) writeProjectConfig(root, attachSelectedPlatform(config, client.apiUrl));
+	log.step(`Project created: ${import_picocolors.default.blue(config.slug)}`);
+	reportProjectCreationWarnings(project);
+	cliLog?.info("project_create_success", {
+		projectId: config.projectId,
+		slug: config.slug
+	});
+	return config;
+}
+function getGitCommit(root) {
+	try {
+		const githubSha = process.env.GITHUB_SHA?.trim();
+		if (githubSha && /^[0-9a-f]{7,64}$/i.test(githubSha)) return githubSha;
+		const gitEnv = buildEnv();
+		execSync("git rev-parse --is-inside-work-tree", {
+			cwd: root,
+			stdio: "ignore",
+			env: gitEnv
+		});
+		if (execSync("git status --porcelain", {
+			cwd: root,
+			encoding: "utf-8",
+			env: gitEnv
+		}).trim() !== "") return null;
+		return execSync("git rev-parse HEAD", {
+			cwd: root,
+			encoding: "utf-8",
+			env: gitEnv
+		}).trim();
+	} catch {
+		return null;
+	}
+}
+/**
+* Check journal coherence and validate the checked-in migrations of a managed
+* deploy. Logs and exits on failure; returns `undefined` when there are none.
+*/
+function validateDeployMigrations(migrationsDir, rawMigrations) {
+	try {
+		assertJournalCoherence(migrationsDir, rawMigrations);
+	} catch (err) {
+		log.error(getErrorMessage(err));
+		process.exit(1);
+	}
+	if (rawMigrations.length === 0) return;
+	try {
+		const validated = validateMigrations(rawMigrations);
+		log.info(`Found ${formatCount(validated.length, "migration")}`);
+		return validated;
+	} catch (err) {
+		log.error(getErrorMessage(err));
+		process.exit(1);
+	}
+}
+/**
+* Ensure a managed external SQL project has Hyperdrive, prompting for the
+* connection string when it is missing.
+*/
+async function ensureManagedHyperdrive(client, projectId, dialect) {
+	let resources = null;
+	try {
+		resources = await client.getResources(projectId);
+	} catch {}
+	if (!resources || resources.some((resource) => resource.type === "hyperdrive")) return;
+	const connectionString = await text({
+		message: `Your project uses ${dialect === "mysql" ? "MySQL" : "PostgreSQL"}. Enter your connection string:`,
+		placeholder: dialect === "mysql" ? "mysql://user:pass@host:3306/dbname" : "postgresql://user:pass@host:5432/dbname",
+		validate(value) {
+			if (!(dialect === "mysql" ? value?.startsWith("mysql://") : value?.startsWith("postgres://") || value?.startsWith("postgresql://"))) return dialect === "mysql" ? "Must start with \"mysql://\"" : "Must start with \"postgres://\" or \"postgresql://\"";
+		}
+	});
+	if (isCancel(connectionString)) {
+		log.info("Deploy cancelled.");
+		process.exit(0);
+	}
+	await client.provisionDatabase(projectId, connectionString);
+	log.step("Hyperdrive provisioned.");
+}
+/** Convert scanned cron jobs and queues into deploy-manifest entries. */
+function toManifestSchedulesAndQueues(jobs, queues) {
+	return {
+		schedules: jobs.flatMap((job) => job.crons.map((cron) => ({
+			name: job.name,
+			cron
+		}))),
+		queues: queues.map((q) => ({
+			name: q.name,
+			bindingName: q.bindingName,
+			...q.maxBatchSize != null && { maxBatchSize: q.maxBatchSize },
+			...q.maxBatchTimeout != null && { maxBatchTimeout: q.maxBatchTimeout }
+		}))
+	};
+}
+/**
+* If the project has an `env.ts`, validate its schema against the union of
+* production env files and remote secret names. Hard-error before upload so
+* deploys never ship missing required env vars.
+*/
+async function assertEnvSchemaValid(root, client, projectId) {
+	if (findEnvFile(root) == null) return;
+	const remoteSecrets = await fetchRemoteSecretNames(client, projectId);
+	const { hasSchema, report } = await validateProdEnv(root, {
+		productionOnly: true,
+		remoteSecrets
+	});
+	if (!hasSchema || report.valid) return;
+	const formatted = formatEnvReport(report);
+	log.error(`Env validation failed:\n${formatted}`);
+	if (report.missing.length > 0) log.info("Upload missing server values with `void secret put <NAME>`; set VITE_* values in the build shell or schema defaults.");
+	throw new DeployEventError("deploy: Aborting because env.ts schema is not satisfied.");
+}
+//#endregion
+//#region src/cli/deploy-drift.ts
+const deployDriftCheckDir = join(".void", "deploy-drift-check");
+/** Top-level entries never copied into the isolated drift-check project. */
+const DRIFT_PROJECT_SKIPPED_ENTRIES = /* @__PURE__ */ new Set([
+	".git",
+	".void",
+	"node_modules",
+	"dist",
+	"build",
+	".wrangler",
+	".turbo",
+	".next",
+	".svelte-kit",
+	".output"
+]);
+function assertDeploySchemaDriftFree(root, dialect) {
+	try {
+		if (!hasDeploySchemaDrift(root, dialect)) return;
+	} catch (error) {
+		log.error(getErrorMessage(error));
+		process.exit(1);
+	}
+	log.error(getDeploySchemaDriftMessage(root));
+	process.exit(1);
+}
+function hasDeploySchemaDrift(root, dialect) {
+	const authSchemaPath = join(root, ".void", "better-auth-schema.ts");
+	if (!discoverSchema(root, readProjectPaths(root)) && !existsSync(authSchemaPath)) return false;
+	const driftRoot = mkDeployDriftCheckRoot(root);
+	const driftProjectRoot = join(driftRoot, "project");
+	createDeployDriftProject(root, driftProjectRoot);
+	try {
+		const migrationsDir = readProjectPaths(driftProjectRoot).migrationsDir;
+		const before = snapshotDir(migrationsDir);
+		const driftAuthSchemaPath = join(driftProjectRoot, ".void", "better-auth-schema.ts");
+		const output = runDrizzleKitGenerate(driftProjectRoot, writeDrizzleConfig(driftProjectRoot, PLACEHOLDER_DB_URL[dialect], dialect, { additionalSchemas: existsSync(driftAuthSchemaPath) ? [driftAuthSchemaPath] : void 0 }));
+		const snapshotsEqual = migrationSnapshotsEqual(before, snapshotDir(migrationsDir));
+		if (snapshotsEqual && !output.includes("No schema changes, nothing to migrate")) throw new Error(output || "drizzle-kit generate finished without reporting schema status.");
+		return !snapshotsEqual;
+	} catch (error) {
+		throw new Error(formatDeploySchemaDriftCheckError(error));
+	} finally {
+		rmSync(driftRoot, {
+			recursive: true,
+			force: true
+		});
+		cleanupDeployDriftCheckRoot(root);
+	}
+}
+function runDrizzleKitGenerate(root, configPath) {
+	const result = spawnSync(process.execPath, [
+		drizzleKitBin,
+		"generate",
+		"--config",
+		configPath
+	], {
+		cwd: root,
+		encoding: "utf-8",
+		env: buildEnv()
+	});
+	const stderr = (result.stderr ?? "").trim();
+	const output = [stderr, (result.stdout ?? "").trim()].filter(Boolean).join("\n").trim();
+	if (result.error) throw result.error;
+	if (stderr) throw new Error(output);
+	if (result.status !== 0) throw new Error(output || `drizzle-kit generate exited with code ${result.status}.`);
+	return output;
+}
+function getDeploySchemaDriftMessage(root) {
+	const migrationsDir = readProjectPaths(root).migrationsDir;
+	if (collectMigrations(migrationsDir).length > 0 && !existsSync(join(migrationsDir, "meta", "_journal.json")) && listDrizzleArtifacts(migrationsDir).length === 0) return [`Missing Drizzle metadata in ${`${relative(root, migrationsDir)}/`}.`, "See https://void.cloud/guide/database#hand-written-migrations"].join("\n");
+	return ["Schema drift detected between your Drizzle schema and db/migrations/.", "Run `void db generate`, review the generated migration, commit it yourself, then rerun `void deploy`."].join("\n");
+}
+function formatDeploySchemaDriftCheckError(error) {
+	const detail = getErrorMessage(error);
+	return [
+		"Failed to check Drizzle schema drift during deploy.",
+		"Run `void db generate` locally, fix any reported issues, review the generated migration, commit it yourself, then rerun `void deploy`.",
+		...detail ? [detail] : []
+	].join("\n\n");
+}
+function createDeployDriftProject(root, driftProjectRoot) {
+	mkdirSync(driftProjectRoot, { recursive: true });
+	for (const entry of readdirSync(root, { withFileTypes: true })) {
+		if (DRIFT_PROJECT_SKIPPED_ENTRIES.has(entry.name)) continue;
+		const source = join(root, entry.name);
+		const target = join(driftProjectRoot, entry.name);
+		cpSync(source, target, { recursive: true });
+	}
+	const authSchemaPath = join(root, ".void", "better-auth-schema.ts");
+	if (existsSync(authSchemaPath)) {
+		const target = join(driftProjectRoot, ".void", "better-auth-schema.ts");
+		mkdirSync(dirname(target), { recursive: true });
+		cpSync(authSchemaPath, target);
+	}
+}
+function mkDeployDriftCheckRoot(root) {
+	const driftCheckDir = join(root, deployDriftCheckDir);
+	rmSync(driftCheckDir, {
+		recursive: true,
+		force: true
+	});
+	mkdirSync(driftCheckDir, { recursive: true });
+	return mkdtempSync(join(driftCheckDir, "check-"));
+}
+function cleanupDeployDriftCheckRoot(root) {
+	const driftCheckDir = join(root, deployDriftCheckDir);
+	try {
+		if (existsSync(driftCheckDir) && readdirSync(driftCheckDir).length === 0) rmSync(driftCheckDir, {
+			recursive: true,
+			force: true
+		});
+	} catch {}
+}
+function snapshotDir(root) {
+	if (!existsSync(root)) return {};
+	const snapshot = {};
+	collectSnapshotFiles(root, root, snapshot);
+	return snapshot;
+}
+function collectSnapshotFiles(current, root, snapshot) {
+	for (const entry of readdirSync(current, { withFileTypes: true })) {
+		const fullPath = join(current, entry.name);
+		if (entry.isDirectory()) {
+			collectSnapshotFiles(fullPath, root, snapshot);
+			continue;
+		}
+		snapshot[relative(root, fullPath)] = readFileSync(fullPath, "utf-8");
+	}
+}
+function migrationSnapshotsEqual(left, right) {
+	const leftEntries = Object.entries(left).sort(([a], [b]) => a.localeCompare(b));
+	const rightEntries = Object.entries(right).sort(([a], [b]) => a.localeCompare(b));
+	if (leftEntries.length !== rightEntries.length) return false;
+	return leftEntries.every(([leftPath, leftContent], index) => {
+		const [rightPath, rightContent] = rightEntries[index] ?? [];
+		return leftPath === rightPath && leftContent === rightContent;
+	});
+}
+//#endregion
+//#region src/cli/deploy-errors.ts
+const BODY_SNIPPET_MAX = 200;
+function trimSnippet(body) {
+	const collapsed = body.replace(/\s+/g, " ").trim();
+	if (collapsed.length <= BODY_SNIPPET_MAX) return collapsed;
+	return `${collapsed.slice(0, BODY_SNIPPET_MAX)}...`;
+}
+function appendDeploymentLine(message, deploymentId) {
+	return deploymentId ? `${message}\nDeployment: ${deploymentId}` : message;
+}
+function appendLogLine(message, logPath) {
+	return logPath ? `${message}\nDetailed log: ${logPath}` : message;
+}
+function appendTrailingLines(message, deploymentId, logPath) {
+	return appendLogLine(appendDeploymentLine(message, deploymentId), logPath);
+}
+/**
+* Describe the deepest `cause` of an error in one short line, e.g.
+* `getaddrinfo ENOTFOUND api.example.com` under `fetch failed`.
+*/
+function describeRootCause(err) {
+	let root = err;
+	for (let depth = 0; depth < 6; depth++) {
+		const cause = root.cause;
+		if (cause === null || typeof cause !== "object") break;
+		root = cause;
+	}
+	if (root === err) return null;
+	const { code, message } = root;
+	const text = typeof message === "string" ? message.trim() : "";
+	const codeText = typeof code === "string" ? code : "";
+	if (!text) return codeText || null;
+	return codeText && !text.includes(codeText) ? `${codeText}: ${text}` : text;
+}
+/**
+* Format a server-emitted `event: 'error'` payload with an optional deployment id.
+*/
+function formatDeployFailureMessage(message, deploymentId, logPath) {
+	return appendTrailingLines(message, deploymentId, logPath);
+}
+/**
+* Format the "stream ended cleanly but no terminal event arrived" case.
+*
+* This is the only call site that should emit the bare "Connection lost during
+* deploy" message — the server closed the NDJSON stream without emitting
+* `done` or `error`, so there is no underlying error to carry.
+*/
+function formatConnectionLostMessage(deploymentId, logPath) {
+	return appendTrailingLines("deploy: Connection lost during deploy.", deploymentId, logPath);
+}
+/**
+* Convert an exception thrown during the deploy NDJSON stream into a
+* user-facing `Error` with a readable message.
+*
+* Four cases:
+*   1. `PlatformApiError` with 409 + a JSON body carrying `{error, deployment}`
+*      — surface the server-supplied error and prefer the body's deployment id.
+*   2. Any other `PlatformApiError` — retain the client's actionable message and
+*      structured error fields; opaque provider failures use a trimmed body snippet.
+*   3. A headers timeout on the last deploy POST attempt — the platform sent
+*      no response in time. Explain that the deploy may still finish and how
+*      to check and retry.
+*   4. Anything else — preserve the original message, plus its root cause when
+*      there is one, under a `Connection lost during deploy: <original>`
+*      prefix so the caller can still tell network, parse, and transport
+*      errors apart.
+*/
+function formatStreamDeployError(err, deploymentId, logPath) {
+	if (err instanceof PlatformApiError) {
+		const parsed = parsePlatformErrorBody(err.body);
+		const parsedError = platformErrorMessage(parsed) ?? parsed?.error ?? null;
+		const effectiveDeploymentId = parsed?.deployment ?? null ?? deploymentId;
+		if (isCliOutdatedError(err) && parsed?.message) {
+			err.message = appendTrailingLines(err.message, effectiveDeploymentId, logPath);
+			return err;
+		}
+		if (parsedError || err.status === 401 || err.status === 403 || parsed !== null) {
+			err.message = appendTrailingLines(`deploy: ${err.message}`, effectiveDeploymentId, logPath);
+			return err;
+		}
+		const detail = trimSnippet(err.body);
+		err.message = appendTrailingLines(detail ? `deploy: Deploy failed (HTTP ${err.status}): ${detail}` : `deploy: Deploy failed (HTTP ${err.status}).`, effectiveDeploymentId, logPath);
+		return err;
+	}
+	if (isHeadersTimeoutError(err)) {
+		const lines = [`deploy: The Void platform did not respond while preparing the deploy. Tried 4 times; the last try waited 5 minutes.`, "It may still finish. Check `void project status`, then run `void deploy` again to retry."];
+		if (logPath) lines.push("If this keeps happening, share the detailed log below.");
+		return new Error(appendTrailingLines(lines.join("\n"), deploymentId, logPath));
+	}
+	const original = err instanceof Error ? err.message : String(err);
+	const rootCause = err instanceof Error ? describeRootCause(err) : null;
+	const detail = rootCause && rootCause !== original ? ` (${rootCause})` : "";
+	return new Error(appendTrailingLines(`deploy: Connection lost during deploy: '${original}'${detail}.`, deploymentId, logPath));
+}
+/**
+* Maximum retry attempts for a single R2 PUT before giving up. Matched to
+* the design doc 0068 spec: 5xx triggers retry, 4xx surfaces immediately.
+*/
+const MAX_R2_PUT_RETRIES = 3;
+/**
+* Retry backoff delays in milliseconds. After attempt `i` fails (5xx) we
+* sleep `RETRY_BACKOFF_MS[i]` before retrying. Indexed from 0; once the
+* array is exhausted we surface the error.
+*/
+const RETRY_BACKOFF_MS = [
+	250,
+	500,
+	1e3
+];
+var DirectR2PutError = class extends Error {
+	status;
+	hash;
+	path;
+	/**
+	* `body` is the response body text (may be empty / non-text). Useful in
+	* the surface error so users can correlate against R2-side errors like
+	* `BadDigest` (Content-MD5 mismatch) or signature errors.
+	*/
+	body;
+	constructor(status, hash, path, body) {
+		super(`R2 PUT failed for ${path} (${hash}): ${status}${body ? ` ${body}` : ""}`);
+		this.name = "DirectR2PutError";
+		this.status = status;
+		this.hash = hash;
+		this.path = path;
+		this.body = body;
+	}
+};
+/**
+* Issue direct-to-R2 PUTs for every item in `items`, bounded to
+* `R2_PUT_CONCURRENCY`. Surfaces the first failure (4xx immediately, 5xx
+* after retry exhaustion) as a `DirectR2PutError` carrying the asset path
+* and hash so the user can correlate against the JSONL log.
+*
+* Logs `r2_put_start` / `r2_put_end` per asset, plus `r2_put_retry` on
+* each retry attempt. Per-asset durations help identify slow uploads.
+*
+* Memory: each successful PUT clears `item.body` and invokes `onAfterPut`
+* so the caller can drop its own ref (e.g. delete from the in-memory
+* `assetFiles` cache). For huge deploys this keeps peak memory bounded by
+* the upload concurrency rather than the total bundle size.
+*/
+async function uploadAssetsToR2(items, cliLog, fetchImpl = fetch, onAfterPut) {
+	if (items.length === 0) return;
+	let firstError = null;
+	let nextIndex = 0;
+	const workerCount = Math.min(10, items.length);
+	const workers = [];
+	for (let w = 0; w < workerCount; w++) workers.push((async () => {
+		while (firstError === null) {
+			const i = nextIndex++;
+			if (i >= items.length) return;
+			try {
+				await uploadOne(items[i], cliLog, fetchImpl);
+			} catch (err) {
+				if (firstError === null) firstError = err;
+				return;
+			}
+			items[i].body = void 0;
+			onAfterPut?.(items[i]);
+		}
+	})());
+	await Promise.all(workers);
+	if (firstError !== null) throw firstError;
+}
+async function uploadOne(item, cliLog, fetchImpl) {
+	if (!item.body) throw new Error(`internal: uploadOne invoked for ${item.path} with no body`);
+	const body = item.body;
+	const startedAt = Date.now();
+	cliLog?.info("r2_put_start", {
+		hash: item.hash,
+		path: item.path,
+		sizeBytes: body.length
+	});
+	let attempt = 0;
+	while (true) {
+		let res;
+		try {
+			res = await fetchImpl(item.url, {
+				method: "PUT",
+				body: new Uint8Array(body),
+				headers: item.headers
+			});
+		} catch (err) {
+			if (attempt < MAX_R2_PUT_RETRIES) {
+				cliLog?.warn("r2_put_retry", {
+					hash: item.hash,
+					path: item.path,
+					attempt: attempt + 1,
+					status: 0,
+					error: err instanceof Error ? err.message : String(err)
+				});
+				await sleep(RETRY_BACKOFF_MS[attempt]);
+				attempt++;
+				continue;
+			}
+			cliLog?.error("r2_put_end", err, {
+				hash: item.hash,
+				path: item.path,
+				durationMs: Date.now() - startedAt,
+				status: 0
+			});
+			throw new DirectR2PutError(0, item.hash, item.path, err instanceof Error ? err.message : String(err));
+		}
+		if (res.ok) {
+			cliLog?.info("r2_put_end", {
+				hash: item.hash,
+				path: item.path,
+				durationMs: Date.now() - startedAt,
+				status: res.status
+			});
+			return;
+		}
+		const errBody = await safeReadText(res);
+		if (res.status >= 500 && attempt < MAX_R2_PUT_RETRIES) {
+			cliLog?.warn("r2_put_retry", {
+				hash: item.hash,
+				path: item.path,
+				attempt: attempt + 1,
+				status: res.status,
+				body: truncate(errBody)
+			});
+			await sleep(RETRY_BACKOFF_MS[attempt]);
+			attempt++;
+			continue;
+		}
+		cliLog?.error("r2_put_end", void 0, {
+			hash: item.hash,
+			path: item.path,
+			durationMs: Date.now() - startedAt,
+			status: res.status,
+			body: truncate(errBody)
+		});
+		throw new DirectR2PutError(res.status, item.hash, item.path, truncate(errBody));
+	}
+}
+async function safeReadText(res) {
+	try {
+		return await res.text();
+	} catch {
+		return "";
+	}
+}
+function truncate(s) {
+	return s.length > 500 ? `${s.slice(0, 500)}...` : s;
+}
+function sleep(ms) {
+	return new Promise((resolve) => setTimeout(resolve, ms));
+}
+//#endregion
+//#region src/cli/deploy-managed-events.ts
+/**
+* Apply the visible side effects of a streamed deploy event (spinner
+* message or log warning). Returns a discriminated result so the caller
+* advances its own state (deploymentId capture, final return, error
+* throw). Pure function of (event, s) so the switch stays unit-testable.
+*/
+function applyDeployEvent(event, s) {
+	switch (event.event) {
+		case "start":
+			s.message("Deploying...");
+			return {
+				kind: "start",
+				deploymentId: event.deploymentId
+			};
+		case "heartbeat":
+			if (event.status === "recovering") s.message("Recovering interrupted deployment...");
+			return { kind: "continue" };
+		case "asset_upload":
+			if (event.new > 0) s.message(`Uploading assets (${event.new} new, ${event.cached} cached)`);
+			else s.message(`Uploading assets (${event.total} cached)`);
+			return { kind: "continue" };
+		case "provisioning":
+			s.message(`Provisioning ${event.bindings.join(", ")}`);
+			return { kind: "continue" };
+		case "worker_readiness":
+			s.message("Waiting for worker to become reachable...");
+			return { kind: "continue" };
+		case "migration_start":
+			s.message(`Checking ${event.pending} bundled migration${event.pending === 1 ? "" : "s"}...`);
+			return { kind: "continue" };
+		case "migration_warning":
+			log.warn(event.message);
+			return { kind: "continue" };
+		case "migration":
+			s.message(`Applied migration: ${event.name} (${event.durationMs}ms)`);
+			return { kind: "continue" };
+		case "worker_upload":
+			s.message("Uploading worker...");
+			return { kind: "continue" };
+		case "queue_setup":
+			s.message(`Configuring queue consumers: ${event.queues.join(", ")}`);
+			return { kind: "continue" };
+		case "queue_consumer_conflict":
+			log.warn(`Queue consumer conflict on "${event.queue}": owned by "${event.ownerScript}". Messages for this queue will not be delivered to this deployment until the owning script is removed.`);
+			return { kind: "continue" };
+		case "prerender":
+			s.message(`Prerendering ${event.pages} pages...`);
+			return { kind: "continue" };
+		case "done":
+			if (event.published === false) s.stop("Deployed, but routing was not published — the project may be unreachable or still serving the previous deploy. Re-run `void deploy` to publish routing.");
+			else s.clear();
+			return {
+				kind: "done",
+				event
+			};
+		case "error":
+			s.stop("Deploy failed");
+			return {
+				kind: "error",
+				message: event.message
+			};
+	}
+	return { kind: "continue" };
+}
+/**
+* Apply a streamed `DeployEvent` iterator to the spinner / cliLog and
+* resolve with the terminal `done` event (or throw on terminal error /
+* connection loss).
+*/
+async function streamDeployEvents(projectId, events, s, cliLog) {
+	const startedAt = Date.now();
+	let deploymentId = null;
+	let lastProgressAt = startedAt;
+	let waitNotice;
+	let interrupted = false;
+	cliLog?.info("stream_start", { projectId });
+	const onSigint = () => {
+		interrupted = true;
+		s.stop("Deploy interrupted");
+		if (deploymentId) log.info(`Deployment: ${deploymentId}`);
+		else log.info("Deployment id was not received before the interrupt.");
+		cliLog?.warn("stream_interrupted", { deploymentId });
+		cliLog?.close().catch(() => {});
+		process.exit(130);
+	};
+	process.once("SIGINT", onSigint);
+	try {
+		for await (const event of events) {
+			if (event.event === "heartbeat") {
+				const fields = {
+					deploymentId,
+					step: event.step,
+					status: event.status,
+					recoveryAt: event.recoveryAt
+				};
+				if (event.status === "recovering" && waitNotice !== "recovering") {
+					log.info(`Deployment ${deploymentId ?? event.deploymentId ?? ""} is recovering; waiting for its result.`);
+					cliLog?.info("deploy_recovering", fields);
+					waitNotice = "recovering";
+				} else if (Date.now() - lastProgressAt >= 9e4 && waitNotice === void 0) {
+					log.warn(`Deployment ${deploymentId ?? event.deploymentId ?? ""} has not reported new progress for 90 seconds (last reported progress: ${event.step.replaceAll("_", " ")}).` + (event.recoveryAt ? ` Automatic recovery can start after ${event.recoveryAt} if execution was interrupted.` : "") + " Inspect with `void project status`.");
+					cliLog?.warn("deploy_progress_stalled", fields);
+					waitNotice = "stalled";
+				}
+			} else {
+				lastProgressAt = Date.now();
+				waitNotice = void 0;
+			}
+			const result = applyDeployEvent(event, s);
+			if (result.kind === "start") {
+				deploymentId = result.deploymentId;
+				cliLog?.info("stream_deployment_id", { deploymentId });
+			} else if (result.kind === "done") {
+				const degraded = result.event.published === false;
+				cliLog?.info(degraded ? "deploy_degraded" : "deploy_success", {
+					deploymentId,
+					url: result.event.url,
+					assets: result.event.assets,
+					workers: result.event.workers,
+					durationMs: Date.now() - startedAt,
+					degraded
+				});
+				return result.event;
+			} else if (result.kind === "error") {
+				cliLog?.error("deploy_server_error", void 0, {
+					deploymentId,
+					message: result.message
+				});
+				throw new DeployEventError(formatDeployFailureMessage(result.message, deploymentId, cliLog?.path ?? null));
+			}
+		}
+	} catch (err) {
+		if (err instanceof DeployEventError || interrupted) throw err;
+		cliLog?.error("stream_deploy_caught", err, { deploymentId });
+		s.stop("Deploy failed");
+		throw formatStreamDeployError(err, deploymentId, cliLog?.path ?? null);
+	} finally {
+		process.removeListener("SIGINT", onSigint);
+	}
+	cliLog?.warn("stream_no_terminal_event", { deploymentId });
+	s.stop("Deploy failed");
+	throw new Error(formatConnectionLostMessage(deploymentId, cliLog?.path ?? null));
+}
+/**
+* Direct-to-R2 deploy orchestration. Issues presigned PUT URLs for each
+* needed asset, uploads bytes directly to R2, then calls the manifest-only
+* deploy endpoint to finalize.
+*
+* Key invariants:
+*   1. No needed assets → skip presign + R2 PUT phase entirely (saves a
+*      round-trip when every asset was already present from a prior deploy).
+*   2. Asset bytes come exclusively from the in-memory `assetFiles` cache
+*      computed by `collectAndHashAssets` — files are NEVER re-read from
+*      disk during this flow.
+*   3. R2 PUT failures (4xx, 5xx, network) are surfaced with the asset
+*      path + hash so the user can correlate against the JSONL trace.
+*/
+async function streamDirectR2Deploy({ client, projectId, manifest, assetManifest, assetFiles, needed, gitMetadata, preflightUsed, workerFiles, spinner: s, cliLog }) {
+	if (needed.length > 0) {
+		const neededPaths = new Set(needed);
+		const preBufferCount = assetFiles.size;
+		for (const path of assetFiles.keys()) if (!neededPaths.has(path)) assetFiles.delete(path);
+		if (assetFiles.size !== preBufferCount) cliLog?.info("asset_cache_pruned", {
+			before: preBufferCount,
+			after: assetFiles.size
+		});
+		s.message(`Requesting upload URLs for ${formatCount(needed.length, "asset")}...`);
+		const seenBlake3 = /* @__PURE__ */ new Set();
+		const uniqueNeeded = [];
+		for (const path of needed) {
+			const entry = assetManifest[path];
+			if (!entry) throw new Error(`internal: preflight returned ${path} but assetManifest has no entry`);
+			if (seenBlake3.has(entry.blake3)) continue;
+			seenBlake3.add(entry.blake3);
+			uniqueNeeded.push(path);
+		}
+		const assetsToUpload = uniqueNeeded.map((path) => {
+			const entry = assetManifest[path];
+			return {
+				blake3: entry.blake3,
+				md5: entry.md5,
+				size: entry.size,
+				contentType: getContentType(path)
+			};
+		});
+		cliLog?.info("presign_request_start", {
+			assetCount: assetsToUpload.length,
+			dedupedFrom: needed.length
+		});
+		const presignStartedAt = Date.now();
+		const urls = await client.requestUploadUrls(projectId, assetsToUpload);
+		cliLog?.info("presign_request_end", {
+			urlsReceived: Object.keys(urls).length,
+			durationMs: Date.now() - presignStartedAt
+		});
+		const items = uniqueNeeded.map((path) => {
+			const entry = assetManifest[path];
+			const presigned = urls[entry.blake3];
+			if (!presigned) throw new Error(`Platform did not return an upload URL for ${path} (blake3=${entry.blake3}). This indicates a server-side bug or a stale client.`);
+			const body = assetFiles.get(path);
+			if (!body) throw new Error(`internal: asset ${path} declared in manifest but missing from buffer cache`);
+			return {
+				path,
+				hash: entry.blake3,
+				body,
+				url: presigned.url,
+				headers: presigned.headers
+			};
+		});
+		s.message(`Uploading ${formatCount(items.length, "asset")} to R2...`);
+		await uploadAssetsToR2(items, cliLog, void 0, (item) => {
+			assetFiles.delete(item.path);
+		});
+	} else {
+		assetFiles.clear();
+		cliLog?.info("presign_skipped", { reason: "no_needed_assets" });
+	}
+	let encodedWorkerFiles;
+	if (workerFiles && workerFiles.size > 0) {
+		encodedWorkerFiles = {};
+		for (const [relPath, buf] of workerFiles) encodedWorkerFiles[relPath] = buf.toString("base64");
+	}
+	const artifact = createDeployArtifact({
+		manifest,
+		assetManifest,
+		workerFiles: encodedWorkerFiles
+	});
+	const payload = createDeployUploadPayload(artifact, {
+		source: getTokenSource(),
+		commit: gitMetadata?.commit ?? null,
+		repositoryUrl: gitMetadata?.repositoryUrl ?? null,
+		commitUrl: gitMetadata?.commitUrl ?? null,
+		gitRef: gitMetadata?.gitRef ?? null,
+		preflight: preflightUsed ? "true" : null
+	});
+	s.message("Finalizing deploy...");
+	cliLog?.info("finalize_start", {
+		workerFileCount: workerFiles?.size ?? 0,
+		assetCount: Object.keys(assetManifest).length
+	});
+	const finalizeStartedAt = Date.now();
+	try {
+		return await streamDeployEvents(projectId, client.finalizeDeploy(projectId, payload), s, cliLog);
+	} finally {
+		cliLog?.info("finalize_end", { durationMs: Date.now() - finalizeStartedAt });
+	}
+}
+/**
+* Surface a persistent warning when a deploy committed live but its routing
+* KV was not published. Uses `log.warn` (not the spinner) so the warning
+* survives the following `note`/`outro` calls and the user sees it after the
+* deploy summary. The deploy is still committed — this is a warning, not a
+* failure, so the process exit code is unaffected.
+*/
+function warnUnpublishedRouting(result) {
+	if (result.published !== false) return;
+	log.warn("Routing was not published for this deploy. The project may be unreachable (first deploy) or still serving the previous deploy. Re-run `void deploy` to publish routing.");
+}
+/** Merge `_headers` / `_redirects` in `dir` with `void.config.ts` routing rules, then lint them. */
+function mergeAndLintRoutingRules(dir, routing) {
+	const merged = mergeRoutingRules({
+		dir,
+		routing
+	});
+	warnRedundantForceOn3xx(merged.redundantForceOn3xx);
+	lintRoutingPhases(merged);
+	return merged;
+}
+/** Warn once about `!` suffixes on 3xx `_redirects` entries, which are no-ops. */
+function warnRedundantForceOn3xx(count) {
+	if (count === 0) return;
+	log.warn(`Found ${count} redundant "!" on 3xx entries in _redirects (these always force by nature; safe to remove).`);
+}
+/**
+* Class B/C framework deploys pin `not_found_handling: 'none'`, so warn when
+* `routing.notFound` is set. Honoring it would turn framework 404s into a 200
+* `index.html` or take the 404 from the framework's own error route.
+*/
+function warnIgnoredNotFoundForFramework(notFound, frameworkName) {
+	if (notFound === void 0) return;
+	log.warn(`"routing.notFound" in void.config.ts is ignored for ${frameworkName} deploys (not_found_handling is pinned to "none" — the framework's own worker owns unmatched HTML).`);
+}
+//#endregion
+//#region src/cli/deploy-summary.ts
+function printDeployContext(project, destination) {
+	intro(`${import_picocolors.default.dim(sanitizeTerminalText(project))} ${import_picocolors.default.dim("→")} ${import_picocolors.default.blue(sanitizeTerminalText(destination))}`);
+}
+function printDeploySuccess(published = true) {
+	if (published) printSuccess("Successfully deployed!");
+}
+/** Only include counts confirmed by the deployment target. */
+function formatDeploySummary(details) {
+	const lines = [];
+	if (details.workerName) lines.push(`Worker: ${details.workerName}`);
+	const output = [];
+	if (details.workers !== void 0) output.push(formatCount(details.workers, "worker module"));
+	if (details.assets !== void 0) {
+		let assets = formatCount(details.assets, "static asset");
+		if (details.unchangedAssets) assets += ` (${details.unchangedAssets} unchanged, ${details.assets - details.unchangedAssets} uploaded)`;
+		output.push(assets);
+	}
+	if (details.typeLabel) lines.push([details.typeLabel, output.join(", ")].filter(Boolean).join(" — "));
+	else if (output.length) lines.push(output.join(", "));
+	if (details.migrations) lines.push(`${formatCount(details.migrations, "migration")} applied`);
+	if (details.d1MigrationsCurrent) lines.push("D1 migrations up to date");
+	if (details.cronJobs) lines.push(`${formatCount(details.cronJobs, "cron job")} scheduled`);
+	if (details.queues) lines.push(`${formatCount(details.queues, "queue")} configured`);
+	if (details.prerenderedPages) lines.push(`${formatCount(details.prerenderedPages, "page")} prerendered`);
+	if (details.ssr) lines.push("SSR enabled");
+	if (details.revalidate) lines.push(typeof details.revalidate === "number" ? `ISR revalidate: ${details.revalidate}s` : `ISR revalidate: ${formatCount(Object.keys(details.revalidate).length, "path rule")}`);
+	if (details.framework) lines.push(details.framework === true ? "Framework mode" : `Framework: ${details.framework}`);
+	return lines.join("\n");
+}
+//#endregion
+//#region src/cli/package.ts
+const textEncoder = new TextEncoder();
+/**
+* Strip dev-only / internal-only fields from each rule before shipping the
+* manifest. The resulting entries contain only `{ source, destination, status }`.
+*
+* - `origin` is used to build the `X-Void-Routing` trace header during local
+*   dev; the deployed platform doesn't consume it.
+* - `force` is used internally by the CLI/router to split rules into the
+*   `redirectRules` (pre-asset, always-fires) and `fallbackRules` (post-asset,
+*   only when the asset resolver 404s) buckets and to label the trace header
+*   on `node`/`bun`/`deno` targets. The platform dispatch worker decides phase
+*   purely from which array the rule lives in, so shipping `force` is dead weight.
+*
+* Keep in sync with `stripOriginForProd` in `router/compile.ts`, which strips
+* only `origin` because the Node/Bun/Deno-target generated code still reads
+* `force` at runtime to label the dev trace header.
+*/
+function stripDevOnlyRuleFields(rules) {
+	if (!rules) return rules;
+	return rules.map(({ origin: _origin, force: _force, ...rest }) => rest);
+}
+/**
+* Layer user `routing.fallbacks` over the SPA default. The platform SPA switch
+* is global, so a SPA with user fallbacks turns it off and appends a synthetic
+* `/* -> /index.html` rule after them (first match wins). An explicit
+* `routing.notFound` is resolved first, so overriding away from SPA also skips
+* the synthetic rule. `detectPreset` classes a plain Vite MPA as `spa`, so this
+* override is its only escape hatch.
+*/
+function resolveSpaFallbackChain(appType, fallbackRules, notFound) {
+	const userRules = fallbackRules && fallbackRules.length > 0 ? fallbackRules : void 0;
+	const handling = notFound ?? (appType === "spa" ? "single-page-application" : appType === "static" ? "404-page" : "none");
+	if (handling !== "single-page-application") return {
+		assetConfig: { not_found_handling: handling },
+		fallbackRules: userRules
+	};
+	if (!userRules) return {
+		assetConfig: { not_found_handling: "single-page-application" },
+		fallbackRules: void 0
+	};
+	if (userRules.some((r) => r.host === void 0 && r.source === "/*" && r.destination === "/index.html")) return {
+		assetConfig: { not_found_handling: "none" },
+		fallbackRules: userRules
+	};
+	const syntheticSpaFallback = {
+		source: "/*",
+		destination: "/index.html",
+		status: 200,
+		force: false,
+		origin: "spa-default"
+	};
+	return {
+		assetConfig: { not_found_handling: "none" },
+		fallbackRules: [...userRules, syntheticSpaFallback]
+	};
+}
+function isNotFoundError(err) {
+	return err instanceof Error && err.code === "ENOENT";
+}
+const PROGRESS_CHUNK = 50;
+/**
+* Yield to the event loop every PROGRESS_CHUNK iterations so spinner ticks
+* can repaint, and emit a progress message via onProgress. Otherwise the
+* tight sync loop blocks the spinner interval and the user sees no updates.
+*/
+async function tickProgress(i, total, onProgress, label) {
+	if (!onProgress) return;
+	if (i % PROGRESS_CHUNK !== 0 && i !== total) return;
+	onProgress(`${label} (${i}/${total})`);
+	await new Promise((resolve) => setImmediate(resolve));
+}
+/**
+* Compute a CF-compatible asset hash: BLAKE3 of base64(content) + extension,
+* first 32 hex chars. Matches Wrangler's hashFile algorithm exactly.
+* Must match the API's computeAssetHash algorithm exactly.
+*/
+function computeAssetHash(content, filePath) {
+	const base64 = content.toString("base64");
+	const ext = extname(filePath).substring(1);
+	const input = textEncoder.encode(base64 + ext);
+	return Buffer.from(hash(input)).toString("hex").slice(0, 32);
+}
+/**
+* Compute MD5 of raw content as a 32-char lowercase hex string.
+*
+* Used as the wire-level upload-integrity primitive on direct-to-R2 PUTs:
+* R2's S3 compatibility layer enforces `Content-MD5` (RFC 1864) on PutObject,
+* so the upload itself fails if uploaded bytes don't match the declared MD5.
+* MD5 collision resistance is acceptable here because (a) this hash is purely
+* an upload-integrity primitive (BLAKE3 remains the canonical content key),
+* and (b) project-scoped storage (`assets/${projectId}/${blake3}`) means any
+* collision attack is exploitable only against the attacker's own project.
+*/
+function computeMd5(content) {
+	return createHash("md5").update(content).digest("hex");
+}
+/**
+* Create a filter function that excludes .assetsignore, _headers, _redirects,
+* OS metadata files, dotenv files, deploy-internal patterns, and any patterns
+* listed in a .assetsignore file.
+* Matches Wrangler's createAssetsIgnoreFunction from workers-shared/utils/helpers.ts.
+*/
+function createAssetsIgnoreFunction(dir, extraPatterns = []) {
+	const patterns = [
+		"/.assetsignore",
+		"/_redirects",
+		"/_headers",
+		".DS_Store",
+		".env",
+		".env.*",
+		...extraPatterns
+	];
+	const assetsIgnorePath = join(dir, ".assetsignore");
+	let assetsIgnoreFilePresent = false;
+	if (existsSync(assetsIgnorePath)) {
+		assetsIgnoreFilePresent = true;
+		const content = readFileSync(assetsIgnorePath, "utf-8");
+		patterns.push(...content.split("\n"));
+	}
+	const ig = ignore().add(patterns);
+	const isIgnored = (relativePath) => {
+		const normalized = relativePath.startsWith("/") ? relativePath.slice(1) : relativePath;
+		return ig.test(normalized).ignored;
+	};
+	return {
+		isIgnored,
+		assetsIgnoreFilePresent
+	};
+}
+/**
+* Guard against accidentally uploading _worker.js as a static asset.
+* Matches Wrangler's errorOnLegacyPagesWorkerJSAsset behavior:
+* throws only when no .assetsignore file exists (if .assetsignore is present
+* but doesn't exclude _worker.js, the user intentionally wants to upload it).
+*/
+function checkWorkerJsAsset(relativePath, assetsIgnoreFilePresent) {
+	if (assetsIgnoreFilePresent) return;
+	const name = relativePath.startsWith("/") ? relativePath.slice(1) : relativePath;
+	if (name === "_worker.js" || name.startsWith("_worker.js/")) throw new Error(`deploy: Refusing to upload _worker.js ${name === "_worker.js" ? "file" : "directory"} as an asset. This could expose private server-side code to the public Internet. If this is unintended, remove it or add a .assetsignore file containing "_worker.js". If intentional, add an empty .assetsignore file to suppress this error.`);
+}
+/**
+* Collect all files in a directory, compute hashes, and return both the
+* manifest (for preflight) and the raw file map (for selective packaging).
+*
+* Each file is read from disk exactly once. Both BLAKE3 (storage key) and
+* MD5 (R2 upload-integrity) digests are derived from that single buffer.
+*/
+async function collectAndHashAssets(dir, onProgress, opts = {}) {
+	const assetManifest = {};
+	const assetFiles = /* @__PURE__ */ new Map();
+	try {
+		const { isIgnored, assetsIgnoreFilePresent } = createAssetsIgnoreFunction(dir, opts.ignorePatterns);
+		const files = collectAssetFiles(dir, isIgnored);
+		let processed = 0;
+		for (const filePath of files) {
+			processed++;
+			await tickProgress(processed, files.length, onProgress, "Hashing assets");
+			const relativePath = "/" + relative(dir, filePath);
+			checkWorkerJsAsset(relativePath, assetsIgnoreFilePresent);
+			const content = readFileSync(filePath);
+			const blake3 = computeAssetHash(content, filePath);
+			assetManifest[relativePath] = {
+				blake3,
+				md5: computeMd5(content),
+				size: content.length,
+				hash: blake3
+			};
+			assetFiles.set(relativePath, content);
+		}
+	} catch (err) {
+		if (!isNotFoundError(err)) throw err;
+	}
+	return {
+		assetManifest,
+		assetFiles
+	};
+}
+function toWebSocketManifest(routes) {
+	if (!routes || routes.length === 0) return;
+	return {
+		routes: routes.map((route) => ({
+			pattern: route.pattern,
+			filePath: route.filePath,
+			className: route.className,
+			mode: route.mode,
+			hasAuthGate: route.hasAuthGate
+		})),
+		classes: routes.map((route) => route.className)
+	};
+}
+function toSandboxManifest(sandbox) {
+	return {
+		controllerProtocol: 2,
+		bindingName: sandbox.binding,
+		className: sandbox.className,
+		containerName: sandbox.containerName,
+		image: sandbox.platformImage,
+		...sandbox.instanceType && { instanceType: sandbox.instanceType }
+	};
+}
+function toLiveManifest(live) {
+	const bindingName = live?.bindingName ?? "VOID_LIVE";
+	const className = live?.className ?? "VoidLiveStreamDurableObject";
+	return {
+		bindingName,
+		className,
+		storage: "sqlite",
+		classes: [className],
+		migrations: [{
+			tag: LIVE_MIGRATION_TAG,
+			newSqliteClasses: [className]
+		}]
+	};
+}
+/**
+* If the user configured `routing.fallbacks` on an app whose resolved
+* `not_found_handling` is not `single-page-application`, the platform still
+* applies the rules but no `/* -> /index.html` SPA shell is synthesised —
+* unmatched paths fall through to the platform 404. Returns the warning
+* message string when that mismatch is detected, or `null` otherwise. Pure
+* function; callers decide whether/how to surface the message (CLI progress,
+* `console.warn`, etc.).
+*
+* The message names `not_found_handling` rather than the app type because an
+* explicit `routing.notFound` can land here too — the app may well be a SPA.
+*/
+function detectNonSpaFallbackWarning(assetConfig, fallbackRules) {
+	if (assetConfig?.not_found_handling === "single-page-application") return null;
+	if (!fallbackRules || fallbackRules.length === 0) return null;
+	return "routing.fallbacks is set but not_found_handling is not \"single-page-application\"; fallbacks will be applied, but no \"/* -> /index.html\" SPA shell fallback is synthesised — unmatched paths fall through to the platform 404.";
+}
+/** Add the database, KV, R2, and AI bindings shared by Void and framework manifests. */
+function applyResourceBindings(manifest, bindings, migrationCount, dialect, bindingNames) {
+	if (needsApplicationDatabase(bindings, migrationCount)) {
+		if (dialect !== "sqlite") manifest.bindings.hyperdrive = ["HYPERDRIVE"];
+		else manifest.bindings.d1 = [bindingNames?.d1 ?? "DB"];
+	}
+	if (bindings.needsKV) manifest.bindings.kv = [bindingNames?.kv ?? "KV"];
+	if (bindings.needsR2) manifest.bindings.r2 = [bindingNames?.r2 ?? "STORAGE"];
+	if (bindings.needsAI) manifest.bindings.ai = true;
+}
+/** Describe bundled migrations; SQLite migrations also carry their plan bundle. */
+function toMigrationsManifest(migrations, dialect) {
+	const planBundle = dialect === "sqlite" ? buildMigrationPlanBundle(migrations) : void 0;
+	return {
+		dialect,
+		...planBundle ? {
+			classifierVersion: planBundle.classifierVersion,
+			migrationListHash: planBundle.migrationListHash,
+			protocolVersion: planBundle.protocolVersion,
+			stability: planBundle.plans.some((plan) => plan.stability === "legacy") ? "legacy" : "stable"
+		} : {},
+		pending: migrations.length
+	};
+}
+/**
+* Build a Void-app deploy manifest from the inferred bindings + per-feature
+* inputs. Pure shape transformation: reads no files, has no I/O.
+*
+* Note: callers are responsible for surfacing the non-SPA-fallbacks warning
+* (see `detectNonSpaFallbackWarning`) before invoking this builder. The
+* builder itself stays I/O-free.
+*/
+function buildVoidManifest(opts) {
+	const { bindings, migrations, schedules, ssr, framework, revalidate, pages, pathRevalidate, queues, prerender, assetConfig, options, hashedAssetsPrefix, headerRules, redirectRules, fallbackRules, dialect, webSockets } = opts;
+	const resolvedDialect = dialect ?? "sqlite";
+	const manifest = {
+		version: 3,
+		assetManifestVersion: 2,
+		bindings: {}
+	};
+	if (opts.hasEmailHandlers) manifest.emailProtocolVersion = 1;
+	if (bindings.needsAuth) manifest.auth = true;
+	applyResourceBindings(manifest, bindings, migrations?.length ?? 0, resolvedDialect, options?.bindingNames);
+	if (bindings.needsSandbox) {
+		if (!options?.sandbox) throw new Error("deploy: Sandbox bindings require sandbox package options.");
+		manifest.sandbox = toSandboxManifest({
+			...options.sandbox,
+			binding: options.bindingNames?.sandbox ?? options.sandbox.binding
+		});
+	}
+	if (bindings.needsLive) manifest.live = toLiveManifest(options?.live);
+	if (migrations && migrations.length > 0) manifest.migrations = toMigrationsManifest(migrations, resolvedDialect);
+	if (schedules && schedules.length > 0) manifest.schedules = schedules;
+	if (queues && queues.length > 0) manifest.queues = queues;
+	if (ssr) manifest.ssr = true;
+	if (framework) manifest.framework = framework;
+	manifest.type = framework ? "framework" : "void";
+	if (revalidate != null && revalidate !== 0) manifest.revalidate = revalidate;
+	if (options?.revalidateQueryAllowlist && Object.keys(options.revalidateQueryAllowlist).length > 0) manifest.revalidateQueryAllowlist = options.revalidateQueryAllowlist;
+	if (pages && pages.length > 0) manifest.pages = pages;
+	if (pathRevalidate && Object.keys(pathRevalidate).length > 0) manifest.pathRevalidate = pathRevalidate;
+	if (prerender && prerender.length > 0) manifest.prerender = prerender;
+	let resolvedAssetConfig = assetConfig;
+	let resolvedFallbackRules = fallbackRules;
+	if (assetConfig?.not_found_handling === "single-page-application") {
+		const chain = resolveSpaFallbackChain("spa", fallbackRules);
+		resolvedAssetConfig = {
+			...assetConfig,
+			...chain.assetConfig
+		};
+		resolvedFallbackRules = chain.fallbackRules;
+	}
+	if (resolvedAssetConfig) manifest.assetConfig = resolvedAssetConfig;
+	if (options?.workerMain) manifest.workerMain = options.workerMain;
+	if (options?.compatibilityDate) manifest.compatibilityDate = options.compatibilityDate;
+	if (options?.compatibilityFlags && options.compatibilityFlags.length > 0) manifest.compatibilityFlags = options.compatibilityFlags;
+	if (options?.cpuMs) manifest.limits = { cpuMs: options.cpuMs };
+	if (hashedAssetsPrefix) manifest.hashedAssetsPrefix = hashedAssetsPrefix;
+	if (headerRules && headerRules.length > 0) manifest.headerRules = headerRules;
+	if (redirectRules && redirectRules.length > 0) manifest.redirectRules = stripDevOnlyRuleFields(redirectRules);
+	if (resolvedFallbackRules && resolvedFallbackRules.length > 0) manifest.fallbackRules = stripDevOnlyRuleFields(resolvedFallbackRules);
+	const websocketManifest = toWebSocketManifest(webSockets);
+	if (websocketManifest) manifest.websocket = websocketManifest;
+	return manifest;
+}
+/**
+* Read every worker module under `workerDir` once and return them as a map
+* keyed by relative path. Skipped files (build metadata, wrangler config,
+* non-module extensions) are filtered out by `isWorkerModule`. Reads each
+* file from disk exactly once — buffer threading downstream is the caller's
+* responsibility.
+*/
+function collectWorkerFiles(workerDir) {
+	const out = /* @__PURE__ */ new Map();
+	let workerPaths;
+	try {
+		workerPaths = collectFiles(workerDir);
+	} catch (err) {
+		if (isNotFoundError(err)) return out;
+		throw err;
+	}
+	for (const filePath of workerPaths) {
+		const relativePath = relative(workerDir, filePath);
+		if (!isWorkerModule(relativePath)) continue;
+		out.set(relativePath, readFileSync(filePath));
+	}
+	return out;
+}
+/**
+* Build a static-deploy manifest. Pure shape transformation — no I/O.
+*/
+function buildStaticManifest(opts) {
+	const { appType, hashedAssetsPrefix, headerRules, redirectRules, fallbackRules, notFound } = opts;
+	const { assetConfig, fallbackRules: resolvedFallbackRules } = resolveSpaFallbackChain(appType, fallbackRules, notFound);
+	const manifest = {
+		version: 3,
+		assetManifestVersion: 2,
+		bindings: {},
+		type: appType,
+		assetConfig
+	};
+	if (hashedAssetsPrefix) manifest.hashedAssetsPrefix = hashedAssetsPrefix;
+	if (headerRules && headerRules.length > 0) manifest.headerRules = headerRules;
+	if (redirectRules && redirectRules.length > 0) manifest.redirectRules = stripDevOnlyRuleFields(redirectRules);
+	if (resolvedFallbackRules && resolvedFallbackRules.length > 0) manifest.fallbackRules = stripDevOnlyRuleFields(resolvedFallbackRules);
+	return manifest;
+}
+/**
+* Build a framework-deploy manifest. Pure shape transformation — no I/O.
+*/
+function buildFrameworkManifest(opts) {
+	const po = opts.packageOptions;
+	const dialect = opts.dialect ?? "sqlite";
+	const manifest = {
+		version: 3,
+		assetManifestVersion: 2,
+		bindings: {}
+	};
+	applyResourceBindings(manifest, opts.bindings, opts.migrations?.length ?? 0, dialect, po?.bindingNames);
+	if (opts.migrations && opts.migrations.length > 0) manifest.migrations = toMigrationsManifest(opts.migrations, dialect);
+	if (opts.schedules && opts.schedules.length > 0) manifest.schedules = opts.schedules;
+	if (opts.queues && opts.queues.length > 0) manifest.queues = opts.queues;
+	if (opts.revalidate != null && opts.revalidate !== 0) manifest.revalidate = opts.revalidate;
+	if (opts.revalidateQueryAllowlist && Object.keys(opts.revalidateQueryAllowlist).length > 0) manifest.revalidateQueryAllowlist = opts.revalidateQueryAllowlist;
+	if (opts.prerender && opts.prerender.length > 0) manifest.prerender = opts.prerender;
+	if (opts.assetConfig) manifest.assetConfig = opts.assetConfig;
+	manifest.ssr = true;
+	manifest.framework = opts.frameworkName;
+	manifest.type = "framework";
+	manifest.workerMain = opts.workerMain;
+	if (po?.compatibilityDate) manifest.compatibilityDate = po.compatibilityDate;
+	if (po?.compatibilityFlags && po.compatibilityFlags.length > 0) manifest.compatibilityFlags = po.compatibilityFlags;
+	if (po?.cpuMs) manifest.limits = { cpuMs: po.cpuMs };
+	if (opts.hashedAssetsPrefix) manifest.hashedAssetsPrefix = opts.hashedAssetsPrefix;
+	if (opts.headerRules && opts.headerRules.length > 0) manifest.headerRules = opts.headerRules;
+	if (opts.redirectRules && opts.redirectRules.length > 0) manifest.redirectRules = stripDevOnlyRuleFields(opts.redirectRules);
+	if (opts.fallbackRules && opts.fallbackRules.length > 0) manifest.fallbackRules = stripDevOnlyRuleFields(opts.fallbackRules);
+	return manifest;
+}
+/**
+* Check if a file (by relative path) should be included as a worker module.
+* Skips build metadata and files with extensions CF Workers can't handle as modules.
+*/
+function isWorkerModule(relativePath) {
+	const norm = relativePath.replace(/\\/g, "/");
+	if (norm.includes("/.vite/") || norm.startsWith(".vite/")) return false;
+	if (norm === "wrangler.json" || norm === "wrangler.jsonc") return false;
+	return /\.(js|mjs|cjs|wasm|map|txt)$/.test(norm);
+}
+/**
+* Recursively collect static asset file paths, refusing symlinks so deploys
+* cannot publish bytes from outside the intended asset root.
+*/
+function collectAssetFiles(root, isIgnored, dir = root) {
+	const files = [];
+	const entries = readdirSync(dir, { withFileTypes: true });
+	for (const entry of entries) {
+		const fullPath = join(dir, entry.name);
+		const relativePath = "/" + relative(root, fullPath);
+		if (isIgnored(relativePath)) continue;
+		if (entry.isSymbolicLink()) throw new Error(`deploy: Refusing to upload symlink as an asset: ${relativePath}`);
+		if (entry.isDirectory()) files.push(...collectAssetFiles(root, isIgnored, fullPath));
+		else files.push(fullPath);
+	}
+	return files;
+}
+//#endregion
+//#region src/cli/deploy-managed-framework.ts
+/**
+* Class B/C framework deploy: build with framework CLI, package with preset output paths.
+*/
+async function runFrameworkDeploy(root, config, client, detected, fwPreset, voidConfig, skipBuild, gitMetadata, cliLog) {
+	log.info(`${detected.name} framework deploy`);
+	cliLog?.info("deploy_mode", {
+		mode: "framework",
+		framework: detected.name
+	});
+	const buildCmd = voidConfig.inference?.build ?? formatProjectCommand(root, fwPreset.buildCommand);
+	if (!skipBuild) {
+		log.step(`Building (${buildCmd})...`);
+		cliLog?.info("build_start", { command: buildCmd });
+		const buildStartedAt = Date.now();
+		execSync(voidConfig.inference?.build ?? resolveProjectCommand(root, fwPreset.buildCommand), {
+			cwd: root,
+			stdio: "inherit",
+			env: buildEnv({ ...MANAGED_DEPLOY_BUILD_ENV }, { localBinRoot: root })
+		});
+		cliLog?.info("build_end", { durationMs: Date.now() - buildStartedAt });
+	} else cliLog?.info("build_skipped", { reason: "skipBuild" });
+	const workerDir = join(root, fwPreset.workerDir);
+	const assetsDir = join(root, fwPreset.assetsDir);
+	const frameworkAssetIgnorePatterns = fwPreset.workerDir === fwPreset.assetsDir && fwPreset.workerMain === "_worker.js" ? [`/${fwPreset.workerMain}`, "/_routes.json"] : [];
+	const { headerRules, redirectRules, fallbackRules } = mergeAndLintRoutingRules(assetsDir, voidConfig.routing);
+	warnIgnoredNotFoundForFramework(voidConfig.routing?.notFound, detected.name);
+	if (!existsSync(workerDir)) {
+		log.error(`deploy: Worker output '${fwPreset.workerDir}' not found. Run '${buildCmd}' first.`);
+		process.exit(1);
+	}
+	const analysis = analyzeApplicationSync(root, {
+		config: voidConfig,
+		environment: "prod"
+	});
+	const { paths, bindings, authEnabled, dialect } = analysis;
+	if (authEnabled) {
+		log.error("deploy: Void-managed Better Auth is only supported in Void apps. Use Better Auth's official integration for this framework instead.");
+		process.exit(1);
+	}
+	if (bindings.needsLive) {
+		log.error("deploy: void/live is currently supported in Void apps only.");
+		process.exit(1);
+	}
+	assertDeploySchemaDriftFree(root, dialect);
+	const validatedMigrations = validateDeployMigrations(paths.migrationsDir, analysis.migrations);
+	if (dialect !== "sqlite" && analysis.needsDatabase) await ensureManagedHyperdrive(client, config.projectId, dialect);
+	const rawJobs = analysis.jobs;
+	const rawQueues = analysis.queues;
+	const originalEntry = join(workerDir, fwPreset.workerMain);
+	const wrapperFeatures = {
+		crons: rawJobs,
+		queues: rawQueues,
+		hasMigrations: validatedMigrations != null && validatedMigrations.length > 0,
+		migrationDialect: dialect
+	};
+	let actualWorkerDir = workerDir;
+	let actualWorkerMain = fwPreset.workerMain;
+	if (fwPreset.bundle) {
+		log.step("Bundling worker...");
+		const bundleResult = await bundleEntry(root, originalEntry);
+		actualWorkerDir = bundleResult.outputDir;
+		actualWorkerMain = bundleResult.entryFilename;
+		log.info("Worker bundled");
+	}
+	if (needsWrapper(wrapperFeatures)) {
+		log.step("Generating wrapper...");
+		await generateDeployWrapperIfNeeded(root, actualWorkerDir, actualWorkerMain, wrapperFeatures);
+		log.info("Wrapper generated");
+	}
+	const wranglerCompat = resolveDeployWranglerCompat(root, voidConfig, workerDir, { dialect });
+	const revalidate = collectRevalidate(voidConfig, null);
+	const prerender = voidConfig.routing?.isr === false ? void 0 : voidConfig.routing?.prerender;
+	const { schedules, queues } = toManifestSchedulesAndQueues(rawJobs, rawQueues);
+	await assertEnvSchemaValid(root, client, config.projectId);
+	const s = createSpinner();
+	const onProgress = (msg) => s.message(msg);
+	s.start("Checking for changes...");
+	cliLog?.info("preflight_start", { dir: assetsDir });
+	const { assetManifest, assetFiles } = await collectAndHashAssets(assetsDir, onProgress, { ignorePatterns: frameworkAssetIgnorePatterns });
+	const { needed, skipped } = await client.preflight(config.projectId, assetManifest, true);
+	s.stop("Checked for changes");
+	cliLog?.info("preflight_end", {
+		total: Object.keys(assetManifest).length,
+		needed: needed.length,
+		skipped
+	});
+	if (skipped > 0) log.info(`Skipping ${formatCount(skipped, "unchanged asset")}`);
+	s.start("Packaging...");
+	cliLog?.info("package_start", {
+		mode: "framework",
+		framework: detected.name
+	});
+	const packageStartedAt = Date.now();
+	const packageOptions = {
+		bindingNames: analysis.bindingNames,
+		compatibilityDate: wranglerCompat?.compatibilityDate,
+		compatibilityFlags: wranglerCompat?.compatibilityFlags,
+		cpuMs: voidConfig.worker?.limits?.cpu_ms
+	};
+	const manifest = buildFrameworkManifest({
+		frameworkName: detected.name,
+		workerMain: actualWorkerMain,
+		bindings,
+		migrations: validatedMigrations,
+		schedules,
+		queues,
+		revalidate,
+		revalidateQueryAllowlist: voidConfig.routing?.revalidateQueryAllowlist,
+		prerender,
+		assetConfig: { not_found_handling: "none" },
+		packageOptions,
+		hashedAssetsPrefix: fwPreset.hashedAssetsPrefix ?? "assets",
+		headerRules,
+		redirectRules,
+		fallbackRules,
+		dialect
+	});
+	const workerFiles = collectWorkerFiles(actualWorkerDir);
+	cliLog?.info("package_end", {
+		mode: "framework",
+		durationMs: Date.now() - packageStartedAt
+	});
+	const result = await streamDirectR2Deploy({
+		client,
+		projectId: config.projectId,
+		manifest,
+		assetManifest,
+		assetFiles,
+		needed,
+		gitMetadata,
+		preflightUsed: skipped > 0,
+		workerFiles,
+		spinner: s,
+		cliLog
+	});
+	note(formatDeploySummary({
+		workers: result.workers,
+		assets: result.assets,
+		unchangedAssets: skipped,
+		migrations: result.migrations,
+		cronJobs: schedules.length,
+		queues: queues.length,
+		prerenderedPages: prerender?.length,
+		revalidate,
+		framework: detected.name
+	}), result.url);
+	cleanupWrapper(root);
+	warnUnpublishedRouting(result);
+	printDeploySuccess(result.published !== false);
+}
+function assertManagedDurableStateSupported(root) {
+	if (scanDurableObjectModules(root).length > 0) throw new Error("deploy: typed Durable State modules in durable-objects/ are not yet supported by the Void managed platform. Deploy to your own Cloudflare account with `void deploy --platform cloudflare`.");
+}
+//#endregion
+//#region src/cli/deploy-managed-static.ts
+/**
+* Assemble the Void deploy manifest, deriving the route-aware ISR `pages` table
+* from the page scan. This is the single production seam that forwards
+* `pageScan` → `manifest.pages`; `runFullDeploy` calls it so the wiring is
+* exercised (and regression-guarded) by a unit test.
+*
+* `pages` is a Void pages-mode concept. In framework mode (Class-A frameworks
+* routed through `runFullDeploy`) we must NOT emit it — the framework owns its
+* own routing/ISR — so `isFrameworkMode` suppresses the table.
+*/
+function assembleVoidManifest(pageScan, isFrameworkMode, opts, revalidateConfig, isrEnabled = true) {
+	return buildVoidManifest({
+		...opts,
+		...isrEnabled ? {} : {
+			revalidate: void 0,
+			prerender: void 0
+		},
+		pages: isFrameworkMode ? void 0 : collectPages(pageScan, revalidateConfig, isrEnabled),
+		pathRevalidate: !isrEnabled || isFrameworkMode || revalidateConfig == null || typeof revalidateConfig !== "object" ? void 0 : revalidateConfig
+	});
+}
+async function runStaticDeploy(root, config, client, preset, skipBuild, gitMetadata, hashedAssetsPrefix, headerRules, redirectRules, fallbackRules, routing, cliLog, notFound) {
+	const typeLabel = preset.appType === "spa" ? "Static SPA" : "Static Site";
+	log.info(`${typeLabel} deploy`);
+	cliLog?.info("deploy_mode", {
+		mode: "static",
+		appType: preset.appType
+	});
+	if (preset.buildCommand && !skipBuild) {
+		log.step("Building...");
+		cliLog?.info("build_start", { command: preset.buildCommand });
+		const buildStartedAt = Date.now();
+		execSync(preset.buildCommand, {
+			cwd: root,
+			stdio: "inherit",
+			env: buildEnv({ ...MANAGED_DEPLOY_BUILD_ENV }, { localBinRoot: root })
+		});
+		cliLog?.info("build_end", { durationMs: Date.now() - buildStartedAt });
+	} else if (skipBuild) cliLog?.info("build_skipped", { reason: "skipBuild" });
+	if (!existsSync(preset.outputDir)) {
+		log.error(`deploy: Output directory '${preset.outputDir}' not found. Run the build first.`);
+		process.exit(1);
+	}
+	if (routing || !headerRules && !redirectRules && !fallbackRules) {
+		const merged = mergeAndLintRoutingRules(preset.outputDir, routing);
+		headerRules = merged.headerRules;
+		redirectRules = merged.redirectRules;
+		fallbackRules = merged.fallbackRules;
+	}
+	const s = createSpinner();
+	const onProgress = (msg) => s.message(msg);
+	s.start("Checking for changes...");
+	cliLog?.info("preflight_start", { dir: preset.outputDir });
+	const { assetManifest, assetFiles } = await collectAndHashAssets(preset.outputDir, onProgress);
+	const { needed, skipped } = await client.preflight(config.projectId, assetManifest);
+	s.stop("Checked for changes");
+	cliLog?.info("preflight_end", {
+		total: Object.keys(assetManifest).length,
+		needed: needed.length,
+		skipped
+	});
+	if (skipped > 0) log.info(`Skipping ${formatCount(skipped, "unchanged asset")}`);
+	s.start("Packaging...");
+	cliLog?.info("package_start", { mode: "static" });
+	const packageStartedAt = Date.now();
+	const manifest = buildStaticManifest({
+		appType: preset.appType,
+		hashedAssetsPrefix: hashedAssetsPrefix ?? "assets",
+		headerRules,
+		redirectRules,
+		fallbackRules,
+		notFound: notFound ?? routing?.notFound
+	});
+	cliLog?.info("package_end", {
+		mode: "static",
+		durationMs: Date.now() - packageStartedAt
+	});
+	const result = await streamDirectR2Deploy({
+		client,
+		projectId: config.projectId,
+		manifest,
+		assetManifest,
+		assetFiles,
+		needed,
+		gitMetadata,
+		preflightUsed: skipped > 0,
+		spinner: s,
+		cliLog
+	});
+	note(formatDeploySummary({
+		typeLabel,
+		assets: result.assets,
+		unchangedAssets: skipped
+	}), result.url);
+	warnUnpublishedRouting(result);
+	printDeploySuccess(result.published !== false);
+}
+//#endregion
+export { resolveDeployLiveBindingConfig as A, generateDeployWrapperIfNeeded as C, hasPrerenderSources as D, hasNonPageBackend as E, resolveStaticDeployPreset as F, toManifestSchedulesAndQueues as I, validateDeployMigrations as L, resolveDeployWranglerCompat as M, resolveFullDeployBuildCommand as N, log as O, resolveStaticBuildCommand as P, needsWrapper as R, ensureManagedHyperdrive as S, getGitCommit as T, hasDeploySchemaDrift as _, buildStaticManifest as a, assertWorkerMainUploaded as b, detectNonSpaFallbackWarning as c, printDeploySuccess as d, mergeAndLintRoutingRules as f, getDeploySchemaDriftMessage as g, assertDeploySchemaDriftFree as h, runFrameworkDeploy as i, resolveDeployWorkerMain as j, promptDeployProjectConfig as k, formatDeploySummary as l, warnUnpublishedRouting as m, runStaticDeploy as n, collectAndHashAssets as o, streamDirectR2Deploy as p, assertManagedDurableStateSupported as r, collectWorkerFiles as s, assembleVoidManifest as t, printDeployContext as u, assertEnvSchemaValid as v, getExitCode as w, createProjectFromSlug as x, assertProjectDeployAccess as y };