void 0.7.0 → 0.7.2

package/dist/{deploy-BPKblFx6.mjs → deploy-BkjqNk9U.mjs}

@@ -4,7 +4,7 @@ import { n as cliTitle, r as createSpinner, s as import_picocolors } from "./out
 import { t as findVoidAuthConfig } from "./config-CvHtTM0q.mjs";
 import { c as R, g as ge, u as Se, v as ue, x as q, y as ye } from "./dist-Dayj3gCK.mjs";
 import { a as writeProjectConfig, r as readProjectConfig } from "./project-TqORyHn8.mjs";
-import { a as parsePlatformErrorBody, c as getTokenSource, i as isExpiredTokenError, l as isStagingMode, n as PlatformClient, s as getToken, t as PlatformApiError } from "./client-snXOjrp1.mjs";
+import { a as isExpiredTokenError, c as getToken, i as isCliOutdatedError, l as getTokenSource, n as PlatformClient, o as parsePlatformErrorBody, t as PlatformApiError, u as isStagingMode } from "./client-DCqnMpDt.mjs";
 import { c as getDatabaseDialect, f as readConfig, l as isNodeTarget, p as resolveBindingNames } from "./config-BIa9HwVX.mjs";
 import { i as scanJobsSync, n as scanWebSocketRoutesSync, r as scanQueuesSync, t as scanRoutes } from "./scan-C6HMEIdW.mjs";
 import { c as validateSsrEntry, n as detectFramework, r as inferProjectBindings, t as FRAMEWORK_SCAN_DIRS } from "./plugin-inference-oZ6Ybu2_.mjs";
@@ -16,18 +16,19 @@ import { n as writeDrizzleConfig } from "./config-BzM9Dy7T.mjs";
 import { t as collectMigrations } from "./collect-CjeZgz5D.mjs";
 import { r as validateMigrations, t as assertJournalCoherence } from "./validate-CaMavMxu.mjs";
 import { t as scanPages } from "./scan-Ba4hFwlH.mjs";
-import { n as promptProjectSelection, r as promptProjectSetupAction, t as promptAndCreateProject } from "./create-project-BIA15W7z.mjs";
-import { r as resolveProjectBySlug, t as getRequestedProjectSlug } from "./resolve-project-Br5BR03U.mjs";
-import { n as lintDuplicateSources, r as mergeRoutingRules, t as lintDestinationSplats } from "./headers-DCXc7mDs.mjs";
-import { t as promptForLoginToken } from "./login-CkcXUiIu.mjs";
-import { i as resolveProjectCommand, n as detectPreset, r as formatProjectCommand, t as FRAMEWORK_PRESETS } from "./preset-D4I73kT4.mjs";
+import { n as promptProjectSelection, r as promptProjectSetupAction, t as promptAndCreateProject } from "./create-project-Bg88Kq_I.mjs";
+import { r as resolveProjectBySlug, t as getRequestedProjectSlug } from "./resolve-project-DdjLQ2tB.mjs";
+import { n as lintDuplicateSources, r as mergeRoutingRules, t as lintDestinationSplats } from "./headers-YVkHjOyq.mjs";
+import { t as promptForLoginToken } from "./login-B5HHT32i.mjs";
+import { i as resolveProjectCommand, n as detectPreset, r as formatProjectCommand, t as FRAMEWORK_PRESETS } from "./preset-DFvePt0l.mjs";
 import { createRequire } from "node:module";
-import { copyFileSync, cpSync, existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, symlinkSync, unlinkSync, writeFileSync } from "node:fs";
+import { copyFileSync, cpSync, createWriteStream, existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, symlinkSync, unlinkSync, writeFileSync } from "node:fs";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { build, loadEnv } from "vite";
-import { tmpdir } from "node:os";
+import { homedir, tmpdir } from "node:os";
 import { parse } from "jsonc-parser";
 import { execFile, execFileSync, execSync } from "node:child_process";
+import { createHash } from "node:crypto";
 import { hash } from "blake3-jit";
 import ignore from "ignore";
 const SANDBOX_MIGRATION_TAG = "void-sandbox-v1";
@@ -808,11 +809,17 @@ function trimSnippet(body) {
 function appendDeploymentLine(message, deploymentId) {
 	return deploymentId ? `${message}\nDeployment: ${deploymentId}` : message;
 }
+function appendLogLine(message, logPath) {
+	return logPath ? `${message}\nDetailed log: ${logPath}` : message;
+}
+function appendTrailingLines(message, deploymentId, logPath) {
+	return appendLogLine(appendDeploymentLine(message, deploymentId), logPath);
+}
 /**
 * Format a server-emitted `event: 'error'` payload with an optional deployment id.
 */
-function formatDeployFailureMessage(message, deploymentId) {
-	return appendDeploymentLine(message, deploymentId);
+function formatDeployFailureMessage(message, deploymentId, logPath) {
+	return appendTrailingLines(message, deploymentId, logPath);
 }
 /**
 * Format the "stream ended cleanly but no terminal event arrived" case.
@@ -821,8 +828,8 @@ function formatDeployFailureMessage(message, deploymentId) {
 * deploy" message — the server closed the NDJSON stream without emitting
 * `done` or `error`, so there is no underlying error to carry.
 */
-function formatConnectionLostMessage(deploymentId) {
-	return appendDeploymentLine("deploy: Connection lost during deploy.", deploymentId);
+function formatConnectionLostMessage(deploymentId, logPath) {
+	return appendTrailingLines("deploy: Connection lost during deploy.", deploymentId, logPath);
 }
 /**
 * Convert an exception thrown during the deploy NDJSON stream into a
@@ -837,18 +844,408 @@ function formatConnectionLostMessage(deploymentId) {
 *      during deploy: <original>` prefix so the caller can still tell network,
 *      parse, and transport errors apart.
 */
-function formatStreamDeployError(err, deploymentId) {
+function formatStreamDeployError(err, deploymentId, logPath) {
 	if (err instanceof PlatformApiError) {
 		const parsed = parsePlatformErrorBody(err.body);
 		const parsedError = parsed?.error ?? parsed?.message ?? null;
 		const effectiveDeploymentId = parsed?.deployment ?? null ?? deploymentId;
-		if (err.status === 409 && parsedError) return new Error(appendDeploymentLine(`deploy: Deploy failed: ${parsedError}`, effectiveDeploymentId));
+		if (isCliOutdatedError(err) && parsed?.message) return new Error(appendTrailingLines(parsed.message, effectiveDeploymentId, logPath));
+		if (err.status === 409 && parsedError) return new Error(appendTrailingLines(`deploy: Deploy failed: ${parsedError}`, effectiveDeploymentId, logPath));
 		const detail = parsedError ?? trimSnippet(err.body);
 		const base = detail ? `deploy: Deploy failed (HTTP ${err.status}): ${detail}` : `deploy: Deploy failed (HTTP ${err.status}).`;
-		return new Error(appendDeploymentLine(base, effectiveDeploymentId));
+		return new Error(appendTrailingLines(base, effectiveDeploymentId, logPath));
 	}
 	const original = err instanceof Error ? err.message : String(err);
-	return new Error(appendDeploymentLine(`deploy: Connection lost during deploy: '${original}'.`, deploymentId));
+	return new Error(appendTrailingLines(`deploy: Connection lost during deploy: '${original}'.`, deploymentId, logPath));
+}
+/**
+* Maximum retry attempts for a single R2 PUT before giving up. Matched to
+* the design doc 0068 spec: 5xx triggers retry, 4xx surfaces immediately.
+*/
+const MAX_R2_PUT_RETRIES = 3;
+/**
+* Retry backoff delays in milliseconds. After attempt `i` fails (5xx) we
+* sleep `RETRY_BACKOFF_MS[i]` before retrying. Indexed from 0; once the
+* array is exhausted we surface the error.
+*/
+const RETRY_BACKOFF_MS = [
+	250,
+	500,
+	1e3
+];
+var DirectR2PutError = class extends Error {
+	status;
+	hash;
+	path;
+	/**
+	* `body` is the response body text (may be empty / non-text). Useful in
+	* the surface error so users can correlate against R2-side errors like
+	* `BadDigest` (Content-MD5 mismatch) or signature errors.
+	*/
+	body;
+	constructor(status, hash, path, body) {
+		super(`R2 PUT failed for ${path} (${hash}): ${status}${body ? ` ${body}` : ""}`);
+		this.name = "DirectR2PutError";
+		this.status = status;
+		this.hash = hash;
+		this.path = path;
+		this.body = body;
+	}
+};
+/**
+* Issue direct-to-R2 PUTs for every item in `items`, bounded to
+* `R2_PUT_CONCURRENCY`. Surfaces the first failure (4xx immediately, 5xx
+* after retry exhaustion) as a `DirectR2PutError` carrying the asset path
+* and hash so the user can correlate against the JSONL log.
+*
+* Logs `r2_put_start` / `r2_put_end` per asset, plus `r2_put_retry` on
+* each retry attempt. Per-asset durations help identify slow uploads.
+*
+* Memory: each successful PUT clears `item.body` and invokes `onAfterPut`
+* so the caller can drop its own ref (e.g. delete from the in-memory
+* `assetFiles` cache). For huge deploys this keeps peak memory bounded by
+* the upload concurrency rather than the total bundle size.
+*/
+async function uploadAssetsToR2(items, cliLog, fetchImpl = fetch, onAfterPut) {
+	if (items.length === 0) return;
+	let firstError = null;
+	let nextIndex = 0;
+	const workerCount = Math.min(10, items.length);
+	const workers = [];
+	for (let w = 0; w < workerCount; w++) workers.push((async () => {
+		while (firstError === null) {
+			const i = nextIndex++;
+			if (i >= items.length) return;
+			try {
+				await uploadOne(items[i], cliLog, fetchImpl);
+			} catch (err) {
+				if (firstError === null) firstError = err;
+				return;
+			}
+			items[i].body = void 0;
+			onAfterPut?.(items[i]);
+		}
+	})());
+	await Promise.all(workers);
+	if (firstError !== null) throw firstError;
+}
+async function uploadOne(item, cliLog, fetchImpl) {
+	if (!item.body) throw new Error(`internal: uploadOne invoked for ${item.path} with no body`);
+	const body = item.body;
+	const startedAt = Date.now();
+	cliLog?.info("r2_put_start", {
+		hash: item.hash,
+		path: item.path,
+		sizeBytes: body.length
+	});
+	let attempt = 0;
+	while (true) {
+		let res;
+		try {
+			res = await fetchImpl(item.url, {
+				method: "PUT",
+				body: new Uint8Array(body),
+				headers: item.headers
+			});
+		} catch (err) {
+			if (attempt < MAX_R2_PUT_RETRIES) {
+				cliLog?.warn("r2_put_retry", {
+					hash: item.hash,
+					path: item.path,
+					attempt: attempt + 1,
+					status: 0,
+					error: err instanceof Error ? err.message : String(err)
+				});
+				await sleep(RETRY_BACKOFF_MS[attempt]);
+				attempt++;
+				continue;
+			}
+			cliLog?.error("r2_put_end", err, {
+				hash: item.hash,
+				path: item.path,
+				durationMs: Date.now() - startedAt,
+				status: 0
+			});
+			throw new DirectR2PutError(0, item.hash, item.path, err instanceof Error ? err.message : String(err));
+		}
+		if (res.ok) {
+			cliLog?.info("r2_put_end", {
+				hash: item.hash,
+				path: item.path,
+				durationMs: Date.now() - startedAt,
+				status: res.status
+			});
+			return;
+		}
+		const errBody = await safeReadText(res);
+		if (res.status >= 500 && attempt < MAX_R2_PUT_RETRIES) {
+			cliLog?.warn("r2_put_retry", {
+				hash: item.hash,
+				path: item.path,
+				attempt: attempt + 1,
+				status: res.status,
+				body: truncate(errBody)
+			});
+			await sleep(RETRY_BACKOFF_MS[attempt]);
+			attempt++;
+			continue;
+		}
+		cliLog?.error("r2_put_end", void 0, {
+			hash: item.hash,
+			path: item.path,
+			durationMs: Date.now() - startedAt,
+			status: res.status,
+			body: truncate(errBody)
+		});
+		throw new DirectR2PutError(res.status, item.hash, item.path, truncate(errBody));
+	}
+}
+async function safeReadText(res) {
+	try {
+		return await res.text();
+	} catch {
+		return "";
+	}
+}
+function truncate(s) {
+	return s.length > 500 ? `${s.slice(0, 500)}...` : s;
+}
+function sleep(ms) {
+	return new Promise((resolve) => setTimeout(resolve, ms));
+}
+//#endregion
+//#region src/cli/git-metadata.ts
+function git(root, args) {
+	try {
+		return execFileSync("git", args, {
+			cwd: root,
+			encoding: "utf-8",
+			stdio: [
+				"ignore",
+				"pipe",
+				"ignore"
+			]
+		}).trim();
+	} catch {
+		return null;
+	}
+}
+function stripGitSuffix(pathname) {
+	return pathname.endsWith(".git") ? pathname.slice(0, -4) : pathname;
+}
+function normalizeGitRemoteUrl(remote) {
+	if (!remote) return null;
+	const trimmed = remote.trim();
+	if (!trimmed) return null;
+	const scpLike = /^(?:[^@]+@)?([^:]+):(.+)$/.exec(trimmed);
+	if (scpLike && !trimmed.includes("://")) {
+		const host = scpLike[1]?.toLowerCase();
+		const path = stripGitSuffix(scpLike[2] ?? "").replace(/^\/+/, "");
+		return host && path ? `https://${host}/${path}` : null;
+	}
+	try {
+		const url = new URL(trimmed);
+		if (url.protocol !== "https:" && url.protocol !== "http:" && url.protocol !== "ssh:") return null;
+		const host = url.hostname.toLowerCase();
+		const path = stripGitSuffix(url.pathname).replace(/^\/+/, "");
+		return host && path ? `https://${host}/${path}` : null;
+	} catch {
+		return null;
+	}
+}
+function buildCommitUrl(repositoryUrl, commit) {
+	if (!repositoryUrl || !commit) return null;
+	try {
+		const url = new URL(repositoryUrl);
+		if (url.hostname === "github.com") return `${repositoryUrl}/commit/${commit}`;
+		if (url.hostname === "gitlab.com") return `${repositoryUrl}/-/commit/${commit}`;
+		if (url.hostname === "bitbucket.org") return `${repositoryUrl}/commits/${commit}`;
+	} catch {
+		return null;
+	}
+	return null;
+}
+function getGitRefFromEnv(env) {
+	if (env.GITHUB_HEAD_REF) return env.GITHUB_HEAD_REF;
+	if (env.GITHUB_REF_NAME) return env.GITHUB_REF_NAME;
+	if (env.GITHUB_REF) return env.GITHUB_REF.replace(/^refs\/(?:heads|tags|pull)\//, "");
+	return null;
+}
+function getGitHubRepositoryUrl(env) {
+	if (!env.GITHUB_REPOSITORY) return null;
+	return normalizeGitRemoteUrl(`${env.GITHUB_SERVER_URL ?? "https://github.com"}/${env.GITHUB_REPOSITORY}`);
+}
+function collectGitDeployMetadata(root, commit, env = process.env) {
+	const repositoryUrl = getGitHubRepositoryUrl(env) ?? normalizeGitRemoteUrl(git(root, [
+		"remote",
+		"get-url",
+		"origin"
+	]));
+	const gitRef = getGitRefFromEnv(env) ?? git(root, [
+		"rev-parse",
+		"--abbrev-ref",
+		"HEAD"
+	]);
+	return {
+		commit,
+		commitUrl: buildCommitUrl(repositoryUrl, commit),
+		gitRef: gitRef && gitRef !== "HEAD" ? gitRef : null,
+		repositoryUrl
+	};
+}
+//#endregion
+//#region src/cli/log-file.ts
+/**
+* Walk `err.cause` up to 6 levels and return a plain JSON-friendly chain.
+* Skips stack traces deliberately — keeps output line-oriented and readable.
+*/
+function describeErrorChain(err, depth = 0) {
+	if (depth > 5 || err == null) return String(err);
+	if (err instanceof Error) {
+		const node = {
+			name: err.name,
+			message: err.message
+		};
+		const code = err.code;
+		if (code !== void 0) node.code = code;
+		const errno = err.errno;
+		if (errno !== void 0) node.errno = errno;
+		const cause = err.cause;
+		if (cause != null) {
+			const sub = describeErrorChain(cause, depth + 1);
+			if (typeof sub === "object") node.cause = sub;
+			else node.cause = { message: sub };
+		}
+		return node;
+	}
+	return String(err);
+}
+/**
+* Flatten an error and its `cause` chain to a single inline string suitable
+* for stderr skimming. Mirrors `describeErrorChain`'s walk (depth cap 6,
+* same fields, no stack traces) but joins levels with ` -> ` instead of
+* nesting JSON.
+*/
+function formatErrorChainInline(err, depth = 0) {
+	if (depth > 5 || err == null) return String(err);
+	if (err instanceof Error) {
+		let head = err.name ? `${err.name}: ${err.message}` : err.message;
+		const code = err.code;
+		const errno = err.errno;
+		const tags = [];
+		if (code !== void 0) tags.push(`code=${code}`);
+		if (errno !== void 0) tags.push(`errno=${errno}`);
+		if (tags.length > 0) head = `${head} (${tags.join(" ")})`;
+		const cause = err.cause;
+		if (cause != null) return `${head} -> ${formatErrorChainInline(cause, depth + 1)}`;
+		return head;
+	}
+	return String(err);
+}
+function formatStderrLine(level, msg, err, fields) {
+	const parts = [level, msg];
+	if (fields) for (const [k, v] of Object.entries(fields)) {
+		if (v === void 0) continue;
+		let s;
+		if (v == null || typeof v === "number" || typeof v === "boolean") s = String(v);
+		else if (typeof v === "string") s = v.length > 200 ? `${v.slice(0, 200)}...` : v;
+		else try {
+			s = JSON.stringify(v);
+		} catch {
+			s = String(v);
+		}
+		parts.push(`${k}=${s}`);
+	}
+	if (err !== void 0) parts.push(`-> err=${formatErrorChainInline(err)}`);
+	return parts.join(" ");
+}
+function openDeployLog(opts) {
+	const mirror = opts?.mirrorToStderr === true;
+	const startedAt = Date.now();
+	let path = null;
+	let stream = null;
+	let broken = false;
+	let closed = false;
+	try {
+		const dir = join(homedir(), ".void", "logs");
+		mkdirSync(dir, { recursive: true });
+		const filePath = join(dir, `deploy-${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}.jsonl`);
+		stream = createWriteStream(filePath, {
+			flags: "a",
+			autoClose: true
+		});
+		stream.on("error", () => {
+			broken = true;
+		});
+		path = filePath;
+	} catch {
+		broken = true;
+		path = null;
+		stream = null;
+	}
+	function write(level, msg, err, fields) {
+		if (mirror) try {
+			process.stderr.write(`${formatStderrLine(level, msg, err, fields)}\n`);
+		} catch {}
+		if (broken || !stream || closed) return;
+		const now = Date.now();
+		const record = {
+			ts: now,
+			elapsedMs: now - startedAt,
+			lvl: level,
+			msg
+		};
+		if (fields) {
+			for (const [k, v] of Object.entries(fields)) if (v !== void 0 && k !== "ts" && k !== "elapsedMs" && k !== "lvl" && k !== "msg" && k !== "err") record[k] = v;
+		}
+		if (err !== void 0) record.err = describeErrorChain(err);
+		let line;
+		try {
+			line = `${JSON.stringify(record)}\n`;
+		} catch {
+			line = `${JSON.stringify({
+				ts: now,
+				elapsedMs: now - startedAt,
+				lvl: level,
+				msg,
+				err: "unserializable fields"
+			})}\n`;
+		}
+		try {
+			stream.write(line);
+		} catch {
+			broken = true;
+		}
+	}
+	return {
+		get path() {
+			return path;
+		},
+		info(msg, fields) {
+			write("info", msg, void 0, fields);
+		},
+		warn(msg, fields) {
+			write("warn", msg, void 0, fields);
+		},
+		error(msg, err, fields) {
+			write("error", msg, err, fields);
+		},
+		debug(msg, fields) {
+			write("debug", msg, void 0, fields);
+		},
+		close() {
+			if (closed) return Promise.resolve();
+			closed = true;
+			if (!stream) return Promise.resolve();
+			return new Promise((resolveClose) => {
+				try {
+					stream.end(() => resolveClose());
+				} catch {
+					resolveClose();
+				}
+			});
+		}
+	};
 }
 //#endregion
 //#region src/shared/utils.ts
@@ -950,8 +1347,88 @@ function computeAssetHash(content, filePath) {
 	return Buffer.from(hash(input)).toString("hex").slice(0, 32);
 }
 /**
+* Map of common asset file extensions → content type. Mirrors
+* `packages/dispatch/src/static.ts`'s MIME_TYPES table so the value the CLI
+* declares for the R2 PUT signature matches what dispatch will serve later
+* (dispatch reads `obj.httpMetadata?.contentType` first, falling back to
+* path-based inference). Keeping the tables aligned avoids a needless
+* mismatch where R2-stored content-type and serve-time content-type
+* disagree on the same asset.
+*/
+const ASSET_MIME_TYPES = {
+	html: "text/html; charset=utf-8",
+	htm: "text/html; charset=utf-8",
+	css: "text/css; charset=utf-8",
+	js: "text/javascript; charset=utf-8",
+	mjs: "text/javascript; charset=utf-8",
+	json: "application/json; charset=utf-8",
+	xml: "application/xml; charset=utf-8",
+	svg: "image/svg+xml; charset=utf-8",
+	txt: "text/plain; charset=utf-8",
+	csv: "text/csv; charset=utf-8",
+	png: "image/png",
+	jpg: "image/jpeg",
+	jpeg: "image/jpeg",
+	gif: "image/gif",
+	ico: "image/x-icon",
+	webp: "image/webp",
+	avif: "image/avif",
+	woff: "font/woff",
+	woff2: "font/woff2",
+	ttf: "font/ttf",
+	otf: "font/otf",
+	eot: "application/vnd.ms-fontobject",
+	pdf: "application/pdf",
+	wasm: "application/wasm",
+	webmanifest: "application/manifest+json; charset=utf-8",
+	map: "application/json; charset=utf-8",
+	mp4: "video/mp4",
+	webm: "video/webm",
+	mp3: "audio/mpeg",
+	ogg: "audio/ogg"
+};
+/**
+* Resolve the content-type to declare on a direct-to-R2 PUT for `path`.
+* The value is part of the signed Content-Type header on the presigned
+* URL — if the bytes are uploaded with a different content-type, R2
+* rejects the PUT (signature mismatch). Defaults to
+* `application/octet-stream` for unknown extensions.
+*/
+function getAssetContentType(path) {
+	return ASSET_MIME_TYPES[path.split(".").pop()?.toLowerCase() ?? ""] ?? "application/octet-stream";
+}
+/**
+* Compute MD5 of raw content as a 32-char lowercase hex string.
+*
+* Used as the wire-level upload-integrity primitive on direct-to-R2 PUTs:
+* R2's S3 compatibility layer enforces `Content-MD5` (RFC 1864) on PutObject,
+* so the upload itself fails if uploaded bytes don't match the declared MD5.
+* MD5 collision resistance is acceptable here because (a) this hash is purely
+* an upload-integrity primitive (BLAKE3 remains the canonical content key),
+* and (b) project-scoped storage (`assets/${projectId}/${blake3}`) means any
+* collision attack is exploitable only against the attacker's own project.
+*/
+function computeMd5(content) {
+	return createHash("md5").update(content).digest("hex");
+}
+/**
+* Compute both BLAKE3 (CF-compatible asset hash) and MD5 (wire-level R2
+* upload-integrity checksum) from a single in-memory buffer. Returned in
+* the v2 manifest entry shape for direct-to-R2 deploys.
+*
+* Single-pass: callers read the file once into `content`; this function
+* then derives both digests from that buffer. The file is never read twice.
+*/
+function computeAssetHashes(content, filePath) {
+	return {
+		blake3: computeAssetHash(content, filePath),
+		md5: computeMd5(content)
+	};
+}
+/**
 * Create a filter function that excludes .assetsignore, _headers, _redirects,
-* deploy-internal patterns, and any patterns listed in a .assetsignore file.
+* OS metadata files, deploy-internal patterns, and any patterns listed in a
+* .assetsignore file.
 * Matches Wrangler's createAssetsIgnoreFunction from workers-shared/utils/helpers.ts.
 */
 function createAssetsIgnoreFunction(dir, extraPatterns = []) {
@@ -959,6 +1436,7 @@ function createAssetsIgnoreFunction(dir, extraPatterns = []) {
 		"/.assetsignore",
 		"/_redirects",
 		"/_headers",
+		".DS_Store",
 		...extraPatterns
 	];
 	const assetsIgnorePath = join(dir, ".assetsignore");
@@ -992,6 +1470,9 @@ function checkWorkerJsAsset(relativePath, assetsIgnoreFilePresent) {
 /**
 * Collect all files in a directory, compute hashes, and return both the
 * manifest (for preflight) and the raw file map (for selective packaging).
+*
+* Each file is read from disk exactly once. Both BLAKE3 (storage key) and
+* MD5 (R2 upload-integrity) digests are derived from that single buffer.
 */
 async function collectAndHashAssets(dir, onProgress, opts = {}) {
 	const assetManifest = {};
@@ -1007,9 +1488,12 @@ async function collectAndHashAssets(dir, onProgress, opts = {}) {
 			if (isIgnored(relativePath)) continue;
 			checkWorkerJsAsset(relativePath, assetsIgnoreFilePresent);
 			const content = readFileSync(filePath);
+			const { blake3, md5 } = computeAssetHashes(content, filePath);
 			assetManifest[relativePath] = {
-				hash: computeAssetHash(content, filePath),
-				size: content.length
+				blake3,
+				md5,
+				size: content.length,
+				hash: blake3
 			};
 			assetFiles.set(relativePath, content);
 		}
@@ -1044,10 +1528,32 @@ function toSandboxManifest(sandbox) {
 		...sandbox.maxInstances != null && { maxInstances: sandbox.maxInstances }
 	};
 }
-async function packageBuild(distDir, workerDirName, bindings, migrations, schedules, ssr, framework, revalidate, vars, queues, prerender, assetConfig, options, neededAssets, hashedAssetsPrefix, headerRules, redirectRules, fallbackRules, dialect, webSockets, onProgress) {
-	const formData = new FormData();
+/**
+* If the user configured `routing.fallbacks` on a non-SPA app, the platform
+* still applies the rules but no `/* -> /index.html` SPA shell is synthesised
+* — unmatched paths fall through to the platform 404. Returns the warning
+* message string when that mismatch is detected, or `null` otherwise. Pure
+* function; callers decide whether/how to surface the message (CLI progress,
+* `console.warn`, etc.).
+*/
+function detectNonSpaFallbackWarning(assetConfig, fallbackRules) {
+	if (assetConfig?.not_found_handling === "single-page-application") return null;
+	if (!fallbackRules || fallbackRules.length === 0) return null;
+	return "routing.fallbacks is set but appType is not \"spa\"; fallbacks will be applied, but no \"/* -> /index.html\" SPA shell fallback is synthesised — unmatched paths fall through to the platform 404.";
+}
+/**
+* Build a Void-app deploy manifest from the inferred bindings + per-feature
+* inputs. Pure shape transformation: reads no files, has no I/O.
+*
+* Note: callers are responsible for surfacing the non-SPA-fallbacks warning
+* (see `detectNonSpaFallbackWarning`) before invoking this builder. The
+* builder itself stays I/O-free.
+*/
+function buildVoidManifest(opts) {
+	const { bindings, migrations, schedules, ssr, framework, revalidate, vars, queues, prerender, assetConfig, options, hashedAssetsPrefix, headerRules, redirectRules, fallbackRules, dialect, webSockets } = opts;
 	const manifest = {
 		version: 3,
+		assetManifestVersion: 2,
 		bindings: {}
 	};
 	if (bindings.needsAuth) manifest.auth = true;
@@ -1064,14 +1570,10 @@ async function packageBuild(distDir, workerDirName, bindings, migrations, schedu
 			binding: options.bindingNames?.sandbox ?? options.sandbox.binding
 		});
 	}
-	if (migrations && migrations.length > 0) {
-		manifest.migrations = {
-			dialect: dialect ?? "sqlite",
-			pending: migrations.length
-		};
-		onProgress?.(`Packaging ${migrations.length} migration${migrations.length === 1 ? "" : "s"}...`);
-		for (const m of migrations) formData.append(`migration:${m.name}`, new Blob([m.sql]), m.name);
-	}
+	if (migrations && migrations.length > 0) manifest.migrations = {
+		dialect: dialect ?? "sqlite",
+		pending: migrations.length
+	};
 	if (schedules && schedules.length > 0) manifest.schedules = schedules;
 	if (queues && queues.length > 0) manifest.queues = queues;
 	if (ssr) manifest.ssr = true;
@@ -1089,10 +1591,6 @@ async function packageBuild(distDir, workerDirName, bindings, migrations, schedu
 			...chain.assetConfig
 		};
 		resolvedFallbackRules = chain.fallbackRules;
-	} else if (fallbackRules && fallbackRules.length > 0) {
-		const msg = "routing.fallbacks is set but appType is not \"spa\"; fallbacks will be applied, but no \"/* -> /index.html\" SPA shell fallback is synthesised — unmatched paths fall through to the platform 404.";
-		onProgress?.(msg);
-		console.warn(`[void] ${msg}`);
 	}
 	if (resolvedAssetConfig) manifest.assetConfig = resolvedAssetConfig;
 	if (vars && Object.keys(vars).length > 0) manifest.vars = vars;
@@ -1105,45 +1603,40 @@ async function packageBuild(distDir, workerDirName, bindings, migrations, schedu
 	if (resolvedFallbackRules && resolvedFallbackRules.length > 0) manifest.fallbackRules = stripDevOnlyRuleFields(resolvedFallbackRules);
 	const websocketManifest = toWebSocketManifest(webSockets);
 	if (websocketManifest) manifest.websocket = websocketManifest;
-	formData.append("manifest", JSON.stringify(manifest));
-	onProgress?.("Packaging worker files...");
-	const workerDir = join(distDir, workerDirName);
-	const workerFiles = collectFiles(workerDir);
-	for (const filePath of workerFiles) {
-		const relativePath = toSlash(relative(workerDir, filePath));
-		if (!isWorkerModule(relativePath)) continue;
-		const content = readFileSync(filePath);
-		formData.append(`worker:${relativePath}`, new Blob([content]), relativePath);
-	}
-	const clientDir = join(distDir, "client");
+	return manifest;
+}
+/**
+* Read every worker module under `workerDir` once and return them as a map
+* keyed by relative path. Skipped files (build metadata, wrangler config,
+* non-module extensions) are filtered out by `isWorkerModule`. Reads each
+* file from disk exactly once — buffer threading downstream is the caller's
+* responsibility.
+*/
+function collectWorkerFiles(workerDir) {
+	const out = /* @__PURE__ */ new Map();
+	let workerPaths;
 	try {
-		const { isIgnored, assetsIgnoreFilePresent } = createAssetsIgnoreFunction(clientDir);
-		const clientFiles = collectFiles(clientDir);
-		let processed = 0;
-		for (const filePath of clientFiles) {
-			processed++;
-			await tickProgress(processed, clientFiles.length, onProgress, "Packaging assets");
-			const relativePath = toSlash(relative(clientDir, filePath));
-			if (isIgnored("/" + relativePath)) continue;
-			checkWorkerJsAsset(relativePath, assetsIgnoreFilePresent);
-			if (neededAssets && !neededAssets.has("/" + relativePath)) continue;
-			const content = readFileSync(filePath);
-			formData.append(`asset:${relativePath}`, new Blob([content]), relativePath);
-		}
+		workerPaths = collectFiles(workerDir);
 	} catch (err) {
-		if (err instanceof Error && "code" in err && err.code === "ENOENT") {} else throw err;
+		if (err instanceof Error && "code" in err && err.code === "ENOENT") return out;
+		throw err;
 	}
-	if (neededAssets) formData.append("preflight", "true");
-	return formData;
+	for (const filePath of workerPaths) {
+		const relativePath = toSlash(relative(workerDir, filePath));
+		if (!isWorkerModule(relativePath)) continue;
+		out.set(relativePath, readFileSync(filePath));
+	}
+	return out;
 }
 /**
-* Package a static build (no worker) into a FormData ready for upload.
+* Build a static-deploy manifest. Pure shape transformation — no I/O.
 */
-async function packageStaticBuild(outputDir, appType, neededAssets, hashedAssetsPrefix, headerRules, redirectRules, fallbackRules, onProgress) {
-	const formData = new FormData();
+function buildStaticManifest(opts) {
+	const { appType, hashedAssetsPrefix, headerRules, redirectRules, fallbackRules } = opts;
 	const { assetConfig, fallbackRules: resolvedFallbackRules } = resolveSpaFallbackChain(appType, fallbackRules);
 	const manifest = {
 		version: 3,
+		assetManifestVersion: 2,
 		bindings: {},
 		type: appType,
 		assetConfig
@@ -1152,36 +1645,16 @@ async function packageStaticBuild(outputDir, appType, neededAssets, hashedAssets
 	if (headerRules && headerRules.length > 0) manifest.headerRules = headerRules;
 	if (redirectRules && redirectRules.length > 0) manifest.redirectRules = stripDevOnlyRuleFields(redirectRules);
 	if (resolvedFallbackRules && resolvedFallbackRules.length > 0) manifest.fallbackRules = stripDevOnlyRuleFields(resolvedFallbackRules);
-	formData.append("manifest", JSON.stringify(manifest));
-	const { isIgnored, assetsIgnoreFilePresent } = createAssetsIgnoreFunction(outputDir);
-	const files = collectFiles(outputDir);
-	let processed = 0;
-	for (const filePath of files) {
-		processed++;
-		await tickProgress(processed, files.length, onProgress, "Packaging assets");
-		const relativePath = toSlash(relative(outputDir, filePath));
-		if (isIgnored("/" + relativePath)) continue;
-		checkWorkerJsAsset(relativePath, assetsIgnoreFilePresent);
-		if (neededAssets && !neededAssets.has("/" + relativePath)) continue;
-		const content = readFileSync(filePath);
-		formData.append(`asset:${relativePath}`, new Blob([content]), relativePath);
-	}
-	if (neededAssets) formData.append("preflight", "true");
-	return formData;
+	return manifest;
 }
 /**
-* Package a framework build (Class B/C) into a FormData ready for upload.
-*
-* Unlike `packageBuild`, the worker and assets directories are absolute paths
-* (resolved from the project root + preset), and the worker directory may be
-* inside the assets directory (SvelteKit, Astro). Worker files are excluded
-* from asset collection when directories overlap.
+* Build a framework-deploy manifest. Pure shape transformation — no I/O.
 */
-async function packageFrameworkBuild(opts) {
-	const formData = new FormData();
+function buildFrameworkManifest(opts) {
 	const po = opts.packageOptions;
 	const manifest = {
 		version: 3,
+		assetManifestVersion: 2,
 		bindings: {}
 	};
 	const hasMigrations = opts.migrations && opts.migrations.length > 0;
@@ -1190,14 +1663,10 @@ async function packageFrameworkBuild(opts) {
 	if (opts.bindings.needsKV) manifest.bindings.kv = [po?.bindingNames?.kv ?? "KV"];
 	if (opts.bindings.needsR2) manifest.bindings.r2 = [po?.bindingNames?.r2 ?? "STORAGE"];
 	if (opts.bindings.needsAI) manifest.bindings.ai = true;
-	if (opts.migrations && opts.migrations.length > 0) {
-		manifest.migrations = {
-			dialect: opts.dialect ?? "sqlite",
-			pending: opts.migrations.length
-		};
-		opts.onProgress?.(`Packaging ${opts.migrations.length} migration${opts.migrations.length === 1 ? "" : "s"}...`);
-		for (const m of opts.migrations) formData.append(`migration:${m.name}`, new Blob([m.sql]), m.name);
-	}
+	if (opts.migrations && opts.migrations.length > 0) manifest.migrations = {
+		dialect: opts.dialect ?? "sqlite",
+		pending: opts.migrations.length
+	};
 	if (opts.schedules && opts.schedules.length > 0) manifest.schedules = opts.schedules;
 	if (opts.queues && opts.queues.length > 0) manifest.queues = opts.queues;
 	if (opts.revalidate != null && opts.revalidate !== 0) manifest.revalidate = opts.revalidate;
@@ -1217,38 +1686,7 @@ async function packageFrameworkBuild(opts) {
 	if (opts.fallbackRules && opts.fallbackRules.length > 0) manifest.fallbackRules = stripDevOnlyRuleFields(opts.fallbackRules);
 	const websocketManifest = toWebSocketManifest(opts.webSockets);
 	if (websocketManifest) manifest.websocket = websocketManifest;
-	formData.append("manifest", JSON.stringify(manifest));
-	const workerDirNorm = opts.workerDir.replace(/\\/g, "/");
-	const assetsDirNorm = opts.assetsDir.replace(/\\/g, "/");
-	const isOverlap = workerDirNorm.startsWith(assetsDirNorm + "/") || workerDirNorm === assetsDirNorm;
-	opts.onProgress?.("Packaging worker files...");
-	const workerFiles = collectFiles(opts.workerDir);
-	for (const filePath of workerFiles) {
-		const relativePath = toSlash(relative(opts.workerDir, filePath));
-		if (!isWorkerModule(relativePath)) continue;
-		const content = readFileSync(filePath);
-		formData.append(`worker:${relativePath}`, new Blob([content]), relativePath);
-	}
-	try {
-		const { isIgnored, assetsIgnoreFilePresent } = createAssetsIgnoreFunction(opts.assetsDir, opts.assetIgnorePatterns);
-		const assetFiles = collectFiles(opts.assetsDir);
-		let processed = 0;
-		for (const filePath of assetFiles) {
-			processed++;
-			await tickProgress(processed, assetFiles.length, opts.onProgress, "Packaging assets");
-			if (isOverlap && filePath.replace(/\\/g, "/").startsWith(workerDirNorm)) continue;
-			const relativePath = toSlash(relative(opts.assetsDir, filePath));
-			if (isIgnored("/" + relativePath)) continue;
-			checkWorkerJsAsset(relativePath, assetsIgnoreFilePresent);
-			if (opts.neededAssets && !opts.neededAssets.has("/" + relativePath)) continue;
-			const content = readFileSync(filePath);
-			formData.append(`asset:${relativePath}`, new Blob([content]), relativePath);
-		}
-	} catch (err) {
-		if (err instanceof Error && "code" in err && err.code === "ENOENT") {} else throw err;
-	}
-	if (opts.neededAssets) formData.append("preflight", "true");
-	return formData;
+	return manifest;
 }
 /**
 * Check if a file (by relative path) should be included as a worker module.
@@ -1528,6 +1966,7 @@ var deploy_exports = /* @__PURE__ */ __exportAll({
 	resolveStaticBuildCommand: () => resolveStaticBuildCommand,
 	resolveWorkerDirName: () => resolveWorkerDirName,
 	runDeploy: () => runDeploy,
+	runStaticDeploy: () => runStaticDeploy,
 	warnRedundantForceOn3xx: () => warnRedundantForceOn3xx
 });
 const drizzleKitBin = join(fileURLToPath(import.meta.resolve("drizzle-kit")), "..", "bin.cjs");
@@ -1573,6 +2012,28 @@ function resolveDeployWranglerCompat(root, config, buildOutputDir) {
 async function runDeploy(root, options) {
 	console.log();
 	ge(cliTitle("deploy"));
+	const cliLog = openDeployLog({ mirrorToStderr: options?.debug === true || process.env.VOID_DEPLOY_DEBUG === "1" });
+	cliLog.info("deploy_start", {
+		cwd: root,
+		projectSlug: options?.projectSlug,
+		dir: options?.dir,
+		spa: options?.spa === true ? true : void 0,
+		skipBuild: options?.skipBuild === true ? true : void 0,
+		nodeVersion: process.version,
+		platform: process.platform,
+		arch: process.arch
+	});
+	try {
+		await runDeployInner(root, options, cliLog);
+		cliLog.info("deploy_end", { ok: true });
+	} catch (err) {
+		cliLog.error("deploy_end", err, { ok: false });
+		throw err;
+	} finally {
+		await cliLog.close().catch(() => {});
+	}
+}
+async function runDeployInner(root, options, cliLog) {
 	let reauthenticated = false;
 	while (true) try {
 		const token = getToken(root);
@@ -1580,38 +2041,54 @@ async function runDeploy(root, options) {
 			R.error("No auth token found. Run `void auth login` first.");
 			process.exit(1);
 		}
-		const client = new PlatformClient(token, { root });
+		const client = new PlatformClient(token, {
+			root,
+			cliLog
+		});
 		const requestedProjectSlug = getRequestedProjectSlug(options);
 		let config = null;
 		if (requestedProjectSlug) {
 			config = resolveProjectBySlug(await client.listProjects(), requestedProjectSlug);
-			if (!config) if (!process.stdin.isTTY) config = await createProjectFromSlug(root, client, requestedProjectSlug);
+			if (!config) if (!process.stdin.isTTY) config = await createProjectFromSlug(root, client, requestedProjectSlug, cliLog);
 			else {
 				const shouldCreate = await ue({ message: `Project "${requestedProjectSlug}" does not exist. Create it?` });
 				if (q(shouldCreate) || !shouldCreate) {
 					R.info("Deploy cancelled.");
 					process.exit(0);
 				}
-				config = await createProjectFromSlug(root, client, requestedProjectSlug);
+				config = await createProjectFromSlug(root, client, requestedProjectSlug, cliLog);
 			}
 		} else config = readProjectConfig(root);
 		if (!config && !process.stdin.isTTY) {
 			R.error("No project specified. Set `VOID_PROJECT`, pass `--project <slug>`, or commit `.void/project.json`.");
 			process.exit(1);
 		}
-		if (!config) config = await promptDeployProjectConfig(root, client);
+		if (!config) config = await promptDeployProjectConfig(root, client, cliLog);
+		cliLog.info("project_resolved", {
+			projectId: config.projectId,
+			slug: config.slug
+		});
 		const voidConfig = readConfig(root);
+		cliLog.info("config_resolved", {
+			target: voidConfig.target,
+			appType: voidConfig.inference?.appType,
+			output: voidConfig.output
+		});
 		const detected = detectFramework(root);
 		if (detected) {
-			const gitCommit = options?.skipBuild ? null : getGitCommit(root);
+			cliLog.info("framework_detected", {
+				name: detected.name,
+				class: detected.class
+			});
+			const gitMetadata = collectGitDeployMetadata(root, options?.skipBuild ? null : getGitCommit(root));
 			const fwPreset = FRAMEWORK_PRESETS[detected.name];
 			if (detected.class === "b" || detected.class === "c") {
 				if (!fwPreset) {
 					R.error(`No deploy preset found for framework "${detected.name}".`);
 					process.exit(1);
 				}
-				await runFrameworkDeploy(root, config, client, detected, fwPreset, voidConfig, options?.skipBuild, gitCommit);
-			} else await runFullDeploy(root, config, client, fwPreset, options?.skipBuild, gitCommit, detected);
+				await runFrameworkDeploy(root, config, client, detected, fwPreset, voidConfig, options?.skipBuild, gitMetadata, cliLog);
+			} else await runFullDeploy(root, config, client, fwPreset, options?.skipBuild, gitMetadata, detected, cliLog);
 			return;
 		}
 		let preset = null;
@@ -1635,14 +2112,14 @@ async function runDeploy(root, options) {
 			dir: options?.dir,
 			spa: options?.spa
 		});
-		const gitCommit = options?.skipBuild ? null : getGitCommit(root);
+		const gitMetadata = collectGitDeployMetadata(root, options?.skipBuild ? null : getGitCommit(root));
 		if (preset) {
 			preset = {
 				...preset,
 				buildCommand: resolveStaticBuildCommand(preset, voidConfig.inference?.build, Boolean(options?.dir))
 			};
-			await runStaticDeploy(root, config, client, preset, options?.skipBuild, gitCommit, void 0, void 0, void 0, void 0, voidConfig.routing);
-		} else await runFullDeploy(root, config, client, void 0, options?.skipBuild, gitCommit);
+			await runStaticDeploy(root, config, client, preset, options?.skipBuild, gitMetadata, void 0, void 0, void 0, void 0, voidConfig.routing, cliLog);
+		} else await runFullDeploy(root, config, client, void 0, options?.skipBuild, gitMetadata, void 0, cliLog);
 		return;
 	} catch (error) {
 		if (isExpiredTokenError(error)) {
@@ -1657,7 +2134,7 @@ async function runDeploy(root, options) {
 		throw error;
 	}
 }
-async function promptDeployProjectConfig(root, client) {
+async function promptDeployProjectConfig(root, client, cliLog) {
 	const projects = await client.listProjects();
 	if (await promptProjectSetupAction("Set up a Void project for deploy:", { includeLink: projects.length > 0 }) === "create") return promptAndCreateProject(root, client);
 	const result = await promptProjectSelection(projects, "Select a project to deploy to:", root, { includeCreate: false });
@@ -1668,6 +2145,10 @@ async function promptDeployProjectConfig(root, client) {
 	};
 	writeProjectConfig(root, config);
 	R.step(`Linked to ${import_picocolors.default.blue(config.slug)}`);
+	cliLog?.info("project_linked", {
+		projectId: config.projectId,
+		slug: config.slug
+	});
 	return config;
 }
 function resolveStaticBuildCommand(preset, buildOverride, hasExplicitDir = false) {
@@ -1729,49 +2210,182 @@ function applyDeployEvent(event, s) {
 	}
 	return { kind: "continue" };
 }
-async function streamDeploy(client, projectId, formData, s) {
+/**
+* Apply a streamed `DeployEvent` iterator to the spinner / cliLog and
+* resolve with the terminal `done` event (or throw on terminal error /
+* connection loss).
+*/
+async function streamDeployEvents(projectId, events, s, cliLog) {
+	const startedAt = Date.now();
 	let deploymentId = null;
 	let interrupted = false;
+	cliLog?.info("stream_start", { projectId });
 	const onSigint = () => {
 		interrupted = true;
 		s.stop("Deploy interrupted");
 		if (deploymentId) R.info(`Deployment: ${deploymentId}`);
 		else R.info("Deployment id was not received before the interrupt.");
+		cliLog?.warn("stream_interrupted", { deploymentId });
+		cliLog?.close().catch(() => {});
 		process.exit(130);
 	};
 	process.once("SIGINT", onSigint);
 	try {
-		for await (const event of client.deploy(projectId, formData)) {
+		for await (const event of events) {
 			const result = applyDeployEvent(event, s);
-			if (result.kind === "start") deploymentId = result.deploymentId;
-			else if (result.kind === "done") return result.event;
-			else if (result.kind === "error") throw new DeployEventError(formatDeployFailureMessage(result.message, deploymentId));
+			if (result.kind === "start") {
+				deploymentId = result.deploymentId;
+				cliLog?.info("stream_deployment_id", { deploymentId });
+			} else if (result.kind === "done") {
+				cliLog?.info("deploy_success", {
+					deploymentId,
+					url: result.event.url,
+					assets: result.event.assets,
+					workers: result.event.workers,
+					durationMs: Date.now() - startedAt
+				});
+				return result.event;
+			} else if (result.kind === "error") {
+				cliLog?.error("deploy_server_error", void 0, {
+					deploymentId,
+					message: result.message
+				});
+				throw new DeployEventError(formatDeployFailureMessage(result.message, deploymentId, cliLog?.path ?? null));
+			}
 		}
 	} catch (err) {
 		if (err instanceof DeployEventError) throw err;
 		if (interrupted) throw err;
+		cliLog?.error("stream_deploy_caught", err, { deploymentId });
 		s.stop("Deploy failed");
-		throw formatStreamDeployError(err, deploymentId);
+		throw formatStreamDeployError(err, deploymentId, cliLog?.path ?? null);
 	} finally {
 		process.removeListener("SIGINT", onSigint);
 	}
+	cliLog?.warn("stream_no_terminal_event", { deploymentId });
 	s.stop("Deploy failed");
-	throw new Error(formatConnectionLostMessage(deploymentId));
+	throw new Error(formatConnectionLostMessage(deploymentId, cliLog?.path ?? null));
+}
+/**
+* Direct-to-R2 deploy orchestration. Issues presigned PUT URLs for each
+* needed asset, uploads bytes directly to R2, then calls the manifest-only
+* deploy endpoint to finalize.
+*
+* Key invariants:
+*   1. No needed assets → skip presign + R2 PUT phase entirely (saves a
+*      round-trip when every asset was already present from a prior deploy).
+*   2. Asset bytes come exclusively from the in-memory `assetFiles` cache
+*      computed by `collectAndHashAssets` — files are NEVER re-read from
+*      disk during this flow (Codex Finding #2 in design doc 0068 review).
+*   3. R2 PUT failures (4xx, 5xx, network) are surfaced with the asset
+*      path + hash so the user can correlate against the JSONL trace.
+*/
+async function streamDirectR2Deploy(client, projectId, manifest, assetManifest, assetFiles, needed, gitMetadata, preflightUsed, workerFiles, s, cliLog) {
+	if (needed.length > 0) {
+		const neededPaths = new Set(needed);
+		const preBufferCount = assetFiles.size;
+		const allPaths = Array.from(assetFiles.keys());
+		for (const path of allPaths) if (!neededPaths.has(path)) assetFiles.delete(path);
+		if (assetFiles.size !== preBufferCount) cliLog?.info("asset_cache_pruned", {
+			before: preBufferCount,
+			after: assetFiles.size
+		});
+		s.message(`Requesting upload URLs for ${needed.length} asset(s)...`);
+		const seenBlake3 = /* @__PURE__ */ new Set();
+		const uniqueNeeded = [];
+		for (const path of needed) {
+			const entry = assetManifest[path];
+			if (!entry) throw new Error(`internal: preflight returned ${path} but assetManifest has no entry`);
+			if (seenBlake3.has(entry.blake3)) continue;
+			seenBlake3.add(entry.blake3);
+			uniqueNeeded.push(path);
+		}
+		const assetsToUpload = uniqueNeeded.map((path) => {
+			const entry = assetManifest[path];
+			return {
+				blake3: entry.blake3,
+				md5: entry.md5,
+				size: entry.size,
+				contentType: getAssetContentType(path)
+			};
+		});
+		cliLog?.info("presign_request_start", {
+			assetCount: assetsToUpload.length,
+			dedupedFrom: needed.length
+		});
+		const presignStartedAt = Date.now();
+		const urls = await client.requestUploadUrls(projectId, assetsToUpload);
+		cliLog?.info("presign_request_end", {
+			urlsReceived: Object.keys(urls).length,
+			durationMs: Date.now() - presignStartedAt
+		});
+		const items = uniqueNeeded.map((path) => {
+			const entry = assetManifest[path];
+			const presigned = urls[entry.blake3];
+			if (!presigned) throw new Error(`Platform did not return an upload URL for ${path} (blake3=${entry.blake3}). This indicates a server-side bug or a stale client.`);
+			const body = assetFiles.get(path);
+			if (!body) throw new Error(`internal: asset ${path} declared in manifest but missing from buffer cache`);
+			return {
+				path,
+				hash: entry.blake3,
+				body,
+				url: presigned.url,
+				headers: presigned.headers
+			};
+		});
+		s.message(`Uploading ${items.length} asset(s) to R2...`);
+		await uploadAssetsToR2(items, cliLog, void 0, (item) => {
+			assetFiles.delete(item.path);
+		});
+	} else cliLog?.info("presign_skipped", { reason: "no_needed_assets" });
+	const payload = {
+		manifest,
+		assetManifest,
+		source: getTokenSource(),
+		commit: gitMetadata?.commit ?? null,
+		repositoryUrl: gitMetadata?.repositoryUrl ?? null,
+		commitUrl: gitMetadata?.commitUrl ?? null,
+		gitRef: gitMetadata?.gitRef ?? null,
+		preflight: preflightUsed ? "true" : null
+	};
+	if (workerFiles && workerFiles.size > 0) {
+		const encoded = {};
+		for (const [relPath, buf] of workerFiles) encoded[relPath] = buf.toString("base64");
+		payload.workerFiles = encoded;
+	}
+	s.message("Finalizing deploy...");
+	cliLog?.info("finalize_start", {
+		workerFileCount: workerFiles?.size ?? 0,
+		assetCount: Object.keys(assetManifest).length
+	});
+	const finalizeStartedAt = Date.now();
+	try {
+		return await streamDeployEvents(projectId, client.finalizeDeploy(projectId, payload), s, cliLog);
+	} finally {
+		cliLog?.info("finalize_end", { durationMs: Date.now() - finalizeStartedAt });
+	}
 }
 function formatKnownAssetSummary(result, skipped) {
 	const uploaded = result.assets - skipped;
 	return skipped > 0 ? `${result.assets} static asset(s) (${skipped} unchanged, ${uploaded} uploaded)` : `${result.assets} static asset(s)`;
 }
-async function runStaticDeploy(root, config, client, preset, skipBuild, commit, hashedAssetsPrefix, headerRules, redirectRules, fallbackRules, routing) {
+async function runStaticDeploy(root, config, client, preset, skipBuild, gitMetadata, hashedAssetsPrefix, headerRules, redirectRules, fallbackRules, routing, cliLog) {
 	const typeLabel = preset.appType === "spa" ? "Static SPA" : "Static Site";
 	R.info(`${typeLabel} deploy`);
+	cliLog?.info("deploy_mode", {
+		mode: "static",
+		appType: preset.appType
+	});
 	if (preset.buildCommand && !skipBuild) {
 		R.step("Building...");
+		cliLog?.info("build_start", { command: preset.buildCommand });
+		const buildStartedAt = Date.now();
 		execSync(preset.buildCommand, {
 			cwd: root,
 			stdio: "inherit"
 		});
-	}
+		cliLog?.info("build_end", { durationMs: Date.now() - buildStartedAt });
+	} else if (skipBuild) cliLog?.info("build_skipped", { reason: "skipBuild" });
 	if (!existsSync(preset.outputDir)) {
 		R.error(`deploy: Output directory '${preset.outputDir}' not found. Run the build first.`);
 		process.exit(1);
@@ -1793,17 +2407,32 @@ async function runStaticDeploy(root, config, client, preset, skipBuild, commit,
 	const s = createSpinner();
 	const onProgress = (msg) => s.message(msg);
 	s.start("Checking for changes...");
-	const { assetManifest } = await collectAndHashAssets(preset.outputDir, onProgress);
+	cliLog?.info("preflight_start", { dir: preset.outputDir });
+	const { assetManifest, assetFiles } = await collectAndHashAssets(preset.outputDir, onProgress);
 	const { needed, skipped } = await client.preflight(config.projectId, assetManifest);
 	s.stop("Checked for changes");
+	cliLog?.info("preflight_end", {
+		total: Object.keys(assetManifest).length,
+		needed: needed.length,
+		skipped
+	});
 	if (skipped > 0) R.info(`Skipping ${skipped} unchanged asset(s)`);
 	s.start("Packaging...");
+	cliLog?.info("package_start", { mode: "static" });
+	const packageStartedAt = Date.now();
 	const neededSet = skipped > 0 ? new Set(needed) : null;
-	const formData = await packageStaticBuild(preset.outputDir, preset.appType, neededSet, hashedAssetsPrefix ?? "assets", headerRules, redirectRules, fallbackRules, onProgress);
-	formData.append("assetManifest", JSON.stringify(assetManifest));
-	formData.append("source", getTokenSource());
-	if (commit) formData.append("commit", commit);
-	const result = await streamDeploy(client, config.projectId, formData, s);
+	const manifest = buildStaticManifest({
+		appType: preset.appType,
+		hashedAssetsPrefix: hashedAssetsPrefix ?? "assets",
+		headerRules,
+		redirectRules,
+		fallbackRules
+	});
+	cliLog?.info("package_end", {
+		mode: "static",
+		durationMs: Date.now() - packageStartedAt
+	});
+	const result = await streamDirectR2Deploy(client, config.projectId, manifest, assetManifest, assetFiles, needed, gitMetadata, neededSet !== null, void 0, s, cliLog);
 	Se([`${typeLabel} — ${formatKnownAssetSummary(result, skipped)}`].join("\n"), result.url);
 	ye("Done!");
 }
@@ -1821,17 +2450,24 @@ function warnRedundantForceOn3xx(count) {
 /**
 * Class B/C framework deploy: build with framework CLI, package with preset output paths.
 */
-async function runFrameworkDeploy(root, config, client, detected, fwPreset, voidConfig, skipBuild, commit) {
+async function runFrameworkDeploy(root, config, client, detected, fwPreset, voidConfig, skipBuild, gitMetadata, cliLog) {
 	R.info(`${detected.name} framework deploy`);
+	cliLog?.info("deploy_mode", {
+		mode: "framework",
+		framework: detected.name
+	});
 	const dialect = getDatabaseDialect(voidConfig);
 	const buildCmd = voidConfig.inference?.build ?? formatProjectCommand(root, fwPreset.buildCommand);
 	if (!skipBuild) {
 		R.step(`Building (${buildCmd})...`);
+		cliLog?.info("build_start", { command: buildCmd });
+		const buildStartedAt = Date.now();
 		execSync(voidConfig.inference?.build ?? resolveProjectCommand(root, fwPreset.buildCommand), {
 			cwd: root,
 			stdio: "inherit"
 		});
-	}
+		cliLog?.info("build_end", { durationMs: Date.now() - buildStartedAt });
+	} else cliLog?.info("build_skipped", { reason: "skipBuild" });
 	const workerDir = join(root, fwPreset.workerDir);
 	const assetsDir = join(root, fwPreset.assetsDir);
 	const frameworkAssetIgnorePatterns = fwPreset.workerDir === fwPreset.assetsDir && fwPreset.workerMain === "_worker.js" ? [`/${fwPreset.workerMain}`, "/_routes.json"] : [];
@@ -1931,45 +2567,54 @@ async function runFrameworkDeploy(root, config, client, detected, fwPreset, void
 	const s = createSpinner();
 	const onProgress = (msg) => s.message(msg);
 	s.start("Checking for changes...");
-	const { assetManifest } = await collectAndHashAssets(assetsDir, onProgress, { ignorePatterns: frameworkAssetIgnorePatterns });
+	cliLog?.info("preflight_start", { dir: assetsDir });
+	const { assetManifest, assetFiles } = await collectAndHashAssets(assetsDir, onProgress, { ignorePatterns: frameworkAssetIgnorePatterns });
 	const { needed, skipped } = await client.preflight(config.projectId, assetManifest, true);
 	s.stop("Checked for changes");
+	cliLog?.info("preflight_end", {
+		total: Object.keys(assetManifest).length,
+		needed: needed.length,
+		skipped
+	});
 	if (skipped > 0) R.info(`Skipping ${skipped} unchanged asset(s)`);
 	s.start("Packaging...");
+	cliLog?.info("package_start", {
+		mode: "framework",
+		framework: detected.name
+	});
+	const packageStartedAt = Date.now();
 	const neededSet = skipped > 0 ? new Set(needed) : null;
-	const formData = await packageFrameworkBuild({
+	const packageOptions = {
+		bindingNames: resolveBindingNames(voidConfig.inference?.bindings),
+		workerMain: actualWorkerMain,
+		compatibilityDate: wranglerCompat.compatibilityDate,
+		compatibilityFlags: wranglerCompat.compatibilityFlags
+	};
+	const manifest = buildFrameworkManifest({
 		frameworkName: detected.name,
-		workerDir: actualWorkerDir,
 		workerMain: actualWorkerMain,
-		assetsDir,
 		bindings,
 		migrations: validatedMigrations,
 		schedules,
 		queues,
 		revalidate,
+		revalidateQueryAllowlist: voidConfig.routing?.revalidateQueryAllowlist,
 		prerender,
 		assetConfig: { not_found_handling: "none" },
 		vars: envVars,
-		packageOptions: {
-			bindingNames: resolveBindingNames(voidConfig.inference?.bindings),
-			workerMain: actualWorkerMain,
-			compatibilityDate: wranglerCompat.compatibilityDate,
-			compatibilityFlags: wranglerCompat.compatibilityFlags
-		},
-		revalidateQueryAllowlist: voidConfig.routing?.revalidateQueryAllowlist,
-		neededAssets: neededSet,
+		packageOptions,
 		hashedAssetsPrefix: fwPreset.hashedAssetsPrefix ?? "assets",
 		headerRules,
 		redirectRules,
 		fallbackRules,
-		dialect,
-		assetIgnorePatterns: frameworkAssetIgnorePatterns,
-		onProgress
+		dialect
 	});
-	formData.append("assetManifest", JSON.stringify(assetManifest));
-	formData.append("source", getTokenSource());
-	if (commit) formData.append("commit", commit);
-	const result = await streamDeploy(client, config.projectId, formData, s);
+	const workerFiles = collectWorkerFiles(actualWorkerDir);
+	cliLog?.info("package_end", {
+		mode: "framework",
+		durationMs: Date.now() - packageStartedAt
+	});
+	const result = await streamDirectR2Deploy(client, config.projectId, manifest, assetManifest, assetFiles, needed, gitMetadata, neededSet !== null, workerFiles, s, cliLog);
 	const summary = [`${result.workers} worker module(s), ${formatKnownAssetSummary(result, skipped)}`];
 	if (result.migrations) summary.push(`${result.migrations} migration(s) applied`);
 	if (schedules.length > 0) summary.push(`${schedules.length} cron job(s) scheduled`);
@@ -1982,10 +2627,16 @@ async function runFrameworkDeploy(root, config, client, detected, fwPreset, void
 	cleanupWrapper(root);
 	ye("Done!");
 }
-async function runFullDeploy(root, config, client, fwPreset, skipBuild, commit, detected) {
+async function runFullDeploy(root, config, client, fwPreset, skipBuild, gitMetadata, detected, cliLog) {
+	cliLog?.info("deploy_mode", {
+		mode: "full",
+		framework: detected?.name
+	});
 	if (!skipBuild) {
 		const buildCmd = formatProjectCommand(root, "vite build");
 		R.step(`Building (${buildCmd})...`);
+		cliLog?.info("build_start", { command: buildCmd });
+		const buildStartedAt = Date.now();
 		try {
 			execSync(resolveProjectCommand(root, "vite build"), {
 				cwd: root,
@@ -1995,10 +2646,12 @@ async function runFullDeploy(root, config, client, fwPreset, skipBuild, commit,
 					VOID_DEPLOY_PROJECT_ID: config.projectId
 				}
 			});
+			cliLog?.info("build_end", { durationMs: Date.now() - buildStartedAt });
 		} catch (err) {
+			cliLog?.error("build_failed", err, { durationMs: Date.now() - buildStartedAt });
 			process.exit(getExitCode(err));
 		}
-	}
+	} else cliLog?.info("build_skipped", { reason: "skipBuild" });
 	const frameworkBuildCmd = fwPreset ? formatProjectCommand(root, fwPreset.buildCommand) : void 0;
 	const distDir = resolveDistDir(root, fwPreset, frameworkBuildCmd);
 	let assetsPrefix = "assets";
@@ -2112,11 +2765,12 @@ async function runFullDeploy(root, config, client, fwPreset, skipBuild, commit,
 	if (deployConfig.output === "static" && pageScan && !isSsr) {
 		if (pageScan.pages.every((p) => p.prerender && (p.params.length === 0 && !p.catchAll || p.hasGetPrerenderPaths)) && !(hasRoutes || hasMiddleware || hasWebSockets || authEnabled) && schedules.length === 0 && queues.length === 0) {
 			R.info("All pages prerendered — deploying as static site");
+			cliLog?.info("full_to_static_redirect", { reason: "all_pages_prerendered" });
 			return runStaticDeploy(root, config, client, {
 				buildCommand: null,
 				outputDir: clientDir,
 				appType: "static"
-			}, true, commit, assetsPrefix, headerRules, redirectRules, fallbackRules);
+			}, true, gitMetadata, assetsPrefix, headerRules, redirectRules, fallbackRules, void 0, cliLog);
 		}
 	}
 	const uniquePrerenderPaths = deployConfig.output === "static" || isFrameworkMode ? [] : isNodeTarget(deployConfig.target) ? await collectPrerenderPathsNode({
@@ -2146,22 +2800,64 @@ async function runFullDeploy(root, config, client, fwPreset, skipBuild, commit,
 		authEnabled
 	});
 	s.start("Checking for changes...");
-	const { assetManifest } = await collectAndHashAssets(clientDir, onProgress);
+	cliLog?.info("preflight_start", { dir: clientDir });
+	const { assetManifest, assetFiles } = await collectAndHashAssets(clientDir, onProgress);
 	const { needed, skipped } = await client.preflight(config.projectId, assetManifest, true);
 	s.stop("Checked for changes");
+	cliLog?.info("preflight_end", {
+		total: Object.keys(assetManifest).length,
+		needed: needed.length,
+		skipped
+	});
 	if (skipped > 0) R.info(`Skipping ${skipped} unchanged asset(s)`);
 	s.start("Packaging...");
+	cliLog?.info("package_start", {
+		mode: "full",
+		isSsr,
+		hasRoutes,
+		hasMiddleware,
+		hasWebSockets,
+		authEnabled,
+		framework: detected?.name
+	});
+	const packageStartedAt = Date.now();
 	const neededSet = skipped > 0 ? new Set(needed) : null;
-	const formData = await packageBuild(distDir, workerDirName, effectiveBindings, validatedMigrations, schedules, isSsr || hasRoutes || hasMiddleware || hasWebSockets || authEnabled, isFrameworkMode ? detected.name : void 0, revalidate, envVars, queues, uniquePrerenderPaths, assetConfig, {
+	const voidPackageOptions = {
 		compatibilityDate: wranglerCompat?.compatibilityDate,
 		compatibilityFlags: wranglerCompat?.compatibilityFlags,
 		...sandboxConfig && { sandbox: sandboxConfig },
 		revalidateQueryAllowlist: deployConfig.routing?.revalidateQueryAllowlist
-	}, neededSet, assetsPrefix, headerRules, redirectRules, fallbackRules, dialect, webSockets, onProgress);
-	formData.append("assetManifest", JSON.stringify(assetManifest));
-	formData.append("source", getTokenSource());
-	if (commit) formData.append("commit", commit);
-	const result = await streamDeploy(client, config.projectId, formData, s);
+	};
+	const fallbackWarning = detectNonSpaFallbackWarning(assetConfig, fallbackRules);
+	if (fallbackWarning) {
+		onProgress?.(fallbackWarning);
+		console.warn(`[void] ${fallbackWarning}`);
+	}
+	const manifest = buildVoidManifest({
+		bindings: effectiveBindings,
+		migrations: validatedMigrations,
+		schedules,
+		ssr: isSsr || hasRoutes || hasMiddleware || hasWebSockets || authEnabled,
+		framework: isFrameworkMode ? detected.name : void 0,
+		revalidate,
+		vars: envVars,
+		queues,
+		prerender: uniquePrerenderPaths,
+		assetConfig,
+		options: voidPackageOptions,
+		hashedAssetsPrefix: assetsPrefix,
+		headerRules,
+		redirectRules,
+		fallbackRules,
+		dialect,
+		webSockets
+	});
+	const workerFiles = collectWorkerFiles(join(distDir, workerDirName));
+	cliLog?.info("package_end", {
+		mode: "full",
+		durationMs: Date.now() - packageStartedAt
+	});
+	const result = await streamDirectR2Deploy(client, config.projectId, manifest, assetManifest, assetFiles, needed, gitMetadata, neededSet !== null, workerFiles, s, cliLog);
 	const summary = [`${result.workers} worker module(s), ${formatKnownAssetSummary(result, skipped)}`];
 	if (result.migrations) summary.push(`${result.migrations} migration(s) applied`);
 	if (schedules.length > 0) summary.push(`${schedules.length} cron job(s) scheduled`);
@@ -2174,8 +2870,9 @@ async function runFullDeploy(root, config, client, fwPreset, skipBuild, commit,
 	Se(summary.join("\n"), result.url);
 	ye("Done!");
 }
-async function createProjectFromSlug(root, client, slug) {
+async function createProjectFromSlug(root, client, slug, cliLog) {
 	R.step(`Creating project ${import_picocolors.default.blue(slug)}...`);
+	cliLog?.info("project_create_start", { slug });
 	const project = await client.createProject(slug);
 	const config = {
 		projectId: project.id,
@@ -2183,10 +2880,16 @@ async function createProjectFromSlug(root, client, slug) {
 	};
 	writeProjectConfig(root, config);
 	R.success(`Project created: ${import_picocolors.default.blue(config.slug)}`);
+	cliLog?.info("project_create_success", {
+		projectId: config.projectId,
+		slug: config.slug
+	});
 	return config;
 }
 function getGitCommit(root) {
 	try {
+		const githubSha = process.env.GITHUB_SHA?.trim();
+		if (githubSha && /^[0-9a-f]{7,64}$/i.test(githubSha)) return githubSha;
 		execSync("git rev-parse --is-inside-work-tree", {
 			cwd: root,
 			stdio: "ignore"