void 0.7.2 → 0.7.4

package/dist/{better-auth-shared-APuDaPqW.mjs → better-auth-shared-BrfZ78iY.mjs}

@@ -1,5 +1,6 @@
 import { a as isVoidSocialAuthProvider, r as getVoidAuthProviderEnvNames } from "./providers-B3aMxWzP.mjs";
 import { authContext } from "./runtime/auth.mjs";
+import { randomBytes, scrypt, timingSafeEqual } from "node:crypto";
 import { betterAuth } from "better-auth";
 //#region src/runtime/better-auth-shared.ts
 function isLocalHost(hostname) {
@@ -17,8 +18,47 @@ function readEnvString(env, ...keys) {
 		if (typeof value === "string" && value.length > 0) return value;
 	}
 }
+const PASSWORD_SALT_LENGTH = 16;
+const SCRYPT_KEY_LENGTH = 64;
+const SCRYPT_OPTIONS = {
+	N: 16384,
+	maxmem: 128 * 16384 * 16 * 2,
+	p: 1,
+	r: 16
+};
+function toHex(bytes) {
+	return Array.from(bytes, (byte) => byte.toString(16).padStart(2, "0")).join("");
+}
+function derivePasswordKey(password, salt) {
+	return new Promise((resolve, reject) => {
+		scrypt(password.normalize("NFKC"), salt, SCRYPT_KEY_LENGTH, SCRYPT_OPTIONS, (error, key) => {
+			if (error) {
+				reject(error);
+				return;
+			}
+			resolve(key);
+		});
+	});
+}
+const voidAuthPassword = {
+	async hash(password) {
+		const salt = toHex(randomBytes(PASSWORD_SALT_LENGTH));
+		return `${salt}:${(await derivePasswordKey(password, salt)).toString("hex")}`;
+	},
+	async verify({ hash, password }) {
+		const [salt, key, ...extra] = hash.split(":");
+		if (!salt || !key || extra.length > 0) return false;
+		const targetKey = await derivePasswordKey(password, salt);
+		const storedKey = Buffer.from(key, "hex");
+		if (storedKey.length !== targetKey.length) return false;
+		return timingSafeEqual(targetKey, storedKey);
+	}
+};
 function resolveEmailAndPassword(configuredProviders) {
-	if (!configuredProviders || configuredProviders.includes("email")) return { enabled: true };
+	if (!configuredProviders || configuredProviders.includes("email")) return {
+		enabled: true,
+		password: voidAuthPassword
+	};
 }
 function resolveSocialProviderCredentials(env, provider) {
 	const envNames = getVoidAuthProviderEnvNames(provider);
@@ -54,17 +94,27 @@ function appendAuthHeaders(target, source) {
 	});
 }
 function resolveUserConfig(userConfig, defaults, request, env, dialect) {
+	const mergeEmailAndPasswordDefaults = (options) => {
+		if (!defaults.emailAndPassword?.password || !options.emailAndPassword) return options;
+		return {
+			...options,
+			emailAndPassword: {
+				...options.emailAndPassword,
+				password: options.emailAndPassword.password ?? defaults.emailAndPassword.password
+			}
+		};
+	};
 	if (!userConfig) return defaults;
-	if (typeof userConfig === "function") return userConfig({
+	if (typeof userConfig === "function") return mergeEmailAndPasswordDefaults(userConfig({
 		defaults,
 		request,
 		env,
 		dialect
-	});
-	return {
+	}));
+	return mergeEmailAndPasswordDefaults({
 		...defaults,
 		...userConfig
-	};
+	});
 }
 function assertRuntimeDialect(runtime, dialect) {
 	if (runtime.dialect !== dialect) throw new Error(`auth: Runtime mismatch. Expected ${dialect}, received '${runtime.dialect}'.`);

package/dist/cli/cli.mjs

@@ -1503,7 +1503,7 @@ else if (command === "deploy") {
 		R.error(err instanceof Error ? err.message : String(err));
 		process.exit(1);
 	}
-	import("../deploy-BkjqNk9U.mjs").then((n) => n.t).then(({ runDeploy }) => {
+	import("../deploy-CRIz77mw.mjs").then((n) => n.t).then(({ runDeploy }) => {
 		runDeploy(root, {
 			projectSlug: deployArgs.projectSlug,
 			dir: deployArgs.dir,
@@ -1519,7 +1519,7 @@ else if (command === "deploy") {
 else if (command === "project") runSubcommandGroup("project", projectSubcommands, parseProjectArgs, (root, parsed) => import("../project-cmd-DKiQYdSd.mjs").then(({ runProjectCommand }) => runProjectCommand(root, parsed)));
 else if (command === "secret") runSubcommandGroup("secret", secretSubcommands, parseSecretArgs, (root, parsed) => import("../secret-BXHx515u.mjs").then(({ runSecretCommand }) => runSecretCommand(root, parsed)));
 else if (command === "domain") runSubcommandGroup("domain", domainSubcommands, parseDomainArgs, (root, parsed) => import("../domain-CDQhvYNZ.mjs").then(({ runDomainCommand }) => runDomainCommand(root, parsed)));
-else if (command === "db") runSubcommandGroup("db", dbSubcommands, parseDbArgs, (root, parsed) => import("../db-ClNu7vYQ.mjs").then(({ runDbCommand }) => runDbCommand(root, parsed)));
+else if (command === "db") runSubcommandGroup("db", dbSubcommands, parseDbArgs, (root, parsed) => import("../db-RqxhOT2E.mjs").then(({ runDbCommand }) => runDbCommand(root, parsed)));
 else if (command === "env") runSubcommandGroup("env", envSubcommands, parseEnvArgs, (root, parsed) => import("../env-CnrQY2b6.mjs").then(({ runEnvCommand }) => runEnvCommand(root, parsed)));
 else if (command === "gen") runSubcommandGroup("gen", genSubcommands, parseGenArgs, (root, parsed) => import("../gen-C0EY2k27.mjs").then(({ runGenCommand }) => runGenCommand(root, parsed)));
 else if (command === "prepare") {
@@ -1531,7 +1531,7 @@ else if (command === "prepare") {
 		R.error(err instanceof Error ? err.message : String(err));
 		process.exit(1);
 	}
-	import("../prepare-DKkx-2Kt.mjs").then(({ runPrepareCommand }) => {
+	import("../prepare-PqAbhLte.mjs").then(({ runPrepareCommand }) => {
 		runPrepareCommand(root, prepareArgs).catch((err) => {
 			R.error(err.message ?? err);
 			process.exit(1);
@@ -1539,7 +1539,7 @@ else if (command === "prepare") {
 	});
 } else if (command === "init") {
 	const root = process.cwd();
-	import("../init-CPny6w9D.mjs").then(({ runInitCommand, parseInitArgs }) => {
+	import("../init-FMZ29UZW.mjs").then(({ runInitCommand, parseInitArgs }) => {
 		let initArgs;
 		try {
 			initArgs = parseInitArgs(args.slice(1));
@@ -1628,12 +1628,12 @@ else if (command === "-v" || command === "--version") {
 		const root = process.cwd();
 		switch (cmd) {
 			case "init": {
-				const { runInitCommand, parseInitArgs } = await import("../init-CPny6w9D.mjs");
+				const { runInitCommand, parseInitArgs } = await import("../init-FMZ29UZW.mjs");
 				await runInitCommand(root, parseInitArgs([]));
 				return;
 			}
 			case "deploy": {
-				const { runDeploy } = await import("../deploy-BkjqNk9U.mjs").then((n) => n.t);
+				const { runDeploy } = await import("../deploy-CRIz77mw.mjs").then((n) => n.t);
 				await runDeploy(root);
 				return;
 			}
@@ -1646,11 +1646,11 @@ else if (command === "-v" || command === "--version") {
 			case "project": return runSubcommandGroup("project", projectSubcommands, parseProjectArgs, (r, p) => import("../project-cmd-DKiQYdSd.mjs").then(({ runProjectCommand }) => runProjectCommand(r, p)));
 			case "secret": return runSubcommandGroup("secret", secretSubcommands, parseSecretArgs, (r, p) => import("../secret-BXHx515u.mjs").then(({ runSecretCommand }) => runSecretCommand(r, p)));
 			case "domain": return runSubcommandGroup("domain", domainSubcommands, parseDomainArgs, (r, p) => import("../domain-CDQhvYNZ.mjs").then(({ runDomainCommand }) => runDomainCommand(r, p)));
-			case "db": return runSubcommandGroup("db", dbSubcommands, parseDbArgs, (r, p) => import("../db-ClNu7vYQ.mjs").then(({ runDbCommand }) => runDbCommand(r, p)));
+			case "db": return runSubcommandGroup("db", dbSubcommands, parseDbArgs, (r, p) => import("../db-RqxhOT2E.mjs").then(({ runDbCommand }) => runDbCommand(r, p)));
 			case "env": return runSubcommandGroup("env", envSubcommands, parseEnvArgs, (r, p) => import("../env-CnrQY2b6.mjs").then(({ runEnvCommand }) => runEnvCommand(r, p)));
 			case "gen": return runSubcommandGroup("gen", genSubcommands, parseGenArgs, (r, p) => import("../gen-C0EY2k27.mjs").then(({ runGenCommand }) => runGenCommand(r, p)));
 			case "prepare": {
-				const { runPrepareCommand } = await import("../prepare-DKkx-2Kt.mjs");
+				const { runPrepareCommand } = await import("../prepare-PqAbhLte.mjs");
 				await runPrepareCommand(root, parsePrepareArgs([]));
 				return;
 			}

package/dist/{db-ClNu7vYQ.mjs → db-RqxhOT2E.mjs}

@@ -4,7 +4,7 @@ import { c as R, g as ge, y as ye } from "./dist-Dayj3gCK.mjs";
 import { r as readProjectConfig } from "./project-TqORyHn8.mjs";
 import { c as getToken, n as PlatformClient } from "./client-DCqnMpDt.mjs";
 import { c as getDatabaseDialect, f as readConfig } from "./config-BIa9HwVX.mjs";
-import { n as detectFramework } from "./plugin-inference-oZ6Ybu2_.mjs";
+import { r as detectFramework } from "./plugin-inference-CCtRkt9O.mjs";
 import { a as writeJournal, i as stripSqlExt, r as readJournal, t as collectMigrations } from "./collect-CjeZgz5D.mjs";
 import { n as listDrizzleArtifacts, r as validateMigrations, t as assertJournalCoherence } from "./validate-CaMavMxu.mjs";
 import { formatTimestamp } from "./gen-C0EY2k27.mjs";

package/dist/{deploy-BkjqNk9U.mjs → deploy-CRIz77mw.mjs}

@@ -6,8 +6,8 @@ import { c as R, g as ge, u as Se, v as ue, x as q, y as ye } from "./dist-Dayj3
 import { a as writeProjectConfig, r as readProjectConfig } from "./project-TqORyHn8.mjs";
 import { a as isExpiredTokenError, c as getToken, i as isCliOutdatedError, l as getTokenSource, n as PlatformClient, o as parsePlatformErrorBody, t as PlatformApiError, u as isStagingMode } from "./client-DCqnMpDt.mjs";
 import { c as getDatabaseDialect, f as readConfig, l as isNodeTarget, p as resolveBindingNames } from "./config-BIa9HwVX.mjs";
-import { i as scanJobsSync, n as scanWebSocketRoutesSync, r as scanQueuesSync, t as scanRoutes } from "./scan-C6HMEIdW.mjs";
-import { c as validateSsrEntry, n as detectFramework, r as inferProjectBindings, t as FRAMEWORK_SCAN_DIRS } from "./plugin-inference-oZ6Ybu2_.mjs";
+import { i as scanJobsSync, n as scanWebSocketRoutesSync, r as scanQueuesSync, t as scanRoutes } from "./scan-QtRTdh94.mjs";
+import { i as inferProjectBindings, l as validateSsrEntry, n as FRAMEWORK_SCAN_DIRS, r as detectFramework } from "./plugin-inference-CCtRkt9O.mjs";
 import { i as voidWarn, r as voidLog } from "./log-DXdqnmhF.mjs";
 import { t as discoverSchema } from "./discover-B7FkXBLB.mjs";
 import { t as findEnvFile } from "./env-types-DknSA4SO.mjs";
@@ -20,15 +20,15 @@ import { n as promptProjectSelection, r as promptProjectSetupAction, t as prompt
 import { r as resolveProjectBySlug, t as getRequestedProjectSlug } from "./resolve-project-DdjLQ2tB.mjs";
 import { n as lintDuplicateSources, r as mergeRoutingRules, t as lintDestinationSplats } from "./headers-YVkHjOyq.mjs";
 import { t as promptForLoginToken } from "./login-B5HHT32i.mjs";
-import { i as resolveProjectCommand, n as detectPreset, r as formatProjectCommand, t as FRAMEWORK_PRESETS } from "./preset-DFvePt0l.mjs";
+import { i as resolveProjectCommand, n as detectPreset, r as formatProjectCommand, t as FRAMEWORK_PRESETS } from "./preset-jKn1hQwP.mjs";
 import { createRequire } from "node:module";
-import { copyFileSync, cpSync, createWriteStream, existsSync, mkdirSync, readFileSync, readdirSync, renameSync, rmSync, symlinkSync, unlinkSync, writeFileSync } from "node:fs";
+import { copyFileSync, cpSync, createWriteStream, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, renameSync, rmSync, unlinkSync, writeFileSync } from "node:fs";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { build, loadEnv } from "vite";
-import { homedir, tmpdir } from "node:os";
-import { parse } from "jsonc-parser";
-import { execFile, execFileSync, execSync } from "node:child_process";
+import { homedir } from "node:os";
 import { createHash } from "node:crypto";
+import { parse } from "jsonc-parser";
+import { execFile, execFileSync, execSync, spawnSync } from "node:child_process";
 import { hash } from "blake3-jit";
 import ignore from "ignore";
 const SANDBOX_MIGRATION_TAG = "void-sandbox-v1";
@@ -77,9 +77,77 @@ function resolveSandboxImage(image, root) {
 //#region src/cli/wrangler.ts
 const COMPAT_DATE_RE = /^\d{4}-\d{2}-\d{2}$/;
 const NODEJS_ALS_FLAG = "nodejs_als";
+const NODEJS_COMPAT_FLAG = "nodejs_compat";
 const VOID_CONFIG_FILE = "void.json";
+const DEFAULT_LIVE_BINDING = "VOID_LIVE";
+const DEFAULT_LIVE_CLASS = "VoidLiveStreamDurableObject";
+const LIVE_MIGRATION_TAG = "live-v1";
 /** Latest compatibility date the Void test suite is pinned against. */
 const LATEST_KNOWN_COMPAT_DATE = "2026-02-24";
+function normalizeWranglerCompatibilityFlags(flags, options) {
+	const existingFlags = flags ?? [];
+	if (options?.needsNodejsCompat && !existingFlags.includes(NODEJS_COMPAT_FLAG)) return [...existingFlags.filter((flag) => flag !== NODEJS_ALS_FLAG), NODEJS_COMPAT_FLAG];
+	if (existingFlags.length === 0 || !existingFlags.includes(NODEJS_ALS_FLAG) && !existingFlags.includes(NODEJS_COMPAT_FLAG)) return [...existingFlags, NODEJS_ALS_FLAG];
+	return flags;
+}
+function hasDurableObjectSqliteMigration(migrations, className) {
+	return migrations.some((migration) => migration.new_sqlite_classes?.includes(className));
+}
+function nextDurableObjectMigrationTag(migrations, baseTag) {
+	const existingTags = new Set(migrations.map((migration) => migration.tag).filter(Boolean));
+	if (!existingTags.has(baseTag)) return baseTag;
+	let index = 2;
+	while (existingTags.has(`${baseTag}-${index}`)) index++;
+	return `${baseTag}-${index}`;
+}
+function resolveLiveBindingConfig(root, options) {
+	const durableObjectBindings = [...readWranglerDurableObjectBindings(root), ...options?.existingBindings ?? []];
+	const generated = findGeneratedLiveBinding(durableObjectBindings);
+	if (generated) return {
+		bindingName: generated.name,
+		className: generated.class_name
+	};
+	const usedBindings = new Set([...durableObjectBindings.map((binding) => binding.name), ...(options?.reservedBindings ?? []).filter((name) => typeof name === "string")]);
+	const usedClasses = new Set([...durableObjectBindings.map((binding) => binding.class_name), ...(options?.reservedClasses ?? []).filter((name) => typeof name === "string")]);
+	return {
+		bindingName: resolveGeneratedName(DEFAULT_LIVE_BINDING, usedBindings, "binding"),
+		className: resolveGeneratedName(DEFAULT_LIVE_CLASS, usedClasses, "class")
+	};
+}
+function readExistingLiveBindingConfig(root) {
+	const generated = findGeneratedLiveBinding(readWranglerDurableObjectBindings(root));
+	return generated ? {
+		bindingName: generated.name,
+		className: generated.class_name
+	} : void 0;
+}
+function readWranglerDurableObjectBindings(root) {
+	for (const name of ["wrangler.jsonc", "wrangler.json"]) try {
+		const bindings = parseJsonc(readFileSync(join(root, name), "utf-8")).durable_objects?.bindings;
+		if (!Array.isArray(bindings)) return [];
+		return bindings.filter((binding) => typeof binding.name === "string" && typeof binding.class_name === "string");
+	} catch {}
+	return [];
+}
+function isGeneratedLiveName(name, base) {
+	return name === base || name.match(generatedLiveNamePattern(base)) !== null;
+}
+function generatedLiveNamePattern(base) {
+	return new RegExp(`^${escapeRegExp(base)}_[0-9a-f]{8}$`);
+}
+function escapeRegExp(value) {
+	return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function findGeneratedLiveBinding(bindings) {
+	return bindings.find((binding) => isGeneratedLiveName(binding.name, "VOID_LIVE") && isGeneratedLiveName(binding.class_name, "VoidLiveStreamDurableObject"));
+}
+function resolveGeneratedName(base, used, kind) {
+	if (!used.has(base)) return base;
+	for (let attempt = 0;; attempt++) {
+		const candidate = `${base}_${createHash("sha256").update(`void/live:${kind}:${base}:${attempt}`).digest("hex").slice(0, 8)}`;
+		if (!used.has(candidate)) return candidate;
+	}
+}
 /**
 * Read compatibility settings from `wrangler.jsonc`/`wrangler.json` and
 * `void.json`, with priority: void.json > wrangler.jsonc > build output.
@@ -271,6 +339,29 @@ function syncWranglerBindings(root, bindings, options) {
 			modified = true;
 		}
 	}
+	if (bindings.needsLive || options?.live) {
+		const existingDurableObjectBindings = parsed.durable_objects?.bindings ?? [];
+		const liveConfig = typeof options?.live === "object" ? options.live : resolveLiveBindingConfig(root, {
+			existingBindings: existingDurableObjectBindings,
+			reservedBindings: options?.websockets?.map((route) => route.bindingName),
+			reservedClasses: [...options?.websockets?.map((route) => route.className) ?? [], options?.sandbox?.className]
+		});
+		if (!existingDurableObjectBindings.some((binding) => binding.name === liveConfig.bindingName)) {
+			parsed.durable_objects = { bindings: [...existingDurableObjectBindings, {
+				name: liveConfig.bindingName,
+				class_name: liveConfig.className
+			}] };
+			modified = true;
+		}
+		const migrations = Array.isArray(parsed.migrations) ? parsed.migrations : [];
+		if (!hasDurableObjectSqliteMigration(migrations, liveConfig.className)) {
+			parsed.migrations = [...migrations, {
+				tag: nextDurableObjectMigrationTag(migrations, LIVE_MIGRATION_TAG),
+				new_sqlite_classes: [liveConfig.className]
+			}];
+			modified = true;
+		}
+	}
 	if (created || modified) writeFileSync(configPath, JSON.stringify(parsed, null, 2) + "\n");
 	return created || modified;
 }
@@ -1259,6 +1350,7 @@ function toSlash(p) {
 //#endregion
 //#region src/cli/package.ts
 const textEncoder = new TextEncoder();
+const FRAMEWORK_LIVE_UNSUPPORTED_MESSAGE = "deploy: void/live is currently supported in Void apps only.";
 /**
 * Strip dev-only / internal-only fields from each rule before shipping the
 * manifest. The resulting entries contain only `{ source, destination, status }`.
@@ -1528,6 +1620,20 @@ function toSandboxManifest(sandbox) {
 		...sandbox.maxInstances != null && { maxInstances: sandbox.maxInstances }
 	};
 }
+function toLiveManifest(live) {
+	const bindingName = live?.bindingName ?? "VOID_LIVE";
+	const className = live?.className ?? "VoidLiveStreamDurableObject";
+	return {
+		bindingName,
+		className,
+		storage: "sqlite",
+		classes: [className],
+		migrations: [{
+			tag: LIVE_MIGRATION_TAG,
+			newSqliteClasses: [className]
+		}]
+	};
+}
 /**
 * If the user configured `routing.fallbacks` on a non-SPA app, the platform
 * still applies the rules but no `/* -> /index.html` SPA shell is synthesised
@@ -1570,6 +1676,7 @@ function buildVoidManifest(opts) {
 			binding: options.bindingNames?.sandbox ?? options.sandbox.binding
 		});
 	}
+	if (bindings.needsLive) manifest.live = toLiveManifest(options?.live);
 	if (migrations && migrations.length > 0) manifest.migrations = {
 		dialect: dialect ?? "sqlite",
 		pending: migrations.length
@@ -1663,6 +1770,7 @@ function buildFrameworkManifest(opts) {
 	if (opts.bindings.needsKV) manifest.bindings.kv = [po?.bindingNames?.kv ?? "KV"];
 	if (opts.bindings.needsR2) manifest.bindings.r2 = [po?.bindingNames?.r2 ?? "STORAGE"];
 	if (opts.bindings.needsAI) manifest.bindings.ai = true;
+	if (opts.bindings.needsLive) throw new Error(FRAMEWORK_LIVE_UNSUPPORTED_MESSAGE);
 	if (opts.migrations && opts.migrations.length > 0) manifest.migrations = {
 		dialect: opts.dialect ?? "sqlite",
 		pending: opts.migrations.length
@@ -1958,9 +2066,11 @@ function generateHandlersSource(root, features) {
 //#region src/cli/deploy.ts
 var deploy_exports = /* @__PURE__ */ __exportAll({
 	applyDeployEvent: () => applyDeployEvent,
+	ensurePreviouslyDeployedLiveBindingConfig: () => ensurePreviouslyDeployedLiveBindingConfig,
 	hasDeploySchemaDrift: () => hasDeploySchemaDrift,
 	promptDeployProjectConfig: () => promptDeployProjectConfig,
 	resolveAssetConfig: () => resolveAssetConfig,
+	resolveDeployLiveBindingConfig: () => resolveDeployLiveBindingConfig,
 	resolveDeployWranglerCompat: () => resolveDeployWranglerCompat,
 	resolveDistDir: () => resolveDistDir,
 	resolveStaticBuildCommand: () => resolveStaticBuildCommand,
@@ -1972,9 +2082,55 @@ var deploy_exports = /* @__PURE__ */ __exportAll({
 const drizzleKitBin = join(fileURLToPath(import.meta.resolve("drizzle-kit")), "..", "bin.cjs");
 const deployDriftCheckDir = join(".void", "deploy-drift-check");
 var DeployEventError = class extends Error {};
+const EMPTY_BINDINGS = {
+	needsD1: false,
+	needsKV: false,
+	needsR2: false,
+	needsAuth: false,
+	needsQueues: false,
+	needsAI: false,
+	needsSandbox: false
+};
 function getErrorMessage(error) {
 	return error instanceof Error ? error.message : String(error);
 }
+function readLiveBindingConfigFromDeployment(deployment) {
+	if (!deployment?.manifest) return;
+	let manifest;
+	try {
+		manifest = JSON.parse(deployment.manifest);
+	} catch {
+		return;
+	}
+	if (typeof manifest.live?.bindingName !== "string" || typeof manifest.live.className !== "string") return;
+	return {
+		bindingName: manifest.live.bindingName,
+		className: manifest.live.className
+	};
+}
+async function ensurePreviouslyDeployedLiveBindingConfig(root, client, projectId, cliLog) {
+	if (readExistingLiveBindingConfig(root)) return false;
+	const { deployments, activeDeploymentId } = await client.listDeployments(projectId);
+	const live = readLiveBindingConfigFromDeployment(deployments.find((deployment) => deployment.id === activeDeploymentId));
+	if (!live) return false;
+	const synced = syncWranglerBindings(root, {
+		...EMPTY_BINDINGS,
+		needsLive: true
+	}, { live });
+	if (synced) cliLog?.info("live_binding_restored", {
+		bindingName: live.bindingName,
+		className: live.className
+	});
+	return synced;
+}
+async function resolveDeployLiveBindingConfig(root, client, projectId, opts) {
+	if (opts.isFrameworkMode || !opts.needsLive) return;
+	await ensurePreviouslyDeployedLiveBindingConfig(root, client, projectId, opts.cliLog);
+	return resolveLiveBindingConfig(root, {
+		reservedBindings: opts.webSockets.map((route) => route.bindingName),
+		reservedClasses: [...opts.webSockets.map((route) => route.className), opts.sandboxClassName]
+	});
+}
 /**
 * Resolve the Cloudflare Workers Static Assets `not_found_handling` config.
 *
@@ -1997,8 +2153,14 @@ function getExitCode(error) {
 	if (typeof error === "object" && error !== null && "status" in error && typeof error.status === "number") return error.status;
 	return 1;
 }
-function resolveDeployWranglerCompat(root, config, buildOutputDir) {
-	return isNodeTarget(config.target) ? void 0 : readWranglerCompat(root, config, buildOutputDir);
+function resolveDeployWranglerCompat(root, config, buildOutputDir, requirements) {
+	if (isNodeTarget(config.target)) return;
+	const compat = readWranglerCompat(root, config, buildOutputDir);
+	const compatibilityFlags = normalizeWranglerCompatibilityFlags(compat.compatibilityFlags, { needsNodejsCompat: requirements?.authEnabled === true || requirements?.dialect === "postgresql" || requirements?.needsSandbox === true });
+	return compatibilityFlags === compat.compatibilityFlags ? compat : {
+		...compat,
+		compatibilityFlags
+	};
 }
 /**
 * Run the full deploy pipeline:
@@ -2489,6 +2651,10 @@ async function runFrameworkDeploy(root, config, client, detected, fwPreset, void
 		R.error("deploy: Void-managed Better Auth is only supported in Void apps. Use Better Auth's official integration for this framework instead.");
 		process.exit(1);
 	}
+	if (bindings.needsLive) {
+		R.error("deploy: void/live is currently supported in Void apps only.");
+		process.exit(1);
+	}
 	const migrationsDir = join(root, "db", "migrations");
 	assertDeploySchemaDriftFree(root, dialect);
 	const rawMigrations = collectMigrations(migrationsDir);
@@ -2548,7 +2714,7 @@ async function runFrameworkDeploy(root, config, client, detected, fwPreset, void
 		await generateWrapper(actualWorkerDir, actualWorkerMain, root, wrapperFeatures);
 		R.info("Wrapper generated");
 	}
-	const wranglerCompat = readWranglerCompat(root, voidConfig, workerDir);
+	const wranglerCompat = resolveDeployWranglerCompat(root, voidConfig, workerDir, { dialect });
 	const revalidate = voidConfig.routing?.revalidate;
 	const prerender = voidConfig.routing?.prerender;
 	const schedules = rawJobs.flatMap((job) => job.crons.map((cron) => ({
@@ -2587,8 +2753,8 @@ async function runFrameworkDeploy(root, config, client, detected, fwPreset, void
 	const packageOptions = {
 		bindingNames: resolveBindingNames(voidConfig.inference?.bindings),
 		workerMain: actualWorkerMain,
-		compatibilityDate: wranglerCompat.compatibilityDate,
-		compatibilityFlags: wranglerCompat.compatibilityFlags
+		compatibilityDate: wranglerCompat?.compatibilityDate,
+		compatibilityFlags: wranglerCompat?.compatibilityFlags
 	};
 	const manifest = buildFrameworkManifest({
 		frameworkName: detected.name,
@@ -2683,6 +2849,10 @@ async function runFullDeploy(root, config, client, fwPreset, skipBuild, gitMetad
 		R.error("deploy: Cloudflare Sandboxes are currently supported in Void apps only.");
 		process.exit(1);
 	}
+	if (isFrameworkMode && bindings.needsLive) {
+		R.error("deploy: void/live is currently supported in Void apps only.");
+		process.exit(1);
+	}
 	const sandboxConfig = bindings.needsSandbox ? resolveSandboxConfig(deployConfig, root) : void 0;
 	if (bindings.needsSandbox && requiresSandboxPlatformImage(deployConfig)) {
 		R.error("deploy: `sandbox.image` points at a local Dockerfile. Add `sandbox.platformImage` with a pushed registry image for `void deploy`, or deploy this sandbox directly with Wrangler.");
@@ -2740,6 +2910,13 @@ async function runFullDeploy(root, config, client, fwPreset, skipBuild, gitMetad
 	})));
 	const routeScan = await scanRoutes(root, { output: deployConfig.output });
 	const webSockets = routeScan.websockets ?? scanWebSocketRoutesSync(root);
+	const liveConfig = await resolveDeployLiveBindingConfig(root, client, config.projectId, {
+		isFrameworkMode,
+		needsLive: effectiveBindings.needsLive,
+		webSockets,
+		sandboxClassName: sandboxConfig?.className,
+		cliLog
+	});
 	const queues = scanQueuesSync(root).map((q) => ({
 		name: q.name,
 		bindingName: q.bindingName,
@@ -2763,7 +2940,7 @@ async function runFullDeploy(root, config, client, fwPreset, skipBuild, gitMetad
 		else revalidate = perPageRules;
 	}
 	if (deployConfig.output === "static" && pageScan && !isSsr) {
-		if (pageScan.pages.every((p) => p.prerender && (p.params.length === 0 && !p.catchAll || p.hasGetPrerenderPaths)) && !(hasRoutes || hasMiddleware || hasWebSockets || authEnabled) && schedules.length === 0 && queues.length === 0) {
+		if (pageScan.pages.every((p) => p.prerender && (p.params.length === 0 && !p.catchAll || p.hasGetPrerenderPaths)) && !(hasRoutes || hasMiddleware || hasWebSockets || authEnabled || liveConfig !== void 0) && schedules.length === 0 && queues.length === 0) {
 			R.info("All pages prerendered — deploying as static site");
 			cliLog?.info("full_to_static_redirect", { reason: "all_pages_prerendered" });
 			return runStaticDeploy(root, config, client, {
@@ -2785,7 +2962,11 @@ async function runFullDeploy(root, config, client, fwPreset, skipBuild, gitMetad
 		remoteMode: resolveRemoteMode(deployConfig.remote),
 		projectId: config.projectId
 	});
-	const wranglerCompat = resolveDeployWranglerCompat(root, deployConfig, join(distDir, workerDirName));
+	const wranglerCompat = resolveDeployWranglerCompat(root, deployConfig, join(distDir, workerDirName), {
+		authEnabled,
+		dialect,
+		needsSandbox: effectiveBindings.needsSandbox
+	});
 	const envVars = loadDeployEnv(root);
 	await assertEnvSchemaValid(root, client, config.projectId);
 	await applySchemaDefaultsToVars(root, envVars);
@@ -2826,6 +3007,7 @@ async function runFullDeploy(root, config, client, fwPreset, skipBuild, gitMetad
 		compatibilityDate: wranglerCompat?.compatibilityDate,
 		compatibilityFlags: wranglerCompat?.compatibilityFlags,
 		...sandboxConfig && { sandbox: sandboxConfig },
+		...liveConfig && { live: liveConfig },
 		revalidateQueryAllowlist: deployConfig.routing?.revalidateQueryAllowlist
 	};
 	const fallbackWarning = detectNonSpaFallbackWarning(assetConfig, fallbackRules);
@@ -2834,7 +3016,10 @@ async function runFullDeploy(root, config, client, fwPreset, skipBuild, gitMetad
 		console.warn(`[void] ${fallbackWarning}`);
 	}
 	const manifest = buildVoidManifest({
-		bindings: effectiveBindings,
+		bindings: liveConfig ? {
+			...effectiveBindings,
+			needsLive: true
+		} : effectiveBindings,
 		migrations: validatedMigrations,
 		schedules,
 		ssr: isSsr || hasRoutes || hasMiddleware || hasWebSockets || authEnabled,
@@ -2918,28 +3103,16 @@ function assertDeploySchemaDriftFree(root, dialect) {
 }
 function hasDeploySchemaDrift(root, dialect) {
 	if (!discoverSchema(root)) return false;
-	const driftRoot = mkDeployDriftCheckRoot();
+	const driftRoot = mkDeployDriftCheckRoot(root);
 	const driftProjectRoot = join(driftRoot, "project");
-	rmSync(driftRoot, {
-		recursive: true,
-		force: true
-	});
-	mkdirSync(driftRoot, { recursive: true });
 	createDeployDriftProject(root, driftProjectRoot);
 	try {
 		const migrationsDir = join(driftProjectRoot, "db", "migrations");
 		const before = snapshotDir(migrationsDir);
-		const driftConfigPath = writeDrizzleConfig(driftProjectRoot, dialect === "postgresql" ? "postgresql://dummy" : ":memory:", dialect);
-		execFileSync(process.execPath, [
-			drizzleKitBin,
-			"generate",
-			"--config",
-			driftConfigPath
-		], {
-			cwd: driftProjectRoot,
-			stdio: "pipe"
-		});
-		return !migrationSnapshotsEqual(before, snapshotDir(migrationsDir));
+		const output = runDrizzleKitGenerate(driftProjectRoot, writeDrizzleConfig(driftProjectRoot, dialect === "postgresql" ? "postgresql://dummy" : ":memory:", dialect));
+		const snapshotsEqual = migrationSnapshotsEqual(before, snapshotDir(migrationsDir));
+		if (snapshotsEqual && !output.includes("No schema changes, nothing to migrate")) throw new Error(output || "drizzle-kit generate finished without reporting schema status.");
+		return !snapshotsEqual;
 	} catch (error) {
 		throw new Error(formatDeploySchemaDriftCheckError(error));
 	} finally {
@@ -2947,8 +3120,26 @@ function hasDeploySchemaDrift(root, dialect) {
 			recursive: true,
 			force: true
 		});
+		cleanupDeployDriftCheckRoot(root);
 	}
 }
+function runDrizzleKitGenerate(root, configPath) {
+	const result = spawnSync(process.execPath, [
+		drizzleKitBin,
+		"generate",
+		"--config",
+		configPath
+	], {
+		cwd: root,
+		encoding: "utf-8"
+	});
+	const stderr = bufferToString(result.stderr);
+	const output = [stderr, bufferToString(result.stdout)].filter(Boolean).join("\n").trim();
+	if (result.error) throw result.error;
+	if (stderr) throw new Error(output);
+	if (result.status !== 0) throw new Error(output || `drizzle-kit generate exited with code ${result.status}.`);
+	return output;
+}
 function getDeploySchemaDriftMessage() {
 	return ["Schema drift detected between your Drizzle schema and db/migrations/.", "Run `void db generate`, review the generated migration, commit it yourself, then rerun `void deploy`."].join("\n");
 }
@@ -2967,6 +3158,8 @@ function extractExecErrorOutput(error) {
 	const stdout = "stdout" in error ? bufferToString(error.stdout) : "";
 	if (stderr) details.push(stderr);
 	if (stdout) details.push(stdout);
+	const message = "message" in error ? bufferToString(error.message) : "";
+	if (details.length === 0 && message) details.push(message);
 	return details.join("\n").trim();
 }
 function bufferToString(value) {
@@ -2979,32 +3172,26 @@ function createDeployDriftProject(root, driftProjectRoot) {
 	for (const entry of readdirSync(root, { withFileTypes: true })) {
 		if (entry.name === ".git" || entry.name === ".void" || entry.name === "node_modules") continue;
 		if (entry.name === "dist" || entry.name === "build" || entry.name === ".wrangler" || entry.name === ".turbo" || entry.name === ".next" || entry.name === ".svelte-kit" || entry.name === ".output") continue;
-		const source = join(root, entry.name);
-		const target = join(driftProjectRoot, entry.name);
-		if (entry.name === "db") {
-			cpSync(source, target, { recursive: true });
-			continue;
-		}
-		symlinkSync(source, target, entry.isDirectory() ? symlinkDirType() : "file");
-	}
-	const nodeModules = findNearestNodeModules(root);
-	if (nodeModules) symlinkSync(nodeModules, join(driftProjectRoot, "node_modules"), symlinkDirType());
-}
-function findNearestNodeModules(root) {
-	let current = root;
-	while (true) {
-		const candidate = join(current, "node_modules");
-		if (existsSync(candidate)) return candidate;
-		const parent = resolve(current, "..");
-		if (parent === current) return null;
-		current = parent;
+		cpSync(join(root, entry.name), join(driftProjectRoot, entry.name), { recursive: true });
 	}
 }
-function mkDeployDriftCheckRoot() {
-	return join(tmpdir(), `${deployDriftCheckDir.replaceAll("/", "-").replaceAll("\\", "-")}-${Date.now()}`);
+function mkDeployDriftCheckRoot(root) {
+	const driftCheckDir = join(root, deployDriftCheckDir);
+	rmSync(driftCheckDir, {
+		recursive: true,
+		force: true
+	});
+	mkdirSync(driftCheckDir, { recursive: true });
+	return mkdtempSync(join(driftCheckDir, "check-"));
 }
-function symlinkDirType() {
-	return process.platform === "win32" ? "junction" : "dir";
+function cleanupDeployDriftCheckRoot(root) {
+	const driftCheckDir = join(root, deployDriftCheckDir);
+	try {
+		if (existsSync(driftCheckDir) && readdirSync(driftCheckDir).length === 0) rmSync(driftCheckDir, {
+			recursive: true,
+			force: true
+		});
+	} catch {}
 }
 function snapshotDir(root) {
 	if (!existsSync(root)) return {};
@@ -3124,4 +3311,4 @@ function resolveWorkerDirName(distDir, fwPreset, buildCommand) {
 	throw new Error("deploy: Worker output not found. Expected dist/ssr/ or dist/rsc/.");
 }
 //#endregion
-export { resolveSandboxConfig as _, prerenderPagesNode as a, filterLoadedEnv as c, ensureWranglerCompatibilityDate as d, ensureWranglerNodejsAlsFlag as f, isSandboxEnabled as g, SANDBOX_MIGRATION_TAG as h, prerenderPages as i, resolveRemoteMode as l, syncWranglerBindings as m, resolveDistDir as n, DEFAULT_PROXY_URL as o, readWranglerCompat as p, resolveWorkerDirName as r, STAGING_PROXY_URL as s, deploy_exports as t, stripInternalEnvKeys as u };
+export { resolveSandboxConfig as C, isSandboxEnabled as S, readExistingLiveBindingConfig as _, prerenderPagesNode as a, syncWranglerBindings as b, filterLoadedEnv as c, LIVE_MIGRATION_TAG as d, ensureWranglerCompatibilityDate as f, normalizeWranglerCompatibilityFlags as g, nextDurableObjectMigrationTag as h, prerenderPages as i, resolveRemoteMode as l, hasDurableObjectSqliteMigration as m, resolveDistDir as n, DEFAULT_PROXY_URL as o, ensureWranglerNodejsAlsFlag as p, resolveWorkerDirName as r, STAGING_PROXY_URL as s, deploy_exports as t, stripInternalEnvKeys as u, readWranglerCompat as v, SANDBOX_MIGRATION_TAG as x, resolveLiveBindingConfig as y };