void 1.2.1 → 1.4.0

package/dist/{deploy-7H32EnUs.mjs → deploy-CdM-LAxX.mjs}

@@ -1,49 +1,50 @@
 import { n as __toESM, t as __commonJSMin } from "./rolldown-runtime-3h0WiCiA.mjs";
 import { a as join, c as resolve, n as dirname, o as normalize, r as extname, s as relative, t as basename } from "./dist-ipQi0Q8y.mjs";
 import { t as require_picocolors } from "./picocolors-BsDfhxIw.mjs";
-import { r as detectFramework } from "./plugin-inference-DUjCd55H.mjs";
+import { r as detectFramework } from "./plugin-inference-CeiB6BG5.mjs";
 import { n as readProjectPaths, t as assertNoRootSourceConventionConflicts } from "./project-paths-DGu_QZ_Q.mjs";
-import { m as resolveBindingNames, p as readConfig, u as isNodeTarget } from "./config-DHgSEWT7.mjs";
-import { a as hasSandboxSqliteMigration, c as sandboxContainerConfig, i as assertSandboxNamespaceConfig, o as requiresSandboxPlatformImage, r as SANDBOX_MIGRATION_TAG, s as resolveSandboxConfig, t as analyzeApplicationSync } from "./application-analysis-fEqoSeMp.mjs";
+import { m as resolveBindingNames, p as readConfig, u as isNodeTarget } from "./config-OFOAimzt.mjs";
+import { a as hasSandboxSqliteMigration, c as sandboxContainerConfig, i as assertSandboxNamespaceConfig, o as requiresSandboxPlatformImage, r as SANDBOX_MIGRATION_TAG, s as resolveSandboxConfig, t as analyzeApplicationSync } from "./application-analysis-DDOQwiXk.mjs";
 import { t as collectMigrations } from "./collect-Dew86qce.mjs";
 import { o as validateSsrEntry } from "./entry-BEM8ZuGP.mjs";
 import { r as hasEmailHandlers } from "./email-B9ayYQEG.mjs";
-import { i as voidWarn } from "./log-BMwmN5Ae.mjs";
 import { a as resolveDistDir, c as hasDocumentRoutes, l as resolveAssetConfig, n as collectRevalidate, o as resolveWorkerDirName, r as hasRevalidate, s as hasApiRoutes } from "./isr-config-fZaJJ8t7.mjs";
 import { t as writeFileAtomic } from "./atomic-write-Dq6R0BPN.mjs";
 import { s as listPlatformConnections } from "./platform-registry-B9mWX9LO.mjs";
 import { c as writeDeploymentPlatform, n as readDeploymentPlatform, r as readProjectConfig } from "./project-rqDnVsJN.mjs";
 import { n as readGeneratedWranglerConfigFile } from "./generated-wrangler-config-DeWj5F9Y.mjs";
-import { i as persistCloudflareConfig, r as materializeCloudflareConfig, s as stashCloudflareDeployPointer } from "./cloudflare-config-DchHxPTo.mjs";
-import { A as syncWranglerWebSockets, C as readWranglerManagedQueueCleanupCandidates, D as sameMigrationsDir, E as resolveLiveBindingConfig, M as writeProvisionedWranglerConfig, N as writeWranglerPublishedTrafficSnapshot, a as LIVE_MIGRATION_TAG, c as bindingEntriesForField, h as nextDurableObjectMigrationTag, k as syncWranglerDurableObjects, m as hasDurableObjectSqliteMigration, o as acknowledgeWranglerManagedQueueRemovals, r as FRIENDLY_BINDING_NAMES, v as readExistingLiveBindingConfig, w as readWranglerPublishedTrafficSnapshot } from "./wrangler-F96NnLyb.mjs";
+import { a as persistCloudflareConfig, c as stashCloudflareDeployPointer, i as materializeCloudflareConfig } from "./cloudflare-config-CH1AylZT.mjs";
+import { A as syncWranglerWebSockets, C as readWranglerManagedQueueCleanupCandidates, D as sameMigrationsDir, E as resolveLiveBindingConfig, L as writeVoidProjectConfig, M as writeProvisionedWranglerConfig, N as writeWranglerPublishedTrafficSnapshot, a as LIVE_MIGRATION_TAG, c as bindingEntriesForField, h as nextDurableObjectMigrationTag, k as syncWranglerDurableObjects, m as hasDurableObjectSqliteMigration, o as acknowledgeWranglerManagedQueueRemovals, r as FRIENDLY_BINDING_NAMES, v as readExistingLiveBindingConfig, w as readWranglerPublishedTrafficSnapshot } from "./wrangler-I-scB_1t.mjs";
 import { r as trustedCloudflareWorkerAccessHeaders, t as cfAccessHeaders } from "./cf-access-BM9G0lhO.mjs";
 import { t as ensurePlatformAccessToken } from "./cf-access-CWP4avfP.mjs";
 import { a as getApiUrl, c as getToken, l as getTokenSource } from "./auth-B6iOCjKI.mjs";
-import { c as resolveRemoteMode, t as CLOUDFLARE_DEPLOY_BUILD_ENV } from "./env-BJjULvL0.mjs";
-import { a as buildEnv, n as readVersionMetadataBinding, r as selectNativeVersionMetadataBinding, t as CLOUDFLARE_PRESERVE_BINDINGS_BUILD_ENV } from "./version-metadata-tS39iW09.mjs";
-import { a as emailConfigInputs, c as renderAddressMap, d as collectPrerenderPathsNode, f as prerenderPages, i as createNodeEmailDns, l as renderEmailChecklist, n as SEND_EMAIL_BINDING, o as preflightEmail, p as prerenderPagesNode, r as applyEmailSetup, t as EMAIL_FROM_VAR, u as collectPrerenderPaths } from "./email-cloudflare-D03g2TkS.mjs";
-import { n as completeApplicationAnalysis, t as analyzeApplication } from "./application-routing-DAhNP4u3.mjs";
-import { a as record, i as migrateBuiltWranglerConfig, n as prepareCfFrameworkBuildOutput, r as prepareCfStaticBuildOutput, t as prepareCfBuildOutput } from "./cf-build-output-BhVxldCw.mjs";
+import { i as otherQueueConsumers, n as chooseCloudflareQueueName, o as scopedCloudflareQueueName, r as cloudflareQueueName } from "./dispatch-CLa2LThw.mjs";
+import { l as resolveRemoteMode, n as CLOUDFLARE_QUEUE_NAMES_BUILD_ENV, t as CLOUDFLARE_DEPLOY_BUILD_ENV } from "./env-BaMz0j7H.mjs";
+import { t as assertNoPrerenderFailures } from "./prerender-render-CaShbHJ3.mjs";
+import { a as buildEnv, n as readVersionMetadataBinding, r as selectNativeVersionMetadataBinding, t as CLOUDFLARE_PRESERVE_BINDINGS_BUILD_ENV } from "./version-metadata-D2vfMQzv.mjs";
+import { a as emailConfigInputs, c as renderAddressMap, d as isGeneratedAssetHeaders, g as prerenderPagesNode, h as prerenderPages, i as createNodeEmailDns, l as renderEmailChecklist, m as collectPrerenderPathsNode, n as SEND_EMAIL_BINDING, o as preflightEmail, p as collectPrerenderPaths, r as applyEmailSetup, t as EMAIL_FROM_VAR } from "./email-cloudflare-PMbAev9Q.mjs";
+import { n as completeApplicationAnalysis, t as analyzeApplication } from "./application-routing-4719u_kf.mjs";
+import { a as record, i as migrateBuiltWranglerConfig, n as prepareCfFrameworkBuildOutput, r as prepareCfStaticBuildOutput, t as prepareCfBuildOutput } from "./cf-build-output-XpNR9zoh.mjs";
 import { i as validateMigrations, t as assertJournalCoherence } from "./validate-CnZPMq4q.mjs";
 import { A as confirm, K as select, L as log, tt as isCancel } from "./dist-Cor9XGoz.mjs";
 import { r as getPackageDir } from "./agents-CuNtT0D_.mjs";
-import { a as isExpiredTokenError, r as PlatformClient } from "./client-BEkdj1kx.mjs";
+import { a as isExpiredTokenError, r as PlatformClient } from "./client-B3LnB_bE.mjs";
 import { o as formatCount, p as note, r as createSpinner, u as getErrorMessage } from "./output-BpgYODYx.mjs";
 import { t as getRequestedProjectSlug } from "./resolve-project-Xoi6eTWY.mjs";
 import { i as safePositional, r as readCfUploadOutput, t as CF_VERSION_SOURCE_MAX_OUTPUT_BYTES } from "./cf-command-values-ByHk0xg4.mjs";
 import { a as FRAMEWORK_PRESETS, c as hasBackendFiles, i as isCleanCloudflareExit, l as resolveCloudflareOperationArgv, o as detectPreset, s as formatProjectCommand, t as createCloudflareProcessRunner, u as resolveProjectCommand } from "./cloudflare-process-8jEYIeim.mjs";
-import { f as listSelfHostSecretNames, h as selfHostSchemaFailureMessage, i as SelfHostSecretListError, l as dischargeSelfHostEnvContext, n as SelfHostFirstDeployError, p as readEmittedWorkerVars, r as SelfHostSchemaError, s as deriveSelfHostEnvContextFromVars, t as SelfHostEnvValidationError } from "./env-validation-Dwq3PJzK.mjs";
-import { a as needsWrapper, r as cleanupWrapper, t as bundleEntry } from "./wrapper-D3sZyh2C.mjs";
-import { A as resolveDeployLiveBindingConfig, C as generateDeployWrapperIfNeeded, D as hasPrerenderSources, E as hasNonPageBackend, F as resolveStaticDeployPreset, I as toManifestSchedulesAndQueues, L as validateDeployMigrations, M as resolveDeployWranglerCompat, N as resolveFullDeployBuildCommand, O as log$1, P as resolveStaticBuildCommand, S as ensureManagedHyperdrive, T as getGitCommit, _ as hasDeploySchemaDrift, a as collectAndHashAssets, b as assertWorkerMainUploaded, c as formatDeploySummary, d as mergeAndLintRoutingRules, f as streamDirectR2Deploy, g as getDeploySchemaDriftMessage, h as assertDeploySchemaDriftFree, i as buildStaticManifest, j as resolveDeployWorkerMain, k as promptDeployProjectConfig, l as printDeployContext, m as warnUnpublishedRouting, n as runStaticDeploy, o as collectWorkerFiles, p as warnIgnoredNotFoundForFramework, r as buildFrameworkManifest, s as detectNonSpaFallbackWarning, t as assembleVoidManifest, u as printDeploySuccess, v as assertEnvSchemaValid, w as getExitCode, x as createProjectFromSlug, y as assertProjectDeployAccess } from "./deploy-managed-static-DlvcvnQT.mjs";
-import { a as checkCloudflareProvisionDrift, d as isQueueConfirmedAbsent, f as isRealD1Id, g as provisionCloudflareResources, i as assertValidResourceName, m as isRealKvId, s as deleteEnvVarCaseAware } from "./provision-DtROpNNI.mjs";
-import { c as scrubWranglerAuthCredentials, n as buildSchemaProbeEnv, o as resolveDeployTransport, r as deployChildEnv, s as scrubManagedDeployBuildMarkers, t as MANAGED_DEPLOY_BUILD_ENV } from "./deploy-transport-BzGEj0Ge.mjs";
-import { n as getCfCliVersion, r as getVoidUserAgent, t as publishCloudflareObservability } from "./cf-worker-settings-BECvvTVd.mjs";
+import { f as listSelfHostSecretNames, h as selfHostSchemaFailureMessage, i as SelfHostSecretListError, l as dischargeSelfHostEnvContext, n as SelfHostFirstDeployError, p as readEmittedWorkerVars, r as SelfHostSchemaError, s as deriveSelfHostEnvContextFromVars, t as SelfHostEnvValidationError } from "./env-validation-B3VobvXm.mjs";
+import { a as needsWrapper, r as cleanupWrapper, t as bundleEntry } from "./wrapper-BBl1rC32.mjs";
+import { A as promptDeployProjectConfig, C as ensureManagedHyperdrive, D as hasNonPageBackend, E as getGitCommit, F as resolveStaticBuildCommand, I as resolveStaticDeployPreset, L as toManifestSchedulesAndQueues, M as resolveDeployWorkerMain, N as resolveDeployWranglerCompat, O as hasPrerenderSources, P as resolveFullDeployBuildCommand, R as validateDeployMigrations, S as createProjectFromSlug, T as getExitCode, _ as getDeploySchemaDriftMessage, a as collectAndHashAssets, b as assertProjectDeployAccess, c as readWranglerHtmlHandling, d as printDeploySuccess, f as mergeAndLintRoutingRules, g as assertDeploySchemaDriftFree, h as warnUnpublishedRouting, i as buildStaticManifest, j as resolveDeployLiveBindingConfig, k as log$1, l as formatDeploySummary, m as warnIgnoredNotFoundForFramework, n as runStaticDeploy, o as collectWorkerFiles, p as streamDirectR2Deploy, r as buildFrameworkManifest, s as detectNonSpaFallbackWarning, t as assembleVoidManifest, u as printDeployContext, v as hasDeploySchemaDrift, w as generateDeployWrapperIfNeeded, x as assertWorkerMainUploaded, y as assertEnvSchemaValid } from "./deploy-managed-static-DjeBFG2c.mjs";
+import { a as checkCloudflareProvisionDrift, b as resolveWorkersDevComplianceRegion, d as isQueueConfirmedAbsent, f as isRealD1Id, g as provisionCloudflareResources, i as assertValidResourceName, m as isRealKvId, s as deleteEnvVarCaseAware } from "./provision-DztLJ97X.mjs";
+import { c as scrubWranglerAuthCredentials, n as buildSchemaProbeEnv, o as resolveDeployTransport, r as deployChildEnv, s as scrubManagedDeployBuildMarkers, t as MANAGED_DEPLOY_BUILD_ENV } from "./deploy-transport-DIq_gFTP.mjs";
+import { n as getCfCliVersion, r as getVoidUserAgent, t as publishCloudflareWorkerSettings } from "./cf-worker-settings-Dg27RzyT.mjs";
 import { t as sanitizeTerminalLogText } from "./terminal-log-text-D9ACPOuG.mjs";
-import { t as promptForLoginToken } from "./login-Cttnagmm.mjs";
-import { a as parseCloudflareAuthSession, i as ensureCloudflareAuthentication, n as cloudflareCredentialOverrides, t as CloudflareAuthenticationError } from "./cloudflare-auth-Byo_0_N9.mjs";
-import { a as createCloudflareEmptyDomainPublisher, i as createCloudflareEmptyCronPublisher } from "./cloudflare-operations-Dh9dEHJj.mjs";
+import { t as promptForLoginToken } from "./login-PcFy5mlC.mjs";
+import { a as parseCloudflareAuthSession, i as ensureCloudflareAuthentication, n as cloudflareCredentialOverrides, t as CloudflareAuthenticationError } from "./cloudflare-auth-DyD_kVFr.mjs";
+import { a as createCloudflareEmptyDomainPublisher, i as createCloudflareEmptyCronPublisher } from "./cloudflare-operations-Bc-7fN44.mjs";
 import { n as openMigrationValidationDatabase, t as SqliteMigrationError } from "./sqlite-validation-BzKMWnO4.mjs";
-import { a as discoverFrameworkWranglerFiles, i as writeVoidProjectConfig, t as migrateLegacyVoidConfig } from "./migrate-DyT2jJ8y.mjs";
+import { r as discoverFrameworkWranglerFiles, t as migrateLegacyVoidConfig } from "./migrate-B8S2xTcb.mjs";
 import { a as runMySqlMigrations } from "./runner-mysql-BWmbk5IE.mjs";
 import { i as runPgMigrations } from "./runner-pg-Cr3qrqi4.mjs";
 import { t as collectGitDeployMetadata } from "./git-metadata-D-gurjzG.mjs";
@@ -59,9 +60,10 @@ import { execFile, execSync, spawn } from "node:child_process";
 import { getWorkerAssetsDir, getWorkerBundleDir, getWorkerConfigPath, readBuildOutput } from "@cloudflare/build-output-utils";
 import { convertToWranglerConfig } from "@cloudflare/config";
 import ignore from "ignore";
-import { CloudflareWorkerInspectionError, activateCloudflareVersion, assertCloudflareBindingsPreserved, assertCloudflareDurableObjectLifecycleSupported, assertExistingCloudflareConfig, cloudflareCommandDiagnostic, encodeCloudflareVersionMessage, extractWorkersDevSubdomain, normalizeWorkersDevSubdomain, parseRootWranglerConfig, parseRootWranglerConfig as parseRootWranglerConfig$1, readBindingFieldPresence, readCloudflareTriggerConfig, readConfigEntryString, readExistingCloudflareWorker, readStoredResourceName, readWranglerTopLevelString, renderCloudflareStaticEntry, resolveD1MigrateTarget, stageCloudflareStaticAssets, writeCloudflareFrameworkDeployConfig, writeCloudflareStaticDeployConfig } from "@void/deploy-cloudflare";
+import { CloudflareWorkerInspectionError, activateCloudflareVersion, assertCloudflareBindingsPreserved, assertCloudflareDurableObjectLifecycleSupported, assertExistingCloudflareConfig, cloudflareCommandDiagnostic, encodeCloudflareVersionMessage, extractWorkersDevSubdomain, normalizeReadinessAccessOrigin, normalizeWorkersDevSubdomain, parseRootWranglerConfig, parseRootWranglerConfig as parseRootWranglerConfig$1, readBindingFieldPresence, readCloudflareTriggerConfig, readConfigEntryString, readExistingCloudflareWorker, readStoredResourceName, readWranglerTopLevelString, renderCloudflareStaticEntry, resolveD1MigrateTarget, stageCloudflareStaticAssets, writeCloudflareFrameworkDeployConfig, writeCloudflareStaticDeployConfig } from "@void/deploy-cloudflare";
 import { setTimeout as setTimeout$1 } from "node:timers/promises";
 import mime from "mime";
+import { Buffer as Buffer$1 } from "node:buffer";
 import { Minimatch } from "minimatch";
 //#region src/cli/cloudflare-candidate.ts
 const CANDIDATE_FILE = ".void/cloudflare-candidate.json";
@@ -217,6 +219,112 @@ async function maybeLinkCloudflareDeploy(root, options = {}, deps = {}) {
 	return isCancel(accepted) || accepted !== true ? "cancelled" : "existing";
 }
 //#endregion
+//#region src/cli/cloudflare-readiness.ts
+const STATE_FILE = join(".void", "cloudflare.json");
+/** Resolve the account subdomain without exposing Cloudflare credentials to project code. */
+function resolveCloudflareWorkersDevSubdomain(root, accountId, env = process.env) {
+	const configured = env.CLOUDFLARE_WORKERS_SUBDOMAIN;
+	if (configured !== void 0 && configured.trim().length > 0) {
+		const normalized = normalizeWorkersDevSubdomain(configured);
+		if (!normalized) throw new Error("deploy: CLOUDFLARE_WORKERS_SUBDOMAIN must be the account subdomain, for example \"my-team\" or \"my-team.workers.dev\".");
+		return normalized;
+	}
+	const cached = subdomainsByAccount(readCloudflareLocalState(root))[accountId];
+	return typeof cached === "string" ? normalizeWorkersDevSubdomain(cached) : void 0;
+}
+/**
+* Record `CF_ACCESS_READINESS_ORIGIN` before project code runs. `void.config.ts` is evaluated in
+* this process, so a later read of `process.env` could see a value that the project assigned,
+* for example through a dotenv import. `null` means unset. An already recorded value is kept.
+*/
+function withRecordedReadinessAccessOrigin(options, env = process.env) {
+	return options.readinessAccessOrigin !== void 0 ? options : {
+		...options,
+		readinessAccessOrigin: env.CF_ACCESS_READINESS_ORIGIN ?? null
+	};
+}
+/**
+* Validate the operator-selected origin that may receive readiness Access credentials when the
+* probe uses a route or Custom Domain. Pass the value that `withRecordedReadinessAccessOrigin`
+* recorded, not the current `process.env`.
+*/
+function resolveCloudflareReadinessAccessOrigin(env) {
+	const configured = env.CF_ACCESS_READINESS_ORIGIN?.trim();
+	if (!configured) return;
+	const origin = normalizeReadinessAccessOrigin(configured);
+	if (!origin) throw new Error("deploy: CF_ACCESS_READINESS_ORIGIN must be one exact https origin, without a wildcard, path, query, fragment, or credentials, for example \"https://app.example.com\".");
+	return origin;
+}
+/**
+* Read the account subdomain from the Cloudflare API when a first publish reports no URL and
+* no subdomain is configured or cached. The API returns only the account label, so this adds
+* `.fed` for FedRAMP High, as Wrangler does. A failed lookup resolves `unavailable`.
+*/
+async function readCloudflareWorkersDevSubdomain(options) {
+	if (!options.verifyUploader()) return {
+		ok: false,
+		reason: "uploader-changed"
+	};
+	let label;
+	try {
+		const result = await options.runWrangler({
+			type: "workers.subdomain.get",
+			configPath: options.configPath
+		}, { capture: true });
+		if (!isCleanCloudflareExit(result) || !result.data || typeof result.data !== "object" || !("subdomain" in result.data) || typeof result.data.subdomain !== "string") return {
+			ok: false,
+			reason: "unavailable"
+		};
+		label = result.data.subdomain;
+	} catch {
+		return {
+			ok: false,
+			reason: "unavailable"
+		};
+	}
+	const subdomain = normalizeWorkersDevSubdomain(options.complianceRegion === "fedramp_high" ? `${label}.fed` : label);
+	return subdomain ? {
+		ok: true,
+		subdomain
+	} : {
+		ok: false,
+		reason: "unavailable"
+	};
+}
+/** Cache a Wrangler-reported account subdomain for later no-preview version probes. */
+function rememberCloudflareWorkersDevSubdomain(root, accountId, url) {
+	const workersDevSubdomain = extractWorkersDevSubdomain(url);
+	if (!workersDevSubdomain) return false;
+	const current = readCloudflareLocalState(root);
+	const currentByAccount = subdomainsByAccount(current);
+	if (currentByAccount[accountId] === workersDevSubdomain) return false;
+	const { workersDevSubdomain: _legacy, ...state } = current;
+	const filePath = join(root, STATE_FILE);
+	mkdirSync(dirname(filePath), { recursive: true });
+	writeFileSync(filePath, JSON.stringify({
+		...state,
+		workersDevSubdomains: {
+			...currentByAccount,
+			[accountId]: workersDevSubdomain
+		}
+	}, null, 2) + "\n");
+	return true;
+}
+function subdomainsByAccount(state) {
+	const value = state.workersDevSubdomains;
+	return value && typeof value === "object" && !Array.isArray(value) ? value : {};
+}
+function readCloudflareLocalState(root) {
+	const filePath = join(root, STATE_FILE);
+	if (!existsSync(filePath)) return {};
+	try {
+		const parsed = JSON.parse(readFileSync(filePath, "utf-8"));
+		return typeof parsed === "object" && parsed !== null && !Array.isArray(parsed) ? parsed : {};
+	} catch {
+		return {};
+	}
+}
+//#endregion
 //#region src/cli/deploy-binding-snapshot.ts
 /** The id-bearing binding fields whose identity must survive the build unchanged. */
 const DEPLOY_BINDING_IDENTITY_FIELDS = {
@@ -786,7 +894,10 @@ async function computeDesiredCloudflareResources(root, voidConfig, configPath, a
 		};
 		reasons.set(binding, analysis.reasons.r2[0]);
 	}
-	desired.queues = analysis.queues.map((q) => q.name);
+	if (analysis.queues.length > 0) {
+		desired.queueNames = Object.fromEntries(analysis.queues.map((q) => [q.name, scopedCloudflareQueueName(toValidWorkerName(workerName), q.name)]));
+		desired.queues = Object.values(desired.queueNames);
+	}
 	if (needsDatabase && dialect !== "sqlite") {
 		const binding = "HYPERDRIVE";
 		desired.hyperdrive = {
@@ -1772,6 +1883,9 @@ async function ensureCloudflareAuthSecret(options) {
 	return { created: true };
 }
 //#endregion
+//#region src/cli/node-buffer.ts
+const Buffer$2 = Buffer$1;
+//#endregion
 //#region src/cli/cf-version-api.ts
 var CloudflareApiError = class extends Error {
 	status;
@@ -1797,6 +1911,31 @@ function textValue(value, label) {
 	if (typeof value !== "string") throw new Error(`The Cloudflare ${label} is missing from the verified Worker output.`);
 	return value;
 }
+/** Match cf's package collection for uploads that preserve secrets through the JSON API. */
+async function readPackageDependencies(directory) {
+	try {
+		const pkg = record(JSON.parse(readFileSync(join(directory, "package.json"), "utf8")));
+		const declared = {
+			...record(pkg?.dependencies),
+			...record(pkg?.devDependencies)
+		};
+		const { getInstalledPackageVersion } = await import("@cloudflare/workers-utils");
+		const dependencies = [];
+		for (const [name, packageJsonVersion] of Object.entries(declared)) {
+			if (dependencies.length >= 200) break;
+			if (typeof packageJsonVersion !== "string" || /^(workspace|catalog|file|link):/.test(packageJsonVersion)) continue;
+			const installedVersion = getInstalledPackageVersion(name, directory);
+			if (installedVersion) dependencies.push({
+				name,
+				packageJsonVersion,
+				installedVersion
+			});
+		}
+		return dependencies.length ? dependencies : void 0;
+	} catch {
+		return;
+	}
+}
 const moduleContentTypes = {
 	esm: "application/javascript+module",
 	cjs: "application/javascript",
@@ -2090,11 +2229,22 @@ function assetConfigFromOutput(value) {
 		...config.runWorkerFirst === void 0 ? {} : { run_worker_first: config.runWorkerFirst }
 	};
 }
-/**
-* The version API placement. Smart placement is normalized the same way as cf's own version
-* uploads. Targeted placement is rejected: the Workers beta version endpoint can drop its
-* target, and an atomic upload is live before a read-back could catch that.
-*/
+/** The region, host or hostname of a targeted placement. */
+function placementTarget(placement) {
+	if (!placement) return;
+	for (const kind of [
+		"region",
+		"host",
+		"hostname"
+	]) {
+		const value = placement[kind];
+		if (typeof value === "string" && value) return {
+			kind,
+			value
+		};
+	}
+}
+/** The version API placement, in the shape cf's own version uploads send. */
 function placementFromOutput(placement) {
 	if (!placement) return;
 	const hint = "hint" in placement ? placement.hint : void 0;
@@ -2102,8 +2252,22 @@ function placementFromOutput(placement) {
 		mode: "smart",
 		...hint ? { hint } : {}
 	};
-	const target = "region" in placement && placement.region && "region" || "host" in placement && placement.host && "host" || "hostname" in placement && placement.hostname && "hostname";
-	if (target) throw new Error(`Cloudflare placement.${target} cannot be deployed while the Worker has secrets. Remove cloudflare.placement from void.config.ts, or set it to { mode: 'smart' }.`);
+	const target = placementTarget(placement);
+	return target ? {
+		mode: "targeted",
+		[target.kind]: target.value
+	} : void 0;
+}
+/**
+* Whether the upload reply still names the requested target. The Workers beta version
+* endpoint has replied `placement: {}` after dropping one (terraform-provider-cloudflare#7273).
+* It now replies with the target alone, e.g. `{ region }`.
+*/
+function keepsPlacementTarget(placement, target) {
+	const reply = record(placement);
+	if (!reply) return false;
+	const targets = reply.target === void 0 ? [reply] : reply.target;
+	return Array.isArray(targets) && targets.length === 1 && record(targets[0])?.[target.kind] === target.value;
 }
 async function apiResult(url, token, method, body, verifyUploader, timeout = 12e4) {
 	assertUploaderUnchanged(verifyUploader);
@@ -2333,6 +2497,22 @@ async function ensureContainerApplications(options) {
 		assertContainerApplicationSettings(confirmed, plan);
 	}
 }
+/**
+* The `_headers` file a native build generated for its fingerprinted files.
+* This API takes it as a `_headers` module, as cf does on its JSON version
+* uploads. A user-authored `_headers` is not sent on this path.
+*/
+function readGeneratedAssetHeaders(output) {
+	if (!output.assetsDirectory) return;
+	let text;
+	try {
+		text = readFileSync(join(getWorkerAssetsDir(output.directory), "_headers"), "utf8");
+	} catch (cause) {
+		if (cause instanceof Error && "code" in cause && cause.code === "ENOENT") return;
+		throw cause;
+	}
+	return isGeneratedAssetHeaders(text) ? text : void 0;
+}
 async function uploadAssets(options) {
 	if (!options.output.assetsDirectory) return;
 	const directory = getWorkerAssetsDir(options.output.directory);
@@ -2460,6 +2640,12 @@ async function uploadPinnedCloudflareVersion(options) {
 			content_base64: readFileSync(join(getWorkerBundleDir(options.output.directory), name)).toString("base64")
 		});
 	}
+	const generatedHeaders = readGeneratedAssetHeaders(options.output);
+	if (generatedHeaders !== void 0) modules.push({
+		name: "_headers",
+		content_type: "text/plain",
+		content_base64: Buffer$2.from(generatedHeaders).toString("base64")
+	});
 	await preflightWorkflowExports({
 		exports,
 		accountUrl,
@@ -2489,6 +2675,7 @@ async function uploadPinnedCloudflareVersion(options) {
 		modules,
 		compatibility_date: config.compatibilityDate,
 		compatibility_flags: config.compatibilityFlags,
+		package_dependencies: await readPackageDependencies(options.output.directory),
 		bindings,
 		...config.limits ? { limits: {
 			cpu_ms: config.limits.cpuMs,
@@ -2522,6 +2709,8 @@ async function uploadPinnedCloudflareVersion(options) {
 	} catch {
 		throw new Error(`Cloudflare Worker version ${versionId} was uploaded${options.atomic ? " and may already be published" : ""}, but its Container applications could not be verified. Read back the Worker deployment and Container identities before retrying.`);
 	}
+	const target = placementTarget(config.placement);
+	if (target && !keepsPlacementTarget(uploaded.placement, target)) throw new Error(`Cloudflare did not keep placement.${target.kind} "${target.value}" on Worker version ${versionId}${options.atomic ? ", which is already live" : ", so it was not deployed"}. Deploy again, or set cloudflare.placement to { mode: 'smart' } in void.config.ts.`);
 	return {
 		id: versionId,
 		urls: Array.isArray(uploaded.urls) ? uploaded.urls.filter((url) => typeof url === "string") : []
@@ -2952,7 +3141,7 @@ function createCfVersionRunner(options) {
 				"versions",
 				"create",
 				"--prebuilt",
-				...operation.message ? ["--message", operation.message] : [],
+				...operation.message ? [`--message=${operation.message}`] : [],
 				...operation.secretsFilePath ? ["--secrets-file", operation.secretsFilePath] : [],
 				...operation.previewAlias ? ["--preview-alias", operation.previewAlias] : []
 			], command.capture));
@@ -2979,7 +3168,8 @@ function createCfVersionRunner(options) {
 					strategy: "percentage",
 					versions: parsed,
 					annotations: { "workers/message": operation.message }
-				})] : []
+				})] : [],
+				...operation.bypassDeploymentChecks ? ["--bypass-deployment-checks"] : []
 			], command.capture);
 		}
 		if (operation.type === "worker.deploy") {
@@ -2989,7 +3179,7 @@ function createCfVersionRunner(options) {
 			return uploadedResult(await run([
 				"deploy",
 				"--prebuilt",
-				...operation.message ? ["--message", operation.message] : [],
+				...operation.message ? [`--message=${operation.message}`] : [],
 				...operation.secretsFilePath ? ["--secrets-file", operation.secretsFilePath] : []
 			], command.capture));
 		}
@@ -3038,17 +3228,18 @@ function createCfVersionRunner(options) {
 					"deploy",
 					"--prebuilt"
 				], command.capture, directory);
-				if (isCleanCloudflareExit(deployed) && raw.observability !== void 0) {
+				if (isCleanCloudflareExit(deployed) && (raw.observability !== void 0 || raw.logpush !== void 0)) {
 					const credentials = options.pinnedUpload;
 					if (!credentials || !credentials.verifyUploader()) return failed("The Cloudflare settings publisher is unavailable.");
 					try {
 						const token = await credentials.getToken();
 						if (!token || !credentials.verifyUploader()) return failed("Cloudflare session is unavailable for publishing Worker settings.");
-						await publishCloudflareObservability({
+						await publishCloudflareWorkerSettings({
 							apiBaseUrl: credentials.apiBaseUrl,
 							accountId: credentials.accountId,
 							workerName,
 							observability: raw.observability,
+							logpush: raw.logpush,
 							headers: { Authorization: `Bearer ${token}` }
 						});
 					} catch (cause) {
@@ -3109,53 +3300,6 @@ function createCfVersionRunner(options) {
 	};
 }
 //#endregion
-//#region src/cli/cloudflare-readiness.ts
-const STATE_FILE = join(".void", "cloudflare.json");
-/** Resolve the account subdomain without exposing Cloudflare credentials to project code. */
-function resolveCloudflareWorkersDevSubdomain(root, accountId, env = process.env) {
-	const configured = env.CLOUDFLARE_WORKERS_SUBDOMAIN;
-	if (configured !== void 0 && configured.trim().length > 0) {
-		const normalized = normalizeWorkersDevSubdomain(configured);
-		if (!normalized) throw new Error("deploy: CLOUDFLARE_WORKERS_SUBDOMAIN must be the account subdomain, for example \"my-team\" or \"my-team.workers.dev\".");
-		return normalized;
-	}
-	const cached = subdomainsByAccount(readCloudflareLocalState(root))[accountId];
-	return typeof cached === "string" ? normalizeWorkersDevSubdomain(cached) : void 0;
-}
-/** Cache a Wrangler-reported account subdomain for later no-preview version probes. */
-function rememberCloudflareWorkersDevSubdomain(root, accountId, url) {
-	const workersDevSubdomain = extractWorkersDevSubdomain(url);
-	if (!workersDevSubdomain) return false;
-	const current = readCloudflareLocalState(root);
-	const currentByAccount = subdomainsByAccount(current);
-	if (currentByAccount[accountId] === workersDevSubdomain) return false;
-	const { workersDevSubdomain: _legacy, ...state } = current;
-	const filePath = join(root, STATE_FILE);
-	mkdirSync(dirname(filePath), { recursive: true });
-	writeFileSync(filePath, JSON.stringify({
-		...state,
-		workersDevSubdomains: {
-			...currentByAccount,
-			[accountId]: workersDevSubdomain
-		}
-	}, null, 2) + "\n");
-	return true;
-}
-function subdomainsByAccount(state) {
-	const value = state.workersDevSubdomains;
-	return value && typeof value === "object" && !Array.isArray(value) ? value : {};
-}
-function readCloudflareLocalState(root) {
-	const filePath = join(root, STATE_FILE);
-	if (!existsSync(filePath)) return {};
-	try {
-		const parsed = JSON.parse(readFileSync(filePath, "utf-8"));
-		return typeof parsed === "object" && parsed !== null && !Array.isArray(parsed) ? parsed : {};
-	} catch {
-		return {};
-	}
-}
-//#endregion
 //#region src/cli/deploy-cloudflare-helpers.ts
 /**
 * Discover the root wrangler config path the same way the build / bindings
@@ -3208,6 +3352,7 @@ async function connectCloudflareDeployAccount(options) {
 		log$1.error(`deploy: ${getErrorMessage(error)}`);
 		return null;
 	}
+	const complianceRegion = resolveWorkersDevComplianceRegion(process.env, readWranglerTopLevelString(rootConfig, "compliance_region"));
 	const pins = createCloudflareUploaderPins(root, deps);
 	let accountId = readWranglerTopLevelString(rootConfig, "account_id") ?? (process.env.CLOUDFLARE_ACCOUNT_ID?.trim() || void 0);
 	if (!accountId) {
@@ -3227,8 +3372,10 @@ async function connectCloudflareDeployAccount(options) {
 		}
 	}
 	let workersDevSubdomain;
+	let readinessAccessOrigin;
 	try {
 		workersDevSubdomain = resolveCloudflareWorkersDevSubdomain(root, accountId);
+		readinessAccessOrigin = resolveCloudflareReadinessAccessOrigin({ CF_ACCESS_READINESS_ORIGIN: options.readinessAccessOrigin ?? void 0 });
 	} catch (error) {
 		log$1.error(getErrorMessage(error));
 		return null;
@@ -3236,8 +3383,10 @@ async function connectCloudflareDeployAccount(options) {
 	return {
 		...pins,
 		apiBaseUrl,
+		complianceRegion,
 		accountId,
 		workersDevSubdomain,
+		readinessAccessOrigin,
 		runWrangler: deps.runWrangler ?? createDeployWranglerRunner(root, accountId, apiBaseUrl),
 		rootConfig
 	};
@@ -3323,7 +3472,21 @@ function cloudflareCandidateActivationOptions(options) {
 		},
 		readinessHeaders: cloudflareWorkerReadinessHeaders(),
 		workersDevSubdomain,
+		resolveWorkersDevSubdomain: async () => {
+			const { complianceRegion } = options;
+			if (complianceRegion === void 0) return {
+				ok: false,
+				reason: "unavailable"
+			};
+			return readCloudflareWorkersDevSubdomain({
+				configPath,
+				complianceRegion,
+				runWrangler,
+				verifyUploader: options.assertUploaderStillPinned
+			});
+		},
 		readinessHeadersWorkersDevSubdomain: process.env.CLOUDFLARE_WORKERS_SUBDOMAIN?.trim() ? workersDevSubdomain : void 0,
+		readinessHeadersOrigin: options.readinessAccessOrigin,
 		...createCloudflareEmptyTriggerPublishers({
 			accountId,
 			apiBaseUrl: options.apiBaseUrl,
@@ -3383,6 +3546,10 @@ async function activateCloudflareVersionWithProgress(activate, options) {
 	}
 }
 function formatCloudflareActivationError(result) {
+	const message = formatCloudflareActivationFailure(result);
+	return result.restoredOlderSecrets ? `${message}\nCloudflare refused to restore the previous version because this deploy changed a secret, so Void forced the restore. The previous version runs with its old secret values; deploy again to apply the new ones.` : message;
+}
+function formatCloudflareActivationFailure(result) {
 	const status = result.status === void 0 ? "" : ` (exit ${String(result.status)})`;
 	const cloudflareCode = result.cloudflareErrorCode === void 0 ? "" : ` Cloudflare error code: ${String(result.cloudflareErrorCode)}.`;
 	const diagnostic = result.diagnostic ? `\n\n${result.diagnostic}` : "";
@@ -3420,36 +3587,64 @@ function formatCloudflareActivationError(result) {
 			].join("\n");
 		case "readiness-staging-failed": return `deploy: Cloudflare could not stage the uploaded Worker Version at zero-percent traffic${status}; production traffic is unchanged.${cloudflareCode}${diagnostic}${result.cloudflareErrorCode === 10210 && (result.diagnostic ?? "").toLowerCase().includes("durable object migration") ? "\n\nReview the Durable Object migration, then run `void deploy --platform cloudflare --atomic`. For future deploys, set deploy.cloudflare.mode to \"atomic\" in void.config.ts." : result.cloudflareErrorCode === 100405 ? "\n\nThe new version declares different exports from the live version (for example a Durable Object or Workflow class), so Cloudflare cannot split traffic between them. Run `void deploy --platform cloudflare --atomic` once to publish it at 100% directly; it receives traffic before readiness is checked." : ""}`;
 		case "atomic-failed": return `deploy: Cloudflare could not publish the Worker atomically${status}; inspect production status before retrying.${cloudflareCode}${diagnostic}`;
-		case "atomic-output-invalid": return "deploy: Cloudflare published atomically but did not report a version id or URL. Inspect `void project status` immediately.";
+		case "atomic-output-invalid":
+			if (result.versionId) return formatCloudflarePublishWithoutUrl(`Cloudflare published Worker version ${result.versionId} atomically`, `If the app uses workers.dev, set CLOUDFLARE_WORKERS_SUBDOMAIN to your account subdomain ${WORKERS_SUBDOMAIN_EXAMPLE}.`);
+			return "deploy: Cloudflare published atomically but did not report its version id. Inspect `void project status` immediately.";
 		case "atomic-readiness-failed":
-		case "atomic-readiness-access-denied": return `deploy: the atomic Worker deployment is live, but /__void/ready could not be verified. Inspect \`void project status\` and Worker logs immediately.${diagnostic}`;
+		case "atomic-readiness-access-denied": return `deploy: the atomic Worker deployment is live, but /__void/ready could not be verified. Inspect \`void project status\` and Worker logs immediately.${diagnostic}${result.customRouteReadinessOrigin ? `\n\n${customRouteAccessHint(result.customRouteReadinessOrigin).join("\n")}` : ""}`;
 		case "readiness-failed": return ["deploy: the uploaded Worker Version did not pass /__void/ready.", formatCloudflareReadinessRestoration(result)].join("\n");
-		case "readiness-access-denied": return [
-			"deploy: Cloudflare Access blocked the uploaded Worker Version readiness probe.",
-			"For CI, set CF_ACCESS_CLIENT_ID and CF_ACCESS_CLIENT_SECRET to an admitted service token.",
-			"For a local deploy, set CF_ACCESS_TOKEN to a short-lived user JWT from cloudflared.",
-			"If the response is error 1050, create an Access application for this hostname; a token alone cannot bypass account default-deny.",
-			`Then retry. ${formatCloudflareReadinessRestoration(result)}`
-		].join("\n");
+		case "readiness-access-denied":
+			if (result.customRouteReadinessOrigin) return [
+				"deploy: Cloudflare Access blocked the uploaded Worker Version readiness probe.",
+				...customRouteAccessHint(result.customRouteReadinessOrigin),
+				ATOMIC_ACCESS_ALTERNATIVE,
+				formatCloudflareReadinessRestoration(result)
+			].join("\n");
+			return [
+				"deploy: Cloudflare Access blocked the uploaded Worker Version readiness probe.",
+				"For CI, set CF_ACCESS_CLIENT_ID and CF_ACCESS_CLIENT_SECRET to an admitted service token.",
+				"For a local deploy, set CF_ACCESS_TOKEN to a short-lived user JWT from cloudflared.",
+				"If the response is error 1050, create an Access application for this hostname; a token alone cannot bypass account default-deny.",
+				`Then retry. ${formatCloudflareReadinessRestoration(result)}`
+			].join("\n");
 		case "bootstrap-failed": return `deploy: Cloudflare could not bootstrap the first Worker deployment${status}.${cloudflareCode}${diagnostic}`;
-		case "bootstrap-output-invalid": return ["deploy: Cloudflare bootstrapped the first Worker deployment, but Wrangler", "did not report its version id and workers.dev URL. Inspect `void project status` before retrying."].join("\n");
+		case "bootstrap-output-invalid":
+			if (result.versionId) return formatCloudflarePublishWithoutUrl(`Cloudflare published the first Worker deployment as version ${result.versionId}`, `If the app uses workers.dev, enable workers.dev for this Worker in the Cloudflare dashboard. Then set CLOUDFLARE_WORKERS_SUBDOMAIN to your account subdomain ${WORKERS_SUBDOMAIN_EXAMPLE}.`);
+			return ["deploy: Cloudflare bootstrapped the first Worker deployment, but Wrangler", "did not report its version id. Inspect `void project status` before retrying."].join("\n");
 		case "bootstrap-readiness-failed": return [
 			"deploy: the first Worker deployment did not pass /__void/ready.",
 			"Cloudflare requires this bootstrap to be non-versioned, so the new Worker is already active;",
 			"inspect its logs and `void project status` before retrying."
 		].join("\n") + diagnostic;
-		case "bootstrap-readiness-access-denied": return [
-			"deploy: Cloudflare Access blocked the first Worker deployment readiness probe.",
-			"For CI, set CF_ACCESS_CLIENT_ID and CF_ACCESS_CLIENT_SECRET to an admitted service token;",
-			"for a local deploy, set CF_ACCESS_TOKEN to a short-lived user JWT from cloudflared.",
-			"If the response is error 1050, create an Access application for this hostname; a token alone cannot bypass account default-deny.",
-			"Then retry. Cloudflare requires the first deployment to be non-versioned, so the new",
-			"Worker is already active behind Access."
-		].join("\n");
+		case "bootstrap-readiness-access-denied":
+			if (result.customRouteReadinessOrigin) return [
+				"deploy: Cloudflare Access blocked the first Worker deployment readiness probe.",
+				"Cloudflare requires the first deployment to be non-versioned, so the new Worker is already active behind Access.",
+				...customRouteAccessHint(result.customRouteReadinessOrigin),
+				"Later deploys check readiness before traffic moves, so they need the same setting.",
+				ATOMIC_ACCESS_ALTERNATIVE
+			].join("\n");
+			return [
+				"deploy: Cloudflare Access blocked the first Worker deployment readiness probe.",
+				"For CI, set CF_ACCESS_CLIENT_ID and CF_ACCESS_CLIENT_SECRET to an admitted service token;",
+				"for a local deploy, set CF_ACCESS_TOKEN to a short-lived user JWT from cloudflared.",
+				"If the response is error 1050, create an Access application for this hostname; a token alone cannot bypass account default-deny.",
+				"Then retry. Cloudflare requires the first deployment to be non-versioned, so the new",
+				"Worker is already active behind Access."
+			].join("\n");
 		case "activation-failed": return `deploy: the ready Worker Version could not be activated${status}; production traffic is unchanged.`;
 		case "triggers-failed": return `deploy: the Worker activated, but Cloudflare trigger synchronization failed${status}. ${result.rollback === "succeeded" ? "Traffic was restored to the previous version." : result.rollback === "unavailable" ? result.previousVersionId === null ? "This was the first deployment, so no previous version was available to restore." : "Traffic or trigger restoration could not be completed. Inspect its routes, schedules, queues, and workflows in Cloudflare before retrying." : "Automatic traffic restoration failed; inspect `void project status` immediately."}`;
 	}
 }
+/** Explain why a custom-route readiness probe carried no Access credentials. */
+function customRouteAccessHint(origin) {
+	return [
+		`Void did not send Access credentials to ${origin}. A route or Custom Domain receives them only when CF_ACCESS_READINESS_ORIGIN names its origin.`,
+		`If Access protects ${origin} and admits your credentials, set CF_ACCESS_READINESS_ORIGIN=${origin} with CF_ACCESS_CLIENT_ID and CF_ACCESS_CLIENT_SECRET, or CF_ACCESS_TOKEN. Then retry.`,
+		"Set it only if you control this hostname and it serves this Worker, because Void sends your Access credentials to it."
+	];
+}
+const ATOMIC_ACCESS_ALTERNATIVE = "For a Worker with Durable Object migration history, `void deploy --platform cloudflare --atomic` publishes without the zero-traffic check. The new version receives traffic first, and the command still exits with an error because Void cannot verify readiness through Access.";
 function formatCloudflareReadinessRestoration(result) {
 	switch (result.rollback) {
 		case "succeeded": return "The failed version remains inactive, and traffic was restored to the previous version.";
@@ -3459,6 +3654,16 @@ function formatCloudflareReadinessRestoration(result) {
 		default: return "The failed version remains inactive for inspection; production traffic is unchanged.";
 	}
 }
+const WORKERS_SUBDOMAIN_EXAMPLE = "(for example \"my-team\", or \"my-team.fed\" for FedRAMP High)";
+/** Explain a live version whose readiness URL Void could not determine. */
+function formatCloudflarePublishWithoutUrl(published, recovery) {
+	return [
+		`deploy: ${published}, but Void could not determine its URL.`,
+		"Void did not update its routes, workers.dev setting, or other triggers, and did not check /__void/ready.",
+		recovery,
+		"Then inspect `void project status` before you deploy again."
+	].join("\n");
+}
 /** Capture the Access credential used only by the guarded Worker readiness probe. */
 function cloudflareWorkerReadinessHeaders() {
 	return trustedCloudflareWorkerAccessHeaders({
@@ -3494,6 +3699,7 @@ async function prepareCloudflareFrameworkArtifact(options) {
 	await generateDeployWrapperIfNeeded(root, join(root, preset.workerDir), preset.workerMain, {
 		crons,
 		queues,
+		cloudflareQueueNames: options.cloudflareQueueNames,
 		hasMigrations: false,
 		migrationDialect: analysis.dialect,
 		readiness: true,
@@ -3585,10 +3791,11 @@ async function runCloudflareStaticDeploy(root, options, voidConfig, preset, cliL
 		configPath,
 		rootConfig: parseRootWranglerConfig(configPath),
 		deps,
-		persistAccount: !(options.reuseExistingWorker || initialCloudflareLink)
+		persistAccount: !(options.reuseExistingWorker || initialCloudflareLink),
+		readinessAccessOrigin: options.readinessAccessOrigin
 	});
 	if (!connection || !await confirmCloudflareDeployAuthentication(connection, configPath)) return exit(1);
-	const { apiBaseUrl, usesCf, cfUploaderIsPinned, assertUploaderStillPinned, accountId, workersDevSubdomain, runWrangler } = connection;
+	const { apiBaseUrl, complianceRegion, usesCf, cfUploaderIsPinned, assertUploaderStillPinned, accountId, workersDevSubdomain, readinessAccessOrigin, runWrangler } = connection;
 	const existingWorker = await prepareExistingCloudflareDeployWithAuth({
 		root,
 		configPath,
@@ -3636,11 +3843,13 @@ async function runCloudflareStaticDeploy(root, options, voidConfig, preset, cliL
 	const merged = mergeAndLintRoutingRules(preset.outputDir, voidConfig.routing);
 	const manifest = buildStaticManifest({
 		appType: preset.appType,
+		alwaysUseHttps: voidConfig.routing?.alwaysUseHttps,
 		hashedAssetsPrefix: "assets",
 		headerRules: merged.headerRules,
 		redirectRules: merged.redirectRules,
 		fallbackRules: merged.fallbackRules,
-		notFound: voidConfig.routing?.notFound
+		notFound: voidConfig.routing?.notFound,
+		html_handling: readWranglerHtmlHandling(rootConfig)
 	});
 	const entryPath = join(root, ".void", "deploy", "cloudflare", "static-edge.mjs");
 	mkdirSync(dirname(entryPath), { recursive: true });
@@ -3667,6 +3876,7 @@ async function runCloudflareStaticDeploy(root, options, voidConfig, preset, cliL
 	}, null, 2)}\n`, { mode: 384 });
 	writeFileSync(entryPath, renderCloudflareStaticEntry({
 		runtimeImport: "void/edge",
+		alwaysUseHttps: manifest.alwaysUseHttps,
 		headerRules: manifest.headerRules,
 		redirectRules: manifest.redirectRules,
 		fallbackRules: manifest.fallbackRules,
@@ -3715,8 +3925,10 @@ async function runCloudflareStaticDeploy(root, options, voidConfig, preset, cliL
 			uploadConfigPath: staticConfigPath,
 			accountId,
 			apiBaseUrl,
+			complianceRegion,
 			workerName,
 			workersDevSubdomain,
+			readinessAccessOrigin,
 			runWrangler,
 			readExistingWorker: deps.readExistingWorker,
 			existingWorker,
@@ -4155,12 +4367,14 @@ async function buildCloudflareWorker(input) {
 	const buildChildEnv = scrubManagedDeployBuildMarkers(scrubWranglerAuthCredentials(deployChildEnv(accountId, apiBaseUrl)));
 	deleteEnvVarCaseAware(buildChildEnv, CLOUDFLARE_DEPLOY_BUILD_ENV);
 	buildChildEnv[CLOUDFLARE_DEPLOY_BUILD_ENV] = "1";
+	deleteEnvVarCaseAware(buildChildEnv, CLOUDFLARE_QUEUE_NAMES_BUILD_ENV);
+	if (desired.queueNames) buildChildEnv[CLOUDFLARE_QUEUE_NAMES_BUILD_ENV] = JSON.stringify(desired.queueNames);
 	deleteEnvVarCaseAware(buildChildEnv, CLOUDFLARE_PRESERVE_BINDINGS_BUILD_ENV);
 	if (existingWorker) buildChildEnv[CLOUDFLARE_PRESERVE_BINDINGS_BUILD_ENV] = "1";
 	deleteEnvVarCaseAware(buildChildEnv, "NODE_ENV");
 	buildChildEnv.NODE_ENV = "production";
 	const runBuild = deps.runBuild ?? ((env) => {
-		const command = frameworkPreset ? voidConfig.inference?.build ?? resolveProjectCommand(root, frameworkPreset.buildCommand) : resolveProjectCommand(root, "vite build");
+		const command = resolveFullDeployBuildCommand(root, voidConfig.inference?.build, frameworkPreset?.buildCommand).command;
 		execSync(command, {
 			cwd: root,
 			stdio: "inherit",
@@ -4185,7 +4399,8 @@ async function buildCloudflareWorker(input) {
 			preset: frameworkPreset,
 			requiredSecretNames: schemaFacts.requiredKeys,
 			ai: needsAI ? { binding: aiBindingName } : void 0,
-			preserveBindings: existingWorker !== null
+			preserveBindings: existingWorker !== null,
+			cloudflareQueueNames: desired.queueNames
 		});
 	} catch (error) {
 		log$1.error(`deploy: could not prepare ${detectedFramework.name} for Cloudflare — ${getErrorMessage(error)}`);
@@ -4301,7 +4516,7 @@ async function buildCloudflareWorker(input) {
 		projectRoot: root,
 		configPath: generatedConfigPath,
 		accountId
-	}) : prepareCfBuildOutput(dirname(generatedConfigPath), accountId);
+	}) : prepareCfBuildOutput(dirname(generatedConfigPath), accountId, void 0, root);
 	if (usesCf) {
 		const preflight = await prepareBuildOutput();
 		if (!preflight) {
@@ -4639,6 +4854,114 @@ function existingAddresses(rootConfig, pre) {
 	return Array.isArray(rootConfig.addresses) ? rootConfig.addresses.map((a) => typeof a === "string" ? a.toLowerCase() : "").filter((a) => pre.addresses.includes(a)) : [];
 }
 //#endregion
+//#region src/cli/deploy-cloudflare-queues.ts
+function isValidQueueName(name) {
+	try {
+		assertValidResourceName("queue", name);
+		return true;
+	} catch {
+		return false;
+	}
+}
+/**
+* Pick each queue's Cloudflare name from the account's queues and write it into `desired`.
+* Returns the chosen names that do not exist yet, or a message that blocks the deploy.
+*/
+async function chooseCloudflareQueueNames(input) {
+	const { desired, workerName, configPath, runWrangler } = input;
+	if (!desired.queueNames) return {
+		ok: true,
+		absent: []
+	};
+	const lookup = async (name) => {
+		const info = await Promise.resolve(runWrangler({
+			type: "queues.info",
+			name,
+			configPath
+		}, { capture: true }));
+		if (isQueueConfirmedAbsent(info)) return null;
+		const data = info.data;
+		if (!isCleanCloudflareExit(info) || !isRecord(data) || data.name !== name || !Array.isArray(data.consumers)) throw new Error(`deploy: could not read Cloudflare queue ${name} and its consumers. Retry \`void deploy --platform cloudflare\`.`);
+		return { consumers: data.consumers };
+	};
+	const invalid = Object.keys(desired.queueNames).filter((queueName) => !isValidQueueName(queueName)).map((queueName) => `  • ${queueName} (queue)`);
+	if (invalid.length > 0) return {
+		ok: false,
+		message: [
+			"Deploy blocked — these queue names are not valid Cloudflare queue names:",
+			...invalid,
+			"",
+			"A queue takes its name from its path in queues/; nested segments are joined with \"-\".",
+			"A queue name must be 1–63 characters, contain only letters, digits and \"-\", and",
+			"begin and end with a letter or digit.",
+			"",
+			"Rename the offending file(s) in queues/ and retry."
+		].join("\n")
+	};
+	const queueNames = desired.queueNames;
+	const clashes = Object.keys(queueNames).filter((queueName) => Object.hasOwn(queueNames, queueNames[queueName])).map((queueName) => `  • ${queueName} uses the Cloudflare queue ${queueNames[queueName]}, which is also a queue in queues/`);
+	if (clashes.length > 0) return {
+		ok: false,
+		message: [
+			"Deploy blocked — these queues would share a Cloudflare queue:",
+			...clashes,
+			"",
+			`A queue's Cloudflare name is the Worker name, "-", then its name from queues/.`,
+			"Rename one of the files in queues/, then retry."
+		].join("\n")
+	};
+	const names = {};
+	const absent = [];
+	const tooLong = [];
+	const taken = [];
+	for (const queueName of Object.keys(desired.queueNames)) {
+		const scopedName = desired.queueNames[queueName];
+		const scoped = isValidQueueName(scopedName) ? await lookup(scopedName) : null;
+		const plain = scoped?.consumers.includes(workerName) ? void 0 : await lookup(queueName);
+		const choice = chooseCloudflareQueueName({
+			workerName,
+			queueName,
+			scopedName,
+			scoped,
+			plain
+		});
+		names[queueName] = choice.name;
+		if (!isValidQueueName(choice.name)) {
+			tooLong.push(`  • ${choice.name} (${choice.name.length} characters)`);
+			continue;
+		}
+		const state = choice.kept ? plain : scoped;
+		if (state === null) absent.push(choice.name);
+		for (const consumer of otherQueueConsumers(state, workerName)) taken.push(`  • ${choice.name} is consumed by ${consumer === null ? "a non-Worker (HTTP pull) consumer" : `Worker ${consumer}`}`);
+		if (choice.kept) input.info(`Queue ${queueName} keeps its Cloudflare name ${choice.name}, because this Worker already consumes it.`);
+	}
+	if (tooLong.length > 0) return {
+		ok: false,
+		message: [
+			"Deploy blocked — these Cloudflare queue names are longer than 63 characters:",
+			...tooLong,
+			"",
+			`A queue's Cloudflare name is the Worker name, "-", then its name from queues/.`,
+			"Shorten the Worker name or rename the file(s) in queues/, then retry."
+		].join("\n")
+	};
+	if (taken.length > 0) return {
+		ok: false,
+		message: [
+			`Deploy blocked — Worker ${workerName} cannot consume these queues:`,
+			...taken,
+			"",
+			"A Cloudflare queue has one consumer. Rename the file in queues/ or the Worker, then retry."
+		].join("\n")
+	};
+	desired.queueNames = names;
+	desired.queues = Object.values(names);
+	return {
+		ok: true,
+		absent
+	};
+}
+//#endregion
 //#region src/cli/deploy-cloudflare-preflight.ts
 /** Validate source-level native deploy inputs before account operations or project code. */
 async function prepareCloudflareDeploySource(root, options, voidConfig) {
@@ -4716,10 +5039,11 @@ async function preflightCloudflareWorker(input) {
 		configPath,
 		rootConfig,
 		deps,
-		persistAccount: !(options.reuseExistingWorker || initialCloudflareLink)
+		persistAccount: !(options.reuseExistingWorker || initialCloudflareLink),
+		readinessAccessOrigin: options.readinessAccessOrigin
 	});
 	if (!connection) return exit(1);
-	const { apiBaseUrl, usesCf, cfUploaderIsPinned, assertUploaderStillPinned, accountId, workersDevSubdomain, runWrangler } = connection;
+	const { apiBaseUrl, complianceRegion, usesCf, cfUploaderIsPinned, assertUploaderStillPinned, accountId, workersDevSubdomain, readinessAccessOrigin, runWrangler } = connection;
 	rootConfig = connection.rootConfig;
 	const workerName = readWranglerTopLevelString(rootConfig, "name") ?? deriveWorkerName(root);
 	printDeployContext(workerName, "Cloudflare");
@@ -4895,53 +5219,38 @@ async function preflightCloudflareWorker(input) {
 			return exit(1);
 		}
 	};
-	const { missing: initiallyMissing } = checkCloudflareProvisionDrift(configPath, desired);
-	const d1NeedsConfigReconciliation = !existingWorker && d1MigrationsDirMissing();
-	if (options.provision || initiallyMissing.length > 0 || d1NeedsConfigReconciliation) await provisionAndVerify();
-	else {
-		const invalidQueues = desired.queues.filter((name) => {
-			try {
-				assertValidResourceName("queue", name);
-				return false;
-			} catch {
-				return true;
-			}
+	let queueNames;
+	try {
+		queueNames = await chooseCloudflareQueueNames({
+			desired,
+			workerName,
+			configPath,
+			runWrangler,
+			info: (message) => log$1.info(message)
 		});
-		if (invalidQueues.length > 0) {
-			log$1.error([
-				"Deploy blocked — these queue names are not valid Cloudflare queue names:",
-				...invalidQueues.map((name) => `  • ${name} (queue)`),
-				"",
-				"A queue takes its name from its path in queues/; nested segments are joined with \"-\".",
-				"A queue name must be 1–63 characters, contain only letters, digits and \"-\", and",
-				"begin and end with a letter or digit.",
-				"",
-				"Rename the offending file(s) in queues/ and retry."
-			].join("\n"));
-			return exit(1);
-		}
-		const absentQueues = [];
-		for (const name of desired.queues) {
-			const info = await Promise.resolve(runWrangler({
-				type: "queues.info",
-				name,
-				configPath
-			}, { capture: true }));
-			if (isQueueConfirmedAbsent(info)) absentQueues.push(name);
-		}
-		if (absentQueues.length > 0) await provisionAndVerify();
+	} catch (error) {
+		log$1.error(getErrorMessage(error));
+		return exit(1);
+	}
+	if (!queueNames.ok) {
+		log$1.error(queueNames.message);
+		return exit(1);
 	}
+	const absentQueues = queueNames.absent;
+	const { missing: initiallyMissing } = checkCloudflareProvisionDrift(configPath, desired);
+	const d1NeedsConfigReconciliation = !existingWorker && d1MigrationsDirMissing();
+	if (options.provision || initiallyMissing.length > 0 || d1NeedsConfigReconciliation || absentQueues.length > 0) await provisionAndVerify();
 	const frameworkQueues = detectedFramework ? source.analysis.queues : [];
 	writeProvisionedWranglerConfig(root, {
 		name: workerName,
 		accountId,
 		...detectedFramework ? { queues: {
 			producers: frameworkQueues.map((queue) => ({
-				queue: queue.name,
+				queue: cloudflareQueueName(queue.name, desired.queueNames),
 				binding: queue.bindingName
 			})),
 			consumers: frameworkQueues.map((queue) => ({
-				queue: queue.name,
+				queue: cloudflareQueueName(queue.name, desired.queueNames),
 				...queue.maxBatchSize != null && { max_batch_size: queue.maxBatchSize },
 				...queue.maxBatchTimeout != null && { max_batch_timeout: queue.maxBatchTimeout },
 				...queue.maxRetries != null && { max_retries: queue.maxRetries },
@@ -4962,11 +5271,13 @@ async function preflightCloudflareWorker(input) {
 	});
 	return {
 		apiBaseUrl,
+		complianceRegion,
 		usesCf,
 		cfUploaderIsPinned,
 		assertUploaderStillPinned,
 		accountId,
 		workersDevSubdomain,
+		readinessAccessOrigin,
 		runWrangler,
 		workerName,
 		emailMap,
@@ -4987,7 +5298,7 @@ async function preflightCloudflareWorker(input) {
 async function publishCloudflareWorker(input) {
 	const { root, deps, exit, cliLog, atomic, detectedFramework, initialCloudflareCandidate } = input;
 	const { configPath, needsSandbox, desired, analysis } = input.source;
-	const { usesCf, existingWorker, pinnedHandoffLink, accountId, workerName, cfUploaderIsPinned, apiBaseUrl, runWrangler, assertUploaderStillPinned, schemaFacts, approvedHandoffKv, workersDevSubdomain } = input.preflight;
+	const { usesCf, existingWorker, pinnedHandoffLink, accountId, workerName, cfUploaderIsPinned, apiBaseUrl, complianceRegion, runWrangler, assertUploaderStillPinned, schemaFacts, approvedHandoffKv, workersDevSubdomain, readinessAccessOrigin } = input.preflight;
 	const { migrations, d1MigrateToken, generatedConfigPath, prepareBuildOutput } = input.build;
 	const { workerWasMissingBeforeSecretProvisioning, initialAuthSecret, appliedMigrations } = input.migration;
 	const queueConsumerCleanup = readWranglerManagedQueueCleanupCandidates(configPath);
@@ -5029,8 +5340,10 @@ async function publishCloudflareWorker(input) {
 			uploadConfigPath: generatedConfigPath,
 			accountId,
 			apiBaseUrl,
+			complianceRegion,
 			workerName,
 			workersDevSubdomain,
+			readinessAccessOrigin,
 			runWrangler,
 			readExistingWorker: deps.readExistingWorker,
 			existingWorker,
@@ -5081,6 +5394,7 @@ async function publishCloudflareWorker(input) {
 //#region src/cli/deploy-cloudflare.ts
 /** Deploy to the user's own Cloudflare account through the guarded native Worker flow. */
 async function runCloudflareDeploy(root, options, cliLog, deps = {}) {
+	options = withRecordedReadinessAccessOrigin(options);
 	const initialCloudflareLink = readCloudflareLink(root);
 	const initialCloudflareCandidate = readCloudflareCandidate(root);
 	const exit = deps.exit ?? ((code) => process.exit(code));
@@ -5117,6 +5431,14 @@ async function runCloudflareDeploy(root, options, cliLog, deps = {}) {
 		}
 		return runCloudflareStaticDeploy(root, options, voidConfig, staticPreset, cliLog, deps, initialCloudflareLink, initialCloudflareCandidate);
 	}
+	if (detectedFramework && voidConfig.routing?.alwaysUseHttps === true) {
+		log$1.error([
+			`deploy: native Cloudflare deployment cannot apply Void routing.alwaysUseHttps to ${detectedFramework.name}.`,
+			"This framework owns its Worker request handler, so the HTTPS redirect would otherwise be ignored.",
+			"Redirect HTTP to HTTPS in the framework, or turn on Cloudflare's Always Use HTTPS setting for your zone, then remove routing.alwaysUseHttps and retry."
+		].join("\n"));
+		return exit(1);
+	}
 	const source = await prepareCloudflareDeploySource(root, options, voidConfig);
 	if (!source) return exit(1);
 	const preflight = await preflightCloudflareWorker({
@@ -5286,6 +5608,7 @@ async function runFrameworkDeploy(root, config, client, detected, fwPreset, void
 	};
 	const manifest = buildFrameworkManifest({
 		frameworkName: detected.name,
+		alwaysUseHttps: voidConfig.routing?.alwaysUseHttps,
 		workerMain: actualWorkerMain,
 		bindings,
 		migrations: validatedMigrations,
@@ -5392,7 +5715,7 @@ async function runFullDeploy(root, config, client, voidConfig, fwPreset, skipBui
 			voidToken: await client.createPrerenderToken(config.projectId)
 		});
 		if (result.paths.length === 0) log$1.info("No pages to prerender");
-		else if (result.failed.length > 0) voidWarn(`${formatCount(result.failed.length, "page")} failed to prerender`);
+		else assertNoPrerenderFailures(result.failed);
 	}
 	const analysis = await analyzeApplication(root, {
 		config: voidConfig,
@@ -5459,7 +5782,7 @@ async function runFullDeploy(root, config, client, voidConfig, fwPreset, skipBui
 				buildCommand: null,
 				outputDir: clientDir,
 				appType: "static"
-			}, true, gitMetadata, assetsPrefix, headerRules, redirectRules, fallbackRules, void 0, cliLog, voidConfig.routing?.notFound);
+			}, true, gitMetadata, assetsPrefix, headerRules, redirectRules, fallbackRules, void 0, cliLog, voidConfig.routing?.notFound, voidConfig.routing?.alwaysUseHttps);
 		}
 	}
 	const prerenderSourcesPresent = hasPrerenderSources({
@@ -5542,6 +5865,7 @@ async function runFullDeploy(root, config, client, voidConfig, fwPreset, skipBui
 			...bindings,
 			needsLive: true
 		} : bindings,
+		alwaysUseHttps: voidConfig.routing?.alwaysUseHttps,
 		hasEmailHandlers: !isFrameworkMode && routeScan.email !== void 0 && hasEmailHandlers(routeScan.email),
 		migrations: validatedMigrations,
 		schedules,
@@ -6044,6 +6368,7 @@ function resolveDeploymentPlatform(root, options) {
 }
 /** Run `void deploy`; a failure carries a summary of the deploy log in its message. */
 async function runDeploy(root, options) {
+	options = withRecordedReadinessAccessOrigin(options ?? {});
 	console.log();
 	const cliLog = openDeployLog({ mirrorToStderr: options?.debug === true || process.env.VOID_DEPLOY_DEBUG === "1" });
 	cliLog.info("deploy_start", {