void 1.3.0 → 1.4.0

package/dist/{deploy-hRPvw8ci.mjs → deploy-CdM-LAxX.mjs}

@@ -3,8 +3,8 @@ import { a as join, c as resolve, n as dirname, o as normalize, r as extname, s
 import { t as require_picocolors } from "./picocolors-BsDfhxIw.mjs";
 import { r as detectFramework } from "./plugin-inference-CeiB6BG5.mjs";
 import { n as readProjectPaths, t as assertNoRootSourceConventionConflicts } from "./project-paths-DGu_QZ_Q.mjs";
-import { m as resolveBindingNames, p as readConfig, u as isNodeTarget } from "./config-DHgSEWT7.mjs";
-import { a as hasSandboxSqliteMigration, c as sandboxContainerConfig, i as assertSandboxNamespaceConfig, o as requiresSandboxPlatformImage, r as SANDBOX_MIGRATION_TAG, s as resolveSandboxConfig, t as analyzeApplicationSync } from "./application-analysis-DYdVoMAY.mjs";
+import { m as resolveBindingNames, p as readConfig, u as isNodeTarget } from "./config-OFOAimzt.mjs";
+import { a as hasSandboxSqliteMigration, c as sandboxContainerConfig, i as assertSandboxNamespaceConfig, o as requiresSandboxPlatformImage, r as SANDBOX_MIGRATION_TAG, s as resolveSandboxConfig, t as analyzeApplicationSync } from "./application-analysis-DDOQwiXk.mjs";
 import { t as collectMigrations } from "./collect-Dew86qce.mjs";
 import { o as validateSsrEntry } from "./entry-BEM8ZuGP.mjs";
 import { r as hasEmailHandlers } from "./email-B9ayYQEG.mjs";
@@ -13,38 +13,38 @@ import { t as writeFileAtomic } from "./atomic-write-Dq6R0BPN.mjs";
 import { s as listPlatformConnections } from "./platform-registry-B9mWX9LO.mjs";
 import { c as writeDeploymentPlatform, n as readDeploymentPlatform, r as readProjectConfig } from "./project-rqDnVsJN.mjs";
 import { n as readGeneratedWranglerConfigFile } from "./generated-wrangler-config-DeWj5F9Y.mjs";
-import { i as persistCloudflareConfig, r as materializeCloudflareConfig, s as stashCloudflareDeployPointer } from "./cloudflare-config-DchHxPTo.mjs";
-import { A as syncWranglerWebSockets, C as readWranglerManagedQueueCleanupCandidates, D as sameMigrationsDir, E as resolveLiveBindingConfig, M as writeProvisionedWranglerConfig, N as writeWranglerPublishedTrafficSnapshot, a as LIVE_MIGRATION_TAG, c as bindingEntriesForField, h as nextDurableObjectMigrationTag, k as syncWranglerDurableObjects, m as hasDurableObjectSqliteMigration, o as acknowledgeWranglerManagedQueueRemovals, r as FRIENDLY_BINDING_NAMES, v as readExistingLiveBindingConfig, w as readWranglerPublishedTrafficSnapshot } from "./wrangler-CDiEBCdS.mjs";
+import { a as persistCloudflareConfig, c as stashCloudflareDeployPointer, i as materializeCloudflareConfig } from "./cloudflare-config-CH1AylZT.mjs";
+import { A as syncWranglerWebSockets, C as readWranglerManagedQueueCleanupCandidates, D as sameMigrationsDir, E as resolveLiveBindingConfig, L as writeVoidProjectConfig, M as writeProvisionedWranglerConfig, N as writeWranglerPublishedTrafficSnapshot, a as LIVE_MIGRATION_TAG, c as bindingEntriesForField, h as nextDurableObjectMigrationTag, k as syncWranglerDurableObjects, m as hasDurableObjectSqliteMigration, o as acknowledgeWranglerManagedQueueRemovals, r as FRIENDLY_BINDING_NAMES, v as readExistingLiveBindingConfig, w as readWranglerPublishedTrafficSnapshot } from "./wrangler-I-scB_1t.mjs";
 import { r as trustedCloudflareWorkerAccessHeaders, t as cfAccessHeaders } from "./cf-access-BM9G0lhO.mjs";
 import { t as ensurePlatformAccessToken } from "./cf-access-CWP4avfP.mjs";
 import { a as getApiUrl, c as getToken, l as getTokenSource } from "./auth-B6iOCjKI.mjs";
-import { i as otherQueueConsumers, n as chooseCloudflareQueueName, o as scopedCloudflareQueueName, r as cloudflareQueueName } from "./dispatch-OVLeWW8K.mjs";
+import { i as otherQueueConsumers, n as chooseCloudflareQueueName, o as scopedCloudflareQueueName, r as cloudflareQueueName } from "./dispatch-CLa2LThw.mjs";
 import { l as resolveRemoteMode, n as CLOUDFLARE_QUEUE_NAMES_BUILD_ENV, t as CLOUDFLARE_DEPLOY_BUILD_ENV } from "./env-BaMz0j7H.mjs";
 import { t as assertNoPrerenderFailures } from "./prerender-render-CaShbHJ3.mjs";
-import { a as buildEnv, n as readVersionMetadataBinding, r as selectNativeVersionMetadataBinding, t as CLOUDFLARE_PRESERVE_BINDINGS_BUILD_ENV } from "./version-metadata-DmaZNTYW.mjs";
-import { a as emailConfigInputs, c as renderAddressMap, d as isGeneratedAssetHeaders, g as prerenderPagesNode, h as prerenderPages, i as createNodeEmailDns, l as renderEmailChecklist, m as collectPrerenderPathsNode, n as SEND_EMAIL_BINDING, o as preflightEmail, p as collectPrerenderPaths, r as applyEmailSetup, t as EMAIL_FROM_VAR } from "./email-cloudflare-B8-pq_-W.mjs";
-import { n as completeApplicationAnalysis, t as analyzeApplication } from "./application-routing-C8EqRDfv.mjs";
-import { a as record, i as migrateBuiltWranglerConfig, n as prepareCfFrameworkBuildOutput, r as prepareCfStaticBuildOutput, t as prepareCfBuildOutput } from "./cf-build-output-Bapzc_8Z.mjs";
+import { a as buildEnv, n as readVersionMetadataBinding, r as selectNativeVersionMetadataBinding, t as CLOUDFLARE_PRESERVE_BINDINGS_BUILD_ENV } from "./version-metadata-D2vfMQzv.mjs";
+import { a as emailConfigInputs, c as renderAddressMap, d as isGeneratedAssetHeaders, g as prerenderPagesNode, h as prerenderPages, i as createNodeEmailDns, l as renderEmailChecklist, m as collectPrerenderPathsNode, n as SEND_EMAIL_BINDING, o as preflightEmail, p as collectPrerenderPaths, r as applyEmailSetup, t as EMAIL_FROM_VAR } from "./email-cloudflare-PMbAev9Q.mjs";
+import { n as completeApplicationAnalysis, t as analyzeApplication } from "./application-routing-4719u_kf.mjs";
+import { a as record, i as migrateBuiltWranglerConfig, n as prepareCfFrameworkBuildOutput, r as prepareCfStaticBuildOutput, t as prepareCfBuildOutput } from "./cf-build-output-XpNR9zoh.mjs";
 import { i as validateMigrations, t as assertJournalCoherence } from "./validate-CnZPMq4q.mjs";
 import { A as confirm, K as select, L as log, tt as isCancel } from "./dist-Cor9XGoz.mjs";
 import { r as getPackageDir } from "./agents-CuNtT0D_.mjs";
-import { a as isExpiredTokenError, r as PlatformClient } from "./client-BEMtySaV.mjs";
+import { a as isExpiredTokenError, r as PlatformClient } from "./client-B3LnB_bE.mjs";
 import { o as formatCount, p as note, r as createSpinner, u as getErrorMessage } from "./output-BpgYODYx.mjs";
 import { t as getRequestedProjectSlug } from "./resolve-project-Xoi6eTWY.mjs";
 import { i as safePositional, r as readCfUploadOutput, t as CF_VERSION_SOURCE_MAX_OUTPUT_BYTES } from "./cf-command-values-ByHk0xg4.mjs";
 import { a as FRAMEWORK_PRESETS, c as hasBackendFiles, i as isCleanCloudflareExit, l as resolveCloudflareOperationArgv, o as detectPreset, s as formatProjectCommand, t as createCloudflareProcessRunner, u as resolveProjectCommand } from "./cloudflare-process-8jEYIeim.mjs";
-import { f as listSelfHostSecretNames, h as selfHostSchemaFailureMessage, i as SelfHostSecretListError, l as dischargeSelfHostEnvContext, n as SelfHostFirstDeployError, p as readEmittedWorkerVars, r as SelfHostSchemaError, s as deriveSelfHostEnvContextFromVars, t as SelfHostEnvValidationError } from "./env-validation-XcukUlFM.mjs";
-import { a as needsWrapper, r as cleanupWrapper, t as bundleEntry } from "./wrapper-CEiDeCqD.mjs";
-import { A as promptDeployProjectConfig, C as ensureManagedHyperdrive, D as hasNonPageBackend, E as getGitCommit, F as resolveStaticBuildCommand, I as resolveStaticDeployPreset, L as toManifestSchedulesAndQueues, M as resolveDeployWorkerMain, N as resolveDeployWranglerCompat, O as hasPrerenderSources, P as resolveFullDeployBuildCommand, R as validateDeployMigrations, S as createProjectFromSlug, T as getExitCode, _ as getDeploySchemaDriftMessage, a as collectAndHashAssets, b as assertProjectDeployAccess, c as readWranglerHtmlHandling, d as printDeploySuccess, f as mergeAndLintRoutingRules, g as assertDeploySchemaDriftFree, h as warnUnpublishedRouting, i as buildStaticManifest, j as resolveDeployLiveBindingConfig, k as log$1, l as formatDeploySummary, m as warnIgnoredNotFoundForFramework, n as runStaticDeploy, o as collectWorkerFiles, p as streamDirectR2Deploy, r as buildFrameworkManifest, s as detectNonSpaFallbackWarning, t as assembleVoidManifest, u as printDeployContext, v as hasDeploySchemaDrift, w as generateDeployWrapperIfNeeded, x as assertWorkerMainUploaded, y as assertEnvSchemaValid } from "./deploy-managed-static-CDYA2p3L.mjs";
-import { a as checkCloudflareProvisionDrift, d as isQueueConfirmedAbsent, f as isRealD1Id, g as provisionCloudflareResources, i as assertValidResourceName, m as isRealKvId, s as deleteEnvVarCaseAware } from "./provision-B7UFrBH7.mjs";
-import { c as scrubWranglerAuthCredentials, n as buildSchemaProbeEnv, o as resolveDeployTransport, r as deployChildEnv, s as scrubManagedDeployBuildMarkers, t as MANAGED_DEPLOY_BUILD_ENV } from "./deploy-transport-JCxw7QDi.mjs";
-import { n as getCfCliVersion, r as getVoidUserAgent, t as publishCloudflareObservability } from "./cf-worker-settings-BECvvTVd.mjs";
+import { f as listSelfHostSecretNames, h as selfHostSchemaFailureMessage, i as SelfHostSecretListError, l as dischargeSelfHostEnvContext, n as SelfHostFirstDeployError, p as readEmittedWorkerVars, r as SelfHostSchemaError, s as deriveSelfHostEnvContextFromVars, t as SelfHostEnvValidationError } from "./env-validation-B3VobvXm.mjs";
+import { a as needsWrapper, r as cleanupWrapper, t as bundleEntry } from "./wrapper-BBl1rC32.mjs";
+import { A as promptDeployProjectConfig, C as ensureManagedHyperdrive, D as hasNonPageBackend, E as getGitCommit, F as resolveStaticBuildCommand, I as resolveStaticDeployPreset, L as toManifestSchedulesAndQueues, M as resolveDeployWorkerMain, N as resolveDeployWranglerCompat, O as hasPrerenderSources, P as resolveFullDeployBuildCommand, R as validateDeployMigrations, S as createProjectFromSlug, T as getExitCode, _ as getDeploySchemaDriftMessage, a as collectAndHashAssets, b as assertProjectDeployAccess, c as readWranglerHtmlHandling, d as printDeploySuccess, f as mergeAndLintRoutingRules, g as assertDeploySchemaDriftFree, h as warnUnpublishedRouting, i as buildStaticManifest, j as resolveDeployLiveBindingConfig, k as log$1, l as formatDeploySummary, m as warnIgnoredNotFoundForFramework, n as runStaticDeploy, o as collectWorkerFiles, p as streamDirectR2Deploy, r as buildFrameworkManifest, s as detectNonSpaFallbackWarning, t as assembleVoidManifest, u as printDeployContext, v as hasDeploySchemaDrift, w as generateDeployWrapperIfNeeded, x as assertWorkerMainUploaded, y as assertEnvSchemaValid } from "./deploy-managed-static-DjeBFG2c.mjs";
+import { a as checkCloudflareProvisionDrift, b as resolveWorkersDevComplianceRegion, d as isQueueConfirmedAbsent, f as isRealD1Id, g as provisionCloudflareResources, i as assertValidResourceName, m as isRealKvId, s as deleteEnvVarCaseAware } from "./provision-DztLJ97X.mjs";
+import { c as scrubWranglerAuthCredentials, n as buildSchemaProbeEnv, o as resolveDeployTransport, r as deployChildEnv, s as scrubManagedDeployBuildMarkers, t as MANAGED_DEPLOY_BUILD_ENV } from "./deploy-transport-DIq_gFTP.mjs";
+import { n as getCfCliVersion, r as getVoidUserAgent, t as publishCloudflareWorkerSettings } from "./cf-worker-settings-Dg27RzyT.mjs";
 import { t as sanitizeTerminalLogText } from "./terminal-log-text-D9ACPOuG.mjs";
-import { t as promptForLoginToken } from "./login-BjSyhXlT.mjs";
-import { a as parseCloudflareAuthSession, i as ensureCloudflareAuthentication, n as cloudflareCredentialOverrides, t as CloudflareAuthenticationError } from "./cloudflare-auth-Byo_0_N9.mjs";
-import { a as createCloudflareEmptyDomainPublisher, i as createCloudflareEmptyCronPublisher } from "./cloudflare-operations-vP3b5CQf.mjs";
+import { t as promptForLoginToken } from "./login-PcFy5mlC.mjs";
+import { a as parseCloudflareAuthSession, i as ensureCloudflareAuthentication, n as cloudflareCredentialOverrides, t as CloudflareAuthenticationError } from "./cloudflare-auth-DyD_kVFr.mjs";
+import { a as createCloudflareEmptyDomainPublisher, i as createCloudflareEmptyCronPublisher } from "./cloudflare-operations-Bc-7fN44.mjs";
 import { n as openMigrationValidationDatabase, t as SqliteMigrationError } from "./sqlite-validation-BzKMWnO4.mjs";
-import { a as discoverFrameworkWranglerFiles, i as writeVoidProjectConfig, t as migrateLegacyVoidConfig } from "./migrate-BXRHpYwR.mjs";
+import { r as discoverFrameworkWranglerFiles, t as migrateLegacyVoidConfig } from "./migrate-B8S2xTcb.mjs";
 import { a as runMySqlMigrations } from "./runner-mysql-BWmbk5IE.mjs";
 import { i as runPgMigrations } from "./runner-pg-Cr3qrqi4.mjs";
 import { t as collectGitDeployMetadata } from "./git-metadata-D-gurjzG.mjs";
@@ -60,7 +60,7 @@ import { execFile, execSync, spawn } from "node:child_process";
 import { getWorkerAssetsDir, getWorkerBundleDir, getWorkerConfigPath, readBuildOutput } from "@cloudflare/build-output-utils";
 import { convertToWranglerConfig } from "@cloudflare/config";
 import ignore from "ignore";
-import { CloudflareWorkerInspectionError, activateCloudflareVersion, assertCloudflareBindingsPreserved, assertCloudflareDurableObjectLifecycleSupported, assertExistingCloudflareConfig, cloudflareCommandDiagnostic, encodeCloudflareVersionMessage, extractWorkersDevSubdomain, normalizeWorkersDevSubdomain, parseRootWranglerConfig, parseRootWranglerConfig as parseRootWranglerConfig$1, readBindingFieldPresence, readCloudflareTriggerConfig, readConfigEntryString, readExistingCloudflareWorker, readStoredResourceName, readWranglerTopLevelString, renderCloudflareStaticEntry, resolveD1MigrateTarget, stageCloudflareStaticAssets, writeCloudflareFrameworkDeployConfig, writeCloudflareStaticDeployConfig } from "@void/deploy-cloudflare";
+import { CloudflareWorkerInspectionError, activateCloudflareVersion, assertCloudflareBindingsPreserved, assertCloudflareDurableObjectLifecycleSupported, assertExistingCloudflareConfig, cloudflareCommandDiagnostic, encodeCloudflareVersionMessage, extractWorkersDevSubdomain, normalizeReadinessAccessOrigin, normalizeWorkersDevSubdomain, parseRootWranglerConfig, parseRootWranglerConfig as parseRootWranglerConfig$1, readBindingFieldPresence, readCloudflareTriggerConfig, readConfigEntryString, readExistingCloudflareWorker, readStoredResourceName, readWranglerTopLevelString, renderCloudflareStaticEntry, resolveD1MigrateTarget, stageCloudflareStaticAssets, writeCloudflareFrameworkDeployConfig, writeCloudflareStaticDeployConfig } from "@void/deploy-cloudflare";
 import { setTimeout as setTimeout$1 } from "node:timers/promises";
 import mime from "mime";
 import { Buffer as Buffer$1 } from "node:buffer";
@@ -219,6 +219,112 @@ async function maybeLinkCloudflareDeploy(root, options = {}, deps = {}) {
 	return isCancel(accepted) || accepted !== true ? "cancelled" : "existing";
 }
 //#endregion
+//#region src/cli/cloudflare-readiness.ts
+const STATE_FILE = join(".void", "cloudflare.json");
+/** Resolve the account subdomain without exposing Cloudflare credentials to project code. */
+function resolveCloudflareWorkersDevSubdomain(root, accountId, env = process.env) {
+	const configured = env.CLOUDFLARE_WORKERS_SUBDOMAIN;
+	if (configured !== void 0 && configured.trim().length > 0) {
+		const normalized = normalizeWorkersDevSubdomain(configured);
+		if (!normalized) throw new Error("deploy: CLOUDFLARE_WORKERS_SUBDOMAIN must be the account subdomain, for example \"my-team\" or \"my-team.workers.dev\".");
+		return normalized;
+	}
+	const cached = subdomainsByAccount(readCloudflareLocalState(root))[accountId];
+	return typeof cached === "string" ? normalizeWorkersDevSubdomain(cached) : void 0;
+}
+/**
+* Record `CF_ACCESS_READINESS_ORIGIN` before project code runs. `void.config.ts` is evaluated in
+* this process, so a later read of `process.env` could see a value that the project assigned,
+* for example through a dotenv import. `null` means unset. An already recorded value is kept.
+*/
+function withRecordedReadinessAccessOrigin(options, env = process.env) {
+	return options.readinessAccessOrigin !== void 0 ? options : {
+		...options,
+		readinessAccessOrigin: env.CF_ACCESS_READINESS_ORIGIN ?? null
+	};
+}
+/**
+* Validate the operator-selected origin that may receive readiness Access credentials when the
+* probe uses a route or Custom Domain. Pass the value that `withRecordedReadinessAccessOrigin`
+* recorded, not the current `process.env`.
+*/
+function resolveCloudflareReadinessAccessOrigin(env) {
+	const configured = env.CF_ACCESS_READINESS_ORIGIN?.trim();
+	if (!configured) return;
+	const origin = normalizeReadinessAccessOrigin(configured);
+	if (!origin) throw new Error("deploy: CF_ACCESS_READINESS_ORIGIN must be one exact https origin, without a wildcard, path, query, fragment, or credentials, for example \"https://app.example.com\".");
+	return origin;
+}
+/**
+* Read the account subdomain from the Cloudflare API when a first publish reports no URL and
+* no subdomain is configured or cached. The API returns only the account label, so this adds
+* `.fed` for FedRAMP High, as Wrangler does. A failed lookup resolves `unavailable`.
+*/
+async function readCloudflareWorkersDevSubdomain(options) {
+	if (!options.verifyUploader()) return {
+		ok: false,
+		reason: "uploader-changed"
+	};
+	let label;
+	try {
+		const result = await options.runWrangler({
+			type: "workers.subdomain.get",
+			configPath: options.configPath
+		}, { capture: true });
+		if (!isCleanCloudflareExit(result) || !result.data || typeof result.data !== "object" || !("subdomain" in result.data) || typeof result.data.subdomain !== "string") return {
+			ok: false,
+			reason: "unavailable"
+		};
+		label = result.data.subdomain;
+	} catch {
+		return {
+			ok: false,
+			reason: "unavailable"
+		};
+	}
+	const subdomain = normalizeWorkersDevSubdomain(options.complianceRegion === "fedramp_high" ? `${label}.fed` : label);
+	return subdomain ? {
+		ok: true,
+		subdomain
+	} : {
+		ok: false,
+		reason: "unavailable"
+	};
+}
+/** Cache a Wrangler-reported account subdomain for later no-preview version probes. */
+function rememberCloudflareWorkersDevSubdomain(root, accountId, url) {
+	const workersDevSubdomain = extractWorkersDevSubdomain(url);
+	if (!workersDevSubdomain) return false;
+	const current = readCloudflareLocalState(root);
+	const currentByAccount = subdomainsByAccount(current);
+	if (currentByAccount[accountId] === workersDevSubdomain) return false;
+	const { workersDevSubdomain: _legacy, ...state } = current;
+	const filePath = join(root, STATE_FILE);
+	mkdirSync(dirname(filePath), { recursive: true });
+	writeFileSync(filePath, JSON.stringify({
+		...state,
+		workersDevSubdomains: {
+			...currentByAccount,
+			[accountId]: workersDevSubdomain
+		}
+	}, null, 2) + "\n");
+	return true;
+}
+function subdomainsByAccount(state) {
+	const value = state.workersDevSubdomains;
+	return value && typeof value === "object" && !Array.isArray(value) ? value : {};
+}
+function readCloudflareLocalState(root) {
+	const filePath = join(root, STATE_FILE);
+	if (!existsSync(filePath)) return {};
+	try {
+		const parsed = JSON.parse(readFileSync(filePath, "utf-8"));
+		return typeof parsed === "object" && parsed !== null && !Array.isArray(parsed) ? parsed : {};
+	} catch {
+		return {};
+	}
+}
+//#endregion
 //#region src/cli/deploy-binding-snapshot.ts
 /** The id-bearing binding fields whose identity must survive the build unchanged. */
 const DEPLOY_BINDING_IDENTITY_FIELDS = {
@@ -1805,6 +1911,31 @@ function textValue(value, label) {
 	if (typeof value !== "string") throw new Error(`The Cloudflare ${label} is missing from the verified Worker output.`);
 	return value;
 }
+/** Match cf's package collection for uploads that preserve secrets through the JSON API. */
+async function readPackageDependencies(directory) {
+	try {
+		const pkg = record(JSON.parse(readFileSync(join(directory, "package.json"), "utf8")));
+		const declared = {
+			...record(pkg?.dependencies),
+			...record(pkg?.devDependencies)
+		};
+		const { getInstalledPackageVersion } = await import("@cloudflare/workers-utils");
+		const dependencies = [];
+		for (const [name, packageJsonVersion] of Object.entries(declared)) {
+			if (dependencies.length >= 200) break;
+			if (typeof packageJsonVersion !== "string" || /^(workspace|catalog|file|link):/.test(packageJsonVersion)) continue;
+			const installedVersion = getInstalledPackageVersion(name, directory);
+			if (installedVersion) dependencies.push({
+				name,
+				packageJsonVersion,
+				installedVersion
+			});
+		}
+		return dependencies.length ? dependencies : void 0;
+	} catch {
+		return;
+	}
+}
 const moduleContentTypes = {
 	esm: "application/javascript+module",
 	cjs: "application/javascript",
@@ -2544,6 +2675,7 @@ async function uploadPinnedCloudflareVersion(options) {
 		modules,
 		compatibility_date: config.compatibilityDate,
 		compatibility_flags: config.compatibilityFlags,
+		package_dependencies: await readPackageDependencies(options.output.directory),
 		bindings,
 		...config.limits ? { limits: {
 			cpu_ms: config.limits.cpuMs,
@@ -3096,17 +3228,18 @@ function createCfVersionRunner(options) {
 					"deploy",
 					"--prebuilt"
 				], command.capture, directory);
-				if (isCleanCloudflareExit(deployed) && raw.observability !== void 0) {
+				if (isCleanCloudflareExit(deployed) && (raw.observability !== void 0 || raw.logpush !== void 0)) {
 					const credentials = options.pinnedUpload;
 					if (!credentials || !credentials.verifyUploader()) return failed("The Cloudflare settings publisher is unavailable.");
 					try {
 						const token = await credentials.getToken();
 						if (!token || !credentials.verifyUploader()) return failed("Cloudflare session is unavailable for publishing Worker settings.");
-						await publishCloudflareObservability({
+						await publishCloudflareWorkerSettings({
 							apiBaseUrl: credentials.apiBaseUrl,
 							accountId: credentials.accountId,
 							workerName,
 							observability: raw.observability,
+							logpush: raw.logpush,
 							headers: { Authorization: `Bearer ${token}` }
 						});
 					} catch (cause) {
@@ -3167,53 +3300,6 @@ function createCfVersionRunner(options) {
 	};
 }
 //#endregion
-//#region src/cli/cloudflare-readiness.ts
-const STATE_FILE = join(".void", "cloudflare.json");
-/** Resolve the account subdomain without exposing Cloudflare credentials to project code. */
-function resolveCloudflareWorkersDevSubdomain(root, accountId, env = process.env) {
-	const configured = env.CLOUDFLARE_WORKERS_SUBDOMAIN;
-	if (configured !== void 0 && configured.trim().length > 0) {
-		const normalized = normalizeWorkersDevSubdomain(configured);
-		if (!normalized) throw new Error("deploy: CLOUDFLARE_WORKERS_SUBDOMAIN must be the account subdomain, for example \"my-team\" or \"my-team.workers.dev\".");
-		return normalized;
-	}
-	const cached = subdomainsByAccount(readCloudflareLocalState(root))[accountId];
-	return typeof cached === "string" ? normalizeWorkersDevSubdomain(cached) : void 0;
-}
-/** Cache a Wrangler-reported account subdomain for later no-preview version probes. */
-function rememberCloudflareWorkersDevSubdomain(root, accountId, url) {
-	const workersDevSubdomain = extractWorkersDevSubdomain(url);
-	if (!workersDevSubdomain) return false;
-	const current = readCloudflareLocalState(root);
-	const currentByAccount = subdomainsByAccount(current);
-	if (currentByAccount[accountId] === workersDevSubdomain) return false;
-	const { workersDevSubdomain: _legacy, ...state } = current;
-	const filePath = join(root, STATE_FILE);
-	mkdirSync(dirname(filePath), { recursive: true });
-	writeFileSync(filePath, JSON.stringify({
-		...state,
-		workersDevSubdomains: {
-			...currentByAccount,
-			[accountId]: workersDevSubdomain
-		}
-	}, null, 2) + "\n");
-	return true;
-}
-function subdomainsByAccount(state) {
-	const value = state.workersDevSubdomains;
-	return value && typeof value === "object" && !Array.isArray(value) ? value : {};
-}
-function readCloudflareLocalState(root) {
-	const filePath = join(root, STATE_FILE);
-	if (!existsSync(filePath)) return {};
-	try {
-		const parsed = JSON.parse(readFileSync(filePath, "utf-8"));
-		return typeof parsed === "object" && parsed !== null && !Array.isArray(parsed) ? parsed : {};
-	} catch {
-		return {};
-	}
-}
-//#endregion
 //#region src/cli/deploy-cloudflare-helpers.ts
 /**
 * Discover the root wrangler config path the same way the build / bindings
@@ -3266,6 +3352,7 @@ async function connectCloudflareDeployAccount(options) {
 		log$1.error(`deploy: ${getErrorMessage(error)}`);
 		return null;
 	}
+	const complianceRegion = resolveWorkersDevComplianceRegion(process.env, readWranglerTopLevelString(rootConfig, "compliance_region"));
 	const pins = createCloudflareUploaderPins(root, deps);
 	let accountId = readWranglerTopLevelString(rootConfig, "account_id") ?? (process.env.CLOUDFLARE_ACCOUNT_ID?.trim() || void 0);
 	if (!accountId) {
@@ -3285,8 +3372,10 @@ async function connectCloudflareDeployAccount(options) {
 		}
 	}
 	let workersDevSubdomain;
+	let readinessAccessOrigin;
 	try {
 		workersDevSubdomain = resolveCloudflareWorkersDevSubdomain(root, accountId);
+		readinessAccessOrigin = resolveCloudflareReadinessAccessOrigin({ CF_ACCESS_READINESS_ORIGIN: options.readinessAccessOrigin ?? void 0 });
 	} catch (error) {
 		log$1.error(getErrorMessage(error));
 		return null;
@@ -3294,8 +3383,10 @@ async function connectCloudflareDeployAccount(options) {
 	return {
 		...pins,
 		apiBaseUrl,
+		complianceRegion,
 		accountId,
 		workersDevSubdomain,
+		readinessAccessOrigin,
 		runWrangler: deps.runWrangler ?? createDeployWranglerRunner(root, accountId, apiBaseUrl),
 		rootConfig
 	};
@@ -3381,7 +3472,21 @@ function cloudflareCandidateActivationOptions(options) {
 		},
 		readinessHeaders: cloudflareWorkerReadinessHeaders(),
 		workersDevSubdomain,
+		resolveWorkersDevSubdomain: async () => {
+			const { complianceRegion } = options;
+			if (complianceRegion === void 0) return {
+				ok: false,
+				reason: "unavailable"
+			};
+			return readCloudflareWorkersDevSubdomain({
+				configPath,
+				complianceRegion,
+				runWrangler,
+				verifyUploader: options.assertUploaderStillPinned
+			});
+		},
 		readinessHeadersWorkersDevSubdomain: process.env.CLOUDFLARE_WORKERS_SUBDOMAIN?.trim() ? workersDevSubdomain : void 0,
+		readinessHeadersOrigin: options.readinessAccessOrigin,
 		...createCloudflareEmptyTriggerPublishers({
 			accountId,
 			apiBaseUrl: options.apiBaseUrl,
@@ -3482,36 +3587,64 @@ function formatCloudflareActivationFailure(result) {
 			].join("\n");
 		case "readiness-staging-failed": return `deploy: Cloudflare could not stage the uploaded Worker Version at zero-percent traffic${status}; production traffic is unchanged.${cloudflareCode}${diagnostic}${result.cloudflareErrorCode === 10210 && (result.diagnostic ?? "").toLowerCase().includes("durable object migration") ? "\n\nReview the Durable Object migration, then run `void deploy --platform cloudflare --atomic`. For future deploys, set deploy.cloudflare.mode to \"atomic\" in void.config.ts." : result.cloudflareErrorCode === 100405 ? "\n\nThe new version declares different exports from the live version (for example a Durable Object or Workflow class), so Cloudflare cannot split traffic between them. Run `void deploy --platform cloudflare --atomic` once to publish it at 100% directly; it receives traffic before readiness is checked." : ""}`;
 		case "atomic-failed": return `deploy: Cloudflare could not publish the Worker atomically${status}; inspect production status before retrying.${cloudflareCode}${diagnostic}`;
-		case "atomic-output-invalid": return "deploy: Cloudflare published atomically but did not report a version id or URL. Inspect `void project status` immediately.";
+		case "atomic-output-invalid":
+			if (result.versionId) return formatCloudflarePublishWithoutUrl(`Cloudflare published Worker version ${result.versionId} atomically`, `If the app uses workers.dev, set CLOUDFLARE_WORKERS_SUBDOMAIN to your account subdomain ${WORKERS_SUBDOMAIN_EXAMPLE}.`);
+			return "deploy: Cloudflare published atomically but did not report its version id. Inspect `void project status` immediately.";
 		case "atomic-readiness-failed":
-		case "atomic-readiness-access-denied": return `deploy: the atomic Worker deployment is live, but /__void/ready could not be verified. Inspect \`void project status\` and Worker logs immediately.${diagnostic}`;
+		case "atomic-readiness-access-denied": return `deploy: the atomic Worker deployment is live, but /__void/ready could not be verified. Inspect \`void project status\` and Worker logs immediately.${diagnostic}${result.customRouteReadinessOrigin ? `\n\n${customRouteAccessHint(result.customRouteReadinessOrigin).join("\n")}` : ""}`;
 		case "readiness-failed": return ["deploy: the uploaded Worker Version did not pass /__void/ready.", formatCloudflareReadinessRestoration(result)].join("\n");
-		case "readiness-access-denied": return [
-			"deploy: Cloudflare Access blocked the uploaded Worker Version readiness probe.",
-			"For CI, set CF_ACCESS_CLIENT_ID and CF_ACCESS_CLIENT_SECRET to an admitted service token.",
-			"For a local deploy, set CF_ACCESS_TOKEN to a short-lived user JWT from cloudflared.",
-			"If the response is error 1050, create an Access application for this hostname; a token alone cannot bypass account default-deny.",
-			`Then retry. ${formatCloudflareReadinessRestoration(result)}`
-		].join("\n");
+		case "readiness-access-denied":
+			if (result.customRouteReadinessOrigin) return [
+				"deploy: Cloudflare Access blocked the uploaded Worker Version readiness probe.",
+				...customRouteAccessHint(result.customRouteReadinessOrigin),
+				ATOMIC_ACCESS_ALTERNATIVE,
+				formatCloudflareReadinessRestoration(result)
+			].join("\n");
+			return [
+				"deploy: Cloudflare Access blocked the uploaded Worker Version readiness probe.",
+				"For CI, set CF_ACCESS_CLIENT_ID and CF_ACCESS_CLIENT_SECRET to an admitted service token.",
+				"For a local deploy, set CF_ACCESS_TOKEN to a short-lived user JWT from cloudflared.",
+				"If the response is error 1050, create an Access application for this hostname; a token alone cannot bypass account default-deny.",
+				`Then retry. ${formatCloudflareReadinessRestoration(result)}`
+			].join("\n");
 		case "bootstrap-failed": return `deploy: Cloudflare could not bootstrap the first Worker deployment${status}.${cloudflareCode}${diagnostic}`;
-		case "bootstrap-output-invalid": return ["deploy: Cloudflare bootstrapped the first Worker deployment, but Wrangler", "did not report its version id and workers.dev URL. Inspect `void project status` before retrying."].join("\n");
+		case "bootstrap-output-invalid":
+			if (result.versionId) return formatCloudflarePublishWithoutUrl(`Cloudflare published the first Worker deployment as version ${result.versionId}`, `If the app uses workers.dev, enable workers.dev for this Worker in the Cloudflare dashboard. Then set CLOUDFLARE_WORKERS_SUBDOMAIN to your account subdomain ${WORKERS_SUBDOMAIN_EXAMPLE}.`);
+			return ["deploy: Cloudflare bootstrapped the first Worker deployment, but Wrangler", "did not report its version id. Inspect `void project status` before retrying."].join("\n");
 		case "bootstrap-readiness-failed": return [
 			"deploy: the first Worker deployment did not pass /__void/ready.",
 			"Cloudflare requires this bootstrap to be non-versioned, so the new Worker is already active;",
 			"inspect its logs and `void project status` before retrying."
 		].join("\n") + diagnostic;
-		case "bootstrap-readiness-access-denied": return [
-			"deploy: Cloudflare Access blocked the first Worker deployment readiness probe.",
-			"For CI, set CF_ACCESS_CLIENT_ID and CF_ACCESS_CLIENT_SECRET to an admitted service token;",
-			"for a local deploy, set CF_ACCESS_TOKEN to a short-lived user JWT from cloudflared.",
-			"If the response is error 1050, create an Access application for this hostname; a token alone cannot bypass account default-deny.",
-			"Then retry. Cloudflare requires the first deployment to be non-versioned, so the new",
-			"Worker is already active behind Access."
-		].join("\n");
+		case "bootstrap-readiness-access-denied":
+			if (result.customRouteReadinessOrigin) return [
+				"deploy: Cloudflare Access blocked the first Worker deployment readiness probe.",
+				"Cloudflare requires the first deployment to be non-versioned, so the new Worker is already active behind Access.",
+				...customRouteAccessHint(result.customRouteReadinessOrigin),
+				"Later deploys check readiness before traffic moves, so they need the same setting.",
+				ATOMIC_ACCESS_ALTERNATIVE
+			].join("\n");
+			return [
+				"deploy: Cloudflare Access blocked the first Worker deployment readiness probe.",
+				"For CI, set CF_ACCESS_CLIENT_ID and CF_ACCESS_CLIENT_SECRET to an admitted service token;",
+				"for a local deploy, set CF_ACCESS_TOKEN to a short-lived user JWT from cloudflared.",
+				"If the response is error 1050, create an Access application for this hostname; a token alone cannot bypass account default-deny.",
+				"Then retry. Cloudflare requires the first deployment to be non-versioned, so the new",
+				"Worker is already active behind Access."
+			].join("\n");
 		case "activation-failed": return `deploy: the ready Worker Version could not be activated${status}; production traffic is unchanged.`;
 		case "triggers-failed": return `deploy: the Worker activated, but Cloudflare trigger synchronization failed${status}. ${result.rollback === "succeeded" ? "Traffic was restored to the previous version." : result.rollback === "unavailable" ? result.previousVersionId === null ? "This was the first deployment, so no previous version was available to restore." : "Traffic or trigger restoration could not be completed. Inspect its routes, schedules, queues, and workflows in Cloudflare before retrying." : "Automatic traffic restoration failed; inspect `void project status` immediately."}`;
 	}
 }
+/** Explain why a custom-route readiness probe carried no Access credentials. */
+function customRouteAccessHint(origin) {
+	return [
+		`Void did not send Access credentials to ${origin}. A route or Custom Domain receives them only when CF_ACCESS_READINESS_ORIGIN names its origin.`,
+		`If Access protects ${origin} and admits your credentials, set CF_ACCESS_READINESS_ORIGIN=${origin} with CF_ACCESS_CLIENT_ID and CF_ACCESS_CLIENT_SECRET, or CF_ACCESS_TOKEN. Then retry.`,
+		"Set it only if you control this hostname and it serves this Worker, because Void sends your Access credentials to it."
+	];
+}
+const ATOMIC_ACCESS_ALTERNATIVE = "For a Worker with Durable Object migration history, `void deploy --platform cloudflare --atomic` publishes without the zero-traffic check. The new version receives traffic first, and the command still exits with an error because Void cannot verify readiness through Access.";
 function formatCloudflareReadinessRestoration(result) {
 	switch (result.rollback) {
 		case "succeeded": return "The failed version remains inactive, and traffic was restored to the previous version.";
@@ -3521,6 +3654,16 @@ function formatCloudflareReadinessRestoration(result) {
 		default: return "The failed version remains inactive for inspection; production traffic is unchanged.";
 	}
 }
+const WORKERS_SUBDOMAIN_EXAMPLE = "(for example \"my-team\", or \"my-team.fed\" for FedRAMP High)";
+/** Explain a live version whose readiness URL Void could not determine. */
+function formatCloudflarePublishWithoutUrl(published, recovery) {
+	return [
+		`deploy: ${published}, but Void could not determine its URL.`,
+		"Void did not update its routes, workers.dev setting, or other triggers, and did not check /__void/ready.",
+		recovery,
+		"Then inspect `void project status` before you deploy again."
+	].join("\n");
+}
 /** Capture the Access credential used only by the guarded Worker readiness probe. */
 function cloudflareWorkerReadinessHeaders() {
 	return trustedCloudflareWorkerAccessHeaders({
@@ -3648,10 +3791,11 @@ async function runCloudflareStaticDeploy(root, options, voidConfig, preset, cliL
 		configPath,
 		rootConfig: parseRootWranglerConfig(configPath),
 		deps,
-		persistAccount: !(options.reuseExistingWorker || initialCloudflareLink)
+		persistAccount: !(options.reuseExistingWorker || initialCloudflareLink),
+		readinessAccessOrigin: options.readinessAccessOrigin
 	});
 	if (!connection || !await confirmCloudflareDeployAuthentication(connection, configPath)) return exit(1);
-	const { apiBaseUrl, usesCf, cfUploaderIsPinned, assertUploaderStillPinned, accountId, workersDevSubdomain, runWrangler } = connection;
+	const { apiBaseUrl, complianceRegion, usesCf, cfUploaderIsPinned, assertUploaderStillPinned, accountId, workersDevSubdomain, readinessAccessOrigin, runWrangler } = connection;
 	const existingWorker = await prepareExistingCloudflareDeployWithAuth({
 		root,
 		configPath,
@@ -3699,6 +3843,7 @@ async function runCloudflareStaticDeploy(root, options, voidConfig, preset, cliL
 	const merged = mergeAndLintRoutingRules(preset.outputDir, voidConfig.routing);
 	const manifest = buildStaticManifest({
 		appType: preset.appType,
+		alwaysUseHttps: voidConfig.routing?.alwaysUseHttps,
 		hashedAssetsPrefix: "assets",
 		headerRules: merged.headerRules,
 		redirectRules: merged.redirectRules,
@@ -3731,6 +3876,7 @@ async function runCloudflareStaticDeploy(root, options, voidConfig, preset, cliL
 	}, null, 2)}\n`, { mode: 384 });
 	writeFileSync(entryPath, renderCloudflareStaticEntry({
 		runtimeImport: "void/edge",
+		alwaysUseHttps: manifest.alwaysUseHttps,
 		headerRules: manifest.headerRules,
 		redirectRules: manifest.redirectRules,
 		fallbackRules: manifest.fallbackRules,
@@ -3779,8 +3925,10 @@ async function runCloudflareStaticDeploy(root, options, voidConfig, preset, cliL
 			uploadConfigPath: staticConfigPath,
 			accountId,
 			apiBaseUrl,
+			complianceRegion,
 			workerName,
 			workersDevSubdomain,
+			readinessAccessOrigin,
 			runWrangler,
 			readExistingWorker: deps.readExistingWorker,
 			existingWorker,
@@ -4368,7 +4516,7 @@ async function buildCloudflareWorker(input) {
 		projectRoot: root,
 		configPath: generatedConfigPath,
 		accountId
-	}) : prepareCfBuildOutput(dirname(generatedConfigPath), accountId);
+	}) : prepareCfBuildOutput(dirname(generatedConfigPath), accountId, void 0, root);
 	if (usesCf) {
 		const preflight = await prepareBuildOutput();
 		if (!preflight) {
@@ -4891,10 +5039,11 @@ async function preflightCloudflareWorker(input) {
 		configPath,
 		rootConfig,
 		deps,
-		persistAccount: !(options.reuseExistingWorker || initialCloudflareLink)
+		persistAccount: !(options.reuseExistingWorker || initialCloudflareLink),
+		readinessAccessOrigin: options.readinessAccessOrigin
 	});
 	if (!connection) return exit(1);
-	const { apiBaseUrl, usesCf, cfUploaderIsPinned, assertUploaderStillPinned, accountId, workersDevSubdomain, runWrangler } = connection;
+	const { apiBaseUrl, complianceRegion, usesCf, cfUploaderIsPinned, assertUploaderStillPinned, accountId, workersDevSubdomain, readinessAccessOrigin, runWrangler } = connection;
 	rootConfig = connection.rootConfig;
 	const workerName = readWranglerTopLevelString(rootConfig, "name") ?? deriveWorkerName(root);
 	printDeployContext(workerName, "Cloudflare");
@@ -5122,11 +5271,13 @@ async function preflightCloudflareWorker(input) {
 	});
 	return {
 		apiBaseUrl,
+		complianceRegion,
 		usesCf,
 		cfUploaderIsPinned,
 		assertUploaderStillPinned,
 		accountId,
 		workersDevSubdomain,
+		readinessAccessOrigin,
 		runWrangler,
 		workerName,
 		emailMap,
@@ -5147,7 +5298,7 @@ async function preflightCloudflareWorker(input) {
 async function publishCloudflareWorker(input) {
 	const { root, deps, exit, cliLog, atomic, detectedFramework, initialCloudflareCandidate } = input;
 	const { configPath, needsSandbox, desired, analysis } = input.source;
-	const { usesCf, existingWorker, pinnedHandoffLink, accountId, workerName, cfUploaderIsPinned, apiBaseUrl, runWrangler, assertUploaderStillPinned, schemaFacts, approvedHandoffKv, workersDevSubdomain } = input.preflight;
+	const { usesCf, existingWorker, pinnedHandoffLink, accountId, workerName, cfUploaderIsPinned, apiBaseUrl, complianceRegion, runWrangler, assertUploaderStillPinned, schemaFacts, approvedHandoffKv, workersDevSubdomain, readinessAccessOrigin } = input.preflight;
 	const { migrations, d1MigrateToken, generatedConfigPath, prepareBuildOutput } = input.build;
 	const { workerWasMissingBeforeSecretProvisioning, initialAuthSecret, appliedMigrations } = input.migration;
 	const queueConsumerCleanup = readWranglerManagedQueueCleanupCandidates(configPath);
@@ -5189,8 +5340,10 @@ async function publishCloudflareWorker(input) {
 			uploadConfigPath: generatedConfigPath,
 			accountId,
 			apiBaseUrl,
+			complianceRegion,
 			workerName,
 			workersDevSubdomain,
+			readinessAccessOrigin,
 			runWrangler,
 			readExistingWorker: deps.readExistingWorker,
 			existingWorker,
@@ -5241,6 +5394,7 @@ async function publishCloudflareWorker(input) {
 //#region src/cli/deploy-cloudflare.ts
 /** Deploy to the user's own Cloudflare account through the guarded native Worker flow. */
 async function runCloudflareDeploy(root, options, cliLog, deps = {}) {
+	options = withRecordedReadinessAccessOrigin(options);
 	const initialCloudflareLink = readCloudflareLink(root);
 	const initialCloudflareCandidate = readCloudflareCandidate(root);
 	const exit = deps.exit ?? ((code) => process.exit(code));
@@ -5277,6 +5431,14 @@ async function runCloudflareDeploy(root, options, cliLog, deps = {}) {
 		}
 		return runCloudflareStaticDeploy(root, options, voidConfig, staticPreset, cliLog, deps, initialCloudflareLink, initialCloudflareCandidate);
 	}
+	if (detectedFramework && voidConfig.routing?.alwaysUseHttps === true) {
+		log$1.error([
+			`deploy: native Cloudflare deployment cannot apply Void routing.alwaysUseHttps to ${detectedFramework.name}.`,
+			"This framework owns its Worker request handler, so the HTTPS redirect would otherwise be ignored.",
+			"Redirect HTTP to HTTPS in the framework, or turn on Cloudflare's Always Use HTTPS setting for your zone, then remove routing.alwaysUseHttps and retry."
+		].join("\n"));
+		return exit(1);
+	}
 	const source = await prepareCloudflareDeploySource(root, options, voidConfig);
 	if (!source) return exit(1);
 	const preflight = await preflightCloudflareWorker({
@@ -5446,6 +5608,7 @@ async function runFrameworkDeploy(root, config, client, detected, fwPreset, void
 	};
 	const manifest = buildFrameworkManifest({
 		frameworkName: detected.name,
+		alwaysUseHttps: voidConfig.routing?.alwaysUseHttps,
 		workerMain: actualWorkerMain,
 		bindings,
 		migrations: validatedMigrations,
@@ -5619,7 +5782,7 @@ async function runFullDeploy(root, config, client, voidConfig, fwPreset, skipBui
 				buildCommand: null,
 				outputDir: clientDir,
 				appType: "static"
-			}, true, gitMetadata, assetsPrefix, headerRules, redirectRules, fallbackRules, void 0, cliLog, voidConfig.routing?.notFound);
+			}, true, gitMetadata, assetsPrefix, headerRules, redirectRules, fallbackRules, void 0, cliLog, voidConfig.routing?.notFound, voidConfig.routing?.alwaysUseHttps);
 		}
 	}
 	const prerenderSourcesPresent = hasPrerenderSources({
@@ -5702,6 +5865,7 @@ async function runFullDeploy(root, config, client, voidConfig, fwPreset, skipBui
 			...bindings,
 			needsLive: true
 		} : bindings,
+		alwaysUseHttps: voidConfig.routing?.alwaysUseHttps,
 		hasEmailHandlers: !isFrameworkMode && routeScan.email !== void 0 && hasEmailHandlers(routeScan.email),
 		migrations: validatedMigrations,
 		schedules,
@@ -6204,6 +6368,7 @@ function resolveDeploymentPlatform(root, options) {
 }
 /** Run `void deploy`; a failure carries a summary of the deploy log in its message. */
 async function runDeploy(root, options) {
+	options = withRecordedReadinessAccessOrigin(options ?? {});
 	console.log();
 	const cliLog = openDeployLog({ mirrorToStderr: options?.debug === true || process.env.VOID_DEPLOY_DEBUG === "1" });
 	cliLog.info("deploy_start", {