void 1.3.0 → 1.5.0

package/dist/{deploy-hRPvw8ci.mjs → deploy-CwmCcTlq.mjs}

@@ -1,53 +1,54 @@
-import { n as __toESM, t as __commonJSMin } from "./rolldown-runtime-3h0WiCiA.mjs";
-import { a as join, c as resolve, n as dirname, o as normalize, r as extname, s as relative, t as basename } from "./dist-ipQi0Q8y.mjs";
-import { t as require_picocolors } from "./picocolors-BsDfhxIw.mjs";
-import { r as detectFramework } from "./plugin-inference-CeiB6BG5.mjs";
-import { n as readProjectPaths, t as assertNoRootSourceConventionConflicts } from "./project-paths-DGu_QZ_Q.mjs";
-import { m as resolveBindingNames, p as readConfig, u as isNodeTarget } from "./config-DHgSEWT7.mjs";
-import { a as hasSandboxSqliteMigration, c as sandboxContainerConfig, i as assertSandboxNamespaceConfig, o as requiresSandboxPlatformImage, r as SANDBOX_MIGRATION_TAG, s as resolveSandboxConfig, t as analyzeApplicationSync } from "./application-analysis-DYdVoMAY.mjs";
-import { t as collectMigrations } from "./collect-Dew86qce.mjs";
-import { o as validateSsrEntry } from "./entry-BEM8ZuGP.mjs";
-import { r as hasEmailHandlers } from "./email-B9ayYQEG.mjs";
-import { a as resolveDistDir, c as hasDocumentRoutes, l as resolveAssetConfig, n as collectRevalidate, o as resolveWorkerDirName, r as hasRevalidate, s as hasApiRoutes } from "./isr-config-fZaJJ8t7.mjs";
-import { t as writeFileAtomic } from "./atomic-write-Dq6R0BPN.mjs";
-import { s as listPlatformConnections } from "./platform-registry-B9mWX9LO.mjs";
-import { c as writeDeploymentPlatform, n as readDeploymentPlatform, r as readProjectConfig } from "./project-rqDnVsJN.mjs";
-import { n as readGeneratedWranglerConfigFile } from "./generated-wrangler-config-DeWj5F9Y.mjs";
-import { i as persistCloudflareConfig, r as materializeCloudflareConfig, s as stashCloudflareDeployPointer } from "./cloudflare-config-DchHxPTo.mjs";
-import { A as syncWranglerWebSockets, C as readWranglerManagedQueueCleanupCandidates, D as sameMigrationsDir, E as resolveLiveBindingConfig, M as writeProvisionedWranglerConfig, N as writeWranglerPublishedTrafficSnapshot, a as LIVE_MIGRATION_TAG, c as bindingEntriesForField, h as nextDurableObjectMigrationTag, k as syncWranglerDurableObjects, m as hasDurableObjectSqliteMigration, o as acknowledgeWranglerManagedQueueRemovals, r as FRIENDLY_BINDING_NAMES, v as readExistingLiveBindingConfig, w as readWranglerPublishedTrafficSnapshot } from "./wrangler-CDiEBCdS.mjs";
-import { r as trustedCloudflareWorkerAccessHeaders, t as cfAccessHeaders } from "./cf-access-BM9G0lhO.mjs";
-import { t as ensurePlatformAccessToken } from "./cf-access-CWP4avfP.mjs";
-import { a as getApiUrl, c as getToken, l as getTokenSource } from "./auth-B6iOCjKI.mjs";
-import { i as otherQueueConsumers, n as chooseCloudflareQueueName, o as scopedCloudflareQueueName, r as cloudflareQueueName } from "./dispatch-OVLeWW8K.mjs";
-import { l as resolveRemoteMode, n as CLOUDFLARE_QUEUE_NAMES_BUILD_ENV, t as CLOUDFLARE_DEPLOY_BUILD_ENV } from "./env-BaMz0j7H.mjs";
-import { t as assertNoPrerenderFailures } from "./prerender-render-CaShbHJ3.mjs";
-import { a as buildEnv, n as readVersionMetadataBinding, r as selectNativeVersionMetadataBinding, t as CLOUDFLARE_PRESERVE_BINDINGS_BUILD_ENV } from "./version-metadata-DmaZNTYW.mjs";
-import { a as emailConfigInputs, c as renderAddressMap, d as isGeneratedAssetHeaders, g as prerenderPagesNode, h as prerenderPages, i as createNodeEmailDns, l as renderEmailChecklist, m as collectPrerenderPathsNode, n as SEND_EMAIL_BINDING, o as preflightEmail, p as collectPrerenderPaths, r as applyEmailSetup, t as EMAIL_FROM_VAR } from "./email-cloudflare-B8-pq_-W.mjs";
-import { n as completeApplicationAnalysis, t as analyzeApplication } from "./application-routing-C8EqRDfv.mjs";
-import { a as record, i as migrateBuiltWranglerConfig, n as prepareCfFrameworkBuildOutput, r as prepareCfStaticBuildOutput, t as prepareCfBuildOutput } from "./cf-build-output-Bapzc_8Z.mjs";
-import { i as validateMigrations, t as assertJournalCoherence } from "./validate-CnZPMq4q.mjs";
-import { A as confirm, K as select, L as log, tt as isCancel } from "./dist-Cor9XGoz.mjs";
-import { r as getPackageDir } from "./agents-CuNtT0D_.mjs";
-import { a as isExpiredTokenError, r as PlatformClient } from "./client-BEMtySaV.mjs";
-import { o as formatCount, p as note, r as createSpinner, u as getErrorMessage } from "./output-BpgYODYx.mjs";
-import { t as getRequestedProjectSlug } from "./resolve-project-Xoi6eTWY.mjs";
-import { i as safePositional, r as readCfUploadOutput, t as CF_VERSION_SOURCE_MAX_OUTPUT_BYTES } from "./cf-command-values-ByHk0xg4.mjs";
-import { a as FRAMEWORK_PRESETS, c as hasBackendFiles, i as isCleanCloudflareExit, l as resolveCloudflareOperationArgv, o as detectPreset, s as formatProjectCommand, t as createCloudflareProcessRunner, u as resolveProjectCommand } from "./cloudflare-process-8jEYIeim.mjs";
-import { f as listSelfHostSecretNames, h as selfHostSchemaFailureMessage, i as SelfHostSecretListError, l as dischargeSelfHostEnvContext, n as SelfHostFirstDeployError, p as readEmittedWorkerVars, r as SelfHostSchemaError, s as deriveSelfHostEnvContextFromVars, t as SelfHostEnvValidationError } from "./env-validation-XcukUlFM.mjs";
-import { a as needsWrapper, r as cleanupWrapper, t as bundleEntry } from "./wrapper-CEiDeCqD.mjs";
-import { A as promptDeployProjectConfig, C as ensureManagedHyperdrive, D as hasNonPageBackend, E as getGitCommit, F as resolveStaticBuildCommand, I as resolveStaticDeployPreset, L as toManifestSchedulesAndQueues, M as resolveDeployWorkerMain, N as resolveDeployWranglerCompat, O as hasPrerenderSources, P as resolveFullDeployBuildCommand, R as validateDeployMigrations, S as createProjectFromSlug, T as getExitCode, _ as getDeploySchemaDriftMessage, a as collectAndHashAssets, b as assertProjectDeployAccess, c as readWranglerHtmlHandling, d as printDeploySuccess, f as mergeAndLintRoutingRules, g as assertDeploySchemaDriftFree, h as warnUnpublishedRouting, i as buildStaticManifest, j as resolveDeployLiveBindingConfig, k as log$1, l as formatDeploySummary, m as warnIgnoredNotFoundForFramework, n as runStaticDeploy, o as collectWorkerFiles, p as streamDirectR2Deploy, r as buildFrameworkManifest, s as detectNonSpaFallbackWarning, t as assembleVoidManifest, u as printDeployContext, v as hasDeploySchemaDrift, w as generateDeployWrapperIfNeeded, x as assertWorkerMainUploaded, y as assertEnvSchemaValid } from "./deploy-managed-static-CDYA2p3L.mjs";
-import { a as checkCloudflareProvisionDrift, d as isQueueConfirmedAbsent, f as isRealD1Id, g as provisionCloudflareResources, i as assertValidResourceName, m as isRealKvId, s as deleteEnvVarCaseAware } from "./provision-B7UFrBH7.mjs";
-import { c as scrubWranglerAuthCredentials, n as buildSchemaProbeEnv, o as resolveDeployTransport, r as deployChildEnv, s as scrubManagedDeployBuildMarkers, t as MANAGED_DEPLOY_BUILD_ENV } from "./deploy-transport-JCxw7QDi.mjs";
-import { n as getCfCliVersion, r as getVoidUserAgent, t as publishCloudflareObservability } from "./cf-worker-settings-BECvvTVd.mjs";
-import { t as sanitizeTerminalLogText } from "./terminal-log-text-D9ACPOuG.mjs";
-import { t as promptForLoginToken } from "./login-BjSyhXlT.mjs";
-import { a as parseCloudflareAuthSession, i as ensureCloudflareAuthentication, n as cloudflareCredentialOverrides, t as CloudflareAuthenticationError } from "./cloudflare-auth-Byo_0_N9.mjs";
-import { a as createCloudflareEmptyDomainPublisher, i as createCloudflareEmptyCronPublisher } from "./cloudflare-operations-vP3b5CQf.mjs";
-import { n as openMigrationValidationDatabase, t as SqliteMigrationError } from "./sqlite-validation-BzKMWnO4.mjs";
-import { a as discoverFrameworkWranglerFiles, i as writeVoidProjectConfig, t as migrateLegacyVoidConfig } from "./migrate-BXRHpYwR.mjs";
-import { a as runMySqlMigrations } from "./runner-mysql-BWmbk5IE.mjs";
-import { i as runPgMigrations } from "./runner-pg-Cr3qrqi4.mjs";
-import { t as collectGitDeployMetadata } from "./git-metadata-D-gurjzG.mjs";
+import { n as __toESM, t as __commonJSMin } from "./rolldown-runtime-uD8oG6U2.mjs";
+import { a as join, c as resolve, n as dirname, o as normalize, r as extname, s as relative, t as basename } from "./dist-DMYe8CZJ.mjs";
+import { t as require_picocolors } from "./picocolors-D1NxSLw-.mjs";
+import { r as detectFramework } from "./plugin-inference-DmwjC3y2.mjs";
+import { n as readProjectPaths, t as assertNoRootSourceConventionConflicts } from "./project-paths-CdGv9Tmi.mjs";
+import { m as resolveBindingNames, p as readConfig, u as isNodeTarget } from "./config-DkA9jYF2.mjs";
+import { a as hasSandboxSqliteMigration, c as sandboxContainerConfig, i as assertSandboxNamespaceConfig, o as requiresSandboxPlatformImage, r as SANDBOX_MIGRATION_TAG, s as resolveSandboxConfig, t as analyzeApplicationSync } from "./application-analysis-2vGZrKzg.mjs";
+import { t as collectMigrations } from "./collect-C6Blu9yw.mjs";
+import { o as validateSsrEntry } from "./entry-CBZsCy3O.mjs";
+import { r as hasEmailHandlers } from "./email-BHY72ixO.mjs";
+import { a as resolveDistDir, c as hasDocumentRoutes, l as resolveAssetConfig, n as collectRevalidate, o as resolveWorkerDirName, r as hasRevalidate, s as hasApiRoutes } from "./isr-config-DhBkzCdY.mjs";
+import { t as writeFileAtomic } from "./atomic-write-DA6eD1Kp.mjs";
+import { s as listPlatformConnections } from "./platform-registry-DZ_2Xuqd.mjs";
+import { c as writeDeploymentPlatform, n as readDeploymentPlatform, r as readProjectConfig } from "./project-CLwxcEdq.mjs";
+import { n as readGeneratedWranglerConfigFile } from "./generated-wrangler-config-CoDaaFsA.mjs";
+import { a as persistCloudflareConfig, c as stashCloudflareDeployPointer, i as materializeCloudflareConfig } from "./cloudflare-config-Chet188_.mjs";
+import { A as syncWranglerWebSockets, C as readWranglerManagedQueueCleanupCandidates, D as sameMigrationsDir, E as resolveLiveBindingConfig, L as writeVoidProjectConfig, M as writeProvisionedWranglerConfig, N as writeWranglerPublishedTrafficSnapshot, a as LIVE_MIGRATION_TAG, c as bindingEntriesForField, h as nextDurableObjectMigrationTag, k as syncWranglerDurableObjects, m as hasDurableObjectSqliteMigration, o as acknowledgeWranglerManagedQueueRemovals, r as FRIENDLY_BINDING_NAMES, v as readExistingLiveBindingConfig, w as readWranglerPublishedTrafficSnapshot } from "./wrangler-p-kLCJqF.mjs";
+import { r as trustedCloudflareWorkerAccessHeaders, t as cfAccessHeaders } from "./cf-access-pejlJmuy.mjs";
+import { t as ensurePlatformAccessToken } from "./cf-access-BmBT2h8_.mjs";
+import { a as getApiUrl, c as getToken, l as getTokenSource } from "./auth-Dy8svcqQ.mjs";
+import { n as record, t as migrateBuiltWranglerConfig } from "./cf-config-migrate-Dy8MrKgF.mjs";
+import { l as resolveRemoteMode, n as CLOUDFLARE_QUEUE_NAMES_BUILD_ENV, t as CLOUDFLARE_DEPLOY_BUILD_ENV } from "./env-CuzZZyjB.mjs";
+import { i as otherQueueConsumers, n as chooseCloudflareQueueName, o as scopedCloudflareQueueName, r as cloudflareQueueName } from "./dispatch-CiJ1Xrba.mjs";
+import { t as assertNoPrerenderFailures } from "./prerender-render-RlAj6hh8.mjs";
+import { a as buildEnv, n as readVersionMetadataBinding, r as selectNativeVersionMetadataBinding, t as CLOUDFLARE_PRESERVE_BINDINGS_BUILD_ENV } from "./version-metadata-Blf5H9BQ.mjs";
+import { a as emailConfigInputs, c as renderAddressMap, d as isGeneratedAssetHeaders, g as prerenderPagesNode, h as prerenderPages, i as createNodeEmailDns, l as renderEmailChecklist, m as collectPrerenderPathsNode, n as SEND_EMAIL_BINDING, o as preflightEmail, p as collectPrerenderPaths, r as applyEmailSetup, t as EMAIL_FROM_VAR } from "./email-cloudflare-CtD8qE13.mjs";
+import { n as completeApplicationAnalysis, t as analyzeApplication } from "./application-routing-DnUQoOJD.mjs";
+import { n as prepareCfFrameworkBuildOutput, r as prepareCfStaticBuildOutput, t as prepareCfBuildOutput } from "./cf-build-output-B1C8U83u.mjs";
+import { i as validateMigrations, t as assertJournalCoherence } from "./validate-Ddzl-IwT.mjs";
+import { A as confirm, K as select, L as log, tt as isCancel } from "./dist-D23AAMxT.mjs";
+import { r as getPackageDir } from "./agents-DRo8gzni.mjs";
+import { a as isExpiredTokenError, r as PlatformClient } from "./client-Qayy9xEh.mjs";
+import { o as formatCount, p as note, r as createSpinner, u as getErrorMessage } from "./output-BCdLioKP.mjs";
+import { t as getRequestedProjectSlug } from "./resolve-project-D0YNnJfm.mjs";
+import { i as safePositional, r as readCfUploadOutput, t as CF_VERSION_SOURCE_MAX_OUTPUT_BYTES } from "./cf-command-values-Ccl-zRhl.mjs";
+import { a as FRAMEWORK_PRESETS, c as hasBackendFiles, i as isCleanCloudflareExit, l as resolveCloudflareOperationArgv, o as detectPreset, s as formatProjectCommand, t as createCloudflareProcessRunner, u as resolveProjectCommand } from "./cloudflare-process-DjJ638A-.mjs";
+import { f as listSelfHostSecretNames, h as selfHostSchemaFailureMessage, i as SelfHostSecretListError, l as dischargeSelfHostEnvContext, n as SelfHostFirstDeployError, p as readEmittedWorkerVars, r as SelfHostSchemaError, s as deriveSelfHostEnvContextFromVars, t as SelfHostEnvValidationError } from "./env-validation-GV1oD4EV.mjs";
+import { a as needsWrapper, r as cleanupWrapper, t as bundleEntry } from "./wrapper-iejSJDwL.mjs";
+import { A as promptDeployProjectConfig, C as ensureManagedHyperdrive, D as hasNonPageBackend, E as getGitCommit, F as resolveStaticBuildCommand, I as resolveStaticDeployPreset, L as toManifestSchedulesAndQueues, M as resolveDeployWorkerMain, N as resolveDeployWranglerCompat, O as hasPrerenderSources, P as resolveFullDeployBuildCommand, R as validateDeployMigrations, S as createProjectFromSlug, T as getExitCode, _ as getDeploySchemaDriftMessage, a as collectAndHashAssets, b as assertProjectDeployAccess, c as readWranglerHtmlHandling, d as printDeploySuccess, f as mergeAndLintRoutingRules, g as assertDeploySchemaDriftFree, h as warnUnpublishedRouting, i as buildStaticManifest, j as resolveDeployLiveBindingConfig, k as log$1, l as formatDeploySummary, m as warnIgnoredNotFoundForFramework, n as runStaticDeploy, o as collectWorkerFiles, p as streamDirectR2Deploy, r as buildFrameworkManifest, s as detectNonSpaFallbackWarning, t as assembleVoidManifest, u as printDeployContext, v as hasDeploySchemaDrift, w as generateDeployWrapperIfNeeded, x as assertWorkerMainUploaded, y as assertEnvSchemaValid } from "./deploy-managed-static-gPDxyp3v.mjs";
+import { a as checkCloudflareProvisionDrift, b as resolveWorkersDevComplianceRegion, d as isQueueConfirmedAbsent, f as isRealD1Id, g as provisionCloudflareResources, i as assertValidResourceName, m as isRealKvId, s as deleteEnvVarCaseAware } from "./provision-CRiNnlfE.mjs";
+import { c as scrubWranglerAuthCredentials, n as buildSchemaProbeEnv, o as resolveDeployTransport, r as deployChildEnv, s as scrubManagedDeployBuildMarkers, t as MANAGED_DEPLOY_BUILD_ENV } from "./deploy-transport-L6zzPE9T.mjs";
+import { n as getCfCliVersion, r as getVoidUserAgent, t as publishCloudflareWorkerSettings } from "./cf-worker-settings-CARs4Wy9.mjs";
+import { t as sanitizeTerminalLogText } from "./terminal-log-text-DNsWJREL.mjs";
+import { t as promptForLoginToken } from "./login-koQbjzPd.mjs";
+import { a as parseCloudflareAuthSession, i as ensureCloudflareAuthentication, n as cloudflareCredentialOverrides, t as CloudflareAuthenticationError } from "./cloudflare-auth-CEu-1Ps_.mjs";
+import { a as createCloudflareEmptyDomainPublisher, i as createCloudflareEmptyCronPublisher } from "./cloudflare-operations-CWA24vCh.mjs";
+import { n as openMigrationValidationDatabase, t as SqliteMigrationError } from "./sqlite-validation-CLJXXN93.mjs";
+import { r as discoverFrameworkWranglerFiles, t as migrateLegacyVoidConfig } from "./migrate-C62pGTfr.mjs";
+import { a as runMySqlMigrations } from "./runner-mysql-Bdmsp_x4.mjs";
+import { i as runPgMigrations } from "./runner-pg-mYc75KfH.mjs";
+import { t as collectGitDeployMetadata } from "./git-metadata-Cukp5kV5.mjs";
 import { createRequire } from "node:module";
 import { cpSync, createWriteStream, existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, readlinkSync, realpathSync, rmSync, statSync, unlinkSync, writeFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
@@ -60,12 +61,12 @@ import { execFile, execSync, spawn } from "node:child_process";
 import { getWorkerAssetsDir, getWorkerBundleDir, getWorkerConfigPath, readBuildOutput } from "@cloudflare/build-output-utils";
 import { convertToWranglerConfig } from "@cloudflare/config";
 import ignore from "ignore";
-import { CloudflareWorkerInspectionError, activateCloudflareVersion, assertCloudflareBindingsPreserved, assertCloudflareDurableObjectLifecycleSupported, assertExistingCloudflareConfig, cloudflareCommandDiagnostic, encodeCloudflareVersionMessage, extractWorkersDevSubdomain, normalizeWorkersDevSubdomain, parseRootWranglerConfig, parseRootWranglerConfig as parseRootWranglerConfig$1, readBindingFieldPresence, readCloudflareTriggerConfig, readConfigEntryString, readExistingCloudflareWorker, readStoredResourceName, readWranglerTopLevelString, renderCloudflareStaticEntry, resolveD1MigrateTarget, stageCloudflareStaticAssets, writeCloudflareFrameworkDeployConfig, writeCloudflareStaticDeployConfig } from "@void/deploy-cloudflare";
+import { CloudflareWorkerInspectionError, activateCloudflareVersion, assertCloudflareBindingsPreserved, assertCloudflareDurableObjectLifecycleSupported, assertExistingCloudflareConfig, cloudflareCommandDiagnostic, encodeCloudflareVersionMessage, extractWorkersDevSubdomain, normalizeReadinessAccessOrigin, normalizeWorkersDevSubdomain, parseRootWranglerConfig, parseRootWranglerConfig as parseRootWranglerConfig$1, readBindingFieldPresence, readCloudflareTriggerConfig, readConfigEntryString, readExistingCloudflareWorker, readStoredResourceName, readWranglerTopLevelString, renderCloudflareStaticEntry, resolveD1MigrateTarget, stageCloudflareStaticAssets, writeCloudflareFrameworkDeployConfig, writeCloudflareStaticDeployConfig } from "@void/deploy-cloudflare";
 import { setTimeout as setTimeout$1 } from "node:timers/promises";
 import mime from "mime";
 import { Buffer as Buffer$1 } from "node:buffer";
 import { Minimatch } from "minimatch";
-//#region src/cli/cloudflare-candidate.ts
+// src/cli/cloudflare-candidate.ts
 const CANDIDATE_FILE = ".void/cloudflare-candidate.json";
 const INVALID_CANDIDATE_MESSAGE = "The saved Cloudflare candidate receipt is invalid. Restore or remove .void/cloudflare-candidate.json before retrying.";
 /** A saved upload chain: a non-empty list of distinct, non-empty version IDs. */
@@ -104,8 +105,7 @@ function clearCloudflareCandidate(root) {
 	const path = join(root, CANDIDATE_FILE);
 	if (existsSync(path)) unlinkSync(path);
 }
-//#endregion
-//#region src/cli/cloudflare-link.ts
+// src/cli/cloudflare-link.ts
 const LINK_FILE = ".void/cloudflare-link.json";
 /** A pending handoff survives a failed build, so retrying cannot provision replacements. */
 function readCloudflareLink(root) {
@@ -218,8 +218,112 @@ async function maybeLinkCloudflareDeploy(root, options = {}, deps = {}) {
 	});
 	return isCancel(accepted) || accepted !== true ? "cancelled" : "existing";
 }
-//#endregion
-//#region src/cli/deploy-binding-snapshot.ts
+// src/cli/cloudflare-readiness.ts
+const STATE_FILE = join(".void", "cloudflare.json");
+/** Resolve the account subdomain without exposing Cloudflare credentials to project code. */
+function resolveCloudflareWorkersDevSubdomain(root, accountId, env = process.env) {
+	const configured = env.CLOUDFLARE_WORKERS_SUBDOMAIN;
+	if (configured !== void 0 && configured.trim().length > 0) {
+		const normalized = normalizeWorkersDevSubdomain(configured);
+		if (!normalized) throw new Error("deploy: CLOUDFLARE_WORKERS_SUBDOMAIN must be the account subdomain, for example \"my-team\" or \"my-team.workers.dev\".");
+		return normalized;
+	}
+	const cached = subdomainsByAccount(readCloudflareLocalState(root))[accountId];
+	return typeof cached === "string" ? normalizeWorkersDevSubdomain(cached) : void 0;
+}
+/**
+* Record `CF_ACCESS_READINESS_ORIGIN` before project code runs. `void.config.ts` is evaluated in
+* this process, so a later read of `process.env` could see a value that the project assigned,
+* for example through a dotenv import. `null` means unset. An already recorded value is kept.
+*/
+function withRecordedReadinessAccessOrigin(options, env = process.env) {
+	return options.readinessAccessOrigin !== void 0 ? options : {
+		...options,
+		readinessAccessOrigin: env.CF_ACCESS_READINESS_ORIGIN ?? null
+	};
+}
+/**
+* Validate the operator-selected origin that may receive readiness Access credentials when the
+* probe uses a route or Custom Domain. Pass the value that `withRecordedReadinessAccessOrigin`
+* recorded, not the current `process.env`.
+*/
+function resolveCloudflareReadinessAccessOrigin(env) {
+	const configured = env.CF_ACCESS_READINESS_ORIGIN?.trim();
+	if (!configured) return;
+	const origin = normalizeReadinessAccessOrigin(configured);
+	if (!origin) throw new Error("deploy: CF_ACCESS_READINESS_ORIGIN must be one exact https origin, without a wildcard, path, query, fragment, or credentials, for example \"https://app.example.com\".");
+	return origin;
+}
+/**
+* Read the account subdomain from the Cloudflare API when a first publish reports no URL and
+* no subdomain is configured or cached. The API returns only the account label, so this adds
+* `.fed` for FedRAMP High, as Wrangler does. A failed lookup resolves `unavailable`.
+*/
+async function readCloudflareWorkersDevSubdomain(options) {
+	if (!options.verifyUploader()) return {
+		ok: false,
+		reason: "uploader-changed"
+	};
+	let label;
+	try {
+		const result = await options.runWrangler({
+			type: "workers.subdomain.get",
+			configPath: options.configPath
+		}, { capture: true });
+		if (!isCleanCloudflareExit(result) || !result.data || typeof result.data !== "object" || !("subdomain" in result.data) || typeof result.data.subdomain !== "string") return {
+			ok: false,
+			reason: "unavailable"
+		};
+		label = result.data.subdomain;
+	} catch {
+		return {
+			ok: false,
+			reason: "unavailable"
+		};
+	}
+	const subdomain = normalizeWorkersDevSubdomain(options.complianceRegion === "fedramp_high" ? `${label}.fed` : label);
+	return subdomain ? {
+		ok: true,
+		subdomain
+	} : {
+		ok: false,
+		reason: "unavailable"
+	};
+}
+/** Cache a Wrangler-reported account subdomain for later no-preview version probes. */
+function rememberCloudflareWorkersDevSubdomain(root, accountId, url) {
+	const workersDevSubdomain = extractWorkersDevSubdomain(url);
+	if (!workersDevSubdomain) return false;
+	const current = readCloudflareLocalState(root);
+	const currentByAccount = subdomainsByAccount(current);
+	if (currentByAccount[accountId] === workersDevSubdomain) return false;
+	const { workersDevSubdomain: _legacy, ...state } = current;
+	const filePath = join(root, STATE_FILE);
+	mkdirSync(dirname(filePath), { recursive: true });
+	writeFileSync(filePath, JSON.stringify({
+		...state,
+		workersDevSubdomains: {
+			...currentByAccount,
+			[accountId]: workersDevSubdomain
+		}
+	}, null, 2) + "\n");
+	return true;
+}
+function subdomainsByAccount(state) {
+	const value = state.workersDevSubdomains;
+	return value && typeof value === "object" && !Array.isArray(value) ? value : {};
+}
+function readCloudflareLocalState(root) {
+	const filePath = join(root, STATE_FILE);
+	if (!existsSync(filePath)) return {};
+	try {
+		const parsed = JSON.parse(readFileSync(filePath, "utf-8"));
+		return typeof parsed === "object" && parsed !== null && !Array.isArray(parsed) ? parsed : {};
+	} catch {
+		return {};
+	}
+}
+// src/cli/deploy-binding-snapshot.ts
 /** The id-bearing binding fields whose identity must survive the build unchanged. */
 const DEPLOY_BINDING_IDENTITY_FIELDS = {
 	d1: {
@@ -642,8 +746,7 @@ function collectEmittedQueueGroupNames(value, group) {
 function deployPointerPath(root) {
 	return join(root, ".wrangler", "deploy", "config.json");
 }
-//#endregion
-//#region src/cli/deploy-resources.ts
+// src/cli/deploy-resources.ts
 /** Human labels for a drifted resource kind, used in guidance messages. */
 const CLOUDFLARE_RESOURCE_LABELS = {
 	d1: "D1 database",
@@ -830,8 +933,7 @@ async function computeDesiredCloudflareResources(root, voidConfig, configPath, a
 		needsLive: bindings.needsLive === true
 	};
 }
-//#endregion
-//#region src/cli/deploy-artifact-validation.ts
+// src/cli/deploy-artifact-validation.ts
 /**
 * Derive the env schema's server and required key names in an isolated subprocess, so project
 * code never runs in the credentialed parent. Loaded lazily to keep it out of managed deploys.
@@ -1251,8 +1353,7 @@ async function validateCloudflarePostBuildEnv(options) {
 	}
 	return true;
 }
-//#endregion
-//#region ../../node_modules/.pnpm/ci-info@4.4.0/node_modules/ci-info/vendors.json
+// ../../node_modules/.pnpm/ci-info@4.4.0/node_modules/ci-info/vendors.json
 var require_vendors = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	module.exports = [
 		{
@@ -1579,8 +1680,7 @@ var require_vendors = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 		}
 	];
 }));
-//#endregion
-//#region src/cli/deploy-cloudflare-auth.ts
+// src/cli/deploy-cloudflare-auth.ts
 var import_ci_info = (/* @__PURE__ */ __commonJSMin(((exports) => {
 	const vendors = require_vendors();
 	const env = process.env;
@@ -1776,11 +1876,9 @@ async function ensureCloudflareAuthSecret(options) {
 	if (!(await list(false)).includes("BETTER_AUTH_SECRET")) throw new CloudflareAuthSecretError(`deploy: Cloudflare reported success but ${BETTER_AUTH_SECRET_NAME} was not present afterward. No worker was uploaded; retry once Cloudflare secret storage is available.`, "verification-failed");
 	return { created: true };
 }
-//#endregion
-//#region src/cli/node-buffer.ts
+// src/cli/node-buffer.ts
 const Buffer$2 = Buffer$1;
-//#endregion
-//#region src/cli/cf-version-api.ts
+// src/cli/cf-version-api.ts
 var CloudflareApiError = class extends Error {
 	status;
 	code;
@@ -1805,6 +1903,31 @@ function textValue(value, label) {
 	if (typeof value !== "string") throw new Error(`The Cloudflare ${label} is missing from the verified Worker output.`);
 	return value;
 }
+/** Match cf's package collection for uploads that preserve secrets through the JSON API. */
+async function readPackageDependencies(directory) {
+	try {
+		const pkg = record(JSON.parse(readFileSync(join(directory, "package.json"), "utf8")));
+		const declared = {
+			...record(pkg?.dependencies),
+			...record(pkg?.devDependencies)
+		};
+		const { getInstalledPackageVersion } = await import("@cloudflare/workers-utils");
+		const dependencies = [];
+		for (const [name, packageJsonVersion] of Object.entries(declared)) {
+			if (dependencies.length >= 200) break;
+			if (typeof packageJsonVersion !== "string" || /^(workspace|catalog|file|link):/.test(packageJsonVersion)) continue;
+			const installedVersion = getInstalledPackageVersion(name, directory);
+			if (installedVersion) dependencies.push({
+				name,
+				packageJsonVersion,
+				installedVersion
+			});
+		}
+		return dependencies.length ? dependencies : void 0;
+	} catch {
+		return;
+	}
+}
 const moduleContentTypes = {
 	esm: "application/javascript+module",
 	cjs: "application/javascript",
@@ -2298,7 +2421,7 @@ async function prepareContainerMetadata(options) {
 						maxOutputBytes: 16777216
 					});
 					if (pushed.status !== 0 || pushed.signal || pushed.error) throw new Error("Cloudflare Container image push failed.");
-					const matches = [...pushed.stdout.matchAll(/Pushed image:\s*(\S+)/g)];
+					const matches = [...`${pushed.stdout}\n${pushed.stderr}`.matchAll(/Pushed image:\s*(\S+)/g)];
 					const remote = matches.length === 1 ? matches[0][1] : "";
 					if (!remote.startsWith(`registry.cloudflare.com/${options.accountId}/`) || [...remote].some((character) => character.charCodeAt(0) <= 32 || character.charCodeAt(0) === 127)) throw new Error("Cloudflare Container image push did not return the verified account registry.");
 					image = await dockerImageDigest(remote, Math.min(12e4, remaining()), options.verifyUploader);
@@ -2544,6 +2667,7 @@ async function uploadPinnedCloudflareVersion(options) {
 		modules,
 		compatibility_date: config.compatibilityDate,
 		compatibility_flags: config.compatibilityFlags,
+		package_dependencies: await readPackageDependencies(options.output.directory),
 		bindings,
 		...config.limits ? { limits: {
 			cpu_ms: config.limits.cpuMs,
@@ -2584,8 +2708,7 @@ async function uploadPinnedCloudflareVersion(options) {
 		urls: Array.isArray(uploaded.urls) ? uploaded.urls.filter((url) => typeof url === "string") : []
 	};
 }
-//#endregion
-//#region src/cli/cf-version-runner.ts
+// src/cli/cf-version-runner.ts
 function failed(message) {
 	return {
 		status: 1,
@@ -2836,7 +2959,7 @@ function createCfVersionRunner(options) {
 	const uploadedResult = (result) => {
 		if (!isCleanCloudflareExit(result)) return result;
 		if (isRecord(result.data) && typeof result.data.versionId === "string") return result;
-		const { versionId, previewUrl, workersDevUrl } = readCfUploadOutput(result.stdout);
+		const { versionId, previewUrl, workersDevUrl } = readCfUploadOutput(result);
 		return {
 			...result,
 			data: versionId ? {
@@ -3096,17 +3219,18 @@ function createCfVersionRunner(options) {
 					"deploy",
 					"--prebuilt"
 				], command.capture, directory);
-				if (isCleanCloudflareExit(deployed) && raw.observability !== void 0) {
+				if (isCleanCloudflareExit(deployed) && (raw.observability !== void 0 || raw.logpush !== void 0)) {
 					const credentials = options.pinnedUpload;
 					if (!credentials || !credentials.verifyUploader()) return failed("The Cloudflare settings publisher is unavailable.");
 					try {
 						const token = await credentials.getToken();
 						if (!token || !credentials.verifyUploader()) return failed("Cloudflare session is unavailable for publishing Worker settings.");
-						await publishCloudflareObservability({
+						await publishCloudflareWorkerSettings({
 							apiBaseUrl: credentials.apiBaseUrl,
 							accountId: credentials.accountId,
 							workerName,
 							observability: raw.observability,
+							logpush: raw.logpush,
 							headers: { Authorization: `Bearer ${token}` }
 						});
 					} catch (cause) {
@@ -3166,55 +3290,7 @@ function createCfVersionRunner(options) {
 		return failed(`Unsupported Cloudflare activation operation: ${operation.type}`);
 	};
 }
-//#endregion
-//#region src/cli/cloudflare-readiness.ts
-const STATE_FILE = join(".void", "cloudflare.json");
-/** Resolve the account subdomain without exposing Cloudflare credentials to project code. */
-function resolveCloudflareWorkersDevSubdomain(root, accountId, env = process.env) {
-	const configured = env.CLOUDFLARE_WORKERS_SUBDOMAIN;
-	if (configured !== void 0 && configured.trim().length > 0) {
-		const normalized = normalizeWorkersDevSubdomain(configured);
-		if (!normalized) throw new Error("deploy: CLOUDFLARE_WORKERS_SUBDOMAIN must be the account subdomain, for example \"my-team\" or \"my-team.workers.dev\".");
-		return normalized;
-	}
-	const cached = subdomainsByAccount(readCloudflareLocalState(root))[accountId];
-	return typeof cached === "string" ? normalizeWorkersDevSubdomain(cached) : void 0;
-}
-/** Cache a Wrangler-reported account subdomain for later no-preview version probes. */
-function rememberCloudflareWorkersDevSubdomain(root, accountId, url) {
-	const workersDevSubdomain = extractWorkersDevSubdomain(url);
-	if (!workersDevSubdomain) return false;
-	const current = readCloudflareLocalState(root);
-	const currentByAccount = subdomainsByAccount(current);
-	if (currentByAccount[accountId] === workersDevSubdomain) return false;
-	const { workersDevSubdomain: _legacy, ...state } = current;
-	const filePath = join(root, STATE_FILE);
-	mkdirSync(dirname(filePath), { recursive: true });
-	writeFileSync(filePath, JSON.stringify({
-		...state,
-		workersDevSubdomains: {
-			...currentByAccount,
-			[accountId]: workersDevSubdomain
-		}
-	}, null, 2) + "\n");
-	return true;
-}
-function subdomainsByAccount(state) {
-	const value = state.workersDevSubdomains;
-	return value && typeof value === "object" && !Array.isArray(value) ? value : {};
-}
-function readCloudflareLocalState(root) {
-	const filePath = join(root, STATE_FILE);
-	if (!existsSync(filePath)) return {};
-	try {
-		const parsed = JSON.parse(readFileSync(filePath, "utf-8"));
-		return typeof parsed === "object" && parsed !== null && !Array.isArray(parsed) ? parsed : {};
-	} catch {
-		return {};
-	}
-}
-//#endregion
-//#region src/cli/deploy-cloudflare-helpers.ts
+// src/cli/deploy-cloudflare-helpers.ts
 /**
 * Discover the root wrangler config path the same way the build / bindings
 * writer do (wrangler.jsonc first, then wrangler.json). Falls back to the
@@ -3266,6 +3342,7 @@ async function connectCloudflareDeployAccount(options) {
 		log$1.error(`deploy: ${getErrorMessage(error)}`);
 		return null;
 	}
+	const complianceRegion = resolveWorkersDevComplianceRegion(process.env, readWranglerTopLevelString(rootConfig, "compliance_region"));
 	const pins = createCloudflareUploaderPins(root, deps);
 	let accountId = readWranglerTopLevelString(rootConfig, "account_id") ?? (process.env.CLOUDFLARE_ACCOUNT_ID?.trim() || void 0);
 	if (!accountId) {
@@ -3285,8 +3362,10 @@ async function connectCloudflareDeployAccount(options) {
 		}
 	}
 	let workersDevSubdomain;
+	let readinessAccessOrigin;
 	try {
 		workersDevSubdomain = resolveCloudflareWorkersDevSubdomain(root, accountId);
+		readinessAccessOrigin = resolveCloudflareReadinessAccessOrigin({ CF_ACCESS_READINESS_ORIGIN: options.readinessAccessOrigin ?? void 0 });
 	} catch (error) {
 		log$1.error(getErrorMessage(error));
 		return null;
@@ -3294,8 +3373,10 @@ async function connectCloudflareDeployAccount(options) {
 	return {
 		...pins,
 		apiBaseUrl,
+		complianceRegion,
 		accountId,
 		workersDevSubdomain,
+		readinessAccessOrigin,
 		runWrangler: deps.runWrangler ?? createDeployWranglerRunner(root, accountId, apiBaseUrl),
 		rootConfig
 	};
@@ -3381,7 +3462,21 @@ function cloudflareCandidateActivationOptions(options) {
 		},
 		readinessHeaders: cloudflareWorkerReadinessHeaders(),
 		workersDevSubdomain,
+		resolveWorkersDevSubdomain: async () => {
+			const { complianceRegion } = options;
+			if (complianceRegion === void 0) return {
+				ok: false,
+				reason: "unavailable"
+			};
+			return readCloudflareWorkersDevSubdomain({
+				configPath,
+				complianceRegion,
+				runWrangler,
+				verifyUploader: options.assertUploaderStillPinned
+			});
+		},
 		readinessHeadersWorkersDevSubdomain: process.env.CLOUDFLARE_WORKERS_SUBDOMAIN?.trim() ? workersDevSubdomain : void 0,
+		readinessHeadersOrigin: options.readinessAccessOrigin,
 		...createCloudflareEmptyTriggerPublishers({
 			accountId,
 			apiBaseUrl: options.apiBaseUrl,
@@ -3482,36 +3577,64 @@ function formatCloudflareActivationFailure(result) {
 			].join("\n");
 		case "readiness-staging-failed": return `deploy: Cloudflare could not stage the uploaded Worker Version at zero-percent traffic${status}; production traffic is unchanged.${cloudflareCode}${diagnostic}${result.cloudflareErrorCode === 10210 && (result.diagnostic ?? "").toLowerCase().includes("durable object migration") ? "\n\nReview the Durable Object migration, then run `void deploy --platform cloudflare --atomic`. For future deploys, set deploy.cloudflare.mode to \"atomic\" in void.config.ts." : result.cloudflareErrorCode === 100405 ? "\n\nThe new version declares different exports from the live version (for example a Durable Object or Workflow class), so Cloudflare cannot split traffic between them. Run `void deploy --platform cloudflare --atomic` once to publish it at 100% directly; it receives traffic before readiness is checked." : ""}`;
 		case "atomic-failed": return `deploy: Cloudflare could not publish the Worker atomically${status}; inspect production status before retrying.${cloudflareCode}${diagnostic}`;
-		case "atomic-output-invalid": return "deploy: Cloudflare published atomically but did not report a version id or URL. Inspect `void project status` immediately.";
+		case "atomic-output-invalid":
+			if (result.versionId) return formatCloudflarePublishWithoutUrl(`Cloudflare published Worker version ${result.versionId} atomically`, `If the app uses workers.dev, set CLOUDFLARE_WORKERS_SUBDOMAIN to your account subdomain ${WORKERS_SUBDOMAIN_EXAMPLE}.`);
+			return "deploy: Cloudflare published atomically but did not report its version id. Inspect `void project status` immediately.";
 		case "atomic-readiness-failed":
-		case "atomic-readiness-access-denied": return `deploy: the atomic Worker deployment is live, but /__void/ready could not be verified. Inspect \`void project status\` and Worker logs immediately.${diagnostic}`;
+		case "atomic-readiness-access-denied": return `deploy: the atomic Worker deployment is live, but /__void/ready could not be verified. Inspect \`void project status\` and Worker logs immediately.${diagnostic}${result.customRouteReadinessOrigin ? `\n\n${customRouteAccessHint(result.customRouteReadinessOrigin).join("\n")}` : ""}`;
 		case "readiness-failed": return ["deploy: the uploaded Worker Version did not pass /__void/ready.", formatCloudflareReadinessRestoration(result)].join("\n");
-		case "readiness-access-denied": return [
-			"deploy: Cloudflare Access blocked the uploaded Worker Version readiness probe.",
-			"For CI, set CF_ACCESS_CLIENT_ID and CF_ACCESS_CLIENT_SECRET to an admitted service token.",
-			"For a local deploy, set CF_ACCESS_TOKEN to a short-lived user JWT from cloudflared.",
-			"If the response is error 1050, create an Access application for this hostname; a token alone cannot bypass account default-deny.",
-			`Then retry. ${formatCloudflareReadinessRestoration(result)}`
-		].join("\n");
+		case "readiness-access-denied":
+			if (result.customRouteReadinessOrigin) return [
+				"deploy: Cloudflare Access blocked the uploaded Worker Version readiness probe.",
+				...customRouteAccessHint(result.customRouteReadinessOrigin),
+				ATOMIC_ACCESS_ALTERNATIVE,
+				formatCloudflareReadinessRestoration(result)
+			].join("\n");
+			return [
+				"deploy: Cloudflare Access blocked the uploaded Worker Version readiness probe.",
+				"For CI, set CF_ACCESS_CLIENT_ID and CF_ACCESS_CLIENT_SECRET to an admitted service token.",
+				"For a local deploy, set CF_ACCESS_TOKEN to a short-lived user JWT from cloudflared.",
+				"If the response is error 1050, create an Access application for this hostname; a token alone cannot bypass account default-deny.",
+				`Then retry. ${formatCloudflareReadinessRestoration(result)}`
+			].join("\n");
 		case "bootstrap-failed": return `deploy: Cloudflare could not bootstrap the first Worker deployment${status}.${cloudflareCode}${diagnostic}`;
-		case "bootstrap-output-invalid": return ["deploy: Cloudflare bootstrapped the first Worker deployment, but Wrangler", "did not report its version id and workers.dev URL. Inspect `void project status` before retrying."].join("\n");
+		case "bootstrap-output-invalid":
+			if (result.versionId) return formatCloudflarePublishWithoutUrl(`Cloudflare published the first Worker deployment as version ${result.versionId}`, `If the app uses workers.dev, enable workers.dev for this Worker in the Cloudflare dashboard. Then set CLOUDFLARE_WORKERS_SUBDOMAIN to your account subdomain ${WORKERS_SUBDOMAIN_EXAMPLE}.`);
+			return ["deploy: Cloudflare bootstrapped the first Worker deployment, but Wrangler", "did not report its version id. Inspect `void project status` before retrying."].join("\n");
 		case "bootstrap-readiness-failed": return [
 			"deploy: the first Worker deployment did not pass /__void/ready.",
 			"Cloudflare requires this bootstrap to be non-versioned, so the new Worker is already active;",
 			"inspect its logs and `void project status` before retrying."
 		].join("\n") + diagnostic;
-		case "bootstrap-readiness-access-denied": return [
-			"deploy: Cloudflare Access blocked the first Worker deployment readiness probe.",
-			"For CI, set CF_ACCESS_CLIENT_ID and CF_ACCESS_CLIENT_SECRET to an admitted service token;",
-			"for a local deploy, set CF_ACCESS_TOKEN to a short-lived user JWT from cloudflared.",
-			"If the response is error 1050, create an Access application for this hostname; a token alone cannot bypass account default-deny.",
-			"Then retry. Cloudflare requires the first deployment to be non-versioned, so the new",
-			"Worker is already active behind Access."
-		].join("\n");
+		case "bootstrap-readiness-access-denied":
+			if (result.customRouteReadinessOrigin) return [
+				"deploy: Cloudflare Access blocked the first Worker deployment readiness probe.",
+				"Cloudflare requires the first deployment to be non-versioned, so the new Worker is already active behind Access.",
+				...customRouteAccessHint(result.customRouteReadinessOrigin),
+				"Later deploys check readiness before traffic moves, so they need the same setting.",
+				ATOMIC_ACCESS_ALTERNATIVE
+			].join("\n");
+			return [
+				"deploy: Cloudflare Access blocked the first Worker deployment readiness probe.",
+				"For CI, set CF_ACCESS_CLIENT_ID and CF_ACCESS_CLIENT_SECRET to an admitted service token;",
+				"for a local deploy, set CF_ACCESS_TOKEN to a short-lived user JWT from cloudflared.",
+				"If the response is error 1050, create an Access application for this hostname; a token alone cannot bypass account default-deny.",
+				"Then retry. Cloudflare requires the first deployment to be non-versioned, so the new",
+				"Worker is already active behind Access."
+			].join("\n");
 		case "activation-failed": return `deploy: the ready Worker Version could not be activated${status}; production traffic is unchanged.`;
 		case "triggers-failed": return `deploy: the Worker activated, but Cloudflare trigger synchronization failed${status}. ${result.rollback === "succeeded" ? "Traffic was restored to the previous version." : result.rollback === "unavailable" ? result.previousVersionId === null ? "This was the first deployment, so no previous version was available to restore." : "Traffic or trigger restoration could not be completed. Inspect its routes, schedules, queues, and workflows in Cloudflare before retrying." : "Automatic traffic restoration failed; inspect `void project status` immediately."}`;
 	}
 }
+/** Explain why a custom-route readiness probe carried no Access credentials. */
+function customRouteAccessHint(origin) {
+	return [
+		`Void did not send Access credentials to ${origin}. A route or Custom Domain receives them only when CF_ACCESS_READINESS_ORIGIN names its origin.`,
+		`If Access protects ${origin} and admits your credentials, set CF_ACCESS_READINESS_ORIGIN=${origin} with CF_ACCESS_CLIENT_ID and CF_ACCESS_CLIENT_SECRET, or CF_ACCESS_TOKEN. Then retry.`,
+		"Set it only if you control this hostname and it serves this Worker, because Void sends your Access credentials to it."
+	];
+}
+const ATOMIC_ACCESS_ALTERNATIVE = "For a Worker with Durable Object migration history, `void deploy --platform cloudflare --atomic` publishes without the zero-traffic check. The new version receives traffic first, and the command still exits with an error because Void cannot verify readiness through Access.";
 function formatCloudflareReadinessRestoration(result) {
 	switch (result.rollback) {
 		case "succeeded": return "The failed version remains inactive, and traffic was restored to the previous version.";
@@ -3521,6 +3644,16 @@ function formatCloudflareReadinessRestoration(result) {
 		default: return "The failed version remains inactive for inspection; production traffic is unchanged.";
 	}
 }
+const WORKERS_SUBDOMAIN_EXAMPLE = "(for example \"my-team\", or \"my-team.fed\" for FedRAMP High)";
+/** Explain a live version whose readiness URL Void could not determine. */
+function formatCloudflarePublishWithoutUrl(published, recovery) {
+	return [
+		`deploy: ${published}, but Void could not determine its URL.`,
+		"Void did not update its routes, workers.dev setting, or other triggers, and did not check /__void/ready.",
+		recovery,
+		"Then inspect `void project status` before you deploy again."
+	].join("\n");
+}
 /** Capture the Access credential used only by the guarded Worker readiness probe. */
 function cloudflareWorkerReadinessHeaders() {
 	return trustedCloudflareWorkerAccessHeaders({
@@ -3529,8 +3662,7 @@ function cloudflareWorkerReadinessHeaders() {
 		CF_ACCESS_TOKEN: process.env.CF_ACCESS_TOKEN
 	});
 }
-//#endregion
-//#region src/cli/deploy-cloudflare-static.ts
+// src/cli/deploy-cloudflare-static.ts
 /** Default runtime date for static and framework Workers that set none. */
 const DEFAULT_COMPATIBILITY_DATE = "2026-09-11";
 /** Build the trusted Wrangler pointer for a framework that emits Worker files directly. */
@@ -3648,10 +3780,11 @@ async function runCloudflareStaticDeploy(root, options, voidConfig, preset, cliL
 		configPath,
 		rootConfig: parseRootWranglerConfig(configPath),
 		deps,
-		persistAccount: !(options.reuseExistingWorker || initialCloudflareLink)
+		persistAccount: !(options.reuseExistingWorker || initialCloudflareLink),
+		readinessAccessOrigin: options.readinessAccessOrigin
 	});
 	if (!connection || !await confirmCloudflareDeployAuthentication(connection, configPath)) return exit(1);
-	const { apiBaseUrl, usesCf, cfUploaderIsPinned, assertUploaderStillPinned, accountId, workersDevSubdomain, runWrangler } = connection;
+	const { apiBaseUrl, complianceRegion, usesCf, cfUploaderIsPinned, assertUploaderStillPinned, accountId, workersDevSubdomain, readinessAccessOrigin, runWrangler } = connection;
 	const existingWorker = await prepareExistingCloudflareDeployWithAuth({
 		root,
 		configPath,
@@ -3699,6 +3832,7 @@ async function runCloudflareStaticDeploy(root, options, voidConfig, preset, cliL
 	const merged = mergeAndLintRoutingRules(preset.outputDir, voidConfig.routing);
 	const manifest = buildStaticManifest({
 		appType: preset.appType,
+		alwaysUseHttps: voidConfig.routing?.alwaysUseHttps,
 		hashedAssetsPrefix: "assets",
 		headerRules: merged.headerRules,
 		redirectRules: merged.redirectRules,
@@ -3731,6 +3865,7 @@ async function runCloudflareStaticDeploy(root, options, voidConfig, preset, cliL
 	}, null, 2)}\n`, { mode: 384 });
 	writeFileSync(entryPath, renderCloudflareStaticEntry({
 		runtimeImport: "void/edge",
+		alwaysUseHttps: manifest.alwaysUseHttps,
 		headerRules: manifest.headerRules,
 		redirectRules: manifest.redirectRules,
 		fallbackRules: manifest.fallbackRules,
@@ -3779,8 +3914,10 @@ async function runCloudflareStaticDeploy(root, options, voidConfig, preset, cliL
 			uploadConfigPath: staticConfigPath,
 			accountId,
 			apiBaseUrl,
+			complianceRegion,
 			workerName,
 			workersDevSubdomain,
+			readinessAccessOrigin,
 			runWrangler,
 			readExistingWorker: deps.readExistingWorker,
 			existingWorker,
@@ -3821,8 +3958,7 @@ async function runCloudflareStaticDeploy(root, options, voidConfig, preset, cliL
 	}), execution.previewUrl);
 	printDeploySuccess();
 }
-//#endregion
-//#region src/cli/deploy-migrations.ts
+// src/cli/deploy-migrations.ts
 /**
 * Apply the checked-in migrations to an in-memory SQLite database and assert the resulting
 * schema has every required auth table and column, with its primary key, NOT NULL, UNIQUE and
@@ -4209,8 +4345,7 @@ To undo these migrations, restore this point (discards every later write):
 	}
 	return { restoreCommand };
 }
-//#endregion
-//#region src/cli/deploy-cloudflare-build.ts
+// src/cli/deploy-cloudflare-build.ts
 /** Build the Worker without Cloudflare credentials, then run the post-build gates. */
 async function buildCloudflareWorker(input) {
 	const { root, voidConfig, deps, exit, atomic, frameworkPreset, detectedFramework } = input;
@@ -4368,7 +4503,7 @@ async function buildCloudflareWorker(input) {
 		projectRoot: root,
 		configPath: generatedConfigPath,
 		accountId
-	}) : prepareCfBuildOutput(dirname(generatedConfigPath), accountId);
+	}) : prepareCfBuildOutput(dirname(generatedConfigPath), accountId, void 0, root);
 	if (usesCf) {
 		const preflight = await prepareBuildOutput();
 		if (!preflight) {
@@ -4384,8 +4519,7 @@ async function buildCloudflareWorker(input) {
 		prepareBuildOutput
 	};
 }
-//#endregion
-//#region src/cli/deploy-cloudflare-migrate.ts
+// src/cli/deploy-cloudflare-migrate.ts
 /** Provision the auth secret and apply database migrations, then verify the artifact. */
 async function migrateCloudflareWorker(input) {
 	const { root, deps, exit, cliLog } = input;
@@ -4471,8 +4605,7 @@ async function migrateCloudflareWorker(input) {
 		d1RestoreCommand
 	};
 }
-//#endregion
-//#region src/cli/cloudflare-deploy/classify.ts
+// src/cli/cloudflare-deploy/classify.ts
 /**
 * Narrow native Cloudflare deploys to app shapes whose emitted Worker artifact
 * the current verifier understands. This runs before any account operation;
@@ -4512,8 +4645,7 @@ function unsupported(reason) {
 		reason
 	};
 }
-//#endregion
-//#region src/cli/cloudflare-isr.ts
+// src/cli/cloudflare-isr.ts
 /** A configured opt-in authorizes only the cache identity declared before the build. */
 function approvedCloudflareIsrBinding(config, rootConfig) {
 	if (config.routing?.isr !== true || resolveBindingNames(config.inference?.bindings)?.kv === "ISR_CACHE") return [];
@@ -4549,8 +4681,7 @@ async function chooseCloudflareIsr(root, config, options) {
 	log.info(`Saved routing.isr: ${String(enabled)} in void.config.ts. ISR caching ${enabled ? "will be enabled in this deployment" : "stays disabled until you change this setting"}.`);
 	return enabled;
 }
-//#endregion
-//#region src/cli/deploy-cloudflare-email.ts
+// src/cli/deploy-cloudflare-email.ts
 /** Whether the root config carries the `send_email` binding Void writes. */
 function hasVoidSendEmailBinding(rootConfig) {
 	return Array.isArray(rootConfig.send_email) && rootConfig.send_email.some((binding) => binding?.name === "SEND_EMAIL");
@@ -4705,8 +4836,7 @@ async function runCloudflareEmailStep(input) {
 function existingAddresses(rootConfig, pre) {
 	return Array.isArray(rootConfig.addresses) ? rootConfig.addresses.map((a) => typeof a === "string" ? a.toLowerCase() : "").filter((a) => pre.addresses.includes(a)) : [];
 }
-//#endregion
-//#region src/cli/deploy-cloudflare-queues.ts
+// src/cli/deploy-cloudflare-queues.ts
 function isValidQueueName(name) {
 	try {
 		assertValidResourceName("queue", name);
@@ -4813,8 +4943,7 @@ async function chooseCloudflareQueueNames(input) {
 		absent
 	};
 }
-//#endregion
-//#region src/cli/deploy-cloudflare-preflight.ts
+// src/cli/deploy-cloudflare-preflight.ts
 /** Validate source-level native deploy inputs before account operations or project code. */
 async function prepareCloudflareDeploySource(root, options, voidConfig) {
 	if (options.skipBuild) {
@@ -4891,10 +5020,11 @@ async function preflightCloudflareWorker(input) {
 		configPath,
 		rootConfig,
 		deps,
-		persistAccount: !(options.reuseExistingWorker || initialCloudflareLink)
+		persistAccount: !(options.reuseExistingWorker || initialCloudflareLink),
+		readinessAccessOrigin: options.readinessAccessOrigin
 	});
 	if (!connection) return exit(1);
-	const { apiBaseUrl, usesCf, cfUploaderIsPinned, assertUploaderStillPinned, accountId, workersDevSubdomain, runWrangler } = connection;
+	const { apiBaseUrl, complianceRegion, usesCf, cfUploaderIsPinned, assertUploaderStillPinned, accountId, workersDevSubdomain, readinessAccessOrigin, runWrangler } = connection;
 	rootConfig = connection.rootConfig;
 	const workerName = readWranglerTopLevelString(rootConfig, "name") ?? deriveWorkerName(root);
 	printDeployContext(workerName, "Cloudflare");
@@ -5122,11 +5252,13 @@ async function preflightCloudflareWorker(input) {
 	});
 	return {
 		apiBaseUrl,
+		complianceRegion,
 		usesCf,
 		cfUploaderIsPinned,
 		assertUploaderStillPinned,
 		accountId,
 		workersDevSubdomain,
+		readinessAccessOrigin,
 		runWrangler,
 		workerName,
 		emailMap,
@@ -5141,13 +5273,12 @@ async function preflightCloudflareWorker(input) {
 		expectedDurableObjectState
 	};
 }
-//#endregion
-//#region src/cli/deploy-cloudflare-publish.ts
+// src/cli/deploy-cloudflare-publish.ts
 /** Upload the verified Worker as a candidate version, probe it, and activate it. */
 async function publishCloudflareWorker(input) {
 	const { root, deps, exit, cliLog, atomic, detectedFramework, initialCloudflareCandidate } = input;
 	const { configPath, needsSandbox, desired, analysis } = input.source;
-	const { usesCf, existingWorker, pinnedHandoffLink, accountId, workerName, cfUploaderIsPinned, apiBaseUrl, runWrangler, assertUploaderStillPinned, schemaFacts, approvedHandoffKv, workersDevSubdomain } = input.preflight;
+	const { usesCf, existingWorker, pinnedHandoffLink, accountId, workerName, cfUploaderIsPinned, apiBaseUrl, complianceRegion, runWrangler, assertUploaderStillPinned, schemaFacts, approvedHandoffKv, workersDevSubdomain, readinessAccessOrigin } = input.preflight;
 	const { migrations, d1MigrateToken, generatedConfigPath, prepareBuildOutput } = input.build;
 	const { workerWasMissingBeforeSecretProvisioning, initialAuthSecret, appliedMigrations } = input.migration;
 	const queueConsumerCleanup = readWranglerManagedQueueCleanupCandidates(configPath);
@@ -5189,8 +5320,10 @@ async function publishCloudflareWorker(input) {
 			uploadConfigPath: generatedConfigPath,
 			accountId,
 			apiBaseUrl,
+			complianceRegion,
 			workerName,
 			workersDevSubdomain,
+			readinessAccessOrigin,
 			runWrangler,
 			readExistingWorker: deps.readExistingWorker,
 			existingWorker,
@@ -5237,10 +5370,10 @@ async function publishCloudflareWorker(input) {
 		framework: detectedFramework?.name
 	}), execution.previewUrl);
 }
-//#endregion
-//#region src/cli/deploy-cloudflare.ts
+// src/cli/deploy-cloudflare.ts
 /** Deploy to the user's own Cloudflare account through the guarded native Worker flow. */
 async function runCloudflareDeploy(root, options, cliLog, deps = {}) {
+	options = withRecordedReadinessAccessOrigin(options);
 	const initialCloudflareLink = readCloudflareLink(root);
 	const initialCloudflareCandidate = readCloudflareCandidate(root);
 	const exit = deps.exit ?? ((code) => process.exit(code));
@@ -5277,6 +5410,14 @@ async function runCloudflareDeploy(root, options, cliLog, deps = {}) {
 		}
 		return runCloudflareStaticDeploy(root, options, voidConfig, staticPreset, cliLog, deps, initialCloudflareLink, initialCloudflareCandidate);
 	}
+	if (detectedFramework && voidConfig.routing?.alwaysUseHttps === true) {
+		log$1.error([
+			`deploy: native Cloudflare deployment cannot apply Void routing.alwaysUseHttps to ${detectedFramework.name}.`,
+			"This framework owns its Worker request handler, so the HTTPS redirect would otherwise be ignored.",
+			"Redirect HTTP to HTTPS in the framework, or turn on Cloudflare's Always Use HTTPS setting for your zone, then remove routing.alwaysUseHttps and retry."
+		].join("\n"));
+		return exit(1);
+	}
 	const source = await prepareCloudflareDeploySource(root, options, voidConfig);
 	if (!source) return exit(1);
 	const preflight = await preflightCloudflareWorker({
@@ -5343,8 +5484,7 @@ async function runCloudflareDeploy(root, options, cliLog, deps = {}) {
 	if (preflight.emailMap) log$1.message(renderAddressMap(preflight.emailMap));
 	printDeploySuccess();
 }
-//#endregion
-//#region src/cli/deploy-managed-framework.ts
+// src/cli/deploy-managed-framework.ts
 /**
 * Class B/C framework deploy: build with framework CLI, package with preset output paths.
 */
@@ -5446,6 +5586,7 @@ async function runFrameworkDeploy(root, config, client, detected, fwPreset, void
 	};
 	const manifest = buildFrameworkManifest({
 		frameworkName: detected.name,
+		alwaysUseHttps: voidConfig.routing?.alwaysUseHttps,
 		workerMain: actualWorkerMain,
 		bindings,
 		migrations: validatedMigrations,
@@ -5496,8 +5637,7 @@ async function runFrameworkDeploy(root, config, client, detected, fwPreset, void
 	warnUnpublishedRouting(result);
 	printDeploySuccess(result.published !== false);
 }
-//#endregion
-//#region src/cli/deploy-managed-full.ts
+// src/cli/deploy-managed-full.ts
 async function runFullDeploy(root, config, client, voidConfig, fwPreset, skipBuild, gitMetadata, detected, cliLog) {
 	cliLog?.info("deploy_mode", {
 		mode: "full",
@@ -5619,7 +5759,7 @@ async function runFullDeploy(root, config, client, voidConfig, fwPreset, skipBui
 				buildCommand: null,
 				outputDir: clientDir,
 				appType: "static"
-			}, true, gitMetadata, assetsPrefix, headerRules, redirectRules, fallbackRules, void 0, cliLog, voidConfig.routing?.notFound);
+			}, true, gitMetadata, assetsPrefix, headerRules, redirectRules, fallbackRules, void 0, cliLog, voidConfig.routing?.notFound, voidConfig.routing?.alwaysUseHttps);
 		}
 	}
 	const prerenderSourcesPresent = hasPrerenderSources({
@@ -5702,6 +5842,7 @@ async function runFullDeploy(root, config, client, voidConfig, fwPreset, skipBui
 			...bindings,
 			needsLive: true
 		} : bindings,
+		alwaysUseHttps: voidConfig.routing?.alwaysUseHttps,
 		hasEmailHandlers: !isFrameworkMode && routeScan.email !== void 0 && hasEmailHandlers(routeScan.email),
 		migrations: validatedMigrations,
 		schedules,
@@ -5769,8 +5910,7 @@ async function runFullDeploy(root, config, client, voidConfig, fwPreset, skipBui
 	warnUnpublishedRouting(result);
 	printDeploySuccess(result.published !== false);
 }
-//#endregion
-//#region src/cli/github-oidc.ts
+// src/cli/github-oidc.ts
 /**
 * GitHub Actions OIDC → Void deploy-token exchange for `void deploy` without `VOID_TOKEN`.
 *
@@ -5865,8 +6005,7 @@ async function safeText(res) {
 		return "";
 	}
 }
-//#endregion
-//#region src/cli/installed-void.ts
+// src/cli/installed-void.ts
 /** A global CLI still builds with the project's installed Vite plugin. */
 function assertInstalledVoidMatchesCli(root) {
 	const projectManifest = join(root, "package.json");
@@ -5903,8 +6042,7 @@ function assertInstalledVoidMatchesCli(root) {
 	if (installedVersion !== cli.version) throw new Error(`deploy: this CLI is void@${cli.version}, but the project's installed Vite plugin is ${installedVersion ? `void@${installedVersion}` : "missing"}. Install the same Void version in the project (or link this development checkout) before deploying. The build imports the project package; mixing versions can rewrite legacy config and produce an unsafe Cloudflare deploy target.`);
 	if (installedPackageDir && existsSync(join(cliPackageDir, "src", "index.ts")) && realpathSync(installedPackageDir) !== realpathSync(cliPackageDir)) throw new Error("deploy: this development CLI and the project Vite plugin come from different Void builds, even though their package versions match. Link the same development checkout into the project before deploying.");
 }
-//#endregion
-//#region src/cli/log-file.ts
+// src/cli/log-file.ts
 /**
 * Flatten a serialized `ErrChainNode` (from `describeErrorChain`, or read back
 * out of a JSONL record) to a single inline string, joining cause levels with
@@ -6054,8 +6192,7 @@ function openDeployLog(opts) {
 		}
 	};
 }
-//#endregion
-//#region src/cli/log-summary.ts
+// src/cli/log-summary.ts
 var import_picocolors = /* @__PURE__ */ __toESM(require_picocolors(), 1);
 const FIELD_VALUE_MAX = 80;
 const LINE_MAX = 160;
@@ -6197,13 +6334,13 @@ function buildDeployLogSummary(path) {
 	}
 	return formatDeployLogSummary(text.split("\n"));
 }
-//#endregion
-//#region src/cli/deploy.ts
+// src/cli/deploy.ts
 function resolveDeploymentPlatform(root, options) {
 	return options?.platform ?? readDeploymentPlatform(root) ?? "void";
 }
 /** Run `void deploy`; a failure carries a summary of the deploy log in its message. */
 async function runDeploy(root, options) {
+	options = withRecordedReadinessAccessOrigin(options ?? {});
 	console.log();
 	const cliLog = openDeployLog({ mirrorToStderr: options?.debug === true || process.env.VOID_DEPLOY_DEBUG === "1" });
 	cliLog.info("deploy_start", {
@@ -6447,5 +6584,4 @@ async function runManagedDeploy(root, options, cliLog) {
 		throw error;
 	}
 }
-//#endregion
 export { discoverRootWranglerConfig as a, runWranglerAuthToken as c, checkWranglerMigrationApplySet as i, deriveWorkerName as l, resolveDeploymentPlatform as n, createDeployWranglerRunner as o, runDeploy as r, isWranglerNonInteractiveOrCI as s, parseRootWranglerConfig$1 as t };