@@ -17,8 +17,6 @@ import { copyRuntimeManifests, installDependencies, runBuildCommand } from './ge
 import { prepareNextCdnBuild } from './cdn-recipes.ts';
 import { toPosixPath } from '../deploy-ignore.ts';
 import { resetOutputDir } from './reset-output-dir.ts';
-import { rewritePublicAssetUrlsInTree } from '../package/public-cdn.ts';
-import { resolveAgentuityCdnBase } from './cdn-origin.ts';
 
 /**
  * Walk the standalone tree for the first `server.js`, skipping
@@ -241,8 +239,8 @@ export const nextjsAdapter: BuildAdapter = {
 
 				// Copy `public/` next to server.js for the same reason.
 				// Next assetPrefix only rewrites /_next/* — public/ files
-				// (e.g. /next.svg) stay origin-relative unless we CDN them
-				// and rewrite references when a CDN base is known.
+				// (e.g. /next.svg) stay origin-relative. Packaging owns CDN
+				// rewrite + launch.static.include when publicStaticDir is set.
 				let packagedPublicDir: string | undefined;
 				if (existsSync(publicPath)) {
 					const publicDst = join(serverDir, 'public');
@@ -251,24 +249,6 @@ export const nextjsAdapter: BuildAdapter = {
 					packagedPublicDir = publicDst;
 				}
 
-				// When CDN base is set, rewrite root-absolute public URLs in
-				// the packaged tree so logos/images hit the CDN, not origin.
-				const cdnBase =
-					cdnPrep.cdnBase ??
-					resolveAgentuityCdnBase({
-						cdnBaseUrl: options.cdnBaseUrl,
-						deploymentId: options.deploymentId,
-					});
-				if (cdnBase && packagedPublicDir) {
-					const rw = rewritePublicAssetUrlsInTree(serverDir, packagedPublicDir, cdnBase);
-					if (rw.publicFileCount > 0) {
-						logs.push(
-							`✓ Next.js CDN: rewrote public/ refs in ${rw.filesChanged}/${rw.filesScanned} files ` +
-								`(${rw.publicFileCount} public asset(s) → ${cdnBase})`
-						);
-					}
-				}
-
 				logs.push(
 					`✓ Standalone output packaged (server entry: ${
 						workingDirectory ? `${workingDirectory}/${serverEntryRel}` : serverEntryRel
@@ -293,6 +273,8 @@ export const nextjsAdapter: BuildAdapter = {
 			// and the package manifests Hadron needs to install production
 			// dependencies before launch. This path is brittle (`next start`
 			// needs the full Next.js install) so we warn the user.
+			// Public CDN rewrite / launch.static.include require standalone
+			// packaging (publicStaticDir is only set on that path).
 			logger.debug('No standalone output found — copying full .next directory');
 			const nextDst = join(outputDir, '.next');
 			cpSync(join(projectDir, '.next'), nextDst, { recursive: true });
 
@@ -2,22 +2,31 @@
  * Build output packaging.
  *
  * After a framework adapter builds the project, the packager:
- * 1. Generates launch metadata (how to start the app)
- * 2. Writes launch.json
+ * 1. Rewrites root-public asset URLs onto the CDN base when applicable
+ * 2. Generates launch metadata (how to start the app)
+ * 3. Writes launch.json
  *
  * The output is a self-contained directory ready for deployment
  * as a buildpack image layer or traditional zip upload.
+ *
+ * Public CDN policy lives here (not in framework adapters): adapters only
+ * stage files and set `BuildResult.publicStaticDir`; packaging owns
+ * rewrite + `launch.static.include`.
  */
 
 import type { DetectedFramework } from '../detect/types.ts';
 import type { MonorepoContext } from '../detect/monorepo.ts';
 import type { BuildResult } from '../adapters/types.ts';
+import { resolveAgentuityCdnBase } from '../adapters/cdn-origin.ts';
 import {
 	generateLaunchMetadata,
+	isSplitCdnLayout,
 	readUserLaunchOverride,
+	resolveProcessRoot,
 	writeLaunchMetadata,
 	type LaunchMetadata,
 } from './launch.ts';
+import { rewritePublicAssetUrlsInTree } from './public-cdn.ts';
 
 export interface PackageResult {
 	/** Absolute path to the packaged output */
@@ -31,13 +40,42 @@ export interface PackageResult {
 
 	/** Path to static assets (if any) */
 	staticDir?: string;
+
+	/** Human-readable packaging log lines (e.g. public URL rewrites) */
+	logs: string[];
 }
 
 export interface PackageBuildOutputOptions {
 	/** Explicit CDN base URL from `--cdn-base-url` (written to launch.static.baseUrl). */
 	cdnBaseUrl?: string;
 }
 
+/**
+ * When CDN base is known and packaging staged a split-layout public root,
+ * rewrite root-absolute `/file` refs under the process tree to the CDN base.
+ */
+function rewriteStagedPublicAssets(
+	buildResult: BuildResult,
+	monorepo: MonorepoContext | undefined,
+	cdnBase: string
+): string[] {
+	const logs: string[] = [];
+	if (!buildResult.publicStaticDir) return logs;
+
+	const publicPath = buildResult.staticAssetPublicPath ?? '';
+	if (!isSplitCdnLayout(publicPath)) return logs;
+
+	const treeRoot = resolveProcessRoot(buildResult, monorepo);
+	const rw = rewritePublicAssetUrlsInTree(treeRoot, buildResult.publicStaticDir, cdnBase);
+	if (rw.publicFileCount > 0) {
+		logs.push(
+			`✓ CDN: rewrote public/ refs in ${rw.filesChanged}/${rw.filesScanned} files ` +
+				`(${rw.publicFileCount} public asset(s) → ${cdnBase})`
+		);
+	}
+	return logs;
+}
+
 /**
  * Package a build result into a deployment-ready directory.
  *
@@ -54,6 +92,14 @@ export async function packageBuildOutput(
 	options?: PackageBuildOutputOptions
 ): Promise<PackageResult> {
 	const override = projectDir ? await readUserLaunchOverride(projectDir) : null;
+	const logs: string[] = [];
+
+	// Same CDN chain as launch.static.baseUrl / adapters. Rewrite before
+	// writing launch.json so staged HTML/JS already point at the CDN.
+	const cdnBase = resolveAgentuityCdnBase({ cdnBaseUrl: options?.cdnBaseUrl });
+	if (cdnBase) {
+		logs.push(...rewriteStagedPublicAssets(buildResult, monorepo, cdnBase));
+	}
 
 	// Generate launch metadata (with optional user override applied).
 	// In monorepo mode, every process inherits the subpackage as its
@@ -74,18 +120,16 @@ export async function packageBuildOutput(
 		launch,
 		hasStaticAssets: !!buildResult.staticDir || !!launch.static,
 		staticDir: buildResult.staticDir,
+		logs,
 	};
 }
 
-// Re-export
+// Re-export public launch contract types (not rewrite helpers — those stay
+// package-internal / testable via their module path).
 export type {
 	LaunchMetadata,
 	LaunchStaticAssets,
 	LaunchStaticRoot,
 	ProcessDefinition,
 } from './launch.ts';
-export {
-	listPublicRelativeFiles,
-	rewritePublicAssetUrlsInText,
-	rewritePublicAssetUrlsInTree,
-} from './public-cdn.ts';
+export { joinCdnAssetUrl } from './launch.ts';
@@ -206,20 +206,11 @@ export interface ProcessDefinition {
 }
 
 /**
- * Static/CDN asset locations recorded in launch.json.
- *
- * Consumers (CDN upload, pilot) compose public URLs as:
- *   `{baseUrl}{publicPath}/{pathWithinDirectory}`
+ * One CDN upload root.
  *
- * `baseUrl` is optional: when set (from `--cdn-base-url` or the platform
- * default), frameworks that bake asset URLs at build time should have
- * used the same prefix. When omitted, the platform may still upload
- * files under `publicPath` using its own CDN root.
- */
-/**
- * One CDN upload root. Consumers compose:
- *   `{baseUrl}{publicPath}/{pathWithinDirectory}`
- * with empty publicPath meaning files live at the CDN base root.
+ * Compose the public object URL with {@link joinCdnAssetUrl}:
+ * - non-empty publicPath → `{baseUrl}{publicPath}/{pathWithinDirectory}`
+ * - empty publicPath → `{baseUrl}{pathWithinDirectory}` (CDN base root)
  */
 export interface LaunchStaticRoot {
 	/**
@@ -237,17 +228,17 @@ export interface LaunchStaticRoot {
 /**
  * Static/CDN asset locations recorded in launch.json.
  *
- * Consumers (CDN upload, pilot) compose public URLs as:
- *   `{baseUrl}{publicPath}/{pathWithinDirectory}`
- *
  * The primary `directory`/`publicPath` is the framework build tree.
  * Optional `include` lists extra roots (Next `public/`) that must also
- * be uploaded when CDN base is set — `assetPrefix` alone does not cover them.
+ * be uploaded when `baseUrl` is set — `assetPrefix` alone does not cover them.
  *
  * `baseUrl` is optional: when set (from `--cdn-base-url` or the platform
  * default), frameworks that bake asset URLs at build time should have
  * used the same prefix. When omitted, the platform may still upload
  * files under `publicPath` using its own CDN root.
+ *
+ * `include` is only emitted when `baseUrl` is known and packaging staged a
+ * split-layout public root (`publicStaticDir` + non-empty primary publicPath).
  */
 export interface LaunchStaticAssets extends LaunchStaticRoot {
 	/**
@@ -258,10 +249,29 @@ export interface LaunchStaticAssets extends LaunchStaticRoot {
 	/**
 	 * Extra CDN roots (e.g. Next `public/` with publicPath `""`).
 	 * Deploy clients should upload each root the same way as the primary.
+	 * Present only when {@link baseUrl} is set.
 	 */
 	include?: LaunchStaticRoot[];
 }
 
+/**
+ * Join a CDN object URL without double-slashes when `publicPath` is empty.
+ *
+ * @param baseUrl - absolute CDN base (trailing slash optional)
+ * @param publicPath - URL path prefix, no leading slash (`''` → base root)
+ * @param pathWithinDirectory - path relative to that root
+ */
+export function joinCdnAssetUrl(
+	baseUrl: string,
+	publicPath: string,
+	pathWithinDirectory: string
+): string {
+	const base = baseUrl.endsWith('/') ? baseUrl : `${baseUrl}/`;
+	const prefix = publicPath.replace(/^\/+|\/+$/g, '');
+	const rel = pathWithinDirectory.replace(/^\/+/, '');
+	return prefix ? `${base}${prefix}/${rel}` : `${base}${rel}`;
+}
+
 /**
  * Complete launch metadata written to the output directory.
  */
@@ -305,6 +315,47 @@ function toPosixPath(p: string): string {
 	return p.split('\\').join('/');
 }
 
+/**
+ * Absolute process cwd used for launch-relative paths: workingDirectory
+ * when set, else monorepo subpath, else the deploy/output root.
+ */
+export function resolveProcessRoot(
+	buildResult: Pick<BuildResult, 'outputDir' | 'workingDirectory'>,
+	monorepo?: MonorepoContext
+): string {
+	const workRel = buildResult.workingDirectory ?? monorepo?.subpath;
+	return workRel ? join(buildResult.outputDir, workRel) : buildResult.outputDir;
+}
+
+/**
+ * Relativize an absolute staged path under `processRoot` (posix).
+ * Returns `undefined` if the path escapes the root (and optional
+ * output-root fallback when `allowOutputFallback` is set).
+ */
+export function relativeToProcessRoot(
+	absPath: string,
+	processRoot: string,
+	options?: { allowOutputFallback?: boolean; outputDir?: string }
+): string | undefined {
+	let rel = toPosixPath(relative(processRoot, absPath));
+	if (!rel || rel === '') return '.';
+	if (!rel.startsWith('..')) return rel;
+	if (options?.allowOutputFallback && options.outputDir) {
+		// Fallback: static staged outside subpath but still under output.
+		rel = toPosixPath(relative(options.outputDir, absPath));
+		if (!rel.startsWith('..')) return rel || '.';
+	}
+	return undefined;
+}
+
+/**
+ * True when the build uses a split CDN layout: built assets under a
+ * non-empty publicPath (e.g. `_next/static`) plus a separate public root.
+ */
+export function isSplitCdnLayout(publicPath: string): boolean {
+	return publicPath !== '';
+}
+
 /**
  * Resolve the static asset block for launch.json from the staged build
  * result (preferred) or framework detection fallback.
@@ -324,20 +375,11 @@ export function resolveLaunchStatic(
 		// (adapter packaging layout wins; monorepo.subpath is the fallback
 		// for adapters that do not set workingDirectory); otherwise to the
 		// deploy/output root.
-		const workRel = buildResult.workingDirectory ?? monorepo?.subpath;
-		const processRoot = workRel ? join(buildResult.outputDir, workRel) : buildResult.outputDir;
-		let rel = toPosixPath(relative(processRoot, buildResult.staticDir));
-		if (!rel || rel === '') {
-			directory = '.';
-		} else if (!rel.startsWith('..')) {
-			directory = rel;
-		} else {
-			// Fallback: relative to output root (e.g. static staged outside subpath).
-			rel = toPosixPath(relative(buildResult.outputDir, buildResult.staticDir));
-			if (!rel.startsWith('..')) {
-				directory = rel || '.';
-			}
-		}
+		const processRoot = resolveProcessRoot(buildResult, monorepo);
+		directory = relativeToProcessRoot(buildResult.staticDir, processRoot, {
+			allowOutputFallback: true,
+			outputDir: buildResult.outputDir,
+		});
 	} else if (framework.staticDir) {
 		// Build did not resolve an absolute staged path, but detection knew
 		// where assets should live relative to the project/working dir.
@@ -350,17 +392,15 @@ export function resolveLaunchStatic(
 	// then AGENTUITY_CDN_BASE_URL / AGENTUITY_CDN_ORIGIN / deployment id.
 	const baseUrl = resolveAgentuityCdnBase({ cdnBaseUrl });
 
-	// Extra roots (Next public/): only when packaging staged them and the
-	// primary publicPath is a non-empty build prefix (split CDN layout).
+	// Extra roots (Next public/): only when CDN base is known, packaging
+	// staged publicStaticDir, and primary publicPath is a non-empty build
+	// prefix (split CDN layout). Without baseUrl, deployers use the primary
+	// root only — include would be meaningless without a CDN target.
 	const include: LaunchStaticRoot[] = [];
-	if (buildResult.publicStaticDir && publicPath !== '') {
-		const workRel = buildResult.workingDirectory ?? monorepo?.subpath;
-		const processRoot = workRel ? join(buildResult.outputDir, workRel) : buildResult.outputDir;
-		let pubRel = toPosixPath(relative(processRoot, buildResult.publicStaticDir));
-		if (!pubRel || pubRel === '') {
-			pubRel = '.';
-		}
-		if (!pubRel.startsWith('..') && pubRel !== directory) {
+	if (baseUrl && buildResult.publicStaticDir && isSplitCdnLayout(publicPath)) {
+		const processRoot = resolveProcessRoot(buildResult, monorepo);
+		const pubRel = relativeToProcessRoot(buildResult.publicStaticDir, processRoot);
+		if (pubRel && pubRel !== directory) {
 			include.push({ directory: pubRel, publicPath: '' });
 		}
 	}