@astrale-os/adapter-cloudflare 0.5.0-beta.60 → 0.5.0-beta.62

package/README.md

@@ -9,3 +9,17 @@ npm install @astrale-os/sdk@beta @astrale-os/adapter-cloudflare@beta
 ```
 
 Bare installs return to stable releases when the package set is promoted and npm `latest` advances.
+
+## Provider-local staging
+
+Managed Cloudflare providers may stage immutable implementation candidates without exposing their
+identity to Publications or installed Kernels:
+
+```ts
+import { stagedWorkerName } from '@astrale-os/adapter-cloudflare/release'
+```
+
+This subpath is runtime-safe. `stagedWorkerName(providerDeployment)` addresses one private staged
+candidate. The public Worker name and `/invoke` endpoint remain stable across compatible
+implementation and Schema updates. Provider staging identity never enters Release, Publication,
+Kernel routing, or graph identity.

package/dist/adapter.js

@@ -9,7 +9,7 @@ import { resolveRouter, workerName } from './build/configuration.js';
 import { startFrontend } from './build/frontend-v1.js';
 import { loadWorkerArtifact } from './build/worker/index.js';
 import { workerModules } from './build/worker/modules.js';
-import { ensureWranglerDispatchNamespace, runWranglerDeploymentStatus, runWranglerDeploy, runWranglerDev, runWranglerReleaseDeploy, } from './build/wrangler-cli.js';
+import { runWranglerDeploymentStatus, runWranglerDeploy, runWranglerDev, } from './build/wrangler-cli.js';
 import { deployCloudflare } from './deploy/index.js';
 import { signingIdentitySecrets } from './identity/secret.js';
 import { signingIdentity } from './identity/source.js';
@@ -19,9 +19,7 @@ export function cloudflare(environments) {
     return cloudflareWithDependencies(environments, {
         artifact,
         materialize,
-        ensureWranglerDispatchNamespace,
         runWranglerDeploy,
-        runWranglerReleaseDeploy,
         runWranglerDeploymentStatus,
         runWranglerDev,
         startFrontend,

package/dist/build/artifact.d.ts

@@ -1,7 +1,7 @@
 import type { ArtifactSource, PrepareContext } from '@astrale-os/sdk/deployment/adapter';
 import type { CloudflareParams } from '../params.js';
 export { materialize } from './materialize.js';
-/** Prepare one revision Service and its stateless gateway without provider mutation. */
+/** Prepare one portable Worker whose public provider address remains stable across builds. */
 export declare function artifact(params: CloudflareParams, context: PrepareContext): Promise<ArtifactSource>;
 /** Prepare the complete portable Cloudflare Worker without direct Wrangler placement files. */
 export declare function prepareWorkerArtifact(params: CloudflareParams, context: PrepareContext): Promise<ArtifactSource>;

package/dist/build/artifact.js

@@ -1,19 +1,18 @@
 import { addressing } from '@astrale-os/sdk/deployment/release';
-import { mkdir } from 'node:fs/promises';
+import { mkdir, mkdtemp, rm } from 'node:fs/promises';
 import { join } from 'node:path';
 import { SIGNING_IDENTITY_BINDING } from '../identity/binding.js';
-import { releaseNamespace, releaseWorkerName } from '../release/index.js';
+import { workerDeployment } from '../release/index.js';
 import { generateWranglerConfig } from './codegen/wrangler.js';
 import { deploymentAddressing, resolveRouter, workerName } from './configuration.js';
 import { frontendFiles } from './frontend-v1.js';
 import { frontendRoutes } from './frontend/routes.js';
-import { prepareGateway } from './gateway/prepare.js';
 import { encodeWorkerArtifactManifest, inferMediaType, workerContentDigest, WORKER_MANIFEST_PATH, } from './worker/artifact.manifest.js';
 import { prepareExecution, RELEASE_ENTRY, RELEASE_SERVICE, runtimeVars, } from './worker/execution.prepare.js';
 import { admitWorkerRuntimeConfiguration } from './worker/runtime.js';
 export { materialize } from './materialize.js';
 const encoder = new TextEncoder();
-/** Prepare one revision Service and its stateless gateway without provider mutation. */
+/** Prepare one portable Worker whose public provider address remains stable across builds. */
 export async function artifact(params, context) {
     return prepare(params, context, true);
 }
@@ -23,129 +22,142 @@ export async function prepareWorkerArtifact(params, context) {
 }
 async function prepare(params, context, direct) {
     const stateDirectory = join(context.projectDir, '.astrale');
-    const directory = join(stateDirectory, 'runtime');
-    await mkdir(directory, { recursive: true });
-    const router = resolveRouter(params.router);
-    const name = workerName(params, context.build.schema.compiled.root.origin);
-    const revision = context.build.schema.compiled.root.revision;
-    const namespace = releaseNamespace(name);
-    const target = releaseWorkerName(revision);
-    const configuredIssuer = deploymentAddressing(params);
-    const execution = await prepareExecution({
-        params,
-        context,
-        directory,
-        name,
-        direct,
-        configuredIssuer,
-        router,
-    });
-    const frontend = await frontendFiles({
-        frontend: context.build.frontend,
-        projectDir: context.projectDir,
-    });
-    const gatewayBundle = await prepareGateway({
-        projectDir: context.projectDir,
-        directory,
-        name,
-        ...(params.route === undefined ? {} : { route: params.route }),
-        namespace,
-        revision,
-    });
-    const releaseConfig = generateWranglerConfig({
-        workerName: target,
-        main: `./${RELEASE_ENTRY}`,
-        vars: runtimeVars(params, configuredIssuer),
-        secretBindings: [SIGNING_IDENTITY_BINDING],
-        modules: { baseDir: './bundle', rules: [{ type: 'ESModule', globs: ['service.mjs'] }] },
-        ...(context.build.frontend?.source.kind === 'vite'
-            ? {
-                frontend: {
-                    directory: './frontend',
-                    routes: frontendRoutes(context.build.frontend),
-                    dev: false,
-                },
-            }
-            : {}),
-        ...(router === undefined
-            ? {}
-            : { router: { binding: router.binding, service: router.service } }),
-        ...(params.wrangler === undefined ? {} : { wrangler: params.wrangler }),
-        selfBinding: false,
-    });
-    const gatewayConfig = generateWranglerConfig({
-        workerName: name,
-        main: './gateway/index.mjs',
-        ...(params.route === undefined ? {} : { route: params.route }),
-        releases: { binding: 'RELEASES', namespace },
-        selfBinding: false,
-    });
-    const runtime = admitWorkerRuntimeConfiguration(releaseConfig);
-    const manifest = encodeWorkerArtifactManifest({
-        origin: context.build.schema.compiled.root.origin,
-        revision,
-        release: {
+    await mkdir(stateDirectory, { recursive: true });
+    const directory = await mkdtemp(join(stateDirectory, 'prepare-'));
+    try {
+        const router = resolveRouter(params.router);
+        const name = workerName(params, context.build.schema.compiled.root.origin);
+        const revision = context.build.schema.compiled.root.revision;
+        const configuredIssuer = deploymentAddressing(params);
+        const modules = await prepareExecution({
+            params,
+            context,
+            directory,
+            name,
+            direct,
+            configuredIssuer,
+            router,
+        });
+        const frontend = await frontendFiles({
+            frontend: context.build.frontend,
+            projectDir: context.projectDir,
+        });
+        const releaseConfig = generateWranglerConfig({
+            workerName: name,
+            main: `./${RELEASE_ENTRY}`,
+            ...(params.route === undefined ? {} : { route: params.route }),
+            vars: runtimeVars(params, configuredIssuer),
+            secretBindings: [SIGNING_IDENTITY_BINDING],
+            modules: { baseDir: './bundle', rules: [{ type: 'ESModule', globs: ['service.mjs'] }] },
+            ...(context.build.frontend?.source.kind === 'vite'
+                ? {
+                    frontend: {
+                        directory: './frontend',
+                        routes: frontendRoutes(context.build.frontend),
+                        dev: false,
+                    },
+                }
+                : {}),
+            ...(router === undefined
+                ? {}
+                : { router: { binding: router.binding, service: router.service } }),
+            ...(params.wrangler === undefined ? {} : { wrangler: params.wrangler }),
+            selfBinding: false,
+        });
+        const runtime = admitWorkerRuntimeConfiguration(releaseConfig);
+        const deployment = workerDeployment({
+            release: {
+                entrypoint: RELEASE_ENTRY,
+                modules: [
+                    { path: RELEASE_ENTRY, kind: 'esm', content: modules.entry },
+                    { path: RELEASE_SERVICE, kind: 'esm', content: modules.service },
+                ],
+            },
+            runtime,
+            bindings: {
+                vars: runtime.vars,
+                services: runtime.services,
+                requiredSecrets: [SIGNING_IDENTITY_BINDING],
+            },
+            ...(frontend.length === 0
+                ? {}
+                : {
+                    assets: {
+                        files: frontend.map((file) => {
+                            const contentType = file.mediaType ?? inferMediaType(file.path);
+                            return {
+                                path: `/${file.path}`,
+                                content: file.bytes(),
+                                ...(contentType === undefined ? {} : { contentType }),
+                            };
+                        }),
+                        notFound: 'none',
+                        runWorkerFirst: true,
+                        htmlHandling: 'none',
+                    },
+                }),
+        });
+        const manifest = encodeWorkerArtifactManifest({
+            origin: context.build.schema.compiled.root.origin,
+            revision,
+            deployment,
+            release: {
+                entrypoint: RELEASE_ENTRY,
+                modules: [
+                    { path: RELEASE_ENTRY, kind: 'esm', digest: workerContentDigest(modules.entry) },
+                    { path: RELEASE_SERVICE, kind: 'esm', digest: workerContentDigest(modules.service) },
+                ],
+            },
+            runtime: {
+                compatibilityDate: runtime.compatibilityDate,
+                compatibilityFlags: runtime.compatibilityFlags,
+            },
+            bindings: {
+                vars: runtime.vars,
+                services: runtime.services,
+                requiredSecrets: [SIGNING_IDENTITY_BINDING],
+            },
+            ...(frontend.length === 0
+                ? {}
+                : {
+                    assets: {
+                        files: frontend.map((file) => {
+                            const contentType = file.mediaType ?? inferMediaType(file.path);
+                            return {
+                                path: `/${file.path}`,
+                                artifactPath: `frontend/${file.path}`,
+                                digest: workerContentDigest(file.bytes()),
+                                ...(contentType === undefined ? {} : { contentType }),
+                            };
+                        }),
+                        notFound: 'none',
+                        runWorkerFirst: true,
+                        htmlHandling: 'none',
+                    },
+                }),
+        });
+        const files = [
+            { path: RELEASE_ENTRY, content: modules.entry },
+            { path: RELEASE_SERVICE, content: modules.service },
+            { path: WORKER_MANIFEST_PATH, content: manifest },
+            ...frontend.map((file) => ({
+                path: `frontend/${file.path}`,
+                content: file.bytes(),
+            })),
+            ...(direct ? [{ path: 'wrangler.jsonc', content: encoder.encode(releaseConfig) }] : []),
+        ];
+        return Object.freeze({
             entrypoint: RELEASE_ENTRY,
-            modules: [
-                { path: RELEASE_ENTRY, kind: 'esm', digest: workerContentDigest(execution.entry) },
-                { path: RELEASE_SERVICE, kind: 'esm', digest: workerContentDigest(execution.service) },
-            ],
-        },
-        gateway: {
-            entrypoint: 'gateway/index.mjs',
-            modules: [
-                { path: 'gateway/index.mjs', kind: 'esm', digest: workerContentDigest(gatewayBundle) },
-            ],
-        },
-        runtime: {
-            compatibilityDate: runtime.compatibilityDate,
-            compatibilityFlags: runtime.compatibilityFlags,
-        },
-        bindings: {
-            vars: runtime.vars,
-            services: runtime.services,
-            requiredSecrets: [SIGNING_IDENTITY_BINDING],
-        },
-        ...(frontend.length === 0
-            ? {}
-            : {
-                assets: {
-                    files: frontend.map((file) => {
-                        const contentType = file.mediaType ?? inferMediaType(file.path);
-                        return {
-                            path: `/${file.path}`,
-                            artifactPath: `frontend/${file.path}`,
-                            digest: workerContentDigest(file.bytes()),
-                            ...(contentType === undefined ? {} : { contentType }),
-                        };
-                    }),
-                    notFound: 'none',
-                    runWorkerFirst: true,
-                    htmlHandling: 'none',
-                },
-            }),
-    });
-    const files = [
-        { path: RELEASE_ENTRY, content: execution.entry },
-        { path: RELEASE_SERVICE, content: execution.service },
-        { path: 'gateway/index.mjs', content: gatewayBundle },
-        { path: WORKER_MANIFEST_PATH, content: manifest },
-        ...frontend.map((file) => ({
-            path: `frontend/${file.path}`,
-            content: file.bytes(),
-        })),
-        ...(direct
-            ? [
-                { path: 'wrangler.release.jsonc', content: encoder.encode(releaseConfig) },
-                { path: 'wrangler.gateway.jsonc', content: encoder.encode(gatewayConfig) },
-            ]
-            : []),
-    ];
-    return Object.freeze({
-        entrypoint: RELEASE_ENTRY,
-        files: Object.freeze(files),
-        addressing: configuredIssuer === undefined
-            ? Object.freeze({ kind: 'provider-assigned', claim: name })
-            : Object.freeze({ kind: 'configured', addressing: addressing(configuredIssuer) }),
-    });
+            files: Object.freeze(files),
+            addressing: configuredIssuer === undefined
+                ? Object.freeze({ kind: 'provider-assigned', claim: name })
+                : Object.freeze({
+                    kind: 'configured',
+                    addressing: addressing(configuredIssuer),
+                }),
+        });
+    }
+    finally {
+        await rm(directory, { recursive: true, force: true });
+    }
 }

package/dist/build/codegen/wrangler.d.ts

@@ -37,11 +37,6 @@ export interface WranglerCodegenOptions {
     };
     /** Add the SELF service binding (autobinding). */
     selfBinding: boolean;
-    /** Bind the stable gateway to its private revision namespace. */
-    releases?: {
-        readonly binding: string;
-        readonly namespace: string;
-    };
     /**
      * Add a service binding to a router Worker for instance-host subrequest
      * routing (see `CloudflareParams.router`). Pairs with the worker

package/dist/build/codegen/wrangler.js

@@ -35,8 +35,7 @@ export function generateWranglerConfig(opts) {
             run_worker_first: opts.frontend.dev
                 ? true
                 : [
-                    '/releases',
-                    '/releases/*',
+                    '/invoke',
                     '/install',
                     '/install/*',
                     '/health',
@@ -70,9 +69,6 @@ export function generateWranglerConfig(opts) {
             fallthrough: true,
         }));
     }
-    if (opts.releases !== undefined) {
-        config.dispatch_namespaces = [opts.releases];
-    }
     const merged = opts.wrangler ? mergeUserConfig(config, opts.wrangler) : config;
     return JSON.stringify(merged, null, 2) + '\n';
 }

package/dist/build/direct.js

@@ -1,13 +1,11 @@
 import { isDeepStrictEqual } from 'node:util';
-import { releaseNamespace, releaseWorkerName } from '../release/index.js';
 import { generateWranglerConfig } from './codegen/wrangler.js';
 import { resolveRouter, workerName } from './configuration.js';
 import { frontendRoutes } from './frontend/routes.js';
 import { workerModules } from './worker/modules.js';
 export function admitDirectPlacement(artifact, worker, parameters) {
     const name = workerName(parameters, worker.origin);
-    const release = config(artifact, 'wrangler.release.jsonc');
-    const gateway = config(artifact, 'wrangler.gateway.jsonc');
+    const release = config(artifact, 'wrangler.jsonc');
     const router = resolveRouter(parameters.router);
     const frontend = artifact.build.frontend;
     const hasViteFrontend = frontend?.source.kind === 'vite';
@@ -17,8 +15,9 @@ export function admitDirectPlacement(artifact, worker, parameters) {
         equal(worker.assets.runWorkerFirst, true);
     }
     equal(release, generated({
-        workerName: releaseWorkerName(worker.revision),
+        workerName: name,
         main: `./${worker.release.entrypoint}`,
+        ...(parameters.route === undefined ? {} : { route: parameters.route }),
         vars: worker.bindings.vars,
         secretBindings: worker.bindings.requiredSecrets,
         modules: directModules(worker.release),
@@ -41,13 +40,6 @@ export function admitDirectPlacement(artifact, worker, parameters) {
     equalStringCollection(release.compatibility_flags, worker.runtime.compatibilityFlags);
     equal(release.services ?? [], worker.bindings.services.map(serviceBinding));
     equal(record(release.assets).html_handling, worker.assets?.htmlHandling);
-    equal(gateway, generated({
-        workerName: name,
-        main: `./${worker.gateway.entrypoint}`,
-        ...(parameters.route === undefined ? {} : { route: parameters.route }),
-        releases: { binding: 'RELEASES', namespace: releaseNamespace(name) },
-        selfBinding: false,
-    }));
 }
 function directModules(worker) {
     try {
@@ -83,8 +75,11 @@ function record(input) {
         : {};
 }
 function equal(actual, expected) {
-    if (!isDeepStrictEqual(actual, expected))
-        mismatch();
+    if (!isDeepStrictEqual(actual, expected)) {
+        throw new TypeError('Direct Cloudflare placement differs from its admitted Worker artifact.', {
+            cause: { actual, expected },
+        });
+    }
 }
 function equalStringCollection(actual, expected) {
     if (!Array.isArray(actual) ||

package/dist/build/worker/artifact.d.ts

@@ -1,3 +1,4 @@
+import type { WorkerDeploymentId } from '../../release/deployment.js';
 export type WorkerModuleKind = 'esm' | 'wasm' | 'text' | 'data';
 export interface WorkerArtifactModule {
     readonly path: string;
@@ -11,8 +12,8 @@ export interface WorkerArtifactExecutable {
 export interface WorkerArtifact {
     readonly origin: string;
     readonly revision: string;
+    readonly deployment: WorkerDeploymentId;
     readonly release: WorkerArtifactExecutable;
-    readonly gateway: WorkerArtifactExecutable;
     readonly runtime: {
         readonly compatibilityDate: string;
         readonly compatibilityFlags: readonly string[];

package/dist/build/worker/artifact.load.js

@@ -1,5 +1,6 @@
 import { isPreparedArtifact } from '@astrale-os/sdk/deployment/verify';
 import { createHash } from 'node:crypto';
+import { workerDeployment } from '../../release/deployment.js';
 import { WORKER_ARTIFACT_FORMAT, WORKER_ARTIFACT_VERSION } from './artifact.manifest.js';
 import { artifactPath, assetPath, comparePath, WORKER_MANIFEST_PATH } from './artifact.paths.js';
 const decoder = new TextDecoder('utf-8', { fatal: true });
@@ -29,7 +30,6 @@ export function loadWorkerArtifact(artifact) {
     }
     const claimed = new Set([WORKER_MANIFEST_PATH]);
     const release = executable(artifact, manifest.release, claimed, 'release');
-    const gateway = executable(artifact, manifest.gateway, claimed, 'gateway');
     const assets = manifest.assets?.files.map((file) => {
         claim(claimed, file.artifactPath);
         const source = requiredFile(artifact, file.artifactPath);
@@ -42,11 +42,42 @@ export function loadWorkerArtifact(artifact) {
             bytes: () => new Uint8Array(content),
         });
     });
+    const deployment = workerDeployment({
+        release: {
+            entrypoint: release.entrypoint,
+            modules: release.modules.map((module) => ({
+                path: module.path,
+                kind: module.kind,
+                content: module.bytes(),
+            })),
+        },
+        runtime: manifest.runtime,
+        bindings: manifest.bindings,
+        ...(manifest.assets === undefined
+            ? {}
+            : {
+                assets: {
+                    files: assets.map((file) => ({
+                        path: file.path,
+                        content: file.bytes(),
+                        ...(file.contentType === undefined ? {} : { contentType: file.contentType }),
+                    })),
+                    notFound: manifest.assets.notFound,
+                    runWorkerFirst: manifest.assets.runWorkerFirst,
+                    ...(manifest.assets.htmlHandling === undefined
+                        ? {}
+                        : { htmlHandling: manifest.assets.htmlHandling }),
+                },
+            }),
+    });
+    if (deployment !== manifest.deployment) {
+        throw new TypeError('Cloudflare Worker deployment identity differs from its material.');
+    }
     return Object.freeze({
         origin,
         revision,
+        deployment,
         release,
-        gateway,
         runtime: Object.freeze({
             compatibilityDate: manifest.runtime.compatibilityDate,
             compatibilityFlags: Object.freeze([...manifest.runtime.compatibilityFlags]),
@@ -96,8 +127,8 @@ function admitManifest(input) {
         'version',
         'origin',
         'revision',
+        'deployment',
         'release',
-        'gateway',
         'runtime',
         'bindings',
         'assets',
@@ -107,11 +138,11 @@ function admitManifest(input) {
     }
     if (typeof value.origin !== 'string' ||
         value.origin.length === 0 ||
-        !REVISION.test(String(value.revision))) {
+        !REVISION.test(String(value.revision)) ||
+        !REVISION.test(String(value.deployment))) {
         invalid();
     }
     const release = admitExecutable(value.release);
-    const gateway = admitExecutable(value.gateway);
     const runtime = record(value.runtime, ['compatibilityDate', 'compatibilityFlags']);
     if (typeof runtime.compatibilityDate !== 'string' || !DATE.test(runtime.compatibilityDate))
         invalid();
@@ -136,8 +167,8 @@ function admitManifest(input) {
         version: WORKER_ARTIFACT_VERSION,
         origin: value.origin,
         revision: value.revision,
+        deployment: value.deployment,
         release,
-        gateway,
         runtime: Object.freeze({
             compatibilityDate: runtime.compatibilityDate,
             compatibilityFlags,

package/dist/build/worker/artifact.manifest.d.ts

@@ -1,14 +1,15 @@
+import type { WorkerDeploymentId } from '../../release/deployment.js';
 import type { WorkerModuleKind } from './artifact.js';
 import { WORKER_MANIFEST_PATH } from './artifact.paths.js';
 export declare const WORKER_ARTIFACT_FORMAT = "astrale.cloudflare.worker";
-export declare const WORKER_ARTIFACT_VERSION = 1;
-export interface WorkerArtifactManifestV1 {
+export declare const WORKER_ARTIFACT_VERSION = 2;
+export interface WorkerArtifactManifestV2 {
     readonly format: typeof WORKER_ARTIFACT_FORMAT;
     readonly version: typeof WORKER_ARTIFACT_VERSION;
     readonly origin: string;
     readonly revision: string;
+    readonly deployment: WorkerDeploymentId;
     readonly release: ManifestExecutable;
-    readonly gateway: ManifestExecutable;
     readonly runtime: {
         readonly compatibilityDate: string;
         readonly compatibilityFlags: readonly string[];
@@ -41,7 +42,7 @@ interface ManifestExecutable {
         readonly digest: string;
     }[];
 }
-export declare function encodeWorkerArtifactManifest(input: Omit<WorkerArtifactManifestV1, 'format' | 'version'>): Uint8Array;
+export declare function encodeWorkerArtifactManifest(input: Omit<WorkerArtifactManifestV2, 'format' | 'version'>): Uint8Array;
 export declare function workerContentDigest(input: Uint8Array): string;
 export declare function inferMediaType(path: string): string | undefined;
 export { WORKER_MANIFEST_PATH };

package/dist/build/worker/artifact.manifest.js

@@ -1,7 +1,7 @@
 import { createHash } from 'node:crypto';
 import { artifactPath, assetPath, comparePath, WORKER_MANIFEST_PATH } from './artifact.paths.js';
 export const WORKER_ARTIFACT_FORMAT = 'astrale.cloudflare.worker';
-export const WORKER_ARTIFACT_VERSION = 1;
+export const WORKER_ARTIFACT_VERSION = 2;
 const encoder = new TextEncoder();
 export function encodeWorkerArtifactManifest(input) {
     const manifest = {
@@ -9,8 +9,8 @@ export function encodeWorkerArtifactManifest(input) {
         version: WORKER_ARTIFACT_VERSION,
         origin: input.origin,
         revision: input.revision,
+        deployment: input.deployment,
         release: canonicalExecutable(input.release),
-        gateway: canonicalExecutable(input.gateway),
         runtime: {
             compatibilityDate: input.runtime.compatibilityDate,
             compatibilityFlags: Object.freeze([...input.runtime.compatibilityFlags].sort()),

package/dist/build/wrangler/deploy.d.ts

@@ -1,5 +1,6 @@
 export interface DeployArgs {
     configPath: string;
+    secrets?: Readonly<Record<string, string>>;
     route?: string;
     onLog?: (line: string) => void;
     signal?: AbortSignal;

package/dist/build/wrangler/deploy.js

@@ -1,5 +1,6 @@
 import { parseDeployUrl, parseDeployVersionId } from '../parse-output.js';
 import { runCapture, wranglerCommand } from './process.js';
+import { secretRedactor, withSecretsFile } from './secrets.js';
 import { runWranglerTypes } from './type-generation.js';
 export class WranglerDeployError extends Error {
     applied;
@@ -13,7 +14,15 @@ export class WranglerDeployError extends Error {
 export async function runWranglerDeploy(args) {
     await runWranglerTypes(args);
     const { cmd, prefix } = wranglerCommand(args.projectDir);
-    const { code, out } = await runCapture(cmd, [...prefix, 'deploy', '--config', args.configPath], args.projectDir, args.onLog, args.signal);
+    const secrets = args.secrets ?? {};
+    const execute = (secretsFile) => runCapture(cmd, [
+        ...prefix,
+        'deploy',
+        '--config',
+        args.configPath,
+        ...(secretsFile === undefined ? [] : ['--secrets-file', secretsFile]),
+    ], args.projectDir, args.onLog, args.signal, secretRedactor(secrets));
+    const { code, out } = await withSecretsFile(secrets, execute);
     const url = parseDeployUrl(out, args.route);
     const deploymentVersion = parseDeployVersionId(out);
     if (code !== 0) {

package/dist/build/wrangler-cli.d.ts

@@ -1,8 +1,6 @@
 export { runWranglerBundle } from './wrangler/bundle.js';
 export { runWranglerDeploy, WranglerDeployError, type DeployArgs } from './wrangler/deploy.js';
 export { runWranglerDev, type DevHandle } from './wrangler/development.js';
-export { ensureWranglerDispatchNamespace, WranglerDispatchNamespaceError, } from './wrangler/namespace.js';
 export { wranglerProcessEnv } from './wrangler/process.js';
-export { runWranglerReleaseDeploy } from './wrangler/release.js';
 export { admitWranglerDeploymentStatus, runWranglerDeploymentStatus, type WranglerDeploymentStatus, } from './wrangler/status.js';
 export { runWranglerTypes } from './wrangler/type-generation.js';

package/dist/build/wrangler-cli.js

@@ -1,8 +1,6 @@
 export { runWranglerBundle } from './wrangler/bundle.js';
 export { runWranglerDeploy, WranglerDeployError } from './wrangler/deploy.js';
 export { runWranglerDev } from './wrangler/development.js';
-export { ensureWranglerDispatchNamespace, WranglerDispatchNamespaceError, } from './wrangler/namespace.js';
 export { wranglerProcessEnv } from './wrangler/process.js';
-export { runWranglerReleaseDeploy } from './wrangler/release.js';
 export { admitWranglerDeploymentStatus, runWranglerDeploymentStatus, } from './wrangler/status.js';
 export { runWranglerTypes } from './wrangler/type-generation.js';