@kedge/cli 0.10.0 → 0.11.0

package/src/commands.ts

@@ -6,6 +6,7 @@
 // acting on production.
 import { spawnSync } from "node:child_process";
 import { existsSync, readdirSync, readFileSync, rmSync, unlinkSync, writeFileSync } from "node:fs";
+import { createServer } from "node:net";
 import { join, resolve } from "node:path";
 import { pathToFileURL } from "node:url";
 import { isPermission, type KedgeConfig } from "@kedge/core";
@@ -20,7 +21,7 @@ import {
   UnknownOutcome,
   wranglerBin,
 } from "./cf";
-import { isCliSession, OLDER_KEDGE, type SessionDeps, withCliSession } from "./cli-session";
+import { isCliSession, OLDER_KEDGE, proveTarget, type SessionDeps, withCliSession } from "./cli-session";
 import { ComposeError, compose, type Lock } from "./compose";
 import { type Executor, wranglerExecute } from "./d1-batch";
 import {
@@ -41,7 +42,7 @@ import { childStdio, emit } from "./output";
 import { needsLive, smoke } from "./smoke";
 import { git, storeNames } from "./store";
 import { storeRequest } from "./store-api";
-import { resolveTarget, type StoreTarget } from "./target";
+import { devPort, resolveTarget, type StoreTarget } from "./target";
 import { compileStoreZone } from "./tz";
 
 export interface CommandDeps {
@@ -267,7 +268,7 @@ export async function deployCommand(args: readonly string[], d: CommandDeps): Pr
         );
       // Adoption takes the store's jurisdiction from what exists, so it asks nothing; a choice is checked against it.
       const choice = flag(args, "--jurisdiction");
-      await preflight(cf);
+      await preflight(cf, undefined, undefined, readWrangler(d.cwd)?.config.workers_dev !== false);
       if (choice !== undefined && !isJurisdictionChoice(choice))
         throw new DeployRefused(`--jurisdiction takes eu, us, fedramp or none, not "${choice}"`);
       return dep.adoptExisting(
@@ -279,7 +280,7 @@ export async function deployCommand(args: readonly string[], d: CommandDeps): Pr
     const window = windowOf(flag(args, "--maintenance-window"));
     const takeOver = flag(args, "--take-over");
     const choice = flag(args, "--jurisdiction");
-    await preflight(cf, dep.names.ops, choice);
+    await preflight(cf, dep.names.ops, choice, readWrangler(d.cwd)?.config.workers_dev !== false);
     await dep.deploy({
       ...(choice ? { jurisdiction: choice as JurisdictionChoice } : {}),
       vars: varsOf(args),
@@ -290,26 +291,26 @@ export async function deployCommand(args: readonly string[], d: CommandDeps): Pr
       ...(window ? { window } : {}),
       ...(takeOver ? { takeOver } : {}),
     });
-    // From the account's subdomain now, never a recorded URL: its owner can change it (p0.10 §4).
-    const url = `https://${dep.names.worker}.${await cf.workersSubdomain()}.workers.dev`;
-    return { worker: dep.names.worker, account: cf.account, url, admin: adminUrl(d.cwd, url) };
+    // From the account's subdomain now, never a recorded URL: its owner can change it (p0.10 §4). Only where the
+    // Worker is served there: a platform with its own domain answers an account subdomain too (p0.11 row 2).
+    const url = await cf.workersDevUrl(dep.names.worker);
+    if (!url) (d.log ?? console.log)(PLATFORM_URL);
+    return { worker: dep.names.worker, account: cf.account, url, admin: url ? adminUrl(d.cwd, url) : null };
   });
 }
 
+/** What deploy says when the store isn't at workers.dev: its platform knows where it is. */
+export const PLATFORM_URL =
+  "this store isn't served at workers.dev: its address is the one its host gives (salve hosting: hosting_status); use that https URL as --url";
+
 /** The admin's address, when the store serves it (p0.9 §3.3); null when it serves none. */
 function adminUrl(cwd: string, url: string): string | null {
   return readWrangler(cwd)?.config.assets ? `${url}/app/` : null;
 }
 
 export async function migrateCommand(args: readonly string[], d: CommandDeps): Promise<number> {
-  if (!args.includes("--remote")) {
-    // Local: the dev database, through Wrangler's own bookkeeping.
-    const r = spawnSync(process.execPath, [wranglerBin(), "d1", "migrations", "apply", "DB", "--local"], {
-      cwd: d.cwd,
-      stdio: childStdio(),
-    });
-    return r.status ?? 1;
-  }
+  // Local: the dev database, through Wrangler's own bookkeeping.
+  if (!args.includes("--remote")) return migrateLocal(d);
   return refusals(d, async () => (await deployer(d)).migrateRemote());
 }
 
@@ -444,11 +445,18 @@ const SAMPLE_APPAREL = [
 const isLocal = (url: string) => ["localhost", "127.0.0.1", "[::1]"].includes(new URL(url).hostname);
 
 /** The store a URL is, for a CLI session or a check: what `resolveTarget` says, credentials resolved as for any remote command. */
-const targetOf = (url: string, d: CommandDeps) => resolveTarget(url, d.cwd, () => cloudflareOf(d));
+const unprovedOf = (url: string, d: CommandDeps) => resolveTarget(url, d.cwd, () => cloudflareOf(d));
+const targetOf = async (url: string, d: CommandDeps) => {
+  const t = await unprovedOf(url, d);
+  // A URL the CLI didn't derive is proved before anything else goes there, a saved key included (p0.11 §3).
+  if (t?.proof) await proveTarget(t, sessionDeps(d));
+  return t;
+};
 
 /** How a CLI session's row is written (p0.10 §6.2). */
 const sessionDeps = (d: CommandDeps): SessionDeps => ({
   cloudflare: () => cloudflareOf(d),
+  fetch: d.fetch ?? fetch,
   executeLocal: (b) => (d.execute ?? wranglerExecute)(b, { database: "DB", remote: false, cwd: d.cwd }),
 });
 
@@ -500,6 +508,7 @@ function authOf(args: readonly string[]): Record<string, string> {
 async function signOutBearer(url: string, token: string, d: CommandDeps): Promise<void> {
   await (d.fetch ?? fetch)(new URL("/auth/admin/sign-out", url), {
     method: "POST",
+    redirect: "manual",
     headers: { authorization: `Bearer ${token}` },
   }).catch(() => undefined);
 }
@@ -574,7 +583,8 @@ export async function seedCommand(args: readonly string[], d: CommandDeps): Prom
     // customers would see sample products, so it's the owner's call (p0.10 §5).
     let target: StoreTarget | null = null;
     if (!isLocal(url) && !args.includes("--live")) {
-      target = await targetOf(url, d);
+      // Only a preview goes on from here, and a preview's origin is derived, never proved: anything else is a handoff.
+      target = await unprovedOf(url, d);
       if (target?.kind !== "preview")
         throw new NeedsPerson(
           `${url} isn't local or a preview this store knows: sample products on a live store are for its owner to allow; with their yes, run this again with --live`,
@@ -601,9 +611,11 @@ export async function smokeCommand(args: readonly string[], d: CommandDeps): Pro
     const name = flag(args, "--run") ?? "first";
     if (!/^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/.test(name))
       throw new DeployRefused("--run takes a name of letters, digits, - and _, up to 64");
-    const target = await targetOf(url, d);
+    // The live store's handoff comes before any proof: nothing goes to a store its owner hasn't allowed.
+    const target = await unprovedOf(url, d);
     if (!target) throw new DeployRefused(`${url} isn't a store this checkout knows: smoke runs only on its own stores`);
     needsLive(target, args.includes("--live"));
+    if (target.proof) await proveTarget(target, sessionDeps(d));
     return smoke(target, name, {
       cwd: d.cwd,
       fetch: d.fetch ?? fetch,
@@ -743,7 +755,41 @@ export function devArgs(cwd: string): string[] {
   return id ? ["--define", `KEDGE_ADMIN_BUILD:${JSON.stringify(id)}`] : [];
 }
 
-export function devCommand(d: CommandDeps): number {
+/**
+ * The local database's migrations, through Wrangler's own bookkeeping, in one
+ * line: Wrangler prints its whole status table again after each migration,
+ * thousands of lines for a new store (p0.10.1 §1, 8). Its full output is shown
+ * only when it fails.
+ */
+export function migrateLocal(d: Pick<CommandDeps, "cwd" | "log" | "error">): number {
+  const r = spawnSync(process.execPath, [wranglerBin(), "d1", "migrations", "apply", "DB", "--local"], {
+    cwd: d.cwd,
+    encoding: "utf8",
+    env: { ...process.env, WRANGLER_SEND_METRICS: "false" },
+    maxBuffer: 1 << 26,
+  });
+  const out = `${r.stdout ?? ""}${r.stderr ?? ""}`;
+  if (r.status !== 0) {
+    (d.error ?? console.error)(out.trim().split("\n").slice(-40).join("\n"));
+    return r.status ?? 1;
+  }
+  const n = new Set(out.match(/\b\d{4}_[a-z0-9_]+\.sql\b/g) ?? []).size;
+  (d.log ?? console.log)(
+    n ? `applied ${n} migration${n === 1 ? "" : "s"} to the local database` : "the local database is up to date",
+  );
+  return 0;
+}
+
+/** Whether something already listens on the port: Wrangler would otherwise move to another, silently. */
+function portTaken(port: number): Promise<boolean> {
+  return new Promise((resolve) => {
+    const server = createServer();
+    server.once("error", () => resolve(true));
+    server.listen(port, "127.0.0.1", () => server.close(() => resolve(false)));
+  });
+}
+
+export async function devCommand(d: CommandDeps): Promise<number> {
   const vars = join(d.cwd, ".dev.vars");
   if (!existsSync(vars)) {
     const lines = [
@@ -759,11 +805,16 @@ export function devCommand(d: CommandDeps): number {
     });
     (d.log ?? console.log)("wrote .dev.vars with fresh local secrets");
   }
-  const migrated = spawnSync(process.execPath, [wranglerBin(), "d1", "migrations", "apply", "DB", "--local"], {
-    cwd: d.cwd,
-    stdio: "inherit",
-  });
-  if (migrated.status !== 0) return migrated.status ?? 1;
+  // One port for dev, its invite link and the CLI's local target (p0.10.1 §3): taken is a refusal, never a move.
+  const port = devPort(d.cwd);
+  if (await portTaken(port)) {
+    (d.error ?? console.error)(
+      `port ${port} is in use: stop what's on it, or set "dev": { "port": <another> } in wrangler.jsonc`,
+    );
+    return 1;
+  }
+  const migrated = migrateLocal(d);
+  if (migrated !== 0) return migrated;
   let extra: string[];
   try {
     extra = devArgs(d.cwd);
@@ -771,7 +822,20 @@ export function devCommand(d: CommandDeps): number {
     (d.log ?? console.log)((e as Error).message);
     return 1;
   }
-  return spawnSync(process.execPath, [wranglerBin(), "dev", ...extra], { cwd: d.cwd, stdio: "inherit" }).status ?? 0;
+  const origin = `http://localhost:${port}`;
+  // Where the store and its admin are, and how a person signs in to a new store's admin (p0.10.1 §1, 5).
+  (d.log ?? console.log)(
+    [
+      `the store: ${origin}   its admin: ${origin}/app/`,
+      "no one can sign in to the admin until there's an Owner: pnpm kedge staff invite-owner <your email>",
+    ].join("\n"),
+  );
+  return (
+    spawnSync(process.execPath, [wranglerBin(), "dev", "--port", String(port), ...extra], {
+      cwd: d.cwd,
+      stdio: "inherit",
+    }).status ?? 0
+  );
 }
 
 export const removeIfExists = (p: string) => rmSync(p, { recursive: true, force: true });

package/src/d1-batch.ts

@@ -7,7 +7,7 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import type { CliBatch } from "@kedge/db";
 import { wranglerBin } from "./cf";
-import { childStdio } from "./output";
+import { childFailed, childStdio } from "./output";
 
 /** Runs one CLI batch against the store's D1; tests replace it. */
 export type Executor = (
@@ -56,8 +56,10 @@ export const wranglerExecute: Executor = (b, opts) => {
         cwd: opts.cwd,
         stdio: childStdio(),
         env: bootstrapEnv(process.env, dir, opts.env),
+        maxBuffer: 1 << 26,
       },
     );
+    childFailed(r);
     return r.status ?? 1;
   } finally {
     // The file holds no secret (only digests), but it needn't outlive the run.

package/src/deploy.ts

@@ -37,9 +37,16 @@ import {
   sha256,
   storeNames,
   type WranglerJson,
+  withDatabaseId,
 } from "./store";
 
 export const SCOPE = "production";
+/**
+ * The settings a release leaves: no Logpush, no invocation logs, query strings
+ * redacted, because a logged or thrown request is recorded with its URL, which
+ * erasure can't reach (docs/10; p0.11 row 18).
+ */
+const RELEASE_SETTINGS: WorkerSettings = { logpush: false, invocationLogs: false, redactQueryString: true };
 /** Core's secrets, generated only at a first deploy and only where missing (§6.1). */
 export const CORE_SECRETS = [
   "CART_TOKEN_SECRET",
@@ -714,6 +721,25 @@ export class Deployer {
         else blocking.push(i);
         continue;
       }
+      if (i.kind === "triggers") {
+        // A schedule PUT or a settings PATCH sets whole values, so a read-back showing them settles it,
+        // and a lost answer to one that landed doesn't block --resume (salve's codex r7). A mismatch
+        // stays unknown: replaying could race a late landing of the original.
+        const d = JSON.parse(i.detail) as { crons?: string[] } & Partial<WorkerSettings>;
+        const shows = d.crons
+          ? JSON.stringify(await this.d.cf.schedules(this.names.worker)) === JSON.stringify(d.crons)
+          : await this.d.cf
+              .settings(this.names.worker)
+              .then((s) =>
+                (["logpush", "invocationLogs", "redactQueryString"] as const).every(
+                  (k) => d[k] === undefined || s[k] === d[k],
+                ),
+              );
+        if (shows) {
+          await this.ops.closeIntent(i.id, "done", "a read-back shows what it set");
+          continue;
+        }
+      }
       if (i.kind === "activate") {
         const deps = await this.d.cf.deployments(this.names.worker);
         const landed = deps.find((d) => d.message?.includes(i.tag));
@@ -918,8 +944,9 @@ export class Deployer {
     if (!existsSync(file)) return;
     const text = readFileSync(file, "utf8");
     if (this.names.databaseId === PLACEHOLDER_ID) {
-      if (text.includes(PLACEHOLDER_ID)) {
-        writeFileSync(file, text.replace(PLACEHOLDER_ID, id));
+      const written = withDatabaseId(text, id);
+      if (written !== text) {
+        writeFileSync(file, written);
         this.log(`wrangler.jsonc now names database ${id}: commit it`);
       }
     } else if (this.names.databaseId !== id)
@@ -1015,10 +1042,9 @@ export class Deployer {
     const cf = this.d.cf;
     const applied = new Set(await appliedNames(cf, p.databaseId as string));
     const pending = (p.pending ?? []).filter((f) => !applied.has(f));
-    for (const f of [...applied]) {
-      const e = this.d.lock.entries.find((x) => x.file === f);
-      if (e) await this.ops.recordApplied(f, e.sha256);
-    }
+    await this.ops.recordApplied(
+      this.d.lock.entries.filter((e) => applied.has(e.file)).map((e) => [e.file, e.sha256] as const),
+    );
     if (pending.length === 0) return;
     await this.step("migrate");
     const dir = this.dir(this.opId);
@@ -1047,7 +1073,9 @@ export class Deployer {
       );
     } finally {
       const now = new Set(await appliedNames(cf, p.databaseId as string));
-      for (const f of pending) if (now.has(f)) await this.ops.recordApplied(f, this.plan.files[f] as string);
+      await this.ops.recordApplied(
+        pending.filter((f) => now.has(f)).map((f) => [f, this.plan.files[f] as string] as const),
+      );
     }
   }
 
@@ -1116,7 +1144,7 @@ export class Deployer {
     }
     if (!classChange) await this.activate("activate", p.appVersion as string);
     await this.markReleased();
-    await this.triggers(this.plan.config.triggers?.crons ?? [], { logpush: false, invocationLogs: false });
+    await this.triggers(this.plan.config.triggers?.crons ?? [], RELEASE_SETTINGS);
   }
 
   /** Crons and settings, each a single-attempt call read back before it counts (§3.1). */
@@ -1132,13 +1160,17 @@ export class Deployer {
         throw new DeployRefused("the cron schedules didn't read back as set");
     }
     const s = await cf.settings(this.names.worker);
-    if (s.logpush !== settings.logpush || s.invocationLogs !== settings.invocationLogs) {
+    if (
+      s.logpush !== settings.logpush ||
+      s.invocationLogs !== settings.invocationLogs ||
+      s.redactQueryString !== settings.redactQueryString
+    ) {
       await this.step("settings");
       await this.intent("settings", "triggers", this.tag("settings"), settings, () =>
         cf.patchSettings(this.names.worker, settings),
       );
       const back = await cf.settings(this.names.worker);
-      if (back.invocationLogs !== settings.invocationLogs)
+      if (back.invocationLogs !== settings.invocationLogs || back.redactQueryString !== settings.redactQueryString)
         throw new DeployRefused("the Worker's settings didn't read back as set");
     }
   }
@@ -1341,7 +1373,9 @@ export class Deployer {
         );
       await this.reconcile();
       await this.activate("abort", before.versionId);
-      await this.triggers(before.crons ?? [], before.settings ?? { logpush: false, invocationLogs: false });
+      // Redaction stays on through a rollback: a "before" read under 0.10 never
+      // recorded it, and turning it off would put query strings back in the logs.
+      await this.triggers(before.crons ?? [], { ...(before.settings ?? RELEASE_SETTINGS), redactQueryString: true });
       await ops.completeDeployment(p.deploymentId as string, {
         ...before,
         commit: servingCommit((await ops.deployments()).filter((r) => r.id !== p.deploymentId)),
@@ -1612,8 +1646,9 @@ export class Deployer {
     const qid = await cf.findQueue(this.names.queue);
     if (qid) await ops.recordResource("queue", this.names.queue, qid, "ours");
     await ops.recordResource("worker", this.names.worker, null, "ours");
-    for (const f of applied)
-      await ops.recordApplied(f, (this.d.lock.entries.find((e) => e.file === f) as LockEntry).sha256);
+    await ops.recordApplied(
+      applied.map((f) => [f, (this.d.lock.entries.find((e) => e.file === f) as LockEntry).sha256] as const),
+    );
     const half: Half = {
       lockSha: sha256(
         JSON.stringify(this.d.lock.entries.filter((e) => applied.includes(e.file)).map((e) => [e.file, e.sha256])),

package/src/doctor.ts

@@ -50,7 +50,8 @@ type WranglerConfig = {
     renamed_classes?: { from: string; to: string }[];
   }[];
   queues?: { producers?: { binding?: string }[] };
-  observability?: { enabled?: boolean; logs?: { invocation_logs?: boolean } };
+  observability?: { enabled?: boolean; redact_query_string?: boolean; logs?: { invocation_logs?: boolean } };
+  workers_dev?: boolean;
   assets?: { directory?: string; binding?: string; not_found_handling?: string; run_worker_first?: unknown };
   env?: Record<string, { observability?: WranglerConfig["observability"] }>;
 };
@@ -382,8 +383,11 @@ export async function doctor(input: DoctorInput): Promise<CheckResult[]> {
       problems.length ? fail("wrangler", "wrangler.jsonc isn't what a Kedge Worker needs", problems) : pass("wrangler"),
     );
 
-    // invocation-logs: Cloudflare's per-request log records the URL, which erasure can't reach.
-    const off = (o: WranglerConfig["observability"]) => o?.logs?.invocation_logs === false;
+    // invocation-logs: Cloudflare records a request with its URL, which erasure can't reach: every
+    // request with invocation logs on, and one that logs or throws with them off unless its query
+    // string is redacted (p0.11 row 18).
+    const off = (o: WranglerConfig["observability"]) =>
+      o?.logs?.invocation_logs === false && o.redact_query_string === true;
     const where = [
       ...(off(c.observability) ? [] : ["the top level"]),
       ...Object.entries(c.env ?? {})
@@ -394,7 +398,7 @@ export async function doctor(input: DoctorInput): Promise<CheckResult[]> {
       where.length
         ? fail(
             "invocation-logs",
-            `set "observability": { "logs": { "invocation_logs": false } } at ${where.join(", ")}: invocation logs record each request's URL, which can carry a customer's data that erasure can't reach`,
+            `set "observability": { "redact_query_string": true, "logs": { "invocation_logs": false } } at ${where.join(", ")}: Cloudflare records a request with its URL, which can carry a customer's data that erasure can't reach`,
           )
         : pass("invocation-logs"),
     );
@@ -461,13 +465,21 @@ export async function credentialsChecks(input: {
   cf: import("./cf").Cloudflare;
   source: string;
   base: string;
+  /** Whether the store is served at workers.dev; when it isn't, a missing subdomain is no failure (codex code r3). */
+  workersDev?: boolean;
 }): Promise<CheckResult[]> {
   const { NeedsPerson } = await import("./cf");
   const where = `from ${input.source}, sent to ${input.base}, account ${input.cf.account}`;
   const read = await input.cf.readable();
-  const refused = Object.entries(read).filter(([, status]) => status !== null);
+  const refused = Object.entries(read).filter(([, status]) => status !== null && status !== "not served");
+  // A list the platform doesn't serve (salve hosting's Workers) is reported, never a failed credential (p0.11 row 5).
+  const notServed = Object.entries(read)
+    .filter(([, s]) => s === "not served")
+    .map(([kind]) => kind);
+  const lists = (["Workers", "D1", "Queues"] as const).filter((k) => !notServed.includes(k));
+  const unserved = notServed.length ? `; ${notServed.join(" and ")} listing not available here` : "";
   const out: CheckResult[] = [];
-  if (refused.length === Object.keys(read).length && refused.every(([, s]) => s === 401 || s === 403))
+  if (refused.length && refused.length === lists.length && refused.every(([, s]) => s === 401 || s === 403))
     out.push(fail("credentials", `the token doesn't answer for this account (${where})`));
   else if (refused.length)
     out.push(
@@ -481,7 +493,7 @@ export async function credentialsChecks(input: {
     out.push(
       pass(
         "credentials",
-        `${where}; lists Workers, D1 and Queues. Writes are unverified until the first deploy: Workers Scripts Edit, D1 Edit, Queues Edit`,
+        `${where}; lists ${lists.join(", ").replace(/, ([^,]*)$/, " and $1")}${unserved}. Writes are unverified until the first deploy: Workers Scripts Edit, D1 Edit, Queues Edit`,
       ),
     );
   try {
@@ -489,7 +501,9 @@ export async function credentialsChecks(input: {
   } catch (e) {
     // Any answer is a report: a token that can't read the subdomain fails this check, never the run (codex code r7).
     // An account without one is the owner's to choose: a handoff, not a technical failure (codex code r9).
-    if (e instanceof NeedsPerson) out.push({ ...fail("workers.dev", e.handoff), handoff: e.handoff });
+    if (e instanceof NeedsPerson && input.workersDev === false)
+      out.push(skip("workers.dev", 'none, and none needed: wrangler.jsonc says "workers_dev": false'));
+    else if (e instanceof NeedsPerson) out.push({ ...fail("workers.dev", e.handoff), handoff: e.handoff });
     else out.push(fail("workers.dev", (e as Error).message));
   }
   return out;
@@ -549,7 +563,9 @@ export async function doctorRemote(input: RemoteDoctorInput): Promise<CheckResul
     if (last.crons && JSON.stringify(crons) !== JSON.stringify(last.crons))
       problems.push(`crons are ${JSON.stringify(crons)}, recorded ${JSON.stringify(last.crons)}`);
     const settings = await input.cf.settings(names.worker);
-    if (last.settings && JSON.stringify(settings) !== JSON.stringify(last.settings))
+    // Only what was recorded: a 0.10 deployment recorded no redaction, and isn't drift for lacking it.
+    const recorded = last.settings;
+    if (recorded && (Object.keys(recorded) as (keyof typeof recorded)[]).some((k) => settings[k] !== recorded[k]))
       problems.push(`settings are ${JSON.stringify(settings)}, recorded ${JSON.stringify(last.settings)}`);
     const held = await ops.current(SCOPE);
     out.push(
@@ -560,6 +576,15 @@ export async function doctorRemote(input: RemoteDoctorInput): Promise<CheckResul
             held ? `operation ${held.op_id} (${held.kind}) holds the store at "${held.step}"` : undefined,
           ),
     );
+    // workers-dev: Wrangler enables workers.dev after a deploy lands, and a platform serving the store elsewhere
+    // refuses that (salve hosting, 400/10400), so every `wrangler deploy` would exit non-zero after landing.
+    if (readWrangler(input.cwd)?.config.workers_dev !== false && !(await input.cf.workersDevUrl(names.worker)))
+      out.push(
+        fail(
+          "workers-dev",
+          `wrangler.jsonc has "workers_dev": true, but ${names.worker} isn't served at workers.dev: on a host that serves it at its own address (salve hosting), set "workers_dev": false and commit it`,
+        ),
+      );
     // do-classes: rollback across a class change is blocked (a warning).
     const planned = (readWrangler(input.cwd)?.config.migrations ?? []) as unknown[];
     if (JSON.stringify(planned) !== JSON.stringify(last.doMigrations ?? []))

package/src/keys-save.ts

@@ -11,7 +11,7 @@ import type { DatabaseSync } from "node:sqlite";
 import { NeedsPerson } from "./cf";
 import { OLDER_KEDGE, type SessionDeps, withCliSession } from "./cli-session";
 import { DeployRefused } from "./deploy";
-import { type RefRecord, readEnvLocal, saveEnv, stateDb, withStoreLock } from "./local-state";
+import { ENV_FILE, type RefRecord, readEnvLocal, saveEnv, stateDb, withStoreLock } from "./local-state";
 import { storeRequest } from "./store-api";
 import type { StoreTarget } from "./target";
 
@@ -85,7 +85,10 @@ async function save(db: DatabaseSync, target: StoreTarget, wanted: Wanted, d: Sa
   // digest, never by a label beside it: a key with no such ref, or one for another store, would be sent
   // to the wrong store or relabelled as this one's (codex code r11, r13). So any such key, of either
   // kind, is the person's to remove before anything is saved beside it.
-  const env = readEnvLocal(d.cwd);
+  moveLocalBundle(db, d);
+  // Each store's keys in its own file (p0.10.1 §4): kedge dev's apart from Cloudflare's.
+  const envFile = target.kind === "local" ? ENV_FILE.local : ENV_FILE.production;
+  const env = readEnvLocal(d.cwd, envFile);
   const all = db.prepare("SELECT * FROM credential_ref").all() as unknown as RefRecord[];
   const foreign: string[] = [];
   for (const name of [ENV.publishable, ENV.secret]) {
@@ -104,7 +107,7 @@ async function save(db: DatabaseSync, target: StoreTarget, wanted: Wanted, d: Sa
   if (sf && !all.some((r) => r.store === store && r.storefront_id === sf)) foreign.push(ENV.storefront);
   if (foreign.length)
     throw new NeedsPerson(
-      `.env.local holds ${foreign.join(", ")} that this checkout didn't make for this store: remove ${foreign.length === 1 ? "that line" : "those lines"}, or save this store's keys in its own checkout, then run this again`,
+      `${envFile} holds ${foreign.join(", ")} that this checkout didn't make for this store: remove ${foreign.length === 1 ? "that line" : "those lines"}, or save this store's keys in its own checkout, then run this again`,
     );
   const saved = env[envName];
   if (saved && (await works(target, wanted, saved, d))) {
@@ -172,7 +175,7 @@ async function save(db: DatabaseSync, target: StoreTarget, wanted: Wanted, d: Sa
     // 4. Saved before anything else happens, then marked saved.
     const values: Record<string, string> = { [ENV.store]: store, [envName]: made.key };
     if (made.storefront_id) values[ENV.storefront] = made.storefront_id;
-    saveEnv(d.cwd, values);
+    saveEnv(d.cwd, values, envFile);
     set(ref, { state: "saved" });
     d.log(`saved ${Object.keys(values).join(", ")} to .env.local`);
     return values;
@@ -254,6 +257,48 @@ export function badOrigins(origins: readonly string[]): string[] {
   });
 }
 
+/**
+ * A 0.10.0 checkout saved `kedge dev`'s keys in `.env.local`, where they'd block
+ * Cloudflare's (p0.10.1 §4). Under the lock, before anything else, the bundle
+ * proven local moves to `.env.development.local`: each key whose digest matches
+ * a ref recorded for a `local/…` store, the storefront a local ref recorded, and
+ * a `local/…` store marker. Nothing unproven moves. The destination is written
+ * first and read back, then only names it now holds are removed from
+ * `.env.local`; a run stopped between the two finishes the removal next time.
+ * A destination already holding one of those names with another value is a handoff.
+ */
+function moveLocalBundle(db: DatabaseSync, d: SaveDeps): void {
+  const prod = readEnvLocal(d.cwd, ENV_FILE.production);
+  const refs = (db.prepare("SELECT * FROM credential_ref").all() as unknown as RefRecord[]).filter((r) =>
+    r.store.startsWith("local/"),
+  );
+  const moving: Record<string, string> = {};
+  for (const name of [ENV.publishable, ENV.secret]) {
+    const value = prod[name];
+    if (value && refs.some((r) => r.env_name === name && r.key_digest === keyDigest(value))) moving[name] = value;
+  }
+  const sf = prod[ENV.storefront];
+  if (sf && refs.some((r) => r.storefront_id === sf)) moving[ENV.storefront] = sf;
+  if (prod[ENV.store]?.startsWith("local/")) moving[ENV.store] = prod[ENV.store] as string;
+  const names = Object.keys(moving);
+  if (!names.length) return;
+  const dev = readEnvLocal(d.cwd, ENV_FILE.local);
+  const clash = names.filter((n) => dev[n] !== undefined && dev[n] !== moving[n]);
+  if (clash.length)
+    throw new NeedsPerson(
+      `${ENV_FILE.production} holds kedge dev's ${clash.join(", ")}, and ${ENV_FILE.local} holds others: keep one, remove the other line, then run this again`,
+    );
+  saveEnv(d.cwd, moving, ENV_FILE.local);
+  const landed = readEnvLocal(d.cwd, ENV_FILE.local);
+  saveEnv(
+    d.cwd,
+    {},
+    ENV_FILE.production,
+    names.filter((n) => landed[n] === moving[n]),
+  );
+  d.log(`moved kedge dev's ${names.join(", ")} from ${ENV_FILE.production} to ${ENV_FILE.local}`);
+}
+
 /**
  * Whether a saved key still does its job (§6.2): a publishable key passes the
  * storefront gate; a secret key holds its grants. Only a definite answer

package/src/local-state.ts

@@ -77,24 +77,36 @@ export function stateDb(cwd: string): DatabaseSync {
   return db;
 }
 
+/** Where a store's saved keys go (p0.10.1 §4): `kedge dev`'s apart from Cloudflare's, so neither blocks the other. */
+export const ENV_FILE = { production: ".env.local", local: ".env.development.local" } as const;
+
 /**
- * Writes `values` into `.env.local`, keeping every other line: a temporary
+ * Rewrites an env file, keeping every line it doesn't touch: `values` set
+ * (replaced in place, or added at the end) and `remove` dropped. A temporary
  * file in the same directory, mode 0600, renamed over it, so a crash leaves
  * the old file or the new one, never half of either.
  */
-export function saveEnv(cwd: string, values: Record<string, string>): void {
-  const file = join(cwd, ".env.local");
+export function saveEnv(
+  cwd: string,
+  values: Record<string, string>,
+  name: string = ENV_FILE.production,
+  remove: readonly string[] = [],
+): void {
+  const file = join(cwd, name);
   const lines = existsSync(file) ? readFileSync(file, "utf8").split("\n") : [];
   const left = new Set(Object.keys(values));
-  const out = lines.map((line) => {
-    const name = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=/.exec(line)?.[1];
-    if (!name || !(name in values)) return line;
-    left.delete(name);
-    return `${name}=${values[name]}`;
+  const drop = new Set(remove);
+  const out = lines.flatMap((line) => {
+    const key = /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=/.exec(line)?.[1];
+    if (!key) return [line];
+    if (drop.has(key)) return [];
+    if (!(key in values)) return [line];
+    left.delete(key);
+    return [`${key}=${values[key]}`];
   });
   while (out.length && out.at(-1) === "") out.pop();
-  for (const name of left) out.push(`${name}=${values[name]}`);
-  const tmp = join(cwd, `.env.local.${process.pid}.tmp`);
+  for (const key of left) out.push(`${key}=${values[key]}`);
+  const tmp = join(cwd, `${name}.${process.pid}.tmp`);
   try {
     writeFileSync(tmp, `${out.join("\n")}\n`, { mode: 0o600 });
     renameSync(tmp, file);
@@ -103,8 +115,8 @@ export function saveEnv(cwd: string, values: Record<string, string>): void {
   }
 }
 
-/** `.env.local`'s values, as the credential resolver reads them. */
-export function readEnvLocal(cwd: string): Record<string, string> {
-  const file = join(cwd, ".env.local");
+/** An env file's values (`.env.local` by default), as the credential resolver reads them. */
+export function readEnvLocal(cwd: string, name: string = ENV_FILE.production): Record<string, string> {
+  const file = join(cwd, name);
   return existsSync(file) ? (parseEnv(readFileSync(file, "utf8")) as Record<string, string>) : {};
 }