@kedge/cli 0.10.1 → 0.11.0

package/src/cf.ts

@@ -26,6 +26,8 @@ export interface Deployment {
 export interface WorkerSettings {
   logpush: boolean;
   invocationLogs: boolean | null;
+  /** `observability.redact_query_string`; null when the read doesn't say (p0.11 row 18). */
+  redactQueryString: boolean | null;
 }
 
 /** A call whose answer never came: the caller records it as an unknown outcome (§3.1). */
@@ -107,8 +109,18 @@ export interface Cloudflare {
   executeD1File(input: { database: string; databaseId: string; sql: string }): Promise<void>;
   /** The account's workers.dev subdomain; none is the person's choice to make (`NeedsPerson`). */
   workersSubdomain(): Promise<string>;
-  /** One list of each resource type a store uses: null where it answered, else the refusing status (0: no answer). */
-  readable(): Promise<Record<ResourceKind, number | null>>;
+  /**
+   * The Worker's workers.dev URL when it's served there, else null: a platform
+   * may answer an account subdomain and serve the store elsewhere (salve
+   * hosting's own domain; p0.11 row 2).
+   */
+  workersDevUrl(worker: string): Promise<string | null>;
+  /**
+   * One list of each resource type a store uses: null where it answered,
+   * "not served" where the platform refuses the route itself (10400, p0.11
+   * row 5), else the refusing status (0: no answer).
+   */
+  readable(): Promise<Record<ResourceKind, number | "not served" | null>>;
   /** The account's Logpush jobs, or null when the token can't read them. */
   logpushJobs(): Promise<{ dataset: string; enabled: boolean; fields: string[] | null }[] | null>;
   /** `wrangler versions secret put|delete`: a new version with one secret changed, not deployed. */
@@ -196,12 +208,18 @@ export function noSubdomain(account: string): NeedsPerson {
  * another. `ops` is that database's name; `preview apply` from a plan names
  * its store only once the plan is read, and `openOps` checks the same there.
  */
-export async function preflight(cf: Cloudflare, ops?: string, choice?: string): Promise<void> {
+export async function preflight(
+  cf: Cloudflare,
+  ops?: string,
+  choice?: string,
+  /** Whether the store is served at workers.dev; a store at its own domain alone needs no subdomain (codex code r3). */
+  workersDev = true,
+): Promise<void> {
   if (choice !== undefined && !isJurisdictionChoice(choice))
     throw new NeedsPerson(
       `--jurisdiction takes ${JURISDICTIONS.join(", ")} or none, not "${choice}": ${CHOOSE_JURISDICTION}`,
     );
-  await cf.workersSubdomain();
+  if (workersDev) await cf.workersSubdomain();
   if (ops === undefined) return;
   const id = await cf.findD1(ops);
   if (!id && choice === undefined) throw new NeedsPerson(CHOOSE_JURISDICTION);
@@ -237,16 +255,26 @@ export async function resolveCloudflare(
 ): Promise<CloudflareAuth> {
   if (env.CLOUDFLARE_API_TOKEN) {
     const token = env.CLOUDFLARE_API_TOKEN;
-    if (!env.CLOUDFLARE_ACCOUNT_ID) throw new NeedsPerson("set CLOUDFLARE_ACCOUNT_ID beside CLOUDFLARE_API_TOKEN");
-    sameAccount(env.CLOUDFLARE_ACCOUNT_ID, configIn(cwd));
-    return { source: "environment", account: env.CLOUDFLARE_ACCOUNT_ID, token: () => token };
+    // A platform that gives a token alone (p0.11 row 3): the one account it reaches.
+    const account =
+      env.CLOUDFLARE_ACCOUNT_ID ??
+      (await tokenAccount(env, token, fetchImpl, "set CLOUDFLARE_ACCOUNT_ID beside CLOUDFLARE_API_TOKEN"));
+    sameAccount(account, configIn(cwd));
+    return { source: "environment", account, token: () => token };
   }
   const file = join(cwd, ".env.local");
   const local = existsSync(file) ? parseEnv(readFileSync(file, "utf8")) : {};
   if (local.CLOUDFLARE_API_TOKEN) {
     const token = local.CLOUDFLARE_API_TOKEN;
-    const account = env.CLOUDFLARE_ACCOUNT_ID ?? local.CLOUDFLARE_ACCOUNT_ID;
-    if (!account) throw new NeedsPerson("add CLOUDFLARE_ACCOUNT_ID to .env.local beside CLOUDFLARE_API_TOKEN");
+    const account =
+      env.CLOUDFLARE_ACCOUNT_ID ??
+      local.CLOUDFLARE_ACCOUNT_ID ??
+      (await tokenAccount(
+        env,
+        token,
+        fetchImpl,
+        "add CLOUDFLARE_ACCOUNT_ID to .env.local beside CLOUDFLARE_API_TOKEN",
+      ));
     sameAccount(account, configIn(cwd));
     return { source: ".env.local", account, token: () => token };
   }
@@ -320,6 +348,25 @@ function wranglerLoginToken(env: NodeJS.ProcessEnv, wranglerEntry: string): stri
   }
 }
 
+/**
+ * The one account an API token reaches (`GET /accounts`, which a platform like
+ * salve answers with its stand-in): none or several is the person's to say.
+ */
+async function tokenAccount(
+  env: NodeJS.ProcessEnv,
+  token: string,
+  fetchImpl: typeof fetch,
+  ask: string,
+): Promise<string> {
+  const res = await fetchImpl(`${cloudflareBase(env)}/accounts?per_page=50`, {
+    headers: { authorization: `Bearer ${token}` },
+  }).catch(() => null);
+  const data = (await res?.json().catch(() => ({}))) as { result?: { id?: string }[] } | undefined;
+  const ids = (data?.result ?? []).map((a) => a.id).filter((id): id is string => !!id);
+  if (ids.length === 1) return ids[0] as string;
+  throw new NeedsPerson(ask);
+}
+
 /** The one account a token can reach; more than one is the person's choice. */
 async function onlyAccount(env: NodeJS.ProcessEnv, token: string, fetchImpl: typeof fetch): Promise<string> {
   const res = await fetchImpl(`${cloudflareBase(env)}/memberships?per_page=50`, {
@@ -357,6 +404,11 @@ export async function cloudflareFor(
   return restCloudflare(env, fetchImpl, wranglerEntry, await resolveCloudflare(env, cwd, fetchImpl, wranglerEntry));
 }
 
+/** A platform's refusal of a route or key, as salve's broker answers it (p0.11 §6): never "not found". */
+export const PLATFORM_REFUSED = 10400;
+/** Attempts of one call refused with proof it ran nothing, before the refusal is the answer. */
+const RETRIES = 5;
+
 export function restCloudflare(
   env: NodeJS.ProcessEnv,
   fetchImpl: typeof fetch = fetch,
@@ -364,6 +416,8 @@ export function restCloudflare(
   wranglerEntry: string = wranglerBin(),
   /** Resolved credentials; without them, the environment's two variables. */
   auth?: CloudflareAuth,
+  /** The wait before a retry; tests make it instant. */
+  sleep: (ms: number) => Promise<void> = (ms) => new Promise((r) => setTimeout(r, ms)),
 ): Cloudflare {
   const resolved =
     auth ??
@@ -377,33 +431,71 @@ export function restCloudflare(
   const apiBase = cloudflareBase(env);
   const base = `${apiBase}/accounts/${account}`;
 
-  async function call<T>(what: string, method: string, path: string, body?: unknown, ok404 = false): Promise<T | null> {
-    // Before the network's catch: a credential that's gone is a handoff, not an unknown outcome.
-    const bearer = resolved.token();
+  async function call<T>(
+    what: string,
+    method: string,
+    path: string,
+    body?: unknown,
+    ok404 = false,
+    /** One upstream call: Cloudflare's 429 blocks it whole. Activation and a Worker's deletion are several (p0.11 row 16). */
+    oneCall = true,
+  ): Promise<T | null> {
     let res: Response;
-    try {
-      res = await fetchImpl(`${base}${path}`, {
-        method,
-        headers: {
-          authorization: `Bearer ${bearer}`,
-          ...(body === undefined ? {} : { "content-type": "application/json" }),
-        },
-        ...(body === undefined ? {} : { body: JSON.stringify(body) }),
-      });
-    } catch {
-      throw new UnknownOutcome(what);
+    let notRun = false;
+    for (let attempt = 1; ; attempt++) {
+      // Before the network's catch: a credential that's gone is a handoff, not an unknown outcome.
+      const bearer = resolved.token();
+      try {
+        res = await fetchImpl(`${base}${path}`, {
+          method,
+          headers: {
+            authorization: `Bearer ${bearer}`,
+            ...(body === undefined ? {} : { "content-type": "application/json" }),
+          },
+          ...(body === undefined ? {} : { body: JSON.stringify(body) }),
+        });
+      } catch {
+        throw new UnknownOutcome(what);
+      }
+      // A refusal proven to have run nothing is sent again after the wait the platform names
+      // (p0.11 row 16): salve marks its own `x-salve-not-run: 1`; Cloudflare's 429 blocks a
+      // one-call request whole; a 503 proves nothing for a write, which can commit and then fail.
+      notRun =
+        res.headers.get("x-salve-not-run") === "1" ||
+        (res.status === 429 && oneCall) ||
+        (res.status === 503 && method === "GET");
+      if (!((res.status === 429 || res.status === 503) && notRun) || attempt >= RETRIES) break;
+      const after = Number(res.headers.get("retry-after"));
+      await sleep(Math.min(Number.isFinite(after) && after > 0 ? after : 5, 60) * 1000);
+    }
+    if (ok404 && res.status === 404) {
+      // A platform's refusal of the route (10400) isn't absence: reading it so would lose a live resource.
+      const refused = (await res.json().catch(() => null)) as Envelope<T> | null;
+      // Absence is a readable envelope saying so; an HTML or plain-text 404 from something in front of the
+      // API says nothing, and reading it as absent would let a teardown skip a live Worker (codex code r4).
+      if (refused?.success !== false || !Array.isArray(refused.errors))
+        throw new CloudflareError(`${what} (answered 404, unreadable)`, 404, []);
+      if (!refused.errors.some((e) => e.code === PLATFORM_REFUSED)) return null;
+      throw new CloudflareError(
+        what,
+        404,
+        refused.errors.map((e) => e.code),
+        refused.errors.map((e) => e.message ?? "").filter(Boolean),
+      );
     }
-    if (ok404 && res.status === 404) return null;
     let data: Envelope<T>;
     try {
       data = (await res.json()) as Envelope<T>;
     } catch {
       // A body we can't read isn't an answer: a lookup reading it as "absent" would forget a live resource.
-      if (method === "GET") throw new CloudflareError(what, res.status, []);
+      // A write is unknown, unless the platform proved it ran nothing (codex code r2).
+      if (method === "GET" || (notRun && !res.ok)) throw new CloudflareError(what, res.status, []);
       throw new UnknownOutcome(what);
     }
     if (!res.ok || data.success !== true) {
-      if (res.status >= 500 && method !== "GET") throw new UnknownOutcome(what);
+      // A write refused without proof it ran nothing may have taken effect: a 5xx, or a 429 from inside a
+      // write of several steps (salve's activation), stays unknown for the caller's intent to reconcile.
+      if (method !== "GET" && !notRun && (res.status >= 500 || res.status === 429)) throw new UnknownOutcome(what);
       throw new CloudflareError(
         what,
         res.status,
@@ -415,6 +507,39 @@ export function restCloudflare(
   }
   const get = <T>(what: string, path: string, ok404 = false) => call<T>(what, "GET", path, undefined, ok404);
 
+  /**
+   * The Worker's settings, read before and after a deploy changes them. A
+   * platform that doesn't serve the read stops the deploy, saying so: Kedge
+   * never infers invocation logs are off (p0.11 row 4).
+   */
+  async function getSettings<T>(what: string, path: string): Promise<T | null> {
+    try {
+      return await get<T>(what, path);
+    } catch (e) {
+      if (e instanceof CloudflareError && e.codes.includes(PLATFORM_REFUSED))
+        throw new CloudflareError(
+          `${what}: this platform doesn't serve the Worker's settings (GET …/script-settings), so Kedge can't confirm its logs keep customer data out, and stops`,
+          e.status,
+          e.codes,
+          e.detail,
+        );
+      throw e;
+    }
+  }
+
+  async function subdomain(): Promise<string> {
+    let r: { subdomain: string } | null;
+    try {
+      r = await get<{ subdomain: string }>("workers.dev subdomain", "/workers/subdomain");
+    } catch (e) {
+      // 10007 is Cloudflare's "no subdomain", as Wrangler reads it (wrangler-dist/cli.js:164937, 4.152.0).
+      if (e instanceof CloudflareError && e.codes.includes(10007)) throw noSubdomain(account);
+      throw e;
+    }
+    if (!r?.subdomain) throw noSubdomain(account);
+    return r.subdomain;
+  }
+
   async function all<T>(what: string, path: string): Promise<T[]> {
     const out: T[] = [];
     for (let page = 1; page <= 50; page++) {
@@ -490,10 +615,20 @@ export function restCloudflare(
     },
     async createD1(name, jurisdiction) {
       // `jurisdiction` in the create body, the only time it can be set (D1 data location, cited above).
-      const r = await call<{ uuid: string }>(`create D1 ${name}`, "POST", "/d1/database", {
-        name,
-        ...(jurisdiction ? { jurisdiction } : {}),
-      });
+      let r: { uuid: string } | null;
+      try {
+        r = await call<{ uuid: string }>(`create D1 ${name}`, "POST", "/d1/database", {
+          name,
+          ...(jurisdiction ? { jurisdiction } : {}),
+        });
+      } catch (e) {
+        // A platform's refusal made nothing; the first create is <store>-ops's, so nothing else exists yet (p0.11 row 7).
+        if (jurisdiction && e instanceof CloudflareError && e.codes.includes(PLATFORM_REFUSED))
+          throw new NeedsPerson(
+            `this platform doesn't take a jurisdiction for a database (${e.detail.join("; ").slice(0, 200) || "refused"}), so a store's data here is unrestricted: run this again with --jurisdiction none`,
+          );
+        throw e;
+      }
       if (!r?.uuid) throw new UnknownOutcome(`create D1 ${name}`);
       return r.uuid;
     },
@@ -525,10 +660,16 @@ export function restCloudflare(
       await call(`delete queue ${id}`, "DELETE", `/queues/${id}`, undefined, true);
     },
     async consumers(queueId) {
-      const r = await get<{ consumer_id: string; script?: string; service?: string }[]>(
-        `consumers of ${queueId}`,
-        `/queues/${queueId}/consumers`,
-      );
+      type Consumer = { consumer_id: string; script?: string; service?: string };
+      let r: Consumer[] | null;
+      try {
+        r = await get<Consumer[]>(`consumers of ${queueId}`, `/queues/${queueId}/consumers`);
+      } catch (e) {
+        // A platform that doesn't serve the list (salve) still answers the queue, which carries its consumers
+        // (https://developers.cloudflare.com/api/resources/queues/methods/get/; p0.11 row 14).
+        if (!(e instanceof CloudflareError && e.codes.includes(PLATFORM_REFUSED))) throw e;
+        r = (await get<{ consumers?: Consumer[] }>(`queue ${queueId}`, `/queues/${queueId}`))?.consumers ?? [];
+      }
       return (r ?? []).map((c) => ({ id: c.consumer_id, script: c.script ?? c.service ?? "" }));
     },
     async deleteConsumer(queueId, consumerId) {
@@ -544,7 +685,15 @@ export function restCloudflare(
       return (await get(`Worker ${name}`, `/workers/scripts/${encodeURIComponent(name)}/settings`, true)) !== null;
     },
     async deleteWorker(name) {
-      await call(`delete Worker ${name}`, "DELETE", `/workers/scripts/${encodeURIComponent(name)}`, undefined, true);
+      // Several steps on a platform that deletes in stages (salve): never replayed on a 429 (p0.11 row 16).
+      await call(
+        `delete Worker ${name}`,
+        "DELETE",
+        `/workers/scripts/${encodeURIComponent(name)}`,
+        undefined,
+        true,
+        false,
+      );
     },
     async versions(name) {
       const r = await get<{
@@ -578,6 +727,9 @@ export function restCloudflare(
           // Only `workers/message`: Cloudflare refuses `workers/triggered_by` here (10210, research/26).
           annotations: { "workers/message": message },
         },
+        false,
+        // salve's activation re-uploads, then deletes dropped secrets: a 429 there can follow a step that landed.
+        false,
       );
     },
     async schedules(name) {
@@ -596,16 +748,24 @@ export function restCloudflare(
       );
     },
     async settings(name) {
-      const r = await get<{ logpush?: boolean; observability?: { logs?: { invocation_logs?: boolean } } }>(
-        `settings of ${name}`,
-        `/workers/scripts/${encodeURIComponent(name)}/script-settings`,
-      );
-      return { logpush: r?.logpush ?? false, invocationLogs: r?.observability?.logs?.invocation_logs ?? null };
+      const r = await getSettings<{
+        logpush?: boolean;
+        observability?: { redact_query_string?: boolean; logs?: { invocation_logs?: boolean } };
+      }>(`settings of ${name}`, `/workers/scripts/${encodeURIComponent(name)}/script-settings`);
+      return {
+        logpush: r?.logpush ?? false,
+        invocationLogs: r?.observability?.logs?.invocation_logs ?? null,
+        redactQueryString: r?.observability?.redact_query_string ?? null,
+      };
     },
     async patchSettings(name, s) {
       await call(`settings of ${name}`, "PATCH", `/workers/scripts/${encodeURIComponent(name)}/script-settings`, {
         logpush: s.logpush,
-        observability: { enabled: true, logs: { enabled: true, invocation_logs: s.invocationLogs ?? false } },
+        observability: {
+          enabled: true,
+          redact_query_string: s.redactQueryString ?? true,
+          logs: { enabled: true, invocation_logs: s.invocationLogs ?? false },
+        },
       });
     },
     async secretNames(name) {
@@ -662,17 +822,22 @@ export function restCloudflare(
         rmSync(dir, { recursive: true, force: true });
       }
     },
-    async workersSubdomain() {
-      let r: { subdomain: string } | null;
+    workersSubdomain: subdomain,
+    async workersDevUrl(worker) {
+      // The Worker's own flag (https://developers.cloudflare.com/api/resources/workers/subresources/scripts/subresources/subdomain/methods/get/).
+      let r: { enabled?: boolean } | null;
       try {
-        r = await get<{ subdomain: string }>("workers.dev subdomain", "/workers/subdomain");
+        r = await get<{ enabled?: boolean }>(
+          `workers.dev route of ${worker}`,
+          `/workers/scripts/${encodeURIComponent(worker)}/subdomain`,
+          true,
+        );
       } catch (e) {
-        // 10007 is Cloudflare's "no subdomain", as Wrangler reads it (wrangler-dist/cli.js:164937, 4.152.0).
-        if (e instanceof CloudflareError && e.codes.includes(10007)) throw noSubdomain(account);
+        // A platform that doesn't serve the read doesn't serve the store at workers.dev either.
+        if (e instanceof CloudflareError && e.codes.includes(PLATFORM_REFUSED)) return null;
         throw e;
       }
-      if (!r?.subdomain) throw noSubdomain(account);
-      return r.subdomain;
+      return r?.enabled === true ? `https://${worker}.${await subdomain()}.workers.dev` : null;
     },
     async d1Jurisdiction(id) {
       // The database's own record (https://developers.cloudflare.com/api/resources/d1/subresources/database/methods/get/);
@@ -683,7 +848,7 @@ export function restCloudflare(
       return j;
     },
     async readable() {
-      const out: Record<ResourceKind, number | null> = { Workers: null, D1: null, Queues: null };
+      const out: Record<ResourceKind, number | "not served" | null> = { Workers: null, D1: null, Queues: null };
       const paths: [ResourceKind, string][] = [
         ["Workers", "/workers/scripts"],
         ["D1", "/d1/database"],
@@ -693,7 +858,8 @@ export function restCloudflare(
         try {
           await get(`list ${kind}`, path);
         } catch (e) {
-          if (e instanceof CloudflareError) out[kind] = e.status;
+          // A platform that doesn't serve a list says nothing about the token.
+          if (e instanceof CloudflareError) out[kind] = e.codes.includes(PLATFORM_REFUSED) ? "not served" : e.status;
           else if (e instanceof UnknownOutcome) out[kind] = 0;
           else throw e;
         }

package/src/cli-session.ts

@@ -14,6 +14,8 @@ export const OLDER_KEDGE = "this store runs a Kedge older than this CLI, without
 
 export interface SessionDeps {
   cloudflare: () => Promise<Cloudflare>;
+  /** The proof's request (p0.11 §3). */
+  fetch?: typeof fetch;
   /** `wrangler d1 execute --local` in the store's directory: `kedge dev`'s database. */
   executeLocal: (b: CliBatch) => number;
   now?: () => number;
@@ -28,8 +30,11 @@ async function write(target: StoreTarget, b: CliBatch, d: SessionDeps): Promise<
   try {
     await cf.executeD1File({ database: target.database.name, databaseId: target.database.id as string, sql: b.sql });
   } catch (e) {
-    // A database from before P0.10 has no table to hold it.
-    if (e instanceof UnknownOutcome && /no such table: cli_session/.test(e.message))
+    // A database from before P0.10 has no table to hold it, and one from before 0.11 no origin (codex code r6).
+    if (
+      e instanceof UnknownOutcome &&
+      /no such table: cli_session|table cli_session has no column named origin/.test(e.message)
+    )
       throw new DeployRefused(OLDER_KEDGE);
     throw e;
   }
@@ -43,7 +48,8 @@ export async function withCliSession<T>(
   work: (auth: Record<string, string>) => Promise<T>,
 ): Promise<T> {
   const now = d.now ?? Date.now;
-  const s = await cliSessionSql(grants, now());
+  // Bound to the origin it's sent to, so it reads nothing anywhere else (p0.11 §3).
+  const s = await cliSessionSql(grants, now(), { origin: target.url });
   await write(target, s, d);
   try {
     return await work({ authorization: `Bearer ${s.token}` });
@@ -54,4 +60,37 @@ export async function withCliSession<T>(
 }
 
 /** Whether a request's credential was a CLI session, so a 401 can be read as an older Worker. */
-export const isCliSession = (auth: Record<string, string>) => auth.authorization?.startsWith("Bearer kcs_") === true;
+export const isCliSession = (auth: Record<string, string>) =>
+  auth.authorization?.startsWith("Bearer kcs_") === true || auth.authorization?.startsWith("Bearer kcb_") === true;
+
+/**
+ * Proves a URL the person gave is this store (p0.11 §3), before anything else
+ * goes there: a `meta:read` session bound to its origin, written to this
+ * store's database, then `GET /admin/meta/me`. Only this store's database holds
+ * the session, and only a request reaching the store at that origin unlocks it,
+ * so a `200` naming the session's own id proves both; a relay in front of the
+ * real store reaches it at the store's origin and is refused. A Worker before
+ * 0.11 refuses the `kcb_` token, so it fails too. No redirect is followed.
+ */
+export async function proveTarget(target: StoreTarget, d: SessionDeps): Promise<void> {
+  const now = d.now ?? Date.now;
+  const s = await cliSessionSql(["meta:read"], now(), { origin: target.url });
+  await write(target, s, d);
+  let echoed: unknown = null;
+  try {
+    const r = await (d.fetch ?? fetch)(new URL("/admin/meta/me", target.url), {
+      headers: { authorization: `Bearer ${s.token}` },
+      redirect: "manual",
+    });
+    if (r.status === 200) echoed = ((await r.json()) as { principal?: { kind?: string; id?: unknown } }).principal;
+  } catch {
+    // No answer, or no JSON: not proved.
+  } finally {
+    await write(target, cliSessionEndSql(s.id, now()), d).catch(() => undefined);
+  }
+  const p = echoed as { kind?: string; id?: unknown } | null;
+  if (p?.kind !== "cli" || p.id !== s.id)
+    throw new DeployRefused(
+      `${target.url} isn't this store, or runs a Kedge older than 0.11 (kedge deploy first): nothing else was sent there`,
+    );
+}

package/src/commands.ts

@@ -21,7 +21,7 @@ import {
   UnknownOutcome,
   wranglerBin,
 } from "./cf";
-import { isCliSession, OLDER_KEDGE, type SessionDeps, withCliSession } from "./cli-session";
+import { isCliSession, OLDER_KEDGE, proveTarget, type SessionDeps, withCliSession } from "./cli-session";
 import { ComposeError, compose, type Lock } from "./compose";
 import { type Executor, wranglerExecute } from "./d1-batch";
 import {
@@ -268,7 +268,7 @@ export async function deployCommand(args: readonly string[], d: CommandDeps): Pr
         );
       // Adoption takes the store's jurisdiction from what exists, so it asks nothing; a choice is checked against it.
       const choice = flag(args, "--jurisdiction");
-      await preflight(cf);
+      await preflight(cf, undefined, undefined, readWrangler(d.cwd)?.config.workers_dev !== false);
       if (choice !== undefined && !isJurisdictionChoice(choice))
         throw new DeployRefused(`--jurisdiction takes eu, us, fedramp or none, not "${choice}"`);
       return dep.adoptExisting(
@@ -280,7 +280,7 @@ export async function deployCommand(args: readonly string[], d: CommandDeps): Pr
     const window = windowOf(flag(args, "--maintenance-window"));
     const takeOver = flag(args, "--take-over");
     const choice = flag(args, "--jurisdiction");
-    await preflight(cf, dep.names.ops, choice);
+    await preflight(cf, dep.names.ops, choice, readWrangler(d.cwd)?.config.workers_dev !== false);
     await dep.deploy({
       ...(choice ? { jurisdiction: choice as JurisdictionChoice } : {}),
       vars: varsOf(args),
@@ -291,12 +291,18 @@ export async function deployCommand(args: readonly string[], d: CommandDeps): Pr
       ...(window ? { window } : {}),
       ...(takeOver ? { takeOver } : {}),
     });
-    // From the account's subdomain now, never a recorded URL: its owner can change it (p0.10 §4).
-    const url = `https://${dep.names.worker}.${await cf.workersSubdomain()}.workers.dev`;
-    return { worker: dep.names.worker, account: cf.account, url, admin: adminUrl(d.cwd, url) };
+    // From the account's subdomain now, never a recorded URL: its owner can change it (p0.10 §4). Only where the
+    // Worker is served there: a platform with its own domain answers an account subdomain too (p0.11 row 2).
+    const url = await cf.workersDevUrl(dep.names.worker);
+    if (!url) (d.log ?? console.log)(PLATFORM_URL);
+    return { worker: dep.names.worker, account: cf.account, url, admin: url ? adminUrl(d.cwd, url) : null };
   });
 }
 
+/** What deploy says when the store isn't at workers.dev: its platform knows where it is. */
+export const PLATFORM_URL =
+  "this store isn't served at workers.dev: its address is the one its host gives (salve hosting: hosting_status); use that https URL as --url";
+
 /** The admin's address, when the store serves it (p0.9 §3.3); null when it serves none. */
 function adminUrl(cwd: string, url: string): string | null {
   return readWrangler(cwd)?.config.assets ? `${url}/app/` : null;
@@ -439,11 +445,18 @@ const SAMPLE_APPAREL = [
 const isLocal = (url: string) => ["localhost", "127.0.0.1", "[::1]"].includes(new URL(url).hostname);
 
 /** The store a URL is, for a CLI session or a check: what `resolveTarget` says, credentials resolved as for any remote command. */
-const targetOf = (url: string, d: CommandDeps) => resolveTarget(url, d.cwd, () => cloudflareOf(d));
+const unprovedOf = (url: string, d: CommandDeps) => resolveTarget(url, d.cwd, () => cloudflareOf(d));
+const targetOf = async (url: string, d: CommandDeps) => {
+  const t = await unprovedOf(url, d);
+  // A URL the CLI didn't derive is proved before anything else goes there, a saved key included (p0.11 §3).
+  if (t?.proof) await proveTarget(t, sessionDeps(d));
+  return t;
+};
 
 /** How a CLI session's row is written (p0.10 §6.2). */
 const sessionDeps = (d: CommandDeps): SessionDeps => ({
   cloudflare: () => cloudflareOf(d),
+  fetch: d.fetch ?? fetch,
   executeLocal: (b) => (d.execute ?? wranglerExecute)(b, { database: "DB", remote: false, cwd: d.cwd }),
 });
 
@@ -495,6 +508,7 @@ function authOf(args: readonly string[]): Record<string, string> {
 async function signOutBearer(url: string, token: string, d: CommandDeps): Promise<void> {
   await (d.fetch ?? fetch)(new URL("/auth/admin/sign-out", url), {
     method: "POST",
+    redirect: "manual",
     headers: { authorization: `Bearer ${token}` },
   }).catch(() => undefined);
 }
@@ -569,7 +583,8 @@ export async function seedCommand(args: readonly string[], d: CommandDeps): Prom
     // customers would see sample products, so it's the owner's call (p0.10 §5).
     let target: StoreTarget | null = null;
     if (!isLocal(url) && !args.includes("--live")) {
-      target = await targetOf(url, d);
+      // Only a preview goes on from here, and a preview's origin is derived, never proved: anything else is a handoff.
+      target = await unprovedOf(url, d);
       if (target?.kind !== "preview")
         throw new NeedsPerson(
           `${url} isn't local or a preview this store knows: sample products on a live store are for its owner to allow; with their yes, run this again with --live`,
@@ -596,9 +611,11 @@ export async function smokeCommand(args: readonly string[], d: CommandDeps): Pro
     const name = flag(args, "--run") ?? "first";
     if (!/^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/.test(name))
       throw new DeployRefused("--run takes a name of letters, digits, - and _, up to 64");
-    const target = await targetOf(url, d);
+    // The live store's handoff comes before any proof: nothing goes to a store its owner hasn't allowed.
+    const target = await unprovedOf(url, d);
     if (!target) throw new DeployRefused(`${url} isn't a store this checkout knows: smoke runs only on its own stores`);
     needsLive(target, args.includes("--live"));
+    if (target.proof) await proveTarget(target, sessionDeps(d));
     return smoke(target, name, {
       cwd: d.cwd,
       fetch: d.fetch ?? fetch,