@moinulmoin/eden 0.1.4 → 0.2.0

package/dist/eve-control-plane.js

@@ -9,7 +9,7 @@ import { fileURLToPath, } from "node:url";
 import { promisify, } from "node:util";
 import { EveCliError, } from "./eve.js";
 import { buildEveProjectSnapshot, createDockerEveProjectBuilder, revalidateEveProjectCandidateInputs, EvePackagingError, } from "./eve-packaging.js";
-import { buildEveRuntimeImage, revalidateEveRuntimeCandidate, validateEveHostRequirements, } from "./eve-runtime-image.js";
+import { buildEveRuntimeImage, discardEveRuntimeImage, revalidateEveRuntimeCandidate, validateEveHostRequirements, } from "./eve-runtime-image.js";
 import { EveRuntimeConfigError, prepareEveRuntimeInjection, redactEveRuntimeOutput, } from "./eve-runtime-config.js";
 const execFileAsync = promisify(execFile);
 const require = createRequire(import.meta.url);
@@ -29,6 +29,8 @@ export const DEFAULT_EVE_NODE_IMAGE = Object.freeze({
     reference: "node:24.17.0-bookworm-slim",
     digest: "sha256:862263c612aa437e3037674b85419622a9d93bff80aa1eee5398dfe686375532",
 });
+/** The single tag Eden pushes to the managed Cloudflare registry per generation. */
+const EVE_REGISTRY_IMAGE_TAG = "candidate";
 function safeText(value) {
     return redactEveRuntimeOutput(value)
         .replace(/(?:^|[\s"'=])(?:Bearer|Token)\s+\S+/giu, "$1[redacted]")
@@ -73,6 +75,113 @@ function blockedAfterFailure(id, message) {
 function allChecksClear(checks) {
     return checks.every((value) => value.status === "passed" || value.status === "skipped");
 }
+/** True when the caller asked for the human progress/summary output. */
+function humanOutput(options) {
+    return options.outputFormat === "human";
+}
+function emitLine(options, line) {
+    (options.stdout ?? (() => undefined))(redactEveRuntimeOutput(line));
+}
+/** Short stage markers so a multi-minute run shows what it is doing. */
+function eveProgress(options, stage) {
+    if (humanOutput(options))
+        emitLine(options, `... ${stage}`);
+}
+function eveCheckLines(checks) {
+    const lines = [];
+    for (const value of checks) {
+        const glyph = value.status === "passed"
+            ? "✓"
+            : value.status === "skipped"
+                ? "-"
+                : "✗";
+        lines.push(`${glyph} ${value.id} — ${value.message}`);
+        if ((value.status === "failed" || value.status === "blocked") &&
+            value.remediation !== undefined) {
+            lines.push(`  → ${value.remediation}`);
+        }
+    }
+    return lines;
+}
+function formatEveElapsed(startedAt) {
+    const elapsed = (Date.now() - startedAt) / 1000;
+    return `${elapsed.toFixed(elapsed < 10 ? 1 : 0)}s`;
+}
+/**
+ * Human summary lines for a preflight or deploy result: every check with a
+ * status glyph, then a compact tail with the outcome.
+ */
+function humanEveResultLines(result, startedAt, eveVersion) {
+    const lines = [...eveCheckLines(result.checks)];
+    const elapsed = formatEveElapsed(startedAt);
+    const commandLabel = result.command === "eve deploy" ? "deploy" : "preflight";
+    if (result.ok) {
+        if (result.command === "eve deploy") {
+            const url = result.deployment?.stableWorkersDevOrigin;
+            lines.push("", `✓ deployed ${result.name} (${result.environment})` +
+                (eveVersion === undefined ? "" : ` · eve ${eveVersion}`));
+            if (url !== undefined)
+                lines.push(url);
+            lines.push(`done in ${elapsed}`);
+        }
+        else {
+            lines.push("", `✓ ${result.name} (${result.environment}) — preflight passed in ${elapsed}`);
+        }
+        return lines;
+    }
+    const firstFailure = result.checks.find((value) => value.status === "failed" || value.status === "blocked");
+    if (result.deployment !== undefined) {
+        lines.push("", `✗ ${commandLabel} ${result.deployment.status}`, `  → ${result.deployment.status === "indeterminate"
+            ? "The outcome is indeterminate; inspect the retained ownership evidence before retrying the same exact target."
+            : result.deployment.status === "deployed"
+                ? "The deployment is live; only local runtime-image cleanup failed, so do not retry the deployment."
+                : "The deployment failed before promotion; the exact target was not claimed."}`);
+    }
+    else if (firstFailure !== undefined) {
+        lines.push("", `✗ ${commandLabel} failed — first failing check: ${firstFailure.id}`);
+    }
+    else {
+        lines.push("", `✗ ${commandLabel} failed`);
+    }
+    lines.push(`stopped after ${elapsed}`);
+    return lines;
+}
+function emitEveResult(options, result, startedAt, eveVersion) {
+    if (humanOutput(options)) {
+        for (const line of humanEveResultLines(result, startedAt, eveVersion)) {
+            emitLine(options, line);
+        }
+        return;
+    }
+    emitLine(options, JSON.stringify(result));
+}
+/**
+ * Human summary lines for a destroy outcome: removed resources, anything
+ * retained, and the outcome tail.
+ */
+function humanEveDestroyLines(outcome, startedAt) {
+    const lines = [...eveCheckLines(outcome.checks)];
+    const elapsed = formatEveElapsed(startedAt);
+    if (outcome.ok) {
+        lines.push("", outcome.status === "absent"
+            ? `✓ ${outcome.name} (${outcome.environment}) is already absent — nothing removed`
+            : `✓ destroyed ${outcome.name} (${outcome.environment}) in ${elapsed}`, "  retained: local deployment records under .eden/eve-deploy");
+        return lines;
+    }
+    const firstFailure = outcome.checks.find((value) => value.status === "failed" || value.status === "blocked");
+    lines.push("", `✗ destroy ${outcome.name} ${outcome.status}` +
+        (firstFailure === undefined ? "" : ` — first failing check: ${firstFailure.id}`));
+    return lines;
+}
+function emitEveDestroyOutcome(options, outcome, startedAt) {
+    if (humanOutput(options)) {
+        for (const line of humanEveDestroyLines(outcome, startedAt)) {
+            emitLine(options, line);
+        }
+        return;
+    }
+    emitLine(options, JSON.stringify(outcome));
+}
 function runtimeConfigExclusion(config) {
     if (config === undefined)
         return undefined;
@@ -1018,12 +1127,13 @@ async function runEveDeployment(request, options, collected) {
         }
     }
     else {
+        eveProgress(options, "pushing container image to the Cloudflare registry");
         const localImageReference = runtimeEvidence.imageReference;
         if (localImageReference === undefined || localImageReference.length === 0) {
             throw deploymentFailure("EVE_IMAGE_IDENTITY_UNAVAILABLE", "The deploy candidate did not return an exact local image handle for publication.");
         }
         const imageRepository = `eden-eve-${targetKey}-${candidate.generationId}`;
-        const imageTag = `${imageRepository}:candidate`;
+        const imageTag = `${imageRepository}:${EVE_REGISTRY_IMAGE_TAG}`;
         const targetImageReference = `registry.cloudflare.com/${accountId}/${imageRepository}@${imageDigest}`;
         const imagePublication = await (options.publishImage ??
             defaultImagePublicationRunner)({
@@ -1062,6 +1172,7 @@ async function runEveDeployment(request, options, collected) {
     }
     let runtimeInjection;
     if (collected.runtimeConfig !== undefined) {
+        eveProgress(options, "registering runtime variables");
         try {
             runtimeInjection = await prepareEveRuntimeInjection(collected.runtimeConfig, {
                 mode: "deploy",
@@ -1143,6 +1254,7 @@ async function runEveDeployment(request, options, collected) {
     };
     let publication;
     try {
+        eveProgress(options, "publishing Worker and Container application");
         publication = await (options.publish ?? defaultPublicationRunner())(publicationRequest);
     }
     catch {
@@ -1217,6 +1329,7 @@ async function runEveDeployment(request, options, collected) {
     }
     let health;
     try {
+        eveProgress(options, `verifying health at ${stableWorkersDevOrigin}`);
         health = await (options.health ?? defaultHealthRunner())({
             identity,
             origin: stableWorkersDevOrigin,
@@ -1341,15 +1454,44 @@ async function runEveDeployment(request, options, collected) {
     });
     await promoteEveTargetPointer(join(request.projectRoot, ".eden", "eve-deploy"), targetKey, candidate.generationRoot);
     await options.afterPromotion?.();
+    let runtimeImageCleanup;
+    if (runtimeEvidence.cleanup.imageRetained) {
+        if (options.retainRuntimeImage === true) {
+            runtimeImageCleanup = check("VAL-CROSS-004", "skipped", "The exact local runtime image was intentionally retained by the programmatic caller.");
+        }
+        else {
+            let discarded = false;
+            try {
+                discarded = await (options.discardRuntimeImage ??
+                    discardEveRuntimeImage)({
+                    imageId: imageDigest,
+                    generationId: candidate.generationId,
+                    generationRoot: candidate.generationRoot,
+                });
+            }
+            catch {
+                discarded = false;
+            }
+            runtimeImageCleanup = discarded
+                ? check("VAL-CROSS-004", "passed", "The exact local runtime image and its publication tags were removed after the healthy deployment was promoted.")
+                : check("VAL-CROSS-004", "failed", "The remote deployment is healthy, but exact local runtime-image cleanup could not be verified.", `Remove only the recorded image ${imageDigest}; do not retry or run broad Docker cleanup.`);
+        }
+    }
     return {
         ...collected.result,
-        ok: true,
+        ok: runtimeImageCleanup?.status !== "failed",
+        ...(runtimeImageCleanup === undefined
+            ? {}
+            : { checks: [...collected.result.checks, runtimeImageCleanup] }),
         deployment: deploymentMetadata(identity, targetKey, "deployed"),
     };
 }
 async function collectEvePreflight(request, options) {
     let runtimeConfig;
     const checks = [];
+    if (request.envFile !== undefined) {
+        eveProgress(options, "validating environment file");
+    }
     try {
         if (request.envFile === undefined) {
             checks.push(check("VAL-SEC-001", "skipped", "No explicit --env-file was supplied; no implicit project environment source was read."), check("VAL-SEC-002", "skipped", "No explicit runtime names were supplied; reserved host-name validation was not needed."));
@@ -1378,6 +1520,7 @@ async function collectEvePreflight(request, options) {
             runtimeConfig,
         };
     }
+    eveProgress(options, "packaging project — snapshot, frozen install, eve build");
     const nodeImage = options.nodeImage ?? DEFAULT_EVE_NODE_IMAGE;
     const artifactRoot = options.artifactRoot ??
         join(request.projectRoot, ".eden", "eve-deploy", "generations", `preflight-${randomUUID()}`);
@@ -1474,6 +1617,7 @@ async function collectEvePreflight(request, options) {
     let cloudflare;
     let publicOrigin;
     if (request.command === "deploy") {
+        eveProgress(options, "checking Cloudflare access and exact target");
         try {
             cloudflare = await readEveCloudflareTarget({
                 projectId: packaging.project?.projectId ?? "unknown-project",
@@ -1547,6 +1691,7 @@ async function collectEvePreflight(request, options) {
     let runtimeEvidence;
     let runtimeInjection;
     if (hostRequirements !== undefined && hostRequirementsValid) {
+        eveProgress(options, "building linux/amd64 runtime image, booting eve, checking health");
         try {
             if (runtimeConfig !== undefined && request.command === "preflight") {
                 runtimeInjection = await prepareEveRuntimeInjection(runtimeConfig, {
@@ -1620,6 +1765,7 @@ async function collectEvePreflight(request, options) {
         };
     }
     if (cloudflare === undefined) {
+        eveProgress(options, "checking Cloudflare access and exact target");
         try {
             cloudflare = await readEveCloudflareTarget({
                 projectId: packaging.project?.projectId ?? "unknown-project",
@@ -1665,6 +1811,10 @@ async function collectEvePreflight(request, options) {
     };
 }
 export async function runEveControlPlane(request, options = {}) {
+    const startedAt = Date.now();
+    if (humanOutput(options)) {
+        emitLine(options, `eden ${request.command} — ${request.name} (${request.environment})`);
+    }
     const lock = request.command === "deploy"
         ? await acquireEveTargetLock(request.projectRoot, request.environment, request.name)
         : undefined;
@@ -1674,8 +1824,9 @@ export async function runEveControlPlane(request, options = {}) {
     let lockReleased = true;
     try {
         collected = await collectEvePreflight(request, options);
+        const eveVersion = collected.candidate?.eveVersion;
         if (!collected.result.ok) {
-            (options.stdout ?? (() => undefined))(redactEveRuntimeOutput(JSON.stringify(collected.result)));
+            emitEveResult(options, collected.result, startedAt, eveVersion);
             throw new EveCliError({
                 code: request.command === "deploy"
                     ? "EVE_DEPLOY_CHECKS_FAILED"
@@ -1686,20 +1837,24 @@ export async function runEveControlPlane(request, options = {}) {
             });
         }
         if (request.command === "preflight") {
-            (options.stdout ?? (() => undefined))(redactEveRuntimeOutput(JSON.stringify(collected.result)));
+            emitEveResult(options, collected.result, startedAt, eveVersion);
         }
         else {
             const deploymentResult = await runEveDeployment(request, options, collected);
-            (options.stdout ?? (() => undefined))(redactEveRuntimeOutput(JSON.stringify(deploymentResult)));
+            emitEveResult(options, deploymentResult, startedAt, eveVersion);
             if (!deploymentResult.ok) {
                 const status = deploymentResult.deployment?.status;
                 throw new EveCliError({
                     code: status === "indeterminate"
                         ? "DEPLOY_INDETERMINATE"
-                        : "EVE_DEPLOYMENT_FAILED",
+                        : status === "deployed"
+                            ? "EVE_RUNTIME_IMAGE_CLEANUP_FAILED"
+                            : "EVE_DEPLOYMENT_FAILED",
                     message: status === "indeterminate"
                         ? "The Eve deployment outcome is indeterminate; inspect the retained exact ownership evidence before retrying."
-                        : "The Eve deployment failed before exact target promotion.",
+                        : status === "deployed"
+                            ? "The Eve deployment is healthy and promoted, but exact local runtime-image cleanup failed; do not retry the deployment."
+                            : "The Eve deployment failed before exact target promotion.",
                 });
             }
         }
@@ -1802,9 +1957,28 @@ async function parseEveDestroyRecord(recordPath, environment, name) {
     if (identity.environment !== environment || identity.name !== name) {
         return undefined;
     }
+    const verified = {
+        workerName: identity.workerName,
+        containerApplicationName: identity.containerApplicationName,
+        stableContainerInstanceName: identity.stableContainerInstanceName,
+        accountId: identity.accountId,
+        environment,
+        name,
+        ...(typeof identity.projectId === "string" && identity.projectId.length > 0
+            ? { projectId: identity.projectId }
+            : {}),
+        ...(typeof identity.generationId === "string" &&
+            identity.generationId.length > 0
+            ? { generationId: identity.generationId }
+            : {}),
+        ...(typeof identity.containerImage === "string" &&
+            identity.containerImage.length > 0
+            ? { containerImage: identity.containerImage }
+            : {}),
+    };
     return {
         recordPath,
-        identity: identity,
+        identity: verified,
     };
 }
 async function defaultDestroyTargetRead(request) {
@@ -1828,14 +2002,57 @@ async function defaultDestroyTargetRead(request) {
         (exactDeploymentEntries(deployments.value)?.length ?? 0) > 0;
     const entries = exactContainerEntries(containers.value, request.containerApplicationName);
     const firstContainer = entries === undefined ? undefined : entries[0];
+    const ownedImages = request.registryImages;
+    let registryImagesPresent;
+    if (ownedImages !== undefined && ownedImages.length > 0) {
+        const images = await readWranglerJson([
+            "containers",
+            "images",
+            "list",
+            "--json",
+        ]);
+        const present = registryImageNames(images.value);
+        if (!images.failed && present !== undefined) {
+            registryImagesPresent = ownedImages.filter((image) => present.has(image));
+        }
+    }
     return {
         workerExists,
         ...(firstContainer === undefined
             ? {}
             : { containerApplicationId: firstContainer.id }),
         ...(accountId === undefined ? {} : { accountId }),
+        ...(registryImagesPresent === undefined
+            ? {}
+            : { registryImagesPresent }),
     };
 }
+/**
+ * `wrangler containers images list --json` reports `[{name, tags}]` entries
+ * with the account prefix already stripped from the repository name. The set
+ * carries `repository:tag` refs for the owned tags Eden publishes.
+ */
+function registryImageNames(value) {
+    const collection = jsonCollection(value);
+    if (collection === undefined)
+        return undefined;
+    const names = new Set();
+    for (const entry of collection) {
+        if (typeof entry !== "object" || entry === null || !("name" in entry)) {
+            return undefined;
+        }
+        const name = entry.name;
+        const tags = "tags" in entry ? entry.tags : undefined;
+        if (typeof name !== "string" || !Array.isArray(tags))
+            return undefined;
+        for (const tag of tags) {
+            if (typeof tag !== "string")
+                return undefined;
+            names.add(`${name}:${tag}`);
+        }
+    }
+    return names;
+}
 async function defaultWorkerDelete(request) {
     const result = await runWranglerWithInput(["delete", "--name", request.name, "--force"], process.cwd(), "y\n");
     if (result.exitCode === 0)
@@ -1854,19 +2071,114 @@ async function defaultContainerDelete(request) {
     }
     return "indeterminate";
 }
-async function verifyEveAbsence(request, options) {
-    const reader = options.destroyCloudflareRead ?? defaultDestroyTargetRead;
-    const observed = await reader({
-        workerName: request.workerName,
-        containerApplicationName: request.containerApplicationName,
-    });
-    return !observed.workerExists &&
-        observed.containerApplicationId === undefined;
+async function defaultRegistryImageDelete(request) {
+    const result = await runWranglerWithInput(["containers", "images", "delete", request.image, "--skip-confirmation"], process.cwd());
+    if (result.exitCode === 0)
+        return "deleted";
+    if (/(?:does not exist|not found|404)/iu.test(result.stderr)) {
+        return "absent";
+    }
+    return "indeterminate";
+}
+/**
+ * The exact `<repository>:${EVE_REGISTRY_IMAGE_TAG}` ref this generation's
+ * deployment record proves Eden pushed, or undefined. Ownership holds only
+ * when the recorded digest reference points at the repository derived from
+ * the same identity that produced it; a digest-bearing reference to any other
+ * repository was published outside Eden's push and is never owned here.
+ */
+function ownedRegistryImageRef(identity, environment, name, accountId) {
+    if (identity.projectId === undefined ||
+        identity.generationId === undefined ||
+        identity.containerImage === undefined ||
+        identity.accountId !== accountId) {
+        return undefined;
+    }
+    const repository = `eden-eve-${stableDeploymentKey(identity.projectId, identity.accountId, environment, name)}-${identity.generationId}`;
+    const expected = `registry.cloudflare.com/${identity.accountId}/${repository}@`;
+    if (!identity.containerImage.startsWith(expected) ||
+        imageDigestFromReference(identity.containerImage) === undefined) {
+        return undefined;
+    }
+    return `${repository}:${EVE_REGISTRY_IMAGE_TAG}`;
+}
+/**
+ * The exact image ref an indeterminate deploy attempt provably pushed. The
+ * retained attempt evidence names the target's repository; the account and
+ * target key must match the verified destroy record.
+ */
+async function attemptRegistryImageRef(attemptPath, accountId, targetKey) {
+    const raw = await readFile(attemptPath, "utf8").catch(() => undefined);
+    if (raw === undefined)
+        return undefined;
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return undefined;
+    }
+    if (typeof parsed !== "object" || parsed === null)
+        return undefined;
+    const prefix = `eden-eve-${targetKey}-`;
+    if ("imageRepository" in parsed &&
+        typeof parsed.imageRepository === "string" &&
+        parsed.imageRepository.startsWith(prefix) &&
+        (!("targetKey" in parsed) || parsed.targetKey === targetKey) &&
+        "accountId" in parsed &&
+        parsed.accountId === accountId) {
+        return `${parsed.imageRepository}:${EVE_REGISTRY_IMAGE_TAG}`;
+    }
+    if ("imageReference" in parsed &&
+        typeof parsed.imageReference === "string" &&
+        imageDigestFromReference(parsed.imageReference) !== undefined) {
+        const repository = parsed.imageReference.split("@")[0];
+        const expected = `registry.cloudflare.com/${accountId}/${prefix}`;
+        if (repository !== undefined &&
+            repository.startsWith(expected) &&
+            (!("targetKey" in parsed) || parsed.targetKey === targetKey)) {
+            return `${repository.slice(`registry.cloudflare.com/${accountId}/`.length)}:${EVE_REGISTRY_IMAGE_TAG}`;
+        }
+    }
+    return undefined;
+}
+/**
+ * Every registry image tag this exact target provably owns: the recorded
+ * digest references in matching deployment records plus the repository
+ * evidence retained by indeterminate pushes. Never derived by prefix-matching
+ * the registry; each ref is computed from the immutable generation records.
+ */
+async function collectEveDestroyRegistryImages(projectRoot, environment, name, record) {
+    const generationsRoot = join(projectRoot, ".eden", "eve-deploy", "generations");
+    const entries = await readdir(generationsRoot).catch(() => []);
+    const images = new Set();
+    const targetKey = record.projectId === undefined
+        ? undefined
+        : stableDeploymentKey(record.projectId, record.accountId, environment, name);
+    for (const entry of entries) {
+        const generationRoot = join(generationsRoot, entry);
+        const parsed = await parseEveDestroyRecord(join(generationRoot, "deployment.json"), environment, name);
+        const deployedImage = parsed === undefined
+            ? undefined
+            : ownedRegistryImageRef(parsed.identity, environment, name, record.accountId);
+        if (deployedImage !== undefined)
+            images.add(deployedImage);
+        if (targetKey === undefined)
+            continue;
+        const attemptImage = await attemptRegistryImageRef(join(generationRoot, "deployment-attempt.json"), record.accountId, targetKey);
+        if (attemptImage !== undefined)
+            images.add(attemptImage);
+    }
+    return [...images];
 }
 export async function runEveDestroy(request, options = {}) {
+    const startedAt = Date.now();
+    if (humanOutput(options)) {
+        emitLine(options, `eden destroy — ${request.name} (${request.environment})`);
+    }
     const checks = [];
     const emit = (outcome) => {
-        (options.stdout ?? (() => undefined))(redactEveRuntimeOutput(JSON.stringify(outcome)));
+        emitEveDestroyOutcome(options, outcome, startedAt);
     };
     const fail = (code, message) => {
         throw new EveCliError({ code, message, source: "eve destroy" });
@@ -1909,15 +2221,24 @@ async function runEveDestroyLocked(request, options, checks, emit, fail) {
         fail("EVE_DESTROY_RECORD_MISMATCH", "The immutable deployment record does not match the selected target.");
     }
     checks.push(check("VAL-LIFE-006-RECORD", "passed", "The immutable deployment record matched the exact target selectors."));
-    const reader = options.destroyCloudflareRead ?? defaultDestroyTargetRead;
-    const before = await reader({
+    eveProgress(options, "verifying the immutable ownership record");
+    const ownedRegistryImages = await collectEveDestroyRegistryImages(request.projectRoot, request.environment, request.name, record.identity);
+    const readTarget = () => Promise.resolve(reader({
         workerName: expectedWorker,
         containerApplicationName: expectedContainer,
-    });
+        registryImages: ownedRegistryImages,
+    }));
+    const reader = options.destroyCloudflareRead ?? defaultDestroyTargetRead;
+    eveProgress(options, "reading the exact remote inventory");
+    const before = await readTarget();
     if (before.accountId !== record.identity.accountId) {
         fail("EVE_DESTROY_OWNERSHIP_UNPROVEN", "The authenticated account does not own the recorded deployment account.");
     }
-    if (!before.workerExists && before.containerApplicationId === undefined) {
+    if (!before.workerExists &&
+        before.containerApplicationId === undefined &&
+        (ownedRegistryImages.length === 0 ||
+            (before.registryImagesPresent !== undefined &&
+                before.registryImagesPresent.length === 0))) {
         emit({
             ok: true,
             status: "absent",
@@ -1932,6 +2253,7 @@ async function runEveDestroyLocked(request, options, checks, emit, fail) {
     }
     const deleteWorker = options.deleteWorker ?? defaultWorkerDelete;
     if (before.workerExists) {
+        eveProgress(options, `deleting Worker ${expectedWorker}`);
         const workerResult = await deleteWorker({ name: expectedWorker });
         if (workerResult === "indeterminate") {
             emit({
@@ -1952,6 +2274,7 @@ async function runEveDestroyLocked(request, options, checks, emit, fail) {
     }
     const deleteContainer = options.deleteContainer ?? defaultContainerDelete;
     if (before.containerApplicationId !== undefined) {
+        eveProgress(options, `deleting Container application ${expectedContainer}`);
         const containerResult = await deleteContainer({
             applicationId: before.containerApplicationId,
         });
@@ -1972,11 +2295,22 @@ async function runEveDestroyLocked(request, options, checks, emit, fail) {
             ? "The exact owned Container application was deleted."
             : "The exact Container application was already absent."));
     }
-    const absent = await verifyEveAbsence({
-        workerName: expectedWorker,
-        containerApplicationName: expectedContainer,
-    }, options);
-    if (!absent) {
+    const imageDeletes = new Map();
+    if (ownedRegistryImages.length > 0) {
+        const deleteRegistryImage = options.deleteRegistryImage ?? defaultRegistryImageDelete;
+        const deletable = before.registryImagesPresent === undefined
+            ? ownedRegistryImages
+            : ownedRegistryImages.filter((image) => before.registryImagesPresent?.includes(image) === true);
+        if (deletable.length > 0) {
+            eveProgress(options, `deleting ${deletable.length} registry image${deletable.length === 1 ? "" : "s"}`);
+        }
+        for (const image of deletable) {
+            imageDeletes.set(image, await deleteRegistryImage({ image }));
+        }
+    }
+    eveProgress(options, "verifying the exact target is absent");
+    const after = await readTarget();
+    if (after.workerExists || after.containerApplicationId !== undefined) {
         emit({
             ok: false,
             status: "failed",
@@ -1989,6 +2323,24 @@ async function runEveDestroyLocked(request, options, checks, emit, fail) {
         });
         fail("EVE_DESTROY_ABSENCE_UNPROVEN", "The exact target could not be proven absent after deletion.");
     }
+    const retainedImages = ownedRegistryImages.filter((image) => after.registryImagesPresent === undefined
+        ? imageDeletes.get(image) === "indeterminate"
+        : after.registryImagesPresent.includes(image));
+    if (ownedRegistryImages.length > 0) {
+        checks.push(retainedImages.length === 0
+            ? check("VAL-LIFE-006-REGISTRY", "passed", "Every registry image tag recorded for this exact target was deleted or proven absent.")
+            : check("VAL-LIFE-006-REGISTRY", "failed", `The exact target's registry image(s) remain after destroy: ${retainedImages.join(", ")}.`, "Retry eden destroy with the same selectors, or remove only the listed image refs with wrangler containers images delete."));
+    }
+    if (retainedImages.length > 0) {
+        emit({
+            ok: false,
+            status: "failed",
+            environment: request.environment,
+            name: request.name,
+            checks,
+        });
+        fail("EVE_DESTROY_IMAGES_RETAINED", `The exact Worker and Container are absent, but registry image(s) remain: ${retainedImages.join(", ")}.`);
+    }
     checks.push(check("VAL-LIFE-006", "passed", "Exact absence was verified; clearing this target's CURRENT pointer only."));
     const currentPath = join(request.projectRoot, ".eden", "eve-deploy", "targets", `${request.environment}-${request.name}`, "CURRENT");
     await rm(currentPath, { force: true });

package/dist/eve-packaging.d.ts

@@ -252,6 +252,13 @@ export declare class EvePackagingError extends Error {
         readonly remediation: string;
     });
 }
+/**
+ * The authored Eve project source the runtime stage must carry so `eve start`
+ * can resolve the project context (agent/, agents/ workspaces, flat layouts,
+ * and the manifest). Returns validated top-level snapshot entries with every
+ * capture-time exclusion still applied; generated roots are never source.
+ */
+export declare function eveSnapshotSourceEntries(snapshotRoot: string): Promise<readonly string[]>;
 export declare function buildEveProjectSnapshot(options: EveProjectSnapshotOptions): Promise<EveProjectPackagingResult>;
 export declare function revalidateEveProjectCandidateInputs(candidate: EveProjectBuildCandidate, runtimeConfig?: EveRuntimeConfigExclusion): Promise<void>;
 export declare function createDockerEveProjectBuilder(options: {