@moinulmoin/eden 0.4.1 → 0.5.0

package/README.md

@@ -12,15 +12,15 @@ If you already have an Eve project, start with `eden deploy`.
 Use any one of these package managers:
 
 ```sh
-npm install --global @moinulmoin/eden@0.4.1
+npm install --global @moinulmoin/eden@0.5.0
 ```
 
 ```sh
-pnpm add --global @moinulmoin/eden@0.4.1
+pnpm add --global @moinulmoin/eden@0.5.0
 ```
 
 ```sh
-bun add --global @moinulmoin/eden@0.4.1
+bun add --global @moinulmoin/eden@0.5.0
 ```
 
 Then confirm the CLI is available:

package/dist/eve-control-plane.d.ts

@@ -21,6 +21,12 @@ export interface EvePreflightCandidate {
 export type EveDeploymentStatus = "deployed" | "failed" | "indeterminate";
 export interface EveDeploymentMetadata {
     readonly status: EveDeploymentStatus;
+    /**
+     * `create` is a first deploy onto an absent target; `update` is an
+     * in-place redeploy of a provably Eden-owned target that keeps the Worker,
+     * Durable Object classes, and durable state.
+     */
+    readonly operation: "create" | "update";
     readonly targetKey: string;
     readonly deploymentId: string;
     readonly workerName: string;
@@ -28,6 +34,9 @@ export interface EveDeploymentMetadata {
     readonly stableContainerInstanceName: string;
     readonly stableWorkersDevOrigin: string;
     readonly imageReference: string;
+    /** Present on updates: the superseded generation and its registry image. */
+    readonly supersededGenerationId?: string;
+    readonly supersededImageReference?: string;
     readonly runtimeVariableNames: readonly string[];
     readonly evidenceRetained: true;
 }
@@ -50,6 +59,7 @@ export type EveCloudflareTargetState = "absent" | "owned" | "unowned" | "mismatc
 export interface EveCloudflareReadRequest {
     readonly projectId: string;
     readonly sourceDigest: string;
+    readonly projectRoot: string;
     readonly environment: EveCliEnvironment;
     readonly name: string;
 }
@@ -65,6 +75,29 @@ export interface EveCloudflareReadResult {
         readonly message?: string;
         readonly remediation?: string;
         readonly identity?: EveDeploymentIdentityProof;
+        /**
+         * Which exact resources the read observed. `undefined` means the
+         * inventory could not be proven; `worker`/`container` booleans mean the
+         * exact names were present or absent without any ownership claim.
+         */
+        readonly observed?: {
+            readonly worker: boolean;
+            readonly container: boolean;
+        };
+        /**
+         * Provider-backed facts about the live target, read through the
+         * Cloudflare API (not self-asserted response headers, which any Worker
+         * can forge): the Container application's configured image and the
+         * `EDEN_EVE_DEPLOYMENT_ID` plain-text var Eden stamps into every Worker
+         * it publishes. `settingsReadable` tells the ownership resolver whether
+         * a missing var is evidence of a foreign Worker or just an unreadable
+         * settings call.
+         */
+        readonly providerEvidence?: {
+            readonly containerImage?: string;
+            readonly workerDeploymentId?: string;
+            readonly settingsReadable?: boolean;
+        };
     };
 }
 export type EveCloudflareReadRunner = (request: EveCloudflareReadRequest) => EveCloudflareReadResult | Promise<EveCloudflareReadResult>;
@@ -104,7 +137,10 @@ export interface EveDeploymentIdentity {
     readonly runtimeVariableNames: readonly string[];
     readonly runtimeRevisionHandle?: string;
 }
-export type EveDeploymentIdentityProof = Partial<EveDeploymentIdentity>;
+export type EveDeploymentIdentityProof = Partial<EveDeploymentIdentity> & {
+    /** The deployment the serving Container verifiably started under; set only by a deployed Eden host that proves its running image before stamping. */
+    readonly startedDeploymentId?: string;
+};
 export interface EveDeploymentPublicationRequest {
     readonly identity: EveDeploymentIdentity;
     readonly hostConfig: EveHostConfig;
@@ -252,6 +288,7 @@ export interface EveDestroyCloudflareReadRequest {
 export declare function exactTargetContainerEntries(value: unknown, name: string): readonly {
     readonly id: string;
     readonly name: string;
+    readonly image?: string;
 }[] | undefined;
 export declare function runEveControlPlane(request: EveCliExecutionRequest, options?: EvePreflightOptions): Promise<void>;
 export interface EveDestroyOutcome {

package/dist/eve-control-plane.js

@@ -290,7 +290,7 @@ function humanEveResultLines(result, startedAt, eveVersion) {
     if (result.ok) {
         if (result.command === "eve deploy") {
             const url = result.deployment?.stableWorkersDevOrigin;
-            lines.push("", `✓ deployed ${result.name} (${result.environment})` +
+            lines.push("", `✓ ${result.deployment?.operation === "update" ? "updated" : "deployed"} ${result.name} (${result.environment})` +
                 (eveVersion === undefined ? "" : ` · eve ${eveVersion}`));
             if (url !== undefined)
                 lines.push(url);
@@ -306,7 +306,7 @@ function humanEveResultLines(result, startedAt, eveVersion) {
         lines.push("", `✗ ${commandLabel} ${result.deployment.status}`, `  → ${result.deployment.status === "indeterminate"
             ? "The outcome is indeterminate; inspect the retained ownership evidence before retrying the same exact target."
             : result.deployment.status === "deployed"
-                ? "The deployment is live; only local runtime-image cleanup failed, so do not retry the deployment."
+                ? "The deployment is live; only image cleanup failed (local runtime image or the superseded registry tag), so do not retry the deployment."
                 : "The deployment failed before promotion; the exact target was not claimed."}`);
     }
     else if (firstFailure !== undefined) {
@@ -442,8 +442,21 @@ function exactContainerEntries(value, name) {
         }
         const id = entry.id;
         const entryName = entry.name;
-        if (entryName === name)
-            entries.push({ id, name: entryName });
+        if (entryName === name) {
+            const configuration = entry.configuration;
+            const image = typeof entry.image === "string"
+                ? entry.image
+                : typeof configuration === "object" &&
+                    configuration !== null &&
+                    typeof configuration.image === "string"
+                    ? configuration.image
+                    : undefined;
+            entries.push({
+                id,
+                name: entryName,
+                ...(image === undefined ? {} : { image }),
+            });
+        }
     }
     if (entries.length === 0 && collection.length >= 100) {
         return undefined;
@@ -595,6 +608,9 @@ async function defaultCloudflareRead(request) {
             target: { state: "absent" },
         };
     }
+    const workerPresent = deploymentEntries.length > 0;
+    const containerPresent = (containerEntries?.length ?? 0) > 0;
+    const providerEvidence = await readProviderEvidence(request.name, accountId, workerPresent, containerPresent ? containerEntries?.[0]?.image : undefined);
     return {
         accountAccess,
         containerAccess,
@@ -605,16 +621,141 @@ async function defaultCloudflareRead(request) {
             ? {}
             : { workersDevSubdomain }),
         target: {
-            state: "ambiguous",
-            message: "The exact target could not be proven absent or owned from the read-only Cloudflare inventory.",
-            remediation: "Resolve the exact Worker and Container ownership state before deployment; no target was claimed or changed.",
+            // The read-only inventory proves the exact target exists but cannot
+            // prove who created it; Eden's immutable deployment record resolves
+            // ownership next.
+            state: "unowned",
+            observed: { worker: workerPresent, container: containerPresent },
+            ...(providerEvidence === undefined ? {} : { providerEvidence }),
+            message: "The exact Worker or Container target already exists, and the read-only inventory cannot prove Eden owns it.",
+            remediation: "Deploy under a different --name or remove the conflicting Worker/Container yourself; Eden never adopts or replaces resources it cannot prove it created.",
+        },
+    };
+}
+/**
+ * Reads provider-backed facts about the live target: the Container
+ * application's configured image (from `wrangler containers list`) and the
+ * `EDEN_EVE_DEPLOYMENT_ID` plain-text var Eden stamps into every Worker it
+ * publishes (from the script settings API). Both are provider state — a
+ * foreign Worker can forge `x-eden-*` response headers but cannot set a var
+ * Eden recorded at publish time.
+ */
+async function readProviderEvidence(workerName, accountId, workerPresent, containerImage) {
+    const evidence = {
+        ...(containerImage === undefined ? {} : { containerImage }),
+    };
+    if (workerPresent && accountId !== undefined) {
+        const token = process.env.CLOUDFLARE_API_TOKEN ??
+            (await readWranglerOAuthToken());
+        if (token !== undefined) {
+            try {
+                const response = await fetch(`https://api.cloudflare.com/client/v4/accounts/${accountId}/workers/scripts/${encodeURIComponent(workerName)}/settings`, {
+                    headers: { authorization: `Bearer ${token}` },
+                    signal: AbortSignal.timeout(20_000),
+                });
+                if (response.ok) {
+                    evidence.settingsReadable = true;
+                    const parsed = (await response.json());
+                    const binding = parsed.result?.bindings?.find((value) => value.type === "plain_text" &&
+                        value.name === "EDEN_EVE_DEPLOYMENT_ID");
+                    if (typeof binding?.text === "string") {
+                        evidence.workerDeploymentId = binding.text;
+                    }
+                }
+                else if (response.status !== 404) {
+                    evidence.settingsReadable = false;
+                }
+            }
+            catch {
+                evidence.settingsReadable = false;
+            }
+        }
+    }
+    return evidence;
+}
+/**
+ * Resolves `unowned` reads against Eden's immutable deployment records AND
+ * the live remote target. The local record proves Eden once created the
+ * target; the remote Worker's stamped identity proves it is still the one
+ * Eden deployed — a same-name Worker recreated by something else after the
+ * target was destroyed (or a forged local record) must never be upgraded to
+ * `owned`.
+ */
+async function resolveEveTargetOwnership(request, result) {
+    if (result.target.state !== "unowned")
+        return result;
+    const record = await readEveDeploymentRecord(request.projectRoot, request.environment, request.name, result.accountId, request.projectId === "unknown-project" ? undefined : request.projectId);
+    if (record === undefined ||
+        record.identity.workerName !== request.name ||
+        record.identity.accountId !== result.accountId ||
+        (request.projectId !== "unknown-project" &&
+            record.identity.projectId !== undefined &&
+            record.identity.projectId !== request.projectId) ||
+        (result.target.observed?.container === true &&
+            record.identity.containerApplicationName !==
+                boundedResourceName(request.name, "container"))) {
+        return result;
+    }
+    // Remote proof must come from provider state. A foreign Worker can echo
+    // `x-eden-*` response headers, but it cannot plant the plain-text var Eden
+    // publishes into script settings, nor point the Container application at an
+    // image digest Eden recorded. The Worker is proven only by its own settings:
+    // a matching Container image proves the Container, never the Worker, so
+    // unreadable settings fail closed.
+    const evidence = result.target.providerEvidence;
+    const recordedDeploymentIds = new Set(record.deploymentIds);
+    const workerProven = result.target.observed?.worker !== true ||
+        (evidence?.settingsReadable === true &&
+            evidence.workerDeploymentId !== undefined &&
+            recordedDeploymentIds.has(evidence.workerDeploymentId));
+    const containerProven = result.target.observed?.container !== true ||
+        (evidence?.containerImage !== undefined &&
+            record.images.includes(evidence.containerImage));
+    const remoteProven = evidence !== undefined && workerProven && containerProven;
+    if (!remoteProven) {
+        return {
+            ...result,
+            target: {
+                ...result.target,
+                message: "The exact Worker or Container target exists, and although a local Eden record matches, provider state cannot prove it is the one Eden deployed — the target may have been recreated outside Eden.",
+                remediation: "Inspect the Worker at its workers.dev origin and the recorded deployment history before redeploying; if it is not Eden's, deploy under a different --name or delete it yourself.",
+            },
+        };
+    }
+    const priorIdentity = {
+        workerName: record.identity.workerName,
+        containerApplicationName: record.identity.containerApplicationName,
+        stableContainerInstanceName: record.identity.stableContainerInstanceName,
+        accountId: record.identity.accountId,
+        environment: request.environment,
+        name: request.name,
+        ...(record.identity.projectId === undefined
+            ? {}
+            : { projectId: record.identity.projectId }),
+        ...(record.identity.generationId === undefined
+            ? {}
+            : { generationId: record.identity.generationId }),
+        ...(record.identity.containerImage === undefined
+            ? {}
+            : { containerImage: record.identity.containerImage }),
+    };
+    return {
+        ...result,
+        target: {
+            state: "owned",
+            identity: priorIdentity,
+            ...(result.target.observed === undefined
+                ? {}
+                : { observed: result.target.observed }),
+            message: "The immutable deployment record proves Eden owns the exact target; deploy proceeds as an in-place update.",
         },
     };
 }
 async function readEveCloudflareTarget(request, options) {
-    return options.cloudflareRead === undefined
-        ? defaultCloudflareRead(request)
-        : options.cloudflareRead(request);
+    const result = options.cloudflareRead === undefined
+        ? await defaultCloudflareRead(request)
+        : await options.cloudflareRead(request);
+    return resolveEveTargetOwnership(request, result);
 }
 async function resolvedCloudflareOrigin(result, workerName) {
     if (result.accountId === undefined ||
@@ -713,12 +854,12 @@ function cloudflareChecks(result) {
         ? undefined
         : "Use an authenticated read-only adapter with account and Container access; preflight never uploads, publishes, or changes remote state.";
     const target = result.target;
-    const targetPasses = target.state === "absent" ||
-        (target.state === "owned" && target.matchesCandidate === true);
+    const targetPasses = target.state === "absent" || target.state === "owned";
     const targetMessage = targetPasses
         ? target.state === "absent"
             ? "The exact target read is absent and is eligible without claiming ownership."
-            : "The exact target is already owned by this candidate identity; no ownership claim was attempted."
+            : target.message ??
+                "The exact target is provably Eden-owned; deploy proceeds as an in-place update."
         : target.message ??
             "The exact target read is unowned, mismatched, cross-environment, or ambiguous.";
     const targetRemediation = targetPasses
@@ -1062,6 +1203,10 @@ function responseIdentity(response, body) {
     read("workerName", "x-eden-eve-worker-name");
     read("containerApplicationName", "x-eden-eve-container-application");
     read("stableContainerInstanceName", "x-eden-eve-container-instance");
+    const started = response.headers.get("x-eden-eve-started-deployment");
+    if (started !== null) {
+        identity["startedDeploymentId"] = started;
+    }
     read("containerImage", "x-eden-eve-container-image");
     return identity;
 }
@@ -1105,9 +1250,20 @@ function defaultHealthRunner() {
                     body.state === "ready" ||
                     body.ready === true);
             if (ready) {
+                const observedIdentity = responseIdentity(response, body);
+                // A Worker activates before its image rollout completes; promotion
+                // must wait until the *served container* verifiably runs this
+                // generation's image (the host stamps the header only after
+                // inspecting the running instance).
+                if (observedIdentity.startedDeploymentId !== request.identity.deploymentId) {
+                    lastReason =
+                        "The served Container has not verifiably started this deployment's image yet; waiting for the rollout to land.";
+                    await wait();
+                    continue;
+                }
                 return {
                     status: "ready",
-                    identity: responseIdentity(response, body),
+                    identity: observedIdentity,
                 };
             }
             lastReason =
@@ -1161,8 +1317,13 @@ async function releaseEveTargetLock(lock) {
     await rm(lock.path, { force: true });
     return (await lstat(lock.path).catch(() => undefined)) === undefined;
 }
-async function promoteEveTargetPointer(deploymentRoot, targetKey, generationRoot) {
-    const targetRoot = join(deploymentRoot, "targets", targetKey);
+/**
+ * Atomically re-points the target's CURRENT symlink at a promoted immutable
+ * generation. The pointer key is `<environment>-<name>` — the same path
+ * `destroy` clears and the update ownership resolver reads.
+ */
+async function promoteEveTargetPointer(deploymentRoot, pointerKey, generationRoot) {
+    const targetRoot = join(deploymentRoot, "targets", pointerKey);
     const artifactBoundary = await realpath(dirname(deploymentRoot)).catch(() => undefined);
     const generationCanonical = await realpath(generationRoot).catch(() => undefined);
     if (artifactBoundary === undefined ||
@@ -1191,7 +1352,7 @@ async function promoteEveTargetPointer(deploymentRoot, targetKey, generationRoot
         throw new EveCliError({
             code: "EVE_DEPLOY_PROMOTION_FAILED",
             message: "The Eve target pointer directory could not be verified safely.",
-            source: targetKey,
+            source: pointerKey,
         });
     }
     const currentPath = join(targetRoot, "CURRENT");
@@ -1208,7 +1369,7 @@ async function promoteEveTargetPointer(deploymentRoot, targetKey, generationRoot
         throw new EveCliError({
             code: "EVE_DEPLOY_PROMOTION_FAILED",
             message: "The Eve target pointer did not resolve to the promoted generation.",
-            source: targetKey,
+            source: pointerKey,
         });
     }
     return currentPath;
@@ -1242,9 +1403,10 @@ async function writeEveIndeterminateEvidence(candidate, evidence, extra = {}) {
         flag: "wx",
     });
 }
-function deploymentMetadata(identity, targetKey, status) {
+function deploymentMetadata(identity, targetKey, status, operation, superseded) {
     return {
         status,
+        operation,
         targetKey,
         deploymentId: identity.deploymentId,
         workerName: identity.workerName,
@@ -1252,6 +1414,12 @@ function deploymentMetadata(identity, targetKey, status) {
         stableContainerInstanceName: identity.stableContainerInstanceName,
         stableWorkersDevOrigin: identity.stableWorkersDevOrigin,
         imageReference: identity.containerImage,
+        ...(superseded?.generationId === undefined
+            ? {}
+            : { supersededGenerationId: superseded.generationId }),
+        ...(superseded?.containerImage === undefined
+            ? {}
+            : { supersededImageReference: superseded.containerImage }),
         runtimeVariableNames: identity.runtimeVariableNames,
         evidenceRetained: true,
     };
@@ -1273,6 +1441,46 @@ async function runEveDeployment(request, options, collected) {
         collected.projectId === undefined) {
         throw deploymentFailure("EVE_DEPLOY_CHECKS_FAILED", "The inline Eve deploy checks did not return a complete immutable candidate.");
     }
+    const isUpdate = cloudflare.target.state === "owned";
+    const operation = isUpdate ? "update" : "create";
+    const prior = collected.priorDeployment;
+    if (isUpdate && prior === undefined) {
+        throw deploymentFailure("EVE_UPDATE_RECORD_UNAVAILABLE", "The exact target is provably Eden-owned, but its immutable deployment record is unreadable; refusing to update without the recorded Durable Object history.");
+    }
+    if (isUpdate && prior?.durableObjects === undefined) {
+        throw deploymentFailure("EVE_UPDATE_RECORD_UNAVAILABLE", "The prior deployment record does not carry a readable Durable Object history; refusing to update because replacing it could emit a divergent migration list.");
+    }
+    const priorIdentity = prior?.identity;
+    const priorDurableObjects = prior?.durableObjects;
+    const superseded = isUpdate
+        ? {
+            generationId: priorIdentity?.generationId,
+            containerImage: priorIdentity?.containerImage,
+        }
+        : undefined;
+    const resultWarnings = collected.result.warnings;
+    if (isUpdate) {
+        const world = collected.workflowWorld;
+        const durableWorld = world !== undefined &&
+            world !== "local" &&
+            world !== "@workflow/world-local";
+        if (durableWorld) {
+            resultWarnings.push({
+                id: "EVE_UPDATE_IN_FLIGHT",
+                message: "This update replaces the running Container; durable World runs in flight resume on the new code — Cloudflare has no deployment pinning, so keep step names and payload shapes backward compatible.",
+                remediation: "Let pending approvals and long runs settle before updating, or keep step names, queue names, and serialized payloads compatible across the change.",
+            });
+        }
+        if (prior?.worldCloudflare !==
+            (world === "@moinulmoin/eden-world-cloudflare")) {
+            resultWarnings.push({
+                id: "EVE_UPDATE_WORLD_SWITCH",
+                message: "The compiled Workflow World changed since the last deploy; existing sessions and pending approvals stay in the previous World and do not migrate to the new one.",
+                remediation: "Existing Durable Object data is preserved (classes and bindings are never removed), but runs started before this update remain where they were created.",
+            });
+        }
+        eveProgress(options, "update: Durable Object data is preserved; the running Container restarts on its next request to serve the new image");
+    }
     const accountId = cloudflare.accountId ??
         cloudflare.target.identity?.accountId;
     const workersDevSubdomain = cloudflare.workersDevSubdomain ??
@@ -1421,6 +1629,13 @@ async function runEveDeployment(request, options, collected) {
             ...(collected.workflowWorld === undefined
                 ? {}
                 : { workflowWorld: collected.workflowWorld }),
+            // In-place updates carry the prior Durable Object bindings and
+            // migration history forward verbatim: classes are append-only, never
+            // re-declared, and never deleted (a deleted_classes migration destroys
+            // the data).
+            ...(isUpdate && priorDurableObjects !== undefined
+                ? { durableObjects: priorDurableObjects }
+                : {}),
             ...(process.env.EDEN_EVE_CONTAINER_SLEEP_AFTER === undefined
                 ? {}
                 : { containerSleepAfter: process.env.EDEN_EVE_CONTAINER_SLEEP_AFTER }),
@@ -1448,7 +1663,7 @@ async function runEveDeployment(request, options, collected) {
     }
     catch {
         await writeEveDeploymentRecord(candidate, identity, hostConfig, "indeterminate", { evidence: "publication-threw-before-terminal-result" });
-        const deployment = deploymentMetadata(identity, targetKey, "indeterminate");
+        const deployment = deploymentMetadata(identity, targetKey, "indeterminate", operation, superseded);
         return {
             ...collected.result,
             ok: false,
@@ -1460,7 +1675,7 @@ async function runEveDeployment(request, options, collected) {
         return {
             ...collected.result,
             ok: false,
-            deployment: deploymentMetadata(identity, targetKey, "indeterminate"),
+            deployment: deploymentMetadata(identity, targetKey, "indeterminate", operation, superseded),
         };
     }
     if (publication.status === "failed" ||
@@ -1472,7 +1687,7 @@ async function runEveDeployment(request, options, collected) {
             return {
                 ...collected.result,
                 ok: false,
-                deployment: deploymentMetadata(identity, targetKey, "indeterminate"),
+                deployment: deploymentMetadata(identity, targetKey, "indeterminate", operation, superseded),
             };
         }
         if (publication.status === "failed" &&
@@ -1483,7 +1698,7 @@ async function runEveDeployment(request, options, collected) {
             return {
                 ...collected.result,
                 ok: false,
-                deployment: deploymentMetadata(identity, targetKey, "indeterminate"),
+                deployment: deploymentMetadata(identity, targetKey, "indeterminate", operation, superseded),
             };
         }
         if (publication.status === "failed" &&
@@ -1501,7 +1716,7 @@ async function runEveDeployment(request, options, collected) {
                 return {
                     ...collected.result,
                     ok: false,
-                    deployment: deploymentMetadata(identity, targetKey, "indeterminate"),
+                    deployment: deploymentMetadata(identity, targetKey, "indeterminate", operation, superseded),
                 };
             }
         }
@@ -1513,7 +1728,7 @@ async function runEveDeployment(request, options, collected) {
         return {
             ...collected.result,
             ok: false,
-            deployment: deploymentMetadata(identity, targetKey, "failed"),
+            deployment: deploymentMetadata(identity, targetKey, "failed", operation, superseded),
         };
     }
     let health;
@@ -1529,7 +1744,7 @@ async function runEveDeployment(request, options, collected) {
         return {
             ...collected.result,
             ok: false,
-            deployment: deploymentMetadata(identity, targetKey, "indeterminate"),
+            deployment: deploymentMetadata(identity, targetKey, "indeterminate", operation, superseded),
         };
     }
     if (health.status === "indeterminate") {
@@ -1537,7 +1752,7 @@ async function runEveDeployment(request, options, collected) {
         return {
             ...collected.result,
             ok: false,
-            deployment: deploymentMetadata(identity, targetKey, "indeterminate"),
+            deployment: deploymentMetadata(identity, targetKey, "indeterminate", operation, superseded),
         };
     }
     const observedHealthIdentity = health.status === "ready"
@@ -1554,7 +1769,7 @@ async function runEveDeployment(request, options, collected) {
             return {
                 ...collected.result,
                 ok: false,
-                deployment: deploymentMetadata(identity, targetKey, "indeterminate"),
+                deployment: deploymentMetadata(identity, targetKey, "indeterminate", operation, superseded),
             };
         }
         if (publication.createdByAttempt === true &&
@@ -1564,7 +1779,7 @@ async function runEveDeployment(request, options, collected) {
             return {
                 ...collected.result,
                 ok: false,
-                deployment: deploymentMetadata(identity, targetKey, "indeterminate"),
+                deployment: deploymentMetadata(identity, targetKey, "indeterminate", operation, superseded),
             };
         }
         if (publication.createdByAttempt === true &&
@@ -1578,7 +1793,7 @@ async function runEveDeployment(request, options, collected) {
                 return {
                     ...collected.result,
                     ok: false,
-                    deployment: deploymentMetadata(identity, targetKey, "indeterminate"),
+                    deployment: deploymentMetadata(identity, targetKey, "indeterminate", operation, superseded),
                 };
             }
         }
@@ -1590,7 +1805,7 @@ async function runEveDeployment(request, options, collected) {
         return {
             ...collected.result,
             ok: false,
-            deployment: deploymentMetadata(identity, targetKey, "failed"),
+            deployment: deploymentMetadata(identity, targetKey, "failed", operation, superseded),
         };
     }
     try {
@@ -1609,7 +1824,7 @@ async function runEveDeployment(request, options, collected) {
                 return {
                     ...collected.result,
                     ok: false,
-                    deployment: deploymentMetadata(identity, targetKey, "indeterminate"),
+                    deployment: deploymentMetadata(identity, targetKey, "indeterminate", operation, superseded),
                 };
             }
             await writeEveDeploymentRecord(candidate, identity, hostConfig, "failed", {
@@ -1620,7 +1835,7 @@ async function runEveDeployment(request, options, collected) {
             return {
                 ...collected.result,
                 ok: false,
-                deployment: deploymentMetadata(identity, targetKey, "failed"),
+                deployment: deploymentMetadata(identity, targetKey, "failed", operation, superseded),
             };
         }
         await writeEveDeploymentRecord(candidate, identity, hostConfig, "indeterminate", {
@@ -1631,7 +1846,7 @@ async function runEveDeployment(request, options, collected) {
         return {
             ...collected.result,
             ok: false,
-            deployment: deploymentMetadata(identity, targetKey, "indeterminate"),
+            deployment: deploymentMetadata(identity, targetKey, "indeterminate", operation, superseded),
         };
     }
     await writeEveDeploymentRecord(candidate, identity, hostConfig, "deployed", {
@@ -1641,8 +1856,33 @@ async function runEveDeployment(request, options, collected) {
             identity: "exact",
         },
     });
-    await promoteEveTargetPointer(join(request.projectRoot, ".eden", "eve-deploy"), targetKey, candidate.generationRoot);
+    await promoteEveTargetPointer(join(request.projectRoot, ".eden", "eve-deploy"), `${request.environment}-${request.name}`, candidate.generationRoot);
     await options.afterPromotion?.();
+    let supersededImageCleanup;
+    if (isUpdate) {
+        // The superseded generation's registry repository is generation-scoped
+        // and no longer referenced once CURRENT promotes this generation; only
+        // then is it safe to delete.
+        const previousImage = priorIdentity === undefined
+            ? undefined
+            : ownedRegistryImageRef(priorIdentity, request.environment, request.name, accountId);
+        if (previousImage !== undefined) {
+            eveProgress(options, `deleting superseded registry image ${previousImage}`);
+            let deleted = "indeterminate";
+            try {
+                deleted = await (options.deleteRegistryImage ??
+                    defaultRegistryImageDelete)({ image: previousImage });
+            }
+            catch {
+                deleted = "indeterminate";
+            }
+            supersededImageCleanup = deleted === "indeterminate"
+                ? check("VAL-LIFE-007", "failed", `The update is healthy and promoted, but the superseded registry image ${previousImage} could not be proven deleted.`, `Remove only the recorded image ref ${previousImage}; do not retry or run broad registry cleanup.`)
+                : check("VAL-LIFE-007", "passed", deleted === "deleted"
+                    ? "The superseded generation's registry image was deleted after promotion."
+                    : "The superseded generation's registry image was already absent.");
+        }
+    }
     let runtimeImageCleanup;
     if (runtimeEvidence.cleanup.imageRetained) {
         if (options.retainRuntimeImage === true) {
@@ -1666,13 +1906,18 @@ async function runEveDeployment(request, options, collected) {
                 : check("VAL-CROSS-004", "failed", "The remote deployment is healthy, but exact local runtime-image cleanup could not be verified.", `Remove only the recorded image ${imageDigest}; do not retry or run broad Docker cleanup.`);
         }
     }
+    const postPromotionChecks = [
+        ...(supersededImageCleanup === undefined ? [] : [supersededImageCleanup]),
+        ...(runtimeImageCleanup === undefined ? [] : [runtimeImageCleanup]),
+    ];
     return {
         ...collected.result,
-        ok: runtimeImageCleanup?.status !== "failed",
-        ...(runtimeImageCleanup === undefined
+        ok: runtimeImageCleanup?.status !== "failed" &&
+            supersededImageCleanup?.status !== "failed",
+        ...(postPromotionChecks.length === 0
             ? {}
-            : { checks: [...collected.result.checks, runtimeImageCleanup] }),
-        deployment: deploymentMetadata(identity, targetKey, "deployed"),
+            : { checks: [...collected.result.checks, ...postPromotionChecks] }),
+        deployment: deploymentMetadata(identity, targetKey, "deployed", operation, superseded),
     };
 }
 async function collectEvePreflight(request, options) {
@@ -1848,12 +2093,14 @@ async function collectEvePreflight(request, options) {
     }
     let cloudflare;
     let publicOrigin;
+    let priorDeployment;
     if (request.command === "deploy") {
         eveProgress(options, "checking Cloudflare access and exact target");
         try {
             cloudflare = await readEveCloudflareTarget({
                 projectId: packaging.project?.projectId ?? "unknown-project",
                 sourceDigest: candidate.sourceDigest,
+                projectRoot: request.projectRoot,
                 environment: request.environment,
                 name: request.name,
             }, options);
@@ -1875,6 +2122,17 @@ async function collectEvePreflight(request, options) {
             };
         }
         checks.push(...cloudflareChecks(cloudflare));
+        // An owned target also requires its immutable record so the update can
+        // carry the published Durable Object history forward append-only.
+        if (cloudflare.target.state === "owned") {
+            const record = await readEveDeploymentRecord(request.projectRoot, request.environment, request.name, cloudflare.accountId, packaging.project?.projectId === "unknown-project"
+                ? undefined
+                : packaging.project?.projectId);
+            priorDeployment = record ?? undefined;
+            if (record === undefined || record.durableObjects === undefined) {
+                checks.push(check("VAL-CLI-007-TARGET-CONFLICT", "failed", "The exact target is Eden-owned, but its immutable deployment record does not carry a readable Durable Object history.", "Re-run the last successful deploy generation or destroy the exact target; updating without the recorded migration history could diverge Durable Object declarations."));
+            }
+        }
         publicOrigin = await resolvedCloudflareOrigin(cloudflare, request.name);
         if (publicOrigin === undefined) {
             checks.push(check("VAL-HOST-006", "failed", "The authenticated Cloudflare read did not prove the exact workers.dev origin before Eve initialization.", "Return one authenticated account ID, one workers.dev subdomain, and the exact Worker-origin binding."));
@@ -2006,6 +2264,7 @@ async function collectEvePreflight(request, options) {
             cloudflare = await readEveCloudflareTarget({
                 projectId: packaging.project?.projectId ?? "unknown-project",
                 sourceDigest: candidate.sourceDigest,
+                projectRoot: request.projectRoot,
                 environment: request.environment,
                 name: request.name,
             }, options);
@@ -2049,6 +2308,7 @@ async function collectEvePreflight(request, options) {
         // reported as EVE_SCHEDULE_UNSUPPORTED and fire only while awake.
         schedules: expressible,
         cloudflare,
+        ...(priorDeployment === undefined ? {} : { priorDeployment }),
         ...(workflowWorld === undefined ? {} : { workflowWorld }),
     };
 }
@@ -2095,7 +2355,7 @@ export async function runEveControlPlane(request, options = {}) {
                     message: status === "indeterminate"
                         ? "The Eve deployment outcome is indeterminate; inspect the retained exact ownership evidence before retrying."
                         : status === "deployed"
-                            ? "The Eve deployment is healthy and promoted, but exact local runtime-image cleanup failed; do not retry the deployment."
+                            ? "The Eve deployment is healthy and promoted, but exact image cleanup failed; do not retry the deployment."
                             : "The Eve deployment failed before exact target promotion.",
                 });
             }
@@ -2223,6 +2483,172 @@ async function parseEveDestroyRecord(recordPath, environment, name) {
         identity: verified,
     };
 }
+/**
+ * Reads the immutable records for this target. The live identity comes from
+ * CURRENT first, then the newest `deployed` record, then the newest record
+ * of any status; the Durable Object history comes from the newest record
+ * that carries one, healthy or not, so a failed update's published tags are
+ * never dropped.
+ */
+async function readEveDeploymentRecord(projectRoot, environment, name, accountId, projectId) {
+    const targetsRoot = join(projectRoot, ".eden", "eve-deploy", "targets", `${environment}-${name}`);
+    const generationsRoot = join(projectRoot, ".eden", "eve-deploy", "generations");
+    const entries = await readdir(generationsRoot).catch(() => []);
+    const scanned = [];
+    const deploymentIds = new Set();
+    const images = new Set();
+    for (const entry of entries) {
+        const generationRoot = join(generationsRoot, entry);
+        const recordPath = join(generationRoot, "deployment.json");
+        const details = await lstat(recordPath).catch(() => undefined);
+        if (details === undefined || !details.isFile())
+            continue;
+        const parsed = await parseEveDeploymentRecord(recordPath, environment, name);
+        if (parsed !== undefined) {
+            // Only records for this account and (when known) this project may
+            // arbitrate ownership or supply migration history.
+            if ((accountId !== undefined && parsed.identity.accountId !== accountId) ||
+                (projectId !== undefined && parsed.identity.projectId !== projectId)) {
+                continue;
+            }
+            scanned.push({
+                record: parsed,
+                generationRoot,
+                modifiedAt: details.mtimeMs,
+            });
+            const deploymentId = parsed.deploymentId;
+            if (deploymentId !== undefined)
+                deploymentIds.add(deploymentId);
+            if (typeof parsed.identity.containerImage === "string") {
+                images.add(parsed.identity.containerImage);
+            }
+        }
+    }
+    scanned.sort((left, right) => right.modifiedAt - left.modifiedAt);
+    const current = await lstat(join(targetsRoot, "CURRENT")).catch(() => undefined);
+    let live = scanned.find((entry) => entry.record.status === "deployed") ?? scanned[0];
+    if (current !== undefined && current.isSymbolicLink()) {
+        const generationRoot = await realpath(join(targetsRoot, "CURRENT")).catch(() => undefined);
+        if (generationRoot !== undefined) {
+            const pinned = scanned.find((entry) => entry.generationRoot === generationRoot);
+            if (pinned !== undefined) {
+                live = pinned;
+            }
+            else {
+                const parsed = await parseEveDeploymentRecord(join(generationRoot, "deployment.json"), environment, name);
+                if (parsed !== undefined &&
+                    !((accountId !== undefined &&
+                        parsed.identity.accountId !== accountId) ||
+                        (projectId !== undefined &&
+                            parsed.identity.projectId !== projectId))) {
+                    live = { record: parsed, generationRoot, modifiedAt: 0 };
+                }
+            }
+        }
+    }
+    if (live === undefined)
+        return undefined;
+    // Newest record carrying a usable DO history wins, regardless of its
+    // deployment outcome: a tag it published must never be replayed.
+    const historySource = scanned.find((entry) => entry.record.durableObjects !== undefined);
+    return {
+        recordPath: live.record.recordPath,
+        generationRoot: live.generationRoot,
+        identity: live.record.identity,
+        status: live.record.status,
+        deploymentIds: [...deploymentIds],
+        images: [...images],
+        worldCloudflare: live.record.worldCloudflare,
+        durableObjects: historySource?.record.durableObjects,
+    };
+}
+async function parseEveDeploymentRecord(recordPath, environment, name) {
+    const base = await parseEveDestroyRecord(recordPath, environment, name);
+    if (base === undefined)
+        return undefined;
+    let parsed;
+    try {
+        parsed = JSON.parse(await readFile(recordPath, "utf8"));
+    }
+    catch {
+        return undefined;
+    }
+    if (typeof parsed !== "object" || parsed === null)
+        return undefined;
+    const record = parsed;
+    const identityRaw = parsed.identity;
+    const deploymentId = typeof identityRaw === "object" &&
+        identityRaw !== null &&
+        typeof identityRaw
+            .deploymentId === "string"
+        ? identityRaw.deploymentId
+        : undefined;
+    const status = typeof record.status === "string" &&
+        ["deployed", "failed", "indeterminate"].includes(record.status)
+        ? record.status
+        : undefined;
+    const worker = typeof record.worker === "object" && record.worker !== null
+        ? record.worker
+        : undefined;
+    const rawBindings = worker !== undefined && "durable_objects" in worker &&
+        typeof worker.durable_objects === "object" &&
+        worker.durable_objects !== null &&
+        "bindings" in worker.durable_objects
+        ? worker.durable_objects.bindings
+        : undefined;
+    const rawMigrations = worker !== undefined && "migrations" in worker
+        ? worker.migrations
+        : undefined;
+    const rawVars = worker !== undefined && "vars" in worker &&
+        typeof worker.vars === "object" && worker.vars !== null
+        ? worker.vars
+        : undefined;
+    const bindings = [];
+    const migrations = [];
+    const durableObjectsValid = Array.isArray(rawBindings) &&
+        Array.isArray(rawMigrations);
+    if (durableObjectsValid) {
+        for (const binding of rawBindings) {
+            if (typeof binding !== "object" || binding === null ||
+                typeof binding.name !== "string" ||
+                typeof binding.class_name !== "string") {
+                return {
+                    recordPath,
+                    identity: base.identity,
+                    status,
+                    deploymentId,
+                    worldCloudflare: rawVars?.EDEN_EVE_WORLD_CLOUDFLARE === true,
+                    durableObjects: undefined,
+                };
+            }
+            bindings.push(binding);
+        }
+        for (const migration of rawMigrations) {
+            if (typeof migration !== "object" || migration === null ||
+                typeof migration.tag !== "string" ||
+                !Array.isArray(migration.new_sqlite_classes) ||
+                migration.new_sqlite_classes.some((className) => typeof className !== "string")) {
+                return {
+                    recordPath,
+                    identity: base.identity,
+                    status,
+                    deploymentId,
+                    worldCloudflare: rawVars?.EDEN_EVE_WORLD_CLOUDFLARE === true,
+                    durableObjects: undefined,
+                };
+            }
+            migrations.push(migration);
+        }
+    }
+    return {
+        recordPath,
+        identity: base.identity,
+        status,
+        deploymentId,
+        worldCloudflare: rawVars?.EDEN_EVE_WORLD_CLOUDFLARE === true,
+        durableObjects: durableObjectsValid ? { bindings, migrations } : undefined,
+    };
+}
 async function defaultDestroyTargetRead(request) {
     const account = await readWranglerJson(["whoami", "--json"]);
     const deployments = await readWranglerJson([

package/dist/eve.js

@@ -49,7 +49,7 @@ Options:
 `,
     deploy: `Usage: eden deploy [--project <path>] [--env <preview|production>] [--name <name>] [--env-file <path>] [--json]
 
-Deploy the selected Eve project to one exact target after host checks pass.
+Deploy the selected Eve project to one exact target after host checks pass. When the exact target already exists and Eden's immutable record proves it owns it, deploy updates the Worker in place and keeps Durable Object data; a target Eden cannot prove it owns still fails the conflict check.
 
 Options:
   --project <path>     Eve project root (default: current directory)

package/dist/index.d.ts

@@ -10,7 +10,7 @@ export type { EveCliCommand, EveCliEnvironment, EveCliExecutionRequest, EveCliHe
 export type { EveNodeImage, EvePackagingCheck, EvePackagingCode, EveProjectBuilder, EveProjectBuilderRequest, EveProjectBuilderResult, EveProjectBuildCandidate, EveProjectFile, EveProjectImage, EveProjectInputManifest, EveProjectOutput, EveProjectPackagingResult, EveProjectRuntime, EveProjectSnapshot, EveProjectSnapshotOptions, EveProjectToolchain, EveRuntimeConfigExclusion, } from "./eve-packaging.js";
 export type { EveHostRequirements, EveRuntimeClosure, EveRuntimeClosureFile, EveRuntimeCleanup, EveRuntimeImage, EveRuntimeImageDiscardRequest, EveRuntimeImageMetadata, EveRuntimeImageRequest, EveRuntimeImageResult, EveRuntimeNativeModule, EveRuntimeStatus, } from "./eve-runtime-image.js";
 export { DEFAULT_EVE_HOST_REQUIREMENTS, DEFAULT_EVE_NODE_IMAGE, runEveControlPlane, runEveDestroy, } from "./eve-control-plane.js";
-export type { EveCloudflareReadRequest, EveCloudflareReadResult, EveCloudflareReadRunner, EveCloudflareTargetState, EveContainerDeleteRunner, EveDeploymentCompensationRequest, EveDeploymentCompensationRunner, EveDeploymentHealthRequest, EveDeploymentHealthResult, EveDeploymentHealthRunner, EveDeploymentIdentity, EveDeploymentIdentityProof, EveDeploymentMetadata, EveDeploymentPublicationRequest, EveDeploymentPublicationResult, EveDeploymentPublicationRunner, EveDeploymentStatus, EveDestroyCloudflareReadRequest, EveDestroyCloudflareReadRunner, EveDestroyOutcome, EveDestroyTargetRead, EveImagePublicationRequest, EveImagePublicationResult, EveImagePublicationRunner, EvePreflightCandidate, EvePreflightResult, EvePreflightRuntimeEvidence, EvePreflightWarning, EvePreflightRuntimeRunner, EvePreflightRuntimeRunnerRequest, EveRuntimeConfigLoader, EveRuntimeImageDiscardRunner, EveWorkerDeleteRunner, } from "./eve-control-plane.js";
+export type { EveCloudflareReadRequest, EveCloudflareReadResult, EveCloudflareReadRunner, EveCloudflareTargetState, EveContainerDeleteRunner, EveDeploymentCompensationRequest, EveDeploymentCompensationRunner, EveDeploymentHealthRequest, EveDeploymentHealthResult, EveDeploymentHealthRunner, EveDeploymentIdentity, EveDeploymentIdentityProof, EveDeploymentMetadata, EveDeploymentPublicationRequest, EveDeploymentPublicationResult, EveDeploymentPublicationRunner, EveDeploymentStatus, EveDestroyCloudflareReadRequest, EveDestroyCloudflareReadRunner, EveDestroyOutcome, EveDestroyTargetRead, EveImagePublicationRequest, EveImagePublicationResult, EveImagePublicationRunner, EvePreflightCandidate, EvePreflightResult, EvePreflightRuntimeEvidence, EvePreflightWarning, EvePreflightRuntimeRunner, EvePreflightRuntimeRunnerRequest, EveRegistryImageDeleteRunner, EveRuntimeConfigLoader, EveRuntimeImageDiscardRunner, EveWorkerDeleteRunner, } from "./eve-control-plane.js";
 export declare const EDEN_CLI_COMMANDS: readonly ["preflight", "deploy", "destroy"];
 export type EdenCliCommand = (typeof EDEN_CLI_COMMANDS)[number];
 export interface EdenCliRunOptions {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moinulmoin/eden",
-  "version": "0.4.1",
+  "version": "0.5.0",
   "description": "Deploy existing Eve projects to your own Cloudflare account.",
   "keywords": [
     "ai",
@@ -31,7 +31,7 @@
     "NOTICE"
   ],
   "dependencies": {
-    "@moinulmoin/eden-runtime-cloudflare": "0.4.1",
+    "@moinulmoin/eden-runtime-cloudflare": "0.5.0",
     "wrangler": "4.120.0"
   },
   "devDependencies": {