@moinulmoin/eden 0.5.0 → 0.6.0

package/NOTICE

@@ -1,15 +1,6 @@
 Eden
 Copyright 2026 Eden contributors
 
-Cloudflare Containers
-  @cloudflare/containers, version 0.3.7
-  https://github.com/cloudflare/containers
-
-Eden's generated Worker host bundle includes software from
-`@cloudflare/containers`, distributed under MIT OR Apache-2.0. Eden
-redistributes that bundled software under the Apache-2.0 option included in
-LICENSE.
-
 Workflow SDK
   @workflow/world-postgres, version 5.0.0-beta.47
   https://github.com/vercel/workflow

package/README.md

@@ -12,15 +12,15 @@ If you already have an Eve project, start with `eden deploy`.
 Use any one of these package managers:
 
 ```sh
-npm install --global @moinulmoin/eden@0.5.0
+npm install --global @moinulmoin/eden@0.6.0
 ```
 
 ```sh
-pnpm add --global @moinulmoin/eden@0.5.0
+pnpm add --global @moinulmoin/eden@0.6.0
 ```
 
 ```sh
-bun add --global @moinulmoin/eden@0.5.0
+bun add --global @moinulmoin/eden@0.6.0
 ```
 
 Then confirm the CLI is available:
@@ -39,7 +39,7 @@ Bun can install Eden, but Eden still runs on Node. Do not use `bunx --bun`.
 - Wrangler authentication:
 
   ```sh
-  npx wrangler@4.120.0 login
+  npx wrangler@4.147.0 login
   ```
 
 - Docker or OrbStack with Linux/amd64 container support

package/dist/eve-control-plane.d.ts

@@ -2,7 +2,7 @@ import { type EveCliEnvironment, type EveCliExecutionRequest } from "./eve.js";
 import { type EveNodeImage, type EveProjectBuildCandidate, type EveProjectBuilder } from "./eve-packaging.js";
 import { type EveHostRequirements, type EveRuntimeCleanup, type EveRuntimeImageDiscardRequest } from "./eve-runtime-image.js";
 import { type EveRuntimeConfig, type EveRuntimeInjection, type EveRuntimeProtectedStore } from "./eve-runtime-config.js";
-import type { EveHostConfig } from "@moinulmoin/eden-runtime-cloudflare";
+import { type EveHostConfig } from "@moinulmoin/eden-runtime-cloudflare";
 export declare const DEFAULT_EVE_HOST_REQUIREMENTS: EveHostRequirements;
 export declare const DEFAULT_EVE_NODE_IMAGE: EveNodeImage;
 export type EvePreflightCheckStatus = "passed" | "failed" | "blocked" | "skipped";
@@ -87,15 +87,18 @@ export interface EveCloudflareReadResult {
         /**
          * Provider-backed facts about the live target, read through the
          * Cloudflare API (not self-asserted response headers, which any Worker
-         * can forge): the Container application's configured image and the
-         * `EDEN_EVE_DEPLOYMENT_ID` plain-text var Eden stamps into every Worker
-         * it publishes. `settingsReadable` tells the ownership resolver whether
-         * a missing var is evidence of a foreign Worker or just an unreadable
-         * settings call.
+         * can forge): the Container application's Durable Object namespace and
+         * the `EDEN_EVE_DEPLOYMENT_ID` plain-text var Eden stamps into every
+         * Worker it publishes. `settingsReadable` tells the ownership resolver
+         * whether a missing var is evidence of a foreign Worker or just an
+         * unreadable settings call.
          */
         readonly providerEvidence?: {
-            readonly containerImage?: string;
+            readonly containerApplicationId?: string;
+            readonly containerSchedulingPolicy?: string;
+            readonly containerNamespaceId?: string;
             readonly workerDeploymentId?: string;
+            readonly workerContainerNamespaceId?: string;
             readonly settingsReadable?: boolean;
         };
     };
@@ -249,19 +252,20 @@ export interface EvePreflightOptions {
     readonly destroyCloudflareRead?: EveDestroyCloudflareReadRunner;
     readonly deleteWorker?: EveWorkerDeleteRunner;
     readonly deleteContainer?: EveContainerDeleteRunner;
-    readonly deleteRegistryImage?: EveRegistryImageDeleteRunner;
+    readonly deleteRegistryRepository?: EveRegistryRepositoryDeleteRunner;
 }
 export interface EveDestroyTargetRead {
     readonly workerExists: boolean;
     readonly containerApplicationId?: string;
     readonly accountId?: string;
     /**
-     * Subset of the request's owned registry image tags (`repository:tag`)
-     * still present in the managed registry. `undefined` means the reader
-     * could not enumerate the registry; destroy then relies on the exact
-     * delete outcomes only.
+     * Every `repository:tag` ref still present in the managed registry whose
+     * repository is one of the request's owned repositories — including the
+     * `rootfs-snapshot-*`/`rootfs-set-*` tags container snapshots create.
+     * `undefined` means the reader could not enumerate the registry; destroy
+     * then relies on the exact delete outcomes only.
      */
-    readonly registryImagesPresent?: readonly string[];
+    readonly registryTagsPresent?: readonly string[];
 }
 export type EveDestroyCloudflareReadRunner = (request: EveDestroyCloudflareReadRequest) => EveDestroyTargetRead | Promise<EveDestroyTargetRead>;
 export type EveWorkerDeleteRunner = (request: {
@@ -270,15 +274,15 @@ export type EveWorkerDeleteRunner = (request: {
 export type EveContainerDeleteRunner = (request: {
     readonly applicationId: string;
 }) => "deleted" | "absent" | "indeterminate" | Promise<"deleted" | "absent" | "indeterminate">;
-export type EveRegistryImageDeleteRunner = (request: {
-    readonly image: string;
+export type EveRegistryRepositoryDeleteRunner = (request: {
+    readonly repository: string;
 }) => "deleted" | "absent" | "indeterminate" | Promise<"deleted" | "absent" | "indeterminate">;
 export type EveRuntimeConfigLoader = (path: string, cwd: string) => EveRuntimeConfig | Promise<EveRuntimeConfig>;
 export interface EveDestroyCloudflareReadRequest {
     readonly workerName: string;
     readonly containerApplicationName: string;
-    /** Exact `repository:tag` image refs recorded for this target. */
-    readonly registryImages?: readonly string[];
+    /** Registry repository names this target provably owns. */
+    readonly registryRepositories?: readonly string[];
 }
 /**
  * Container applications in the account that belong to this exact target.
@@ -288,7 +292,6 @@ export interface EveDestroyCloudflareReadRequest {
 export declare function exactTargetContainerEntries(value: unknown, name: string): readonly {
     readonly id: string;
     readonly name: string;
-    readonly image?: string;
 }[] | undefined;
 export declare function runEveControlPlane(request: EveCliExecutionRequest, options?: EvePreflightOptions): Promise<void>;
 export interface EveDestroyOutcome {

package/dist/eve-control-plane.js

@@ -11,6 +11,7 @@ import { EveCliError, } from "./eve.js";
 import { buildEveProjectSnapshot, createDockerEveProjectBuilder, revalidateEveProjectCandidateInputs, EvePackagingError, } from "./eve-packaging.js";
 import { buildEveRuntimeImage, discardEveRuntimeImage, revalidateEveRuntimeCandidate, validateEveHostRequirements, } from "./eve-runtime-image.js";
 import { EveRuntimeConfigError, prepareEveRuntimeInjection, redactEveRuntimeOutput, } from "./eve-runtime-config.js";
+import { createEveHostConfig, generateEveHostWorkerSource, parseEveScheduleCron, resolveStableWorkersDevOrigin, } from "@moinulmoin/eden-runtime-cloudflare";
 const execFileAsync = promisify(execFile);
 const require = createRequire(import.meta.url);
 const wranglerEntrypoint = require.resolve("wrangler");
@@ -440,21 +441,11 @@ function exactContainerEntries(value, name) {
             typeof entry.name !== "string") {
             return undefined;
         }
-        const id = entry.id;
         const entryName = entry.name;
         if (entryName === name) {
-            const configuration = entry.configuration;
-            const image = typeof entry.image === "string"
-                ? entry.image
-                : typeof configuration === "object" &&
-                    configuration !== null &&
-                    typeof configuration.image === "string"
-                    ? configuration.image
-                    : undefined;
             entries.push({
-                id,
+                id: entry.id,
                 name: entryName,
-                ...(image === undefined ? {} : { image }),
             });
         }
     }
@@ -610,7 +601,7 @@ async function defaultCloudflareRead(request) {
     }
     const workerPresent = deploymentEntries.length > 0;
     const containerPresent = (containerEntries?.length ?? 0) > 0;
-    const providerEvidence = await readProviderEvidence(request.name, accountId, workerPresent, containerPresent ? containerEntries?.[0]?.image : undefined);
+    const providerEvidence = await readProviderEvidence(request.name, accountId, workerPresent, containerPresent ? containerEntries?.[0] : undefined);
     return {
         accountAccess,
         containerAccess,
@@ -634,16 +625,40 @@ async function defaultCloudflareRead(request) {
 }
 /**
  * Reads provider-backed facts about the live target: the Container
- * application's configured image (from `wrangler containers list`) and the
- * `EDEN_EVE_DEPLOYMENT_ID` plain-text var Eden stamps into every Worker it
- * publishes (from the script settings API). Both are provider state — a
- * foreign Worker can forge `x-eden-*` response headers but cannot set a var
- * Eden recorded at publish time.
+ * application's identity from `wrangler containers list` plus `containers
+ * info` (scheduling policy and Durable Object namespace), and the
+ * `EDEN_EVE_DEPLOYMENT_ID` plain-text var plus the `EVE_CONTAINER` Durable
+ * Object namespace Eden stamps into every Worker it publishes (from the
+ * script settings API). All are provider state — a foreign Worker can forge
+ * `x-eden-*` response headers but cannot set vars or namespaces Eden
+ * recorded at publish time. The ownership proof is the Container
+ * application's Durable Object namespace matching the Worker's binding
+ * namespace.
  */
-async function readProviderEvidence(workerName, accountId, workerPresent, containerImage) {
+async function readProviderEvidence(workerName, accountId, workerPresent, containerEntry) {
     const evidence = {
-        ...(containerImage === undefined ? {} : { containerImage }),
+        ...(containerEntry === undefined
+            ? {}
+            : { containerApplicationId: containerEntry.id }),
     };
+    if (containerEntry !== undefined) {
+        const info = await readWranglerJson([
+            "containers",
+            "info",
+            containerEntry.id,
+            "--json",
+        ]);
+        if (!info.failed && typeof info.value === "object" && info.value !== null) {
+            const infoRecord = info.value;
+            if (typeof infoRecord.scheduling_policy === "string") {
+                evidence.containerSchedulingPolicy = infoRecord.scheduling_policy;
+            }
+            const namespaceId = infoRecord.durable_objects?.namespace_id;
+            if (typeof namespaceId === "string") {
+                evidence.containerNamespaceId = namespaceId;
+            }
+        }
+    }
     if (workerPresent && accountId !== undefined) {
         const token = process.env.CLOUDFLARE_API_TOKEN ??
             (await readWranglerOAuthToken());
@@ -656,10 +671,16 @@ async function readProviderEvidence(workerName, accountId, workerPresent, contai
                 if (response.ok) {
                     evidence.settingsReadable = true;
                     const parsed = (await response.json());
-                    const binding = parsed.result?.bindings?.find((value) => value.type === "plain_text" &&
+                    const bindings = parsed.result?.bindings ?? [];
+                    const deploymentBinding = bindings.find((value) => value.type === "plain_text" &&
                         value.name === "EDEN_EVE_DEPLOYMENT_ID");
-                    if (typeof binding?.text === "string") {
-                        evidence.workerDeploymentId = binding.text;
+                    if (typeof deploymentBinding?.text === "string") {
+                        evidence.workerDeploymentId = deploymentBinding.text;
+                    }
+                    const containerBinding = bindings.find((value) => value.type === "durable_object_namespace" &&
+                        value.name === "EVE_CONTAINER");
+                    if (typeof containerBinding?.namespace_id === "string") {
+                        evidence.workerContainerNamespaceId = containerBinding.namespace_id;
                     }
                 }
                 else if (response.status !== 404) {
@@ -698,19 +719,23 @@ async function resolveEveTargetOwnership(request, result) {
     }
     // Remote proof must come from provider state. A foreign Worker can echo
     // `x-eden-*` response headers, but it cannot plant the plain-text var Eden
-    // publishes into script settings, nor point the Container application at an
-    // image digest Eden recorded. The Worker is proven only by its own settings:
-    // a matching Container image proves the Container, never the Worker, so
-    // unreadable settings fail closed.
+    // publishes into script settings or claim the Durable Object namespace the
+    // Worker's EVE_CONTAINER binding resolves to. The Worker is proven only by
+    // its own settings: unreadable settings fail closed.
     const evidence = result.target.providerEvidence;
     const recordedDeploymentIds = new Set(record.deploymentIds);
     const workerProven = result.target.observed?.worker !== true ||
         (evidence?.settingsReadable === true &&
             evidence.workerDeploymentId !== undefined &&
             recordedDeploymentIds.has(evidence.workerDeploymentId));
+    // The Container proof is the application running the durable_object
+    // scheduling policy with a namespace that matches the Worker binding's
+    // namespace; anything else fails closed.
     const containerProven = result.target.observed?.container !== true ||
-        (evidence?.containerImage !== undefined &&
-            record.images.includes(evidence.containerImage));
+        (evidence?.containerSchedulingPolicy === "durable_object" &&
+            evidence.containerNamespaceId !== undefined &&
+            evidence.workerContainerNamespaceId !== undefined &&
+            evidence.containerNamespaceId === evidence.workerContainerNamespaceId);
     const remoteProven = evidence !== undefined && workerProven && containerProven;
     if (!remoteProven) {
         return {
@@ -763,7 +788,6 @@ async function resolvedCloudflareOrigin(result, workerName) {
         return undefined;
     }
     try {
-        const { resolveStableWorkersDevOrigin } = await import("@moinulmoin/eden-runtime-cloudflare");
         const origin = resolveStableWorkersDevOrigin({
             workerName,
             workersDevSubdomain: result.workersDevSubdomain,
@@ -1130,8 +1154,6 @@ function defaultPublicationRunner() {
             "--env",
             request.identity.environment,
             "--strict",
-            "--containers-rollout",
-            "immediate",
         ], dirname(request.wranglerConfigPath));
         if (result.exitCode !== 0) {
             return {
@@ -1490,7 +1512,6 @@ async function runEveDeployment(request, options, collected) {
     }
     let stableWorkersDevOrigin;
     try {
-        const { resolveStableWorkersDevOrigin } = await import("@moinulmoin/eden-runtime-cloudflare");
         stableWorkersDevOrigin = resolveStableWorkersDevOrigin({
             workerName: request.name,
             workersDevSubdomain,
@@ -1607,38 +1628,39 @@ async function runEveDeployment(request, options, collected) {
             ? {}
             : { runtimeRevisionHandle: runtimeInjection.protectedHandle }),
     };
+    const baseConfigRequest = {
+        accountId,
+        workerName: identity.workerName,
+        containerApplicationName: identity.containerApplicationName,
+        containerClassName: "EveHostDurableContainer",
+        containerBindingName: "EVE_CONTAINER",
+        stableContainerInstanceName: identity.stableContainerInstanceName,
+        deploymentId: identity.deploymentId,
+        generationId: identity.generationId,
+        stableWorkersDevOrigin: identity.stableWorkersDevOrigin,
+        containerImage: identity.containerImage,
+        runtimeVariableNames: identity.runtimeVariableNames,
+        ...(identity.runtimeRevisionHandle === undefined
+            ? {}
+            : { runtimeRevisionHandle: identity.runtimeRevisionHandle }),
+        schedules: collected.schedules ?? [],
+        ...(collected.workflowWorld === undefined
+            ? {}
+            : { workflowWorld: collected.workflowWorld }),
+        // In-place updates carry the prior Durable Object bindings and
+        // migration history forward verbatim: classes are append-only and are
+        // never silently re-declared or removed.
+        ...(isUpdate && priorDurableObjects !== undefined
+            ? { durableObjects: priorDurableObjects }
+            : {}),
+        ...(process.env.EDEN_EVE_CONTAINER_SLEEP_AFTER === undefined
+            ? {}
+            : { containerSleepAfter: process.env.EDEN_EVE_CONTAINER_SLEEP_AFTER }),
+    };
     let hostConfig;
     try {
-        const { createEveHostConfig, } = await import("@moinulmoin/eden-runtime-cloudflare");
         hostConfig = createEveHostConfig({
-            accountId,
-            workerName: identity.workerName,
-            containerApplicationName: identity.containerApplicationName,
-            containerClassName: "EveHostContainer",
-            containerBindingName: "EVE_CONTAINER",
-            stableContainerInstanceName: identity.stableContainerInstanceName,
-            deploymentId: identity.deploymentId,
-            generationId: identity.generationId,
-            stableWorkersDevOrigin: identity.stableWorkersDevOrigin,
-            containerImage: identity.containerImage,
-            runtimeVariableNames: identity.runtimeVariableNames,
-            ...(identity.runtimeRevisionHandle === undefined
-                ? {}
-                : { runtimeRevisionHandle: identity.runtimeRevisionHandle }),
-            schedules: collected.schedules ?? [],
-            ...(collected.workflowWorld === undefined
-                ? {}
-                : { workflowWorld: collected.workflowWorld }),
-            // In-place updates carry the prior Durable Object bindings and
-            // migration history forward verbatim: classes are append-only, never
-            // re-declared, and never deleted (a deleted_classes migration destroys
-            // the data).
-            ...(isUpdate && priorDurableObjects !== undefined
-                ? { durableObjects: priorDurableObjects }
-                : {}),
-            ...(process.env.EDEN_EVE_CONTAINER_SLEEP_AFTER === undefined
-                ? {}
-                : { containerSleepAfter: process.env.EDEN_EVE_CONTAINER_SLEEP_AFTER }),
+            ...baseConfigRequest,
         });
     }
     catch (error) {
@@ -1646,7 +1668,6 @@ async function runEveDeployment(request, options, collected) {
             ? error.message
             : "The exact Eve Worker/Container host configuration was invalid.");
     }
-    const { generateEveHostWorkerSource } = await import("@moinulmoin/eden-runtime-cloudflare");
     const workerSource = generateEveHostWorkerSource({ config: hostConfig });
     const paths = await writeEveDeploymentArtifacts(candidate, hostConfig, workerSource);
     const publicationRequest = {
@@ -1656,13 +1677,26 @@ async function runEveDeployment(request, options, collected) {
         ...paths,
         ...(runtimeInjection === undefined ? {} : { runtimeInjection }),
     };
+    /** Publishes one wrangler config; returns its terminal result. */
+    const publishOne = async (request) => (options.publish ?? defaultPublicationRunner())(request);
     let publication;
+    const writeFailureRecord = async (status, evidence) => {
+        try {
+            await writeEveDeploymentRecord(candidate, identity, hostConfig, status, {
+                evidence,
+            });
+        }
+        catch (error) {
+            if (error.code !== "EEXIST")
+                throw error;
+        }
+    };
     try {
         eveProgress(options, "publishing Worker and Container application");
-        publication = await (options.publish ?? defaultPublicationRunner())(publicationRequest);
+        publication = await publishOne(publicationRequest);
     }
     catch {
-        await writeEveDeploymentRecord(candidate, identity, hostConfig, "indeterminate", { evidence: "publication-threw-before-terminal-result" });
+        await writeFailureRecord("indeterminate", "publication-threw-before-terminal-result");
         const deployment = deploymentMetadata(identity, targetKey, "indeterminate", operation, superseded);
         return {
             ...collected.result,
@@ -1671,7 +1705,7 @@ async function runEveDeployment(request, options, collected) {
         };
     }
     if (publication.status === "indeterminate") {
-        await writeEveDeploymentRecord(candidate, identity, hostConfig, "indeterminate", { evidence: safeText(publication.reason) });
+        await writeFailureRecord("indeterminate", safeText(publication.reason));
         return {
             ...collected.result,
             ok: false,
@@ -1862,25 +1896,26 @@ async function runEveDeployment(request, options, collected) {
     if (isUpdate) {
         // The superseded generation's registry repository is generation-scoped
         // and no longer referenced once CURRENT promotes this generation; only
-        // then is it safe to delete.
-        const previousImage = priorIdentity === undefined
+        // then is it safe to delete. Every tag in the repository goes with it —
+        // including the snapshot tags Cloudflare created under it.
+        const previousRepository = priorIdentity === undefined
             ? undefined
-            : ownedRegistryImageRef(priorIdentity, request.environment, request.name, accountId);
-        if (previousImage !== undefined) {
-            eveProgress(options, `deleting superseded registry image ${previousImage}`);
+            : ownedRegistryRepository(priorIdentity, request.environment, request.name, accountId);
+        if (previousRepository !== undefined) {
+            eveProgress(options, `deleting superseded registry repository ${previousRepository}`);
             let deleted = "indeterminate";
             try {
-                deleted = await (options.deleteRegistryImage ??
-                    defaultRegistryImageDelete)({ image: previousImage });
+                deleted = await (options.deleteRegistryRepository ??
+                    defaultRegistryRepositoryDelete)({ repository: previousRepository });
             }
             catch {
                 deleted = "indeterminate";
             }
             supersededImageCleanup = deleted === "indeterminate"
-                ? check("VAL-LIFE-007", "failed", `The update is healthy and promoted, but the superseded registry image ${previousImage} could not be proven deleted.`, `Remove only the recorded image ref ${previousImage}; do not retry or run broad registry cleanup.`)
+                ? check("VAL-LIFE-007", "failed", `The update is healthy and promoted, but the superseded registry repository ${previousRepository} could not be proven deleted.`, `Remove only the recorded repository's tags ${previousRepository}; do not retry or run broad registry cleanup.`)
                 : check("VAL-LIFE-007", "passed", deleted === "deleted"
-                    ? "The superseded generation's registry image was deleted after promotion."
-                    : "The superseded generation's registry image was already absent.");
+                    ? "The superseded generation's registry repository (all tags, including snapshots) was deleted after promotion."
+                    : "The superseded generation's registry repository was already absent.");
         }
     }
     let runtimeImageCleanup;
@@ -2058,9 +2093,6 @@ async function collectEvePreflight(request, options) {
     }
     warnings.push(...(await collectEveWorldWarnings(candidate, undefined)));
     const schedules = await readCompiledSchedules(candidate);
-    // The runtime package is imported lazily so `eden` commands that never
-    // reach deploy checks stay fast; the module specifier is fixed.
-    const { parseEveScheduleCron } = await import("@moinulmoin/eden-runtime-cloudflare");
     const expressible = schedules.filter((schedule) => parseEveScheduleCron(schedule.cron) !== undefined);
     const unexpressible = schedules.filter((schedule) => parseEveScheduleCron(schedule.cron) === undefined);
     if (unexpressible.length > 0) {
@@ -2496,7 +2528,6 @@ async function readEveDeploymentRecord(projectRoot, environment, name, accountId
     const entries = await readdir(generationsRoot).catch(() => []);
     const scanned = [];
     const deploymentIds = new Set();
-    const images = new Set();
     for (const entry of entries) {
         const generationRoot = join(generationsRoot, entry);
         const recordPath = join(generationRoot, "deployment.json");
@@ -2519,9 +2550,6 @@ async function readEveDeploymentRecord(projectRoot, environment, name, accountId
             const deploymentId = parsed.deploymentId;
             if (deploymentId !== undefined)
                 deploymentIds.add(deploymentId);
-            if (typeof parsed.identity.containerImage === "string") {
-                images.add(parsed.identity.containerImage);
-            }
         }
     }
     scanned.sort((left, right) => right.modifiedAt - left.modifiedAt);
@@ -2557,7 +2585,6 @@ async function readEveDeploymentRecord(projectRoot, environment, name, accountId
         identity: live.record.identity,
         status: live.record.status,
         deploymentIds: [...deploymentIds],
-        images: [...images],
         worldCloudflare: live.record.worldCloudflare,
         durableObjects: historySource?.record.durableObjects,
     };
@@ -2607,19 +2634,20 @@ async function parseEveDeploymentRecord(recordPath, environment, name) {
     const migrations = [];
     const durableObjectsValid = Array.isArray(rawBindings) &&
         Array.isArray(rawMigrations);
+    const invalidHistory = () => ({
+        recordPath,
+        identity: base.identity,
+        status,
+        deploymentId,
+        worldCloudflare: rawVars?.EDEN_EVE_WORLD_CLOUDFLARE === true,
+        durableObjects: undefined,
+    });
     if (durableObjectsValid) {
         for (const binding of rawBindings) {
             if (typeof binding !== "object" || binding === null ||
                 typeof binding.name !== "string" ||
                 typeof binding.class_name !== "string") {
-                return {
-                    recordPath,
-                    identity: base.identity,
-                    status,
-                    deploymentId,
-                    worldCloudflare: rawVars?.EDEN_EVE_WORLD_CLOUDFLARE === true,
-                    durableObjects: undefined,
-                };
+                return invalidHistory();
             }
             bindings.push(binding);
         }
@@ -2627,15 +2655,8 @@ async function parseEveDeploymentRecord(recordPath, environment, name) {
             if (typeof migration !== "object" || migration === null ||
                 typeof migration.tag !== "string" ||
                 !Array.isArray(migration.new_sqlite_classes) ||
-                migration.new_sqlite_classes.some((className) => typeof className !== "string")) {
-                return {
-                    recordPath,
-                    identity: base.identity,
-                    status,
-                    deploymentId,
-                    worldCloudflare: rawVars?.EDEN_EVE_WORLD_CLOUDFLARE === true,
-                    durableObjects: undefined,
-                };
+                (migration.new_sqlite_classes ?? []).some((className) => typeof className !== "string")) {
+                return invalidHistory();
             }
             migrations.push(migration);
         }
@@ -2670,18 +2691,25 @@ async function defaultDestroyTargetRead(request) {
         (exactDeploymentEntries(deployments.value)?.length ?? 0) > 0;
     const entries = exactContainerEntries(containers.value, request.containerApplicationName);
     const firstContainer = entries === undefined ? undefined : entries[0];
-    const ownedImages = request.registryImages;
-    let registryImagesPresent;
-    if (ownedImages !== undefined && ownedImages.length > 0) {
+    const ownedRepositories = request.registryRepositories;
+    let registryTagsPresent;
+    if (ownedRepositories !== undefined && ownedRepositories.length > 0) {
         const images = await readWranglerJson([
             "containers",
             "images",
             "list",
             "--json",
         ]);
-        const present = registryImageNames(images.value);
-        if (!images.failed && present !== undefined) {
-            registryImagesPresent = ownedImages.filter((image) => present.has(image));
+        const tagsByRepository = registryTagsByRepository(images.value);
+        if (!images.failed && tagsByRepository !== undefined) {
+            const present = [];
+            for (const [repository, tags] of tagsByRepository) {
+                if (!ownedRepositories.includes(repository))
+                    continue;
+                for (const tag of tags)
+                    present.push(`${repository}:${tag}`);
+            }
+            registryTagsPresent = present;
         }
     }
     return {
@@ -2690,21 +2718,22 @@ async function defaultDestroyTargetRead(request) {
             ? {}
             : { containerApplicationId: firstContainer.id }),
         ...(accountId === undefined ? {} : { accountId }),
-        ...(registryImagesPresent === undefined
+        ...(registryTagsPresent === undefined
             ? {}
-            : { registryImagesPresent }),
+            : { registryTagsPresent }),
     };
 }
 /**
  * `wrangler containers images list --json` reports `[{name, tags}]` entries
- * with the account prefix already stripped from the repository name. The set
- * carries `repository:tag` refs for the owned tags Eden publishes.
+ * with the account prefix already stripped from the repository name. The map
+ * carries every tag per repository so owned-repository cleanup can delete
+ * snapshot tags alongside the pushed `candidate` tag.
  */
-function registryImageNames(value) {
+function registryTagsByRepository(value) {
     const collection = jsonCollection(value);
     if (collection === undefined)
         return undefined;
-    const names = new Set();
+    const tagsByRepository = new Map();
     for (const entry of collection) {
         if (typeof entry !== "object" || entry === null || !("name" in entry)) {
             return undefined;
@@ -2713,13 +2742,15 @@ function registryImageNames(value) {
         const tags = "tags" in entry ? entry.tags : undefined;
         if (typeof name !== "string" || !Array.isArray(tags))
             return undefined;
+        const validTags = [];
         for (const tag of tags) {
             if (typeof tag !== "string")
                 return undefined;
-            names.add(`${name}:${tag}`);
+            validTags.push(tag);
         }
+        tagsByRepository.set(name, validTags);
     }
-    return names;
+    return tagsByRepository;
 }
 async function defaultWorkerDelete(request) {
     const result = await runWranglerWithInput(["delete", "--name", request.name, "--force"], process.cwd(), "y\n");
@@ -2739,23 +2770,59 @@ async function defaultContainerDelete(request) {
     }
     return "indeterminate";
 }
-async function defaultRegistryImageDelete(request) {
-    const result = await runWranglerWithInput(["containers", "images", "delete", request.image, "--skip-confirmation"], process.cwd());
-    if (result.exitCode === 0)
-        return "deleted";
-    if (/(?:does not exist|not found|404)/iu.test(result.stderr)) {
+/**
+ * Deletes every tag in an owned registry repository — the `candidate` tag
+ * Eden pushed plus any `rootfs-snapshot-*`/`rootfs-set-*` tags container
+ * snapshots created under the source image repository. Deleting only
+ * `candidate` would leave snapshot storage behind, so each tag in the
+ * repository is deleted individually.
+ */
+async function defaultRegistryRepositoryDelete(request) {
+    const images = await readWranglerJson([
+        "containers",
+        "images",
+        "list",
+        "--json",
+    ]);
+    const collection = jsonCollection(images.value);
+    if (images.failed || collection === undefined)
+        return "indeterminate";
+    const entry = collection.find((candidate) => typeof candidate === "object" &&
+        candidate !== null &&
+        candidate.name === request.repository);
+    if (entry === undefined)
         return "absent";
+    const tags = entry.tags;
+    if (!Array.isArray(tags) || tags.some((tag) => typeof tag !== "string")) {
+        return "indeterminate";
     }
-    return "indeterminate";
+    let deletedAny = false;
+    for (const tag of tags) {
+        const result = await runWranglerWithInput([
+            "containers",
+            "images",
+            "delete",
+            `${request.repository}:${tag}`,
+            "--skip-confirmation",
+        ], process.cwd());
+        if (result.exitCode === 0) {
+            deletedAny = true;
+            continue;
+        }
+        if (!/(?:does not exist|not found|404)/iu.test(result.stderr)) {
+            return "indeterminate";
+        }
+    }
+    return deletedAny ? "deleted" : "absent";
 }
 /**
- * The exact `<repository>:${EVE_REGISTRY_IMAGE_TAG}` ref this generation's
- * deployment record proves Eden pushed, or undefined. Ownership holds only
- * when the recorded digest reference points at the repository derived from
- * the same identity that produced it; a digest-bearing reference to any other
- * repository was published outside Eden's push and is never owned here.
+ * The registry repository this generation's deployment record proves Eden
+ * pushed to, or undefined. Ownership holds only when the recorded digest
+ * reference points at the repository derived from the same identity that
+ * produced it; a digest-bearing reference to any other repository was
+ * published outside Eden's push and is never owned here.
  */
-function ownedRegistryImageRef(identity, environment, name, accountId) {
+function ownedRegistryRepository(identity, environment, name, accountId) {
     if (identity.projectId === undefined ||
         identity.generationId === undefined ||
         identity.containerImage === undefined ||
@@ -2768,14 +2835,14 @@ function ownedRegistryImageRef(identity, environment, name, accountId) {
         imageDigestFromReference(identity.containerImage) === undefined) {
         return undefined;
     }
-    return `${repository}:${EVE_REGISTRY_IMAGE_TAG}`;
+    return repository;
 }
 /**
- * The exact image ref an indeterminate deploy attempt provably pushed. The
- * retained attempt evidence names the target's repository; the account and
- * target key must match the verified destroy record.
+ * The registry repository an indeterminate deploy attempt provably pushed.
+ * The retained attempt evidence names the target's repository; the account
+ * and target key must match the verified destroy record.
  */
-async function attemptRegistryImageRef(attemptPath, accountId, targetKey) {
+async function attemptRegistryRepository(attemptPath, accountId, targetKey) {
     const raw = await readFile(attemptPath, "utf8").catch(() => undefined);
     if (raw === undefined)
         return undefined;
@@ -2795,7 +2862,7 @@ async function attemptRegistryImageRef(attemptPath, accountId, targetKey) {
         (!("targetKey" in parsed) || parsed.targetKey === targetKey) &&
         "accountId" in parsed &&
         parsed.accountId === accountId) {
-        return `${parsed.imageRepository}:${EVE_REGISTRY_IMAGE_TAG}`;
+        return parsed.imageRepository;
     }
     if ("imageReference" in parsed &&
         typeof parsed.imageReference === "string" &&
@@ -2805,39 +2872,40 @@ async function attemptRegistryImageRef(attemptPath, accountId, targetKey) {
         if (repository !== undefined &&
             repository.startsWith(expected) &&
             (!("targetKey" in parsed) || parsed.targetKey === targetKey)) {
-            return `${repository.slice(`registry.cloudflare.com/${accountId}/`.length)}:${EVE_REGISTRY_IMAGE_TAG}`;
+            return repository.slice(`registry.cloudflare.com/${accountId}/`.length);
         }
     }
     return undefined;
 }
 /**
- * Every registry image tag this exact target provably owns: the recorded
+ * Every registry repository this exact target provably owns: the recorded
  * digest references in matching deployment records plus the repository
  * evidence retained by indeterminate pushes. Never derived by prefix-matching
- * the registry; each ref is computed from the immutable generation records.
+ * the registry; each repository is computed from the immutable generation
+ * records.
  */
-async function collectEveDestroyRegistryImages(projectRoot, environment, name, record) {
+async function collectEveDestroyRegistryRepositories(projectRoot, environment, name, record) {
     const generationsRoot = join(projectRoot, ".eden", "eve-deploy", "generations");
     const entries = await readdir(generationsRoot).catch(() => []);
-    const images = new Set();
+    const repositories = new Set();
     const targetKey = record.projectId === undefined
         ? undefined
         : stableDeploymentKey(record.projectId, record.accountId, environment, name);
     for (const entry of entries) {
         const generationRoot = join(generationsRoot, entry);
         const parsed = await parseEveDestroyRecord(join(generationRoot, "deployment.json"), environment, name);
-        const deployedImage = parsed === undefined
+        const deployedRepository = parsed === undefined
             ? undefined
-            : ownedRegistryImageRef(parsed.identity, environment, name, record.accountId);
-        if (deployedImage !== undefined)
-            images.add(deployedImage);
+            : ownedRegistryRepository(parsed.identity, environment, name, record.accountId);
+        if (deployedRepository !== undefined)
+            repositories.add(deployedRepository);
         if (targetKey === undefined)
             continue;
-        const attemptImage = await attemptRegistryImageRef(join(generationRoot, "deployment-attempt.json"), record.accountId, targetKey);
-        if (attemptImage !== undefined)
-            images.add(attemptImage);
+        const attemptRepository = await attemptRegistryRepository(join(generationRoot, "deployment-attempt.json"), record.accountId, targetKey);
+        if (attemptRepository !== undefined)
+            repositories.add(attemptRepository);
     }
-    return [...images];
+    return [...repositories];
 }
 export async function runEveDestroy(request, options = {}) {
     const startedAt = Date.now();
@@ -2890,11 +2958,11 @@ async function runEveDestroyLocked(request, options, checks, emit, fail) {
     }
     checks.push(check("VAL-LIFE-006-RECORD", "passed", "The immutable deployment record matched the exact target selectors."));
     eveProgress(options, "verifying the immutable ownership record");
-    const ownedRegistryImages = await collectEveDestroyRegistryImages(request.projectRoot, request.environment, request.name, record.identity);
+    const ownedRegistryRepositories = await collectEveDestroyRegistryRepositories(request.projectRoot, request.environment, request.name, record.identity);
     const readTarget = () => Promise.resolve(reader({
         workerName: expectedWorker,
         containerApplicationName: expectedContainer,
-        registryImages: ownedRegistryImages,
+        registryRepositories: ownedRegistryRepositories,
     }));
     const reader = options.destroyCloudflareRead ?? defaultDestroyTargetRead;
     eveProgress(options, "reading the exact remote inventory");
@@ -2904,9 +2972,9 @@ async function runEveDestroyLocked(request, options, checks, emit, fail) {
     }
     if (!before.workerExists &&
         before.containerApplicationId === undefined &&
-        (ownedRegistryImages.length === 0 ||
-            (before.registryImagesPresent !== undefined &&
-                before.registryImagesPresent.length === 0))) {
+        (ownedRegistryRepositories.length === 0 ||
+            (before.registryTagsPresent !== undefined &&
+                before.registryTagsPresent.length === 0))) {
         emit({
             ok: true,
             status: "absent",
@@ -2963,17 +3031,22 @@ async function runEveDestroyLocked(request, options, checks, emit, fail) {
             ? "The exact owned Container application was deleted."
             : "The exact Container application was already absent."));
     }
-    const imageDeletes = new Map();
-    if (ownedRegistryImages.length > 0) {
-        const deleteRegistryImage = options.deleteRegistryImage ?? defaultRegistryImageDelete;
-        const deletable = before.registryImagesPresent === undefined
-            ? ownedRegistryImages
-            : ownedRegistryImages.filter((image) => before.registryImagesPresent?.includes(image) === true);
+    const repositoryDeletes = new Map();
+    if (ownedRegistryRepositories.length > 0) {
+        const deleteRegistryRepository = options.deleteRegistryRepository ?? defaultRegistryRepositoryDelete;
+        // Every tag inside an owned repository is deleted (candidate plus
+        // snapshot tags). When the registry could not be enumerated, still
+        // attempt the exact owned repositories; absence verification below
+        // re-reads the registry when it becomes readable.
+        const presentRepositories = new Set((before.registryTagsPresent ?? []).map((ref) => ref.split(":")[0] ?? ""));
+        const deletable = before.registryTagsPresent === undefined
+            ? ownedRegistryRepositories
+            : ownedRegistryRepositories.filter((repository) => presentRepositories.has(repository));
         if (deletable.length > 0) {
-            eveProgress(options, `deleting ${deletable.length} registry image${deletable.length === 1 ? "" : "s"}`);
+            eveProgress(options, `deleting ${deletable.length} registry repositor${deletable.length === 1 ? "y" : "ies"}`);
         }
-        for (const image of deletable) {
-            imageDeletes.set(image, await deleteRegistryImage({ image }));
+        for (const repository of deletable) {
+            repositoryDeletes.set(repository, await deleteRegistryRepository({ repository }));
         }
     }
     eveProgress(options, "verifying the exact target is absent");
@@ -2991,15 +3064,16 @@ async function runEveDestroyLocked(request, options, checks, emit, fail) {
         });
         fail("EVE_DESTROY_ABSENCE_UNPROVEN", "The exact target could not be proven absent after deletion.");
     }
-    const retainedImages = ownedRegistryImages.filter((image) => after.registryImagesPresent === undefined
-        ? imageDeletes.get(image) === "indeterminate"
-        : after.registryImagesPresent.includes(image));
-    if (ownedRegistryImages.length > 0) {
-        checks.push(retainedImages.length === 0
+    const presentTagsAfter = after.registryTagsPresent ?? [];
+    const retainedRepositories = ownedRegistryRepositories.filter((repository) => presentTagsAfter.some((ref) => ref.startsWith(`${repository}:`)) ||
+        (after.registryTagsPresent === undefined &&
+            repositoryDeletes.get(repository) === "indeterminate"));
+    if (ownedRegistryRepositories.length > 0) {
+        checks.push(retainedRepositories.length === 0
             ? check("VAL-LIFE-006-REGISTRY", "passed", "Every registry image tag recorded for this exact target was deleted or proven absent.")
-            : check("VAL-LIFE-006-REGISTRY", "failed", `The exact target's registry image(s) remain after destroy: ${retainedImages.join(", ")}.`, "Retry eden destroy with the same selectors, or remove only the listed image refs with wrangler containers images delete."));
+            : check("VAL-LIFE-006-REGISTRY", "failed", `The exact target's registry image tag(s) remain after destroy: ${retainedRepositories.join(", ")}.`, "Retry eden destroy with the same selectors, or remove only the listed repositories' tags with wrangler containers images delete."));
     }
-    if (retainedImages.length > 0) {
+    if (retainedRepositories.length > 0) {
         emit({
             ok: false,
             status: "failed",
@@ -3007,7 +3081,7 @@ async function runEveDestroyLocked(request, options, checks, emit, fail) {
             name: request.name,
             checks,
         });
-        fail("EVE_DESTROY_IMAGES_RETAINED", `The exact Worker and Container are absent, but registry image(s) remain: ${retainedImages.join(", ")}.`);
+        fail("EVE_DESTROY_IMAGES_RETAINED", `The exact Worker and Container are absent, but registry image tag(s) remain in: ${retainedRepositories.join(", ")}.`);
     }
     checks.push(check("VAL-LIFE-006", "passed", "Exact absence was verified; clearing this target's CURRENT pointer only."));
     const currentPath = join(request.projectRoot, ".eden", "eve-deploy", "targets", `${request.environment}-${request.name}`, "CURRENT");

package/dist/index.d.ts

@@ -10,7 +10,7 @@ export type { EveCliCommand, EveCliEnvironment, EveCliExecutionRequest, EveCliHe
 export type { EveNodeImage, EvePackagingCheck, EvePackagingCode, EveProjectBuilder, EveProjectBuilderRequest, EveProjectBuilderResult, EveProjectBuildCandidate, EveProjectFile, EveProjectImage, EveProjectInputManifest, EveProjectOutput, EveProjectPackagingResult, EveProjectRuntime, EveProjectSnapshot, EveProjectSnapshotOptions, EveProjectToolchain, EveRuntimeConfigExclusion, } from "./eve-packaging.js";
 export type { EveHostRequirements, EveRuntimeClosure, EveRuntimeClosureFile, EveRuntimeCleanup, EveRuntimeImage, EveRuntimeImageDiscardRequest, EveRuntimeImageMetadata, EveRuntimeImageRequest, EveRuntimeImageResult, EveRuntimeNativeModule, EveRuntimeStatus, } from "./eve-runtime-image.js";
 export { DEFAULT_EVE_HOST_REQUIREMENTS, DEFAULT_EVE_NODE_IMAGE, runEveControlPlane, runEveDestroy, } from "./eve-control-plane.js";
-export type { EveCloudflareReadRequest, EveCloudflareReadResult, EveCloudflareReadRunner, EveCloudflareTargetState, EveContainerDeleteRunner, EveDeploymentCompensationRequest, EveDeploymentCompensationRunner, EveDeploymentHealthRequest, EveDeploymentHealthResult, EveDeploymentHealthRunner, EveDeploymentIdentity, EveDeploymentIdentityProof, EveDeploymentMetadata, EveDeploymentPublicationRequest, EveDeploymentPublicationResult, EveDeploymentPublicationRunner, EveDeploymentStatus, EveDestroyCloudflareReadRequest, EveDestroyCloudflareReadRunner, EveDestroyOutcome, EveDestroyTargetRead, EveImagePublicationRequest, EveImagePublicationResult, EveImagePublicationRunner, EvePreflightCandidate, EvePreflightResult, EvePreflightRuntimeEvidence, EvePreflightWarning, EvePreflightRuntimeRunner, EvePreflightRuntimeRunnerRequest, EveRegistryImageDeleteRunner, EveRuntimeConfigLoader, EveRuntimeImageDiscardRunner, EveWorkerDeleteRunner, } from "./eve-control-plane.js";
+export type { EveCloudflareReadRequest, EveCloudflareReadResult, EveCloudflareReadRunner, EveCloudflareTargetState, EveContainerDeleteRunner, EveDeploymentCompensationRequest, EveDeploymentCompensationRunner, EveDeploymentHealthRequest, EveDeploymentHealthResult, EveDeploymentHealthRunner, EveDeploymentIdentity, EveDeploymentIdentityProof, EveDeploymentMetadata, EveDeploymentPublicationRequest, EveDeploymentPublicationResult, EveDeploymentPublicationRunner, EveDeploymentStatus, EveDestroyCloudflareReadRequest, EveDestroyCloudflareReadRunner, EveDestroyOutcome, EveDestroyTargetRead, EveImagePublicationRequest, EveImagePublicationResult, EveImagePublicationRunner, EvePreflightCandidate, EvePreflightResult, EvePreflightRuntimeEvidence, EvePreflightWarning, EvePreflightRuntimeRunner, EvePreflightRuntimeRunnerRequest, EveRegistryRepositoryDeleteRunner, EveRuntimeConfigLoader, EveRuntimeImageDiscardRunner, EveWorkerDeleteRunner, } from "./eve-control-plane.js";
 export declare const EDEN_CLI_COMMANDS: readonly ["preflight", "deploy", "destroy"];
 export type EdenCliCommand = (typeof EDEN_CLI_COMMANDS)[number];
 export interface EdenCliRunOptions {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moinulmoin/eden",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "Deploy existing Eve projects to your own Cloudflare account.",
   "keywords": [
     "ai",
@@ -31,8 +31,8 @@
     "NOTICE"
   ],
   "dependencies": {
-    "@moinulmoin/eden-runtime-cloudflare": "0.5.0",
-    "wrangler": "4.120.0"
+    "@moinulmoin/eden-runtime-cloudflare": "0.6.0",
+    "wrangler": "4.147.0"
   },
   "devDependencies": {
     "@types/node": "24.0.0"