@moinulmoin/eden 0.5.0 → 0.7.0

package/dist/eve-control-plane.js

@@ -7,10 +7,11 @@ import { createServer, } from "node:net";
 import { execFile, spawn, } from "node:child_process";
 import { fileURLToPath, } from "node:url";
 import { promisify, } from "node:util";
-import { EveCliError, } from "./eve.js";
-import { buildEveProjectSnapshot, createDockerEveProjectBuilder, revalidateEveProjectCandidateInputs, EvePackagingError, } from "./eve-packaging.js";
+import { EveCliError, EVE_NAME_PATTERN, } from "./eve.js";
+import { buildEveProjectSnapshot, createDockerEveProjectBuilder, revalidateEveProjectCandidateInputs, EvePackagingError, IMAGE_ID_PATTERN, } from "./eve-packaging.js";
 import { buildEveRuntimeImage, discardEveRuntimeImage, revalidateEveRuntimeCandidate, validateEveHostRequirements, } from "./eve-runtime-image.js";
 import { EveRuntimeConfigError, prepareEveRuntimeInjection, redactEveRuntimeOutput, } from "./eve-runtime-config.js";
+import { createEveHostConfig, generateEveHostWorkerSource, parseEveScheduleCron, resolveStableWorkersDevOrigin, } from "@moinulmoin/eden-runtime-cloudflare";
 const execFileAsync = promisify(execFile);
 const require = createRequire(import.meta.url);
 const wranglerEntrypoint = require.resolve("wrangler");
@@ -63,6 +64,8 @@ function mapPackagingCheck(value) {
                 return "VAL-SEC-003";
             case "DOCKER_PLATFORM_BLOCKED":
                 return "VAL-BUILD-005";
+            case "EVE_SANDBOX_RESUME_PATCH":
+                return value.id;
             default:
                 return `EVE-${value.id}`;
         }
@@ -440,21 +443,11 @@ function exactContainerEntries(value, name) {
             typeof entry.name !== "string") {
             return undefined;
         }
-        const id = entry.id;
         const entryName = entry.name;
         if (entryName === name) {
-            const configuration = entry.configuration;
-            const image = typeof entry.image === "string"
-                ? entry.image
-                : typeof configuration === "object" &&
-                    configuration !== null &&
-                    typeof configuration.image === "string"
-                    ? configuration.image
-                    : undefined;
             entries.push({
-                id,
+                id: entry.id,
                 name: entryName,
-                ...(image === undefined ? {} : { image }),
             });
         }
     }
@@ -530,7 +523,7 @@ async function readWorkersDevSubdomain(accountId) {
             ? result.subdomain
             : undefined;
         return typeof subdomain === "string" &&
-            /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/u.test(subdomain)
+            EVE_NAME_PATTERN.test(subdomain)
             ? subdomain
             : undefined;
     }
@@ -546,34 +539,34 @@ async function readWorkersDevSubdomain(accountId) {
 export function exactTargetContainerEntries(value, name) {
     return exactContainerEntries(value, boundedResourceName(name, "container"));
 }
-async function defaultCloudflareRead(request) {
-    const account = await readWranglerJson(["whoami", "--json"]);
+async function readExactTargetInventory(workerName, containerApp) {
     const containers = await readWranglerJson([
-        "containers",
-        "list",
-        "--json",
-        "--per-page",
-        "100",
+        "containers", "list", "--json", "--per-page", "100",
     ]);
     const deployments = await readWranglerJson([
-        "deployments",
-        "list",
-        "--name",
-        request.name,
-        "--json",
+        "deployments", "list", "--name", workerName, "--json",
     ]);
+    return {
+        containers,
+        deployments,
+        containerEntries: exactContainerEntries(containers.value, containerApp),
+        deploymentEntries: exactDeploymentEntries(deployments.value),
+    };
+}
+async function defaultCloudflareRead(request) {
+    const account = await readWranglerJson(["whoami", "--json"]);
+    const { containers, deployments, containerEntries, deploymentEntries: listedDeployments } = await readExactTargetInventory(request.name, boundedResourceName(request.name, "container"));
     const accountId = authenticatedAccountId(account.value);
     const accountAccess = account.failed || accountId === undefined
         ? "unavailable"
         : "available";
-    const containerEntries = exactTargetContainerEntries(containers.value, request.name);
     const containerAccess = containers.failed || containerEntries === undefined
         ? "unavailable"
         : "available";
     const deploymentEntries = deployments.failed &&
         /(?:does not exist|not found)/iu.test(deployments.stderr ?? "")
         ? []
-        : exactDeploymentEntries(deployments.value);
+        : listedDeployments;
     const workersDevSubdomain = await readWorkersDevSubdomain(accountId);
     if (accountAccess === "unavailable" ||
         containerAccess === "unavailable" ||
@@ -610,7 +603,7 @@ async function defaultCloudflareRead(request) {
     }
     const workerPresent = deploymentEntries.length > 0;
     const containerPresent = (containerEntries?.length ?? 0) > 0;
-    const providerEvidence = await readProviderEvidence(request.name, accountId, workerPresent, containerPresent ? containerEntries?.[0]?.image : undefined);
+    const providerEvidence = await readProviderEvidence(request.name, accountId, workerPresent, containerPresent ? containerEntries?.[0] : undefined);
     return {
         accountAccess,
         containerAccess,
@@ -634,16 +627,40 @@ async function defaultCloudflareRead(request) {
 }
 /**
  * Reads provider-backed facts about the live target: the Container
- * application's configured image (from `wrangler containers list`) and the
- * `EDEN_EVE_DEPLOYMENT_ID` plain-text var Eden stamps into every Worker it
- * publishes (from the script settings API). Both are provider state — a
- * foreign Worker can forge `x-eden-*` response headers but cannot set a var
- * Eden recorded at publish time.
+ * application's identity from `wrangler containers list` plus `containers
+ * info` (scheduling policy and Durable Object namespace), and the
+ * `EDEN_EVE_DEPLOYMENT_ID` plain-text var plus the `EVE_CONTAINER` Durable
+ * Object namespace Eden stamps into every Worker it publishes (from the
+ * script settings API). All are provider state — a foreign Worker can forge
+ * `x-eden-*` response headers but cannot set vars or namespaces Eden
+ * recorded at publish time. The ownership proof is the Container
+ * application's Durable Object namespace matching the Worker's binding
+ * namespace.
  */
-async function readProviderEvidence(workerName, accountId, workerPresent, containerImage) {
+async function readProviderEvidence(workerName, accountId, workerPresent, containerEntry) {
     const evidence = {
-        ...(containerImage === undefined ? {} : { containerImage }),
+        ...(containerEntry === undefined
+            ? {}
+            : { containerApplicationId: containerEntry.id }),
     };
+    if (containerEntry !== undefined) {
+        const info = await readWranglerJson([
+            "containers",
+            "info",
+            containerEntry.id,
+            "--json",
+        ]);
+        if (!info.failed && typeof info.value === "object" && info.value !== null) {
+            const infoRecord = info.value;
+            if (typeof infoRecord.scheduling_policy === "string") {
+                evidence.containerSchedulingPolicy = infoRecord.scheduling_policy;
+            }
+            const namespaceId = infoRecord.durable_objects?.namespace_id;
+            if (typeof namespaceId === "string") {
+                evidence.containerNamespaceId = namespaceId;
+            }
+        }
+    }
     if (workerPresent && accountId !== undefined) {
         const token = process.env.CLOUDFLARE_API_TOKEN ??
             (await readWranglerOAuthToken());
@@ -656,10 +673,16 @@ async function readProviderEvidence(workerName, accountId, workerPresent, contai
                 if (response.ok) {
                     evidence.settingsReadable = true;
                     const parsed = (await response.json());
-                    const binding = parsed.result?.bindings?.find((value) => value.type === "plain_text" &&
+                    const bindings = parsed.result?.bindings ?? [];
+                    const deploymentBinding = bindings.find((value) => value.type === "plain_text" &&
                         value.name === "EDEN_EVE_DEPLOYMENT_ID");
-                    if (typeof binding?.text === "string") {
-                        evidence.workerDeploymentId = binding.text;
+                    if (typeof deploymentBinding?.text === "string") {
+                        evidence.workerDeploymentId = deploymentBinding.text;
+                    }
+                    const containerBinding = bindings.find((value) => value.type === "durable_object_namespace" &&
+                        value.name === "EVE_CONTAINER");
+                    if (typeof containerBinding?.namespace_id === "string") {
+                        evidence.workerContainerNamespaceId = containerBinding.namespace_id;
                     }
                 }
                 else if (response.status !== 404) {
@@ -698,19 +721,23 @@ async function resolveEveTargetOwnership(request, result) {
     }
     // Remote proof must come from provider state. A foreign Worker can echo
     // `x-eden-*` response headers, but it cannot plant the plain-text var Eden
-    // publishes into script settings, nor point the Container application at an
-    // image digest Eden recorded. The Worker is proven only by its own settings:
-    // a matching Container image proves the Container, never the Worker, so
-    // unreadable settings fail closed.
+    // publishes into script settings or claim the Durable Object namespace the
+    // Worker's EVE_CONTAINER binding resolves to. The Worker is proven only by
+    // its own settings: unreadable settings fail closed.
     const evidence = result.target.providerEvidence;
     const recordedDeploymentIds = new Set(record.deploymentIds);
     const workerProven = result.target.observed?.worker !== true ||
         (evidence?.settingsReadable === true &&
             evidence.workerDeploymentId !== undefined &&
             recordedDeploymentIds.has(evidence.workerDeploymentId));
+    // The Container proof is the application running the durable_object
+    // scheduling policy with a namespace that matches the Worker binding's
+    // namespace; anything else fails closed.
     const containerProven = result.target.observed?.container !== true ||
-        (evidence?.containerImage !== undefined &&
-            record.images.includes(evidence.containerImage));
+        (evidence?.containerSchedulingPolicy === "durable_object" &&
+            evidence.containerNamespaceId !== undefined &&
+            evidence.workerContainerNamespaceId !== undefined &&
+            evidence.containerNamespaceId === evidence.workerContainerNamespaceId);
     const remoteProven = evidence !== undefined && workerProven && containerProven;
     if (!remoteProven) {
         return {
@@ -763,7 +790,6 @@ async function resolvedCloudflareOrigin(result, workerName) {
         return undefined;
     }
     try {
-        const { resolveStableWorkersDevOrigin } = await import("@moinulmoin/eden-runtime-cloudflare");
         const origin = resolveStableWorkersDevOrigin({
             workerName,
             workersDevSubdomain: result.workersDevSubdomain,
@@ -1130,8 +1156,6 @@ function defaultPublicationRunner() {
             "--env",
             request.identity.environment,
             "--strict",
-            "--containers-rollout",
-            "immediate",
         ], dirname(request.wranglerConfigPath));
         if (result.exitCode !== 0) {
             return {
@@ -1140,22 +1164,7 @@ function defaultPublicationRunner() {
                 ownershipEvidenceRetained: true,
             };
         }
-        const containers = await readWranglerJson([
-            "containers",
-            "list",
-            "--json",
-            "--per-page",
-            "100",
-        ]);
-        const containerEntries = exactContainerEntries(containers.value, request.hostConfig.container.applicationName);
-        const deployments = await readWranglerJson([
-            "deployments",
-            "list",
-            "--name",
-            request.identity.workerName,
-            "--json",
-        ]);
-        const deploymentEntries = exactDeploymentEntries(deployments.value);
+        const { containers, deployments, containerEntries, deploymentEntries } = await readExactTargetInventory(request.identity.workerName, request.hostConfig.container.applicationName);
         if (containers.failed ||
             containerEntries === undefined ||
             containerEntries.length !== 1 ||
@@ -1490,7 +1499,6 @@ async function runEveDeployment(request, options, collected) {
     }
     let stableWorkersDevOrigin;
     try {
-        const { resolveStableWorkersDevOrigin } = await import("@moinulmoin/eden-runtime-cloudflare");
         stableWorkersDevOrigin = resolveStableWorkersDevOrigin({
             workerName: request.name,
             workersDevSubdomain,
@@ -1506,7 +1514,7 @@ async function runEveDeployment(request, options, collected) {
         throw deploymentFailure("EVE_ORIGIN_UNAVAILABLE", "The authenticated stable workers.dev origin did not match the exact Worker target.");
     }
     const imageDigest = runtimeEvidence.imageDigest;
-    if (imageDigest === undefined || !/^sha256:[0-9a-f]{64}$/u.test(imageDigest)) {
+    if (imageDigest === undefined || !IMAGE_ID_PATTERN.test(imageDigest)) {
         throw deploymentFailure("EVE_IMAGE_IDENTITY_UNAVAILABLE", "The deploy candidate did not provide an immutable runtime image digest.");
     }
     const targetKey = stableDeploymentKey(collected.projectId, accountId, request.environment, request.name);
@@ -1607,38 +1615,37 @@ async function runEveDeployment(request, options, collected) {
             ? {}
             : { runtimeRevisionHandle: runtimeInjection.protectedHandle }),
     };
+    const baseConfigRequest = {
+        accountId,
+        workerName: identity.workerName,
+        containerApplicationName: identity.containerApplicationName,
+        stableContainerInstanceName: identity.stableContainerInstanceName,
+        deploymentId: identity.deploymentId,
+        generationId: identity.generationId,
+        stableWorkersDevOrigin: identity.stableWorkersDevOrigin,
+        containerImage: identity.containerImage,
+        runtimeVariableNames: identity.runtimeVariableNames,
+        ...(identity.runtimeRevisionHandle === undefined
+            ? {}
+            : { runtimeRevisionHandle: identity.runtimeRevisionHandle }),
+        schedules: collected.schedules ?? [],
+        ...(collected.workflowWorld === undefined
+            ? {}
+            : { workflowWorld: collected.workflowWorld }),
+        // In-place updates carry the prior Durable Object bindings and
+        // migration history forward verbatim: classes are append-only and are
+        // never silently re-declared or removed.
+        ...(isUpdate && priorDurableObjects !== undefined
+            ? { durableObjects: priorDurableObjects }
+            : {}),
+        ...(process.env.EDEN_EVE_CONTAINER_SLEEP_AFTER === undefined
+            ? {}
+            : { containerSleepAfter: process.env.EDEN_EVE_CONTAINER_SLEEP_AFTER }),
+    };
     let hostConfig;
     try {
-        const { createEveHostConfig, } = await import("@moinulmoin/eden-runtime-cloudflare");
         hostConfig = createEveHostConfig({
-            accountId,
-            workerName: identity.workerName,
-            containerApplicationName: identity.containerApplicationName,
-            containerClassName: "EveHostContainer",
-            containerBindingName: "EVE_CONTAINER",
-            stableContainerInstanceName: identity.stableContainerInstanceName,
-            deploymentId: identity.deploymentId,
-            generationId: identity.generationId,
-            stableWorkersDevOrigin: identity.stableWorkersDevOrigin,
-            containerImage: identity.containerImage,
-            runtimeVariableNames: identity.runtimeVariableNames,
-            ...(identity.runtimeRevisionHandle === undefined
-                ? {}
-                : { runtimeRevisionHandle: identity.runtimeRevisionHandle }),
-            schedules: collected.schedules ?? [],
-            ...(collected.workflowWorld === undefined
-                ? {}
-                : { workflowWorld: collected.workflowWorld }),
-            // In-place updates carry the prior Durable Object bindings and
-            // migration history forward verbatim: classes are append-only, never
-            // re-declared, and never deleted (a deleted_classes migration destroys
-            // the data).
-            ...(isUpdate && priorDurableObjects !== undefined
-                ? { durableObjects: priorDurableObjects }
-                : {}),
-            ...(process.env.EDEN_EVE_CONTAINER_SLEEP_AFTER === undefined
-                ? {}
-                : { containerSleepAfter: process.env.EDEN_EVE_CONTAINER_SLEEP_AFTER }),
+            ...baseConfigRequest,
         });
     }
     catch (error) {
@@ -1646,7 +1653,6 @@ async function runEveDeployment(request, options, collected) {
             ? error.message
             : "The exact Eve Worker/Container host configuration was invalid.");
     }
-    const { generateEveHostWorkerSource } = await import("@moinulmoin/eden-runtime-cloudflare");
     const workerSource = generateEveHostWorkerSource({ config: hostConfig });
     const paths = await writeEveDeploymentArtifacts(candidate, hostConfig, workerSource);
     const publicationRequest = {
@@ -1656,13 +1662,26 @@ async function runEveDeployment(request, options, collected) {
         ...paths,
         ...(runtimeInjection === undefined ? {} : { runtimeInjection }),
     };
+    /** Publishes one wrangler config; returns its terminal result. */
+    const publishOne = async (request) => (options.publish ?? defaultPublicationRunner())(request);
     let publication;
+    const writeFailureRecord = async (status, evidence) => {
+        try {
+            await writeEveDeploymentRecord(candidate, identity, hostConfig, status, {
+                evidence,
+            });
+        }
+        catch (error) {
+            if (error.code !== "EEXIST")
+                throw error;
+        }
+    };
     try {
         eveProgress(options, "publishing Worker and Container application");
-        publication = await (options.publish ?? defaultPublicationRunner())(publicationRequest);
+        publication = await publishOne(publicationRequest);
     }
     catch {
-        await writeEveDeploymentRecord(candidate, identity, hostConfig, "indeterminate", { evidence: "publication-threw-before-terminal-result" });
+        await writeFailureRecord("indeterminate", "publication-threw-before-terminal-result");
         const deployment = deploymentMetadata(identity, targetKey, "indeterminate", operation, superseded);
         return {
             ...collected.result,
@@ -1671,7 +1690,7 @@ async function runEveDeployment(request, options, collected) {
         };
     }
     if (publication.status === "indeterminate") {
-        await writeEveDeploymentRecord(candidate, identity, hostConfig, "indeterminate", { evidence: safeText(publication.reason) });
+        await writeFailureRecord("indeterminate", safeText(publication.reason));
         return {
             ...collected.result,
             ok: false,
@@ -1862,25 +1881,26 @@ async function runEveDeployment(request, options, collected) {
     if (isUpdate) {
         // The superseded generation's registry repository is generation-scoped
         // and no longer referenced once CURRENT promotes this generation; only
-        // then is it safe to delete.
-        const previousImage = priorIdentity === undefined
+        // then is it safe to delete. Every tag in the repository goes with it —
+        // including the snapshot tags Cloudflare created under it.
+        const previousRepository = priorIdentity === undefined
             ? undefined
-            : ownedRegistryImageRef(priorIdentity, request.environment, request.name, accountId);
-        if (previousImage !== undefined) {
-            eveProgress(options, `deleting superseded registry image ${previousImage}`);
+            : ownedRegistryRepository(priorIdentity, request.environment, request.name, accountId);
+        if (previousRepository !== undefined) {
+            eveProgress(options, `deleting superseded registry repository ${previousRepository}`);
             let deleted = "indeterminate";
             try {
-                deleted = await (options.deleteRegistryImage ??
-                    defaultRegistryImageDelete)({ image: previousImage });
+                deleted = await (options.deleteRegistryRepository ??
+                    defaultRegistryRepositoryDelete)({ repository: previousRepository });
             }
             catch {
                 deleted = "indeterminate";
             }
             supersededImageCleanup = deleted === "indeterminate"
-                ? check("VAL-LIFE-007", "failed", `The update is healthy and promoted, but the superseded registry image ${previousImage} could not be proven deleted.`, `Remove only the recorded image ref ${previousImage}; do not retry or run broad registry cleanup.`)
+                ? check("VAL-LIFE-007", "failed", `The update is healthy and promoted, but the superseded registry repository ${previousRepository} could not be proven deleted.`, `Remove only the recorded repository's tags ${previousRepository}; do not retry or run broad registry cleanup.`)
                 : check("VAL-LIFE-007", "passed", deleted === "deleted"
-                    ? "The superseded generation's registry image was deleted after promotion."
-                    : "The superseded generation's registry image was already absent.");
+                    ? "The superseded generation's registry repository (all tags, including snapshots) was deleted after promotion."
+                    : "The superseded generation's registry repository was already absent.");
         }
     }
     let runtimeImageCleanup;
@@ -1992,7 +2012,6 @@ async function collectEvePreflight(request, options) {
             snapshot: null,
             toolchain: null,
             image: null,
-            runtime: null,
             secrets: {
                 runtimeVariableNames: [],
                 valuesRecorded: false,
@@ -2005,6 +2024,7 @@ async function collectEvePreflight(request, options) {
                 redactionRegisteredBeforeChildren: false,
             },
             checks: [],
+            sandboxResumePatch: "absent",
             candidateImageId: null,
             candidateImageRetainedLocally: false,
             writtenPaths: [],
@@ -2012,6 +2032,13 @@ async function collectEvePreflight(request, options) {
         };
     }
     checks.push(...packaging.checks.map(mapPackagingCheck));
+    if (packaging.sandboxResumePatch === "skipped") {
+        warnings.push({
+            id: "EVE_SANDBOX_RESUME_PATCH",
+            message: "Eve's just-bash file is not a version Eden knows; conversations may lose their sandbox after a skill change (eve#4440)",
+            remediation: "Pin Eve to a version Eden knows, or update Eden so its known Eve versions include yours.",
+        });
+    }
     const discardPackagingImage = async () => {
         if (packaging.candidateImageId === null ||
             builder.discard === undefined) {
@@ -2058,9 +2085,6 @@ async function collectEvePreflight(request, options) {
     }
     warnings.push(...(await collectEveWorldWarnings(candidate, undefined)));
     const schedules = await readCompiledSchedules(candidate);
-    // The runtime package is imported lazily so `eden` commands that never
-    // reach deploy checks stay fast; the module specifier is fixed.
-    const { parseEveScheduleCron } = await import("@moinulmoin/eden-runtime-cloudflare");
     const expressible = schedules.filter((schedule) => parseEveScheduleCron(schedule.cron) !== undefined);
     const unexpressible = schedules.filter((schedule) => parseEveScheduleCron(schedule.cron) === undefined);
     if (unexpressible.length > 0) {
@@ -2208,7 +2232,7 @@ async function collectEvePreflight(request, options) {
                 "VAL-BUILD-007",
             ];
             const runtimeProofComplete = requiredRuntimeChecks.every((id) => runtimeEvidence?.checks.some((value) => value.id === id && value.status === "passed"));
-            const runtimeImageIdentityValid = /^sha256:[0-9a-f]{64}$/u.test(runtimeEvidence.imageDigest ?? "");
+            const runtimeImageIdentityValid = IMAGE_ID_PATTERN.test(runtimeEvidence.imageDigest ?? "");
             if (!runtimeProofComplete) {
                 checks.push(check("VAL-BUILD-005", "failed", "The runtime seam did not return complete proof of Linux/amd64 image construction, official Eve-start boot, and real health.", "Return passed VAL-BUILD-005, VAL-BUILD-006, and VAL-BUILD-007 checks from the disposable runtime runner."));
             }
@@ -2496,7 +2520,6 @@ async function readEveDeploymentRecord(projectRoot, environment, name, accountId
     const entries = await readdir(generationsRoot).catch(() => []);
     const scanned = [];
     const deploymentIds = new Set();
-    const images = new Set();
     for (const entry of entries) {
         const generationRoot = join(generationsRoot, entry);
         const recordPath = join(generationRoot, "deployment.json");
@@ -2519,9 +2542,6 @@ async function readEveDeploymentRecord(projectRoot, environment, name, accountId
             const deploymentId = parsed.deploymentId;
             if (deploymentId !== undefined)
                 deploymentIds.add(deploymentId);
-            if (typeof parsed.identity.containerImage === "string") {
-                images.add(parsed.identity.containerImage);
-            }
         }
     }
     scanned.sort((left, right) => right.modifiedAt - left.modifiedAt);
@@ -2557,7 +2577,6 @@ async function readEveDeploymentRecord(projectRoot, environment, name, accountId
         identity: live.record.identity,
         status: live.record.status,
         deploymentIds: [...deploymentIds],
-        images: [...images],
         worldCloudflare: live.record.worldCloudflare,
         durableObjects: historySource?.record.durableObjects,
     };
@@ -2607,19 +2626,20 @@ async function parseEveDeploymentRecord(recordPath, environment, name) {
     const migrations = [];
     const durableObjectsValid = Array.isArray(rawBindings) &&
         Array.isArray(rawMigrations);
+    const invalidHistory = () => ({
+        recordPath,
+        identity: base.identity,
+        status,
+        deploymentId,
+        worldCloudflare: rawVars?.EDEN_EVE_WORLD_CLOUDFLARE === true,
+        durableObjects: undefined,
+    });
     if (durableObjectsValid) {
         for (const binding of rawBindings) {
             if (typeof binding !== "object" || binding === null ||
                 typeof binding.name !== "string" ||
                 typeof binding.class_name !== "string") {
-                return {
-                    recordPath,
-                    identity: base.identity,
-                    status,
-                    deploymentId,
-                    worldCloudflare: rawVars?.EDEN_EVE_WORLD_CLOUDFLARE === true,
-                    durableObjects: undefined,
-                };
+                return invalidHistory();
             }
             bindings.push(binding);
         }
@@ -2627,15 +2647,8 @@ async function parseEveDeploymentRecord(recordPath, environment, name) {
             if (typeof migration !== "object" || migration === null ||
                 typeof migration.tag !== "string" ||
                 !Array.isArray(migration.new_sqlite_classes) ||
-                migration.new_sqlite_classes.some((className) => typeof className !== "string")) {
-                return {
-                    recordPath,
-                    identity: base.identity,
-                    status,
-                    deploymentId,
-                    worldCloudflare: rawVars?.EDEN_EVE_WORLD_CLOUDFLARE === true,
-                    durableObjects: undefined,
-                };
+                (migration.new_sqlite_classes ?? []).some((className) => typeof className !== "string")) {
+                return invalidHistory();
             }
             migrations.push(migration);
         }
@@ -2651,37 +2664,30 @@ async function parseEveDeploymentRecord(recordPath, environment, name) {
 }
 async function defaultDestroyTargetRead(request) {
     const account = await readWranglerJson(["whoami", "--json"]);
-    const deployments = await readWranglerJson([
-        "deployments",
-        "list",
-        "--name",
-        request.workerName,
-        "--json",
-    ]);
-    const containers = await readWranglerJson([
-        "containers",
-        "list",
-        "--json",
-        "--per-page",
-        "100",
-    ]);
+    const { deployments, containerEntries: entries, deploymentEntries } = await readExactTargetInventory(request.workerName, request.containerApplicationName);
     const accountId = authenticatedAccountId(account.value);
     const workerExists = !deployments.failed &&
-        (exactDeploymentEntries(deployments.value)?.length ?? 0) > 0;
-    const entries = exactContainerEntries(containers.value, request.containerApplicationName);
+        (deploymentEntries?.length ?? 0) > 0;
     const firstContainer = entries === undefined ? undefined : entries[0];
-    const ownedImages = request.registryImages;
-    let registryImagesPresent;
-    if (ownedImages !== undefined && ownedImages.length > 0) {
+    const ownedRepositories = request.registryRepositories;
+    let registryTagsPresent;
+    if (ownedRepositories !== undefined && ownedRepositories.length > 0) {
         const images = await readWranglerJson([
             "containers",
             "images",
             "list",
             "--json",
         ]);
-        const present = registryImageNames(images.value);
-        if (!images.failed && present !== undefined) {
-            registryImagesPresent = ownedImages.filter((image) => present.has(image));
+        const tagsByRepository = registryTagsByRepository(images.value);
+        if (!images.failed && tagsByRepository !== undefined) {
+            const present = [];
+            for (const [repository, tags] of tagsByRepository) {
+                if (!ownedRepositories.includes(repository))
+                    continue;
+                for (const tag of tags)
+                    present.push(`${repository}:${tag}`);
+            }
+            registryTagsPresent = present;
         }
     }
     return {
@@ -2690,21 +2696,22 @@ async function defaultDestroyTargetRead(request) {
             ? {}
             : { containerApplicationId: firstContainer.id }),
         ...(accountId === undefined ? {} : { accountId }),
-        ...(registryImagesPresent === undefined
+        ...(registryTagsPresent === undefined
             ? {}
-            : { registryImagesPresent }),
+            : { registryTagsPresent }),
     };
 }
 /**
  * `wrangler containers images list --json` reports `[{name, tags}]` entries
- * with the account prefix already stripped from the repository name. The set
- * carries `repository:tag` refs for the owned tags Eden publishes.
+ * with the account prefix already stripped from the repository name. The map
+ * carries every tag per repository so owned-repository cleanup can delete
+ * snapshot tags alongside the pushed `candidate` tag.
  */
-function registryImageNames(value) {
+function registryTagsByRepository(value) {
     const collection = jsonCollection(value);
     if (collection === undefined)
         return undefined;
-    const names = new Set();
+    const tagsByRepository = new Map();
     for (const entry of collection) {
         if (typeof entry !== "object" || entry === null || !("name" in entry)) {
             return undefined;
@@ -2713,13 +2720,15 @@ function registryImageNames(value) {
         const tags = "tags" in entry ? entry.tags : undefined;
         if (typeof name !== "string" || !Array.isArray(tags))
             return undefined;
+        const validTags = [];
         for (const tag of tags) {
             if (typeof tag !== "string")
                 return undefined;
-            names.add(`${name}:${tag}`);
+            validTags.push(tag);
         }
+        tagsByRepository.set(name, validTags);
     }
-    return names;
+    return tagsByRepository;
 }
 async function defaultWorkerDelete(request) {
     const result = await runWranglerWithInput(["delete", "--name", request.name, "--force"], process.cwd(), "y\n");
@@ -2739,23 +2748,59 @@ async function defaultContainerDelete(request) {
     }
     return "indeterminate";
 }
-async function defaultRegistryImageDelete(request) {
-    const result = await runWranglerWithInput(["containers", "images", "delete", request.image, "--skip-confirmation"], process.cwd());
-    if (result.exitCode === 0)
-        return "deleted";
-    if (/(?:does not exist|not found|404)/iu.test(result.stderr)) {
+/**
+ * Deletes every tag in an owned registry repository — the `candidate` tag
+ * Eden pushed plus any `rootfs-snapshot-*`/`rootfs-set-*` tags container
+ * snapshots created under the source image repository. Deleting only
+ * `candidate` would leave snapshot storage behind, so each tag in the
+ * repository is deleted individually.
+ */
+async function defaultRegistryRepositoryDelete(request) {
+    const images = await readWranglerJson([
+        "containers",
+        "images",
+        "list",
+        "--json",
+    ]);
+    const collection = jsonCollection(images.value);
+    if (images.failed || collection === undefined)
+        return "indeterminate";
+    const entry = collection.find((candidate) => typeof candidate === "object" &&
+        candidate !== null &&
+        candidate.name === request.repository);
+    if (entry === undefined)
         return "absent";
+    const tags = entry.tags;
+    if (!Array.isArray(tags) || tags.some((tag) => typeof tag !== "string")) {
+        return "indeterminate";
     }
-    return "indeterminate";
+    let deletedAny = false;
+    for (const tag of tags) {
+        const result = await runWranglerWithInput([
+            "containers",
+            "images",
+            "delete",
+            `${request.repository}:${tag}`,
+            "--skip-confirmation",
+        ], process.cwd());
+        if (result.exitCode === 0) {
+            deletedAny = true;
+            continue;
+        }
+        if (!/(?:does not exist|not found|404)/iu.test(result.stderr)) {
+            return "indeterminate";
+        }
+    }
+    return deletedAny ? "deleted" : "absent";
 }
 /**
- * The exact `<repository>:${EVE_REGISTRY_IMAGE_TAG}` ref this generation's
- * deployment record proves Eden pushed, or undefined. Ownership holds only
- * when the recorded digest reference points at the repository derived from
- * the same identity that produced it; a digest-bearing reference to any other
- * repository was published outside Eden's push and is never owned here.
+ * The registry repository this generation's deployment record proves Eden
+ * pushed to, or undefined. Ownership holds only when the recorded digest
+ * reference points at the repository derived from the same identity that
+ * produced it; a digest-bearing reference to any other repository was
+ * published outside Eden's push and is never owned here.
  */
-function ownedRegistryImageRef(identity, environment, name, accountId) {
+function ownedRegistryRepository(identity, environment, name, accountId) {
     if (identity.projectId === undefined ||
         identity.generationId === undefined ||
         identity.containerImage === undefined ||
@@ -2768,14 +2813,14 @@ function ownedRegistryImageRef(identity, environment, name, accountId) {
         imageDigestFromReference(identity.containerImage) === undefined) {
         return undefined;
     }
-    return `${repository}:${EVE_REGISTRY_IMAGE_TAG}`;
+    return repository;
 }
 /**
- * The exact image ref an indeterminate deploy attempt provably pushed. The
- * retained attempt evidence names the target's repository; the account and
- * target key must match the verified destroy record.
+ * The registry repository an indeterminate deploy attempt provably pushed.
+ * The retained attempt evidence names the target's repository; the account
+ * and target key must match the verified destroy record.
  */
-async function attemptRegistryImageRef(attemptPath, accountId, targetKey) {
+async function attemptRegistryRepository(attemptPath, accountId, targetKey) {
     const raw = await readFile(attemptPath, "utf8").catch(() => undefined);
     if (raw === undefined)
         return undefined;
@@ -2795,7 +2840,7 @@ async function attemptRegistryImageRef(attemptPath, accountId, targetKey) {
         (!("targetKey" in parsed) || parsed.targetKey === targetKey) &&
         "accountId" in parsed &&
         parsed.accountId === accountId) {
-        return `${parsed.imageRepository}:${EVE_REGISTRY_IMAGE_TAG}`;
+        return parsed.imageRepository;
     }
     if ("imageReference" in parsed &&
         typeof parsed.imageReference === "string" &&
@@ -2805,39 +2850,40 @@ async function attemptRegistryImageRef(attemptPath, accountId, targetKey) {
         if (repository !== undefined &&
             repository.startsWith(expected) &&
             (!("targetKey" in parsed) || parsed.targetKey === targetKey)) {
-            return `${repository.slice(`registry.cloudflare.com/${accountId}/`.length)}:${EVE_REGISTRY_IMAGE_TAG}`;
+            return repository.slice(`registry.cloudflare.com/${accountId}/`.length);
         }
     }
     return undefined;
 }
 /**
- * Every registry image tag this exact target provably owns: the recorded
+ * Every registry repository this exact target provably owns: the recorded
  * digest references in matching deployment records plus the repository
  * evidence retained by indeterminate pushes. Never derived by prefix-matching
- * the registry; each ref is computed from the immutable generation records.
+ * the registry; each repository is computed from the immutable generation
+ * records.
  */
-async function collectEveDestroyRegistryImages(projectRoot, environment, name, record) {
+async function collectEveDestroyRegistryRepositories(projectRoot, environment, name, record) {
     const generationsRoot = join(projectRoot, ".eden", "eve-deploy", "generations");
     const entries = await readdir(generationsRoot).catch(() => []);
-    const images = new Set();
+    const repositories = new Set();
     const targetKey = record.projectId === undefined
         ? undefined
         : stableDeploymentKey(record.projectId, record.accountId, environment, name);
     for (const entry of entries) {
         const generationRoot = join(generationsRoot, entry);
         const parsed = await parseEveDestroyRecord(join(generationRoot, "deployment.json"), environment, name);
-        const deployedImage = parsed === undefined
+        const deployedRepository = parsed === undefined
             ? undefined
-            : ownedRegistryImageRef(parsed.identity, environment, name, record.accountId);
-        if (deployedImage !== undefined)
-            images.add(deployedImage);
+            : ownedRegistryRepository(parsed.identity, environment, name, record.accountId);
+        if (deployedRepository !== undefined)
+            repositories.add(deployedRepository);
         if (targetKey === undefined)
             continue;
-        const attemptImage = await attemptRegistryImageRef(join(generationRoot, "deployment-attempt.json"), record.accountId, targetKey);
-        if (attemptImage !== undefined)
-            images.add(attemptImage);
+        const attemptRepository = await attemptRegistryRepository(join(generationRoot, "deployment-attempt.json"), record.accountId, targetKey);
+        if (attemptRepository !== undefined)
+            repositories.add(attemptRepository);
     }
-    return [...images];
+    return [...repositories];
 }
 export async function runEveDestroy(request, options = {}) {
     const startedAt = Date.now();
@@ -2890,11 +2936,11 @@ async function runEveDestroyLocked(request, options, checks, emit, fail) {
     }
     checks.push(check("VAL-LIFE-006-RECORD", "passed", "The immutable deployment record matched the exact target selectors."));
     eveProgress(options, "verifying the immutable ownership record");
-    const ownedRegistryImages = await collectEveDestroyRegistryImages(request.projectRoot, request.environment, request.name, record.identity);
+    const ownedRegistryRepositories = await collectEveDestroyRegistryRepositories(request.projectRoot, request.environment, request.name, record.identity);
     const readTarget = () => Promise.resolve(reader({
         workerName: expectedWorker,
         containerApplicationName: expectedContainer,
-        registryImages: ownedRegistryImages,
+        registryRepositories: ownedRegistryRepositories,
     }));
     const reader = options.destroyCloudflareRead ?? defaultDestroyTargetRead;
     eveProgress(options, "reading the exact remote inventory");
@@ -2904,9 +2950,9 @@ async function runEveDestroyLocked(request, options, checks, emit, fail) {
     }
     if (!before.workerExists &&
         before.containerApplicationId === undefined &&
-        (ownedRegistryImages.length === 0 ||
-            (before.registryImagesPresent !== undefined &&
-                before.registryImagesPresent.length === 0))) {
+        (ownedRegistryRepositories.length === 0 ||
+            (before.registryTagsPresent !== undefined &&
+                before.registryTagsPresent.length === 0))) {
         emit({
             ok: true,
             status: "absent",
@@ -2963,17 +3009,22 @@ async function runEveDestroyLocked(request, options, checks, emit, fail) {
             ? "The exact owned Container application was deleted."
             : "The exact Container application was already absent."));
     }
-    const imageDeletes = new Map();
-    if (ownedRegistryImages.length > 0) {
-        const deleteRegistryImage = options.deleteRegistryImage ?? defaultRegistryImageDelete;
-        const deletable = before.registryImagesPresent === undefined
-            ? ownedRegistryImages
-            : ownedRegistryImages.filter((image) => before.registryImagesPresent?.includes(image) === true);
+    const repositoryDeletes = new Map();
+    if (ownedRegistryRepositories.length > 0) {
+        const deleteRegistryRepository = options.deleteRegistryRepository ?? defaultRegistryRepositoryDelete;
+        // Every tag inside an owned repository is deleted (candidate plus
+        // snapshot tags). When the registry could not be enumerated, still
+        // attempt the exact owned repositories; absence verification below
+        // re-reads the registry when it becomes readable.
+        const presentRepositories = new Set((before.registryTagsPresent ?? []).map((ref) => ref.split(":")[0] ?? ""));
+        const deletable = before.registryTagsPresent === undefined
+            ? ownedRegistryRepositories
+            : ownedRegistryRepositories.filter((repository) => presentRepositories.has(repository));
         if (deletable.length > 0) {
-            eveProgress(options, `deleting ${deletable.length} registry image${deletable.length === 1 ? "" : "s"}`);
+            eveProgress(options, `deleting ${deletable.length} registry repositor${deletable.length === 1 ? "y" : "ies"}`);
         }
-        for (const image of deletable) {
-            imageDeletes.set(image, await deleteRegistryImage({ image }));
+        for (const repository of deletable) {
+            repositoryDeletes.set(repository, await deleteRegistryRepository({ repository }));
         }
     }
     eveProgress(options, "verifying the exact target is absent");
@@ -2991,15 +3042,16 @@ async function runEveDestroyLocked(request, options, checks, emit, fail) {
         });
         fail("EVE_DESTROY_ABSENCE_UNPROVEN", "The exact target could not be proven absent after deletion.");
     }
-    const retainedImages = ownedRegistryImages.filter((image) => after.registryImagesPresent === undefined
-        ? imageDeletes.get(image) === "indeterminate"
-        : after.registryImagesPresent.includes(image));
-    if (ownedRegistryImages.length > 0) {
-        checks.push(retainedImages.length === 0
+    const presentTagsAfter = after.registryTagsPresent ?? [];
+    const retainedRepositories = ownedRegistryRepositories.filter((repository) => presentTagsAfter.some((ref) => ref.startsWith(`${repository}:`)) ||
+        (after.registryTagsPresent === undefined &&
+            repositoryDeletes.get(repository) === "indeterminate"));
+    if (ownedRegistryRepositories.length > 0) {
+        checks.push(retainedRepositories.length === 0
             ? check("VAL-LIFE-006-REGISTRY", "passed", "Every registry image tag recorded for this exact target was deleted or proven absent.")
-            : check("VAL-LIFE-006-REGISTRY", "failed", `The exact target's registry image(s) remain after destroy: ${retainedImages.join(", ")}.`, "Retry eden destroy with the same selectors, or remove only the listed image refs with wrangler containers images delete."));
+            : check("VAL-LIFE-006-REGISTRY", "failed", `The exact target's registry image tag(s) remain after destroy: ${retainedRepositories.join(", ")}.`, "Retry eden destroy with the same selectors, or remove only the listed repositories' tags with wrangler containers images delete."));
     }
-    if (retainedImages.length > 0) {
+    if (retainedRepositories.length > 0) {
         emit({
             ok: false,
             status: "failed",
@@ -3007,7 +3059,7 @@ async function runEveDestroyLocked(request, options, checks, emit, fail) {
             name: request.name,
             checks,
         });
-        fail("EVE_DESTROY_IMAGES_RETAINED", `The exact Worker and Container are absent, but registry image(s) remain: ${retainedImages.join(", ")}.`);
+        fail("EVE_DESTROY_IMAGES_RETAINED", `The exact Worker and Container are absent, but registry image tag(s) remain in: ${retainedRepositories.join(", ")}.`);
     }
     checks.push(check("VAL-LIFE-006", "passed", "Exact absence was verified; clearing this target's CURRENT pointer only."));
     const currentPath = join(request.projectRoot, ".eden", "eve-deploy", "targets", `${request.environment}-${request.name}`, "CURRENT");