@moinulmoin/eden 0.8.0 → 0.10.0

package/README.md

@@ -12,15 +12,15 @@ If you already have an Eve project, start with `eden deploy`.
 Use any one of these package managers:
 
 ```sh
-npm install --global @moinulmoin/eden@0.8.0
+npm install --global @moinulmoin/eden@0.10.0
 ```
 
 ```sh
-pnpm add --global @moinulmoin/eden@0.8.0
+pnpm add --global @moinulmoin/eden@0.10.0
 ```
 
 ```sh
-bun add --global @moinulmoin/eden@0.8.0
+bun add --global @moinulmoin/eden@0.10.0
 ```
 
 Then confirm the CLI is available:

package/dist/eve-control-plane.d.ts

@@ -128,6 +128,11 @@ export interface EveDeploymentIdentity {
     readonly sourceDigest: string;
     readonly generationId: string;
     readonly deploymentId: string;
+    readonly releaseId?: string;
+    readonly eveVersion?: string;
+    readonly affinityContract?: number;
+    readonly retainedDeployments?: Readonly<Record<string, EveAffinityDeployment>>;
+    readonly pendingRetirements?: Readonly<Record<string, EveAffinityDeployment>>;
     readonly environment: EveCliEnvironment;
     readonly name: string;
     readonly accountId: string;
@@ -144,6 +149,28 @@ export type EveDeploymentIdentityProof = Partial<EveDeploymentIdentity> & {
     /** The deployment the serving Container verifiably started under; set only by a deployed Eden host that proves its running image before stamping. */
     readonly startedDeploymentId?: string;
 };
+export interface EveAffinityDeployment {
+    readonly image: string;
+    readonly generationId: string;
+    readonly runtimeRevisionHandle?: string;
+    readonly eveVersion?: string;
+    readonly affinityContract?: number;
+    readonly releaseId?: string;
+    readonly worldRpcAuth?: boolean;
+}
+export interface EveDeploymentDrainState {
+    readonly liveRuns: number;
+    readonly liveSessions: number;
+    readonly pendingMessages: number;
+    readonly unfinishedTransfers: number;
+    readonly drained: boolean;
+}
+export type EveDeploymentRpcRunner = (request: {
+    readonly origin: string;
+    readonly operation: "deployments.drainState" | "deployments.retire";
+    readonly deploymentIds: readonly string[];
+    readonly controlToken: string;
+}) => Promise<unknown>;
 export interface EveDeploymentPublicationRequest {
     readonly identity: EveDeploymentIdentity;
     readonly hostConfig: EveHostConfig;
@@ -233,6 +260,7 @@ export interface EvePreflightOptions {
     readonly protectedStore?: EveRuntimeProtectedStore;
     readonly publish?: EveDeploymentPublicationRunner;
     readonly publishImage?: EveImagePublicationRunner;
+    readonly deploymentRpc?: EveDeploymentRpcRunner;
     readonly compensate?: EveDeploymentCompensationRunner;
     readonly health?: EveDeploymentHealthRunner;
     readonly afterPromotion?: () => void | Promise<void>;

package/dist/eve-control-plane.js

@@ -1,3 +1,4 @@
+import { setTimeout as waitForActivation } from "node:timers/promises";
 import { createRequire, } from "node:module";
 import { createHash, randomUUID, } from "node:crypto";
 import { join, dirname, relative, } from "node:path";
@@ -8,10 +9,10 @@ import { execFile, spawn, } from "node:child_process";
 import { fileURLToPath, } from "node:url";
 import { promisify, } from "node:util";
 import { EveCliError, EVE_NAME_PATTERN, } from "./eve.js";
-import { buildEveProjectSnapshot, createDockerEveProjectBuilder, revalidateEveProjectCandidateInputs, EvePackagingError, IMAGE_ID_PATTERN, } from "./eve-packaging.js";
+import { buildEveProjectSnapshot, checkEveSandboxProvider, createDockerEveProjectBuilder, revalidateEveProjectCandidateInputs, EvePackagingError, IMAGE_ID_PATTERN, } from "./eve-packaging.js";
 import { buildEveRuntimeImage, discardEveRuntimeImage, revalidateEveRuntimeCandidate, validateEveHostRequirements, } from "./eve-runtime-image.js";
 import { EveRuntimeConfigError, prepareEveRuntimeInjection, redactEveRuntimeOutput, } from "./eve-runtime-config.js";
-import { createEveHostConfig, generateEveHostWorkerSource, parseEveScheduleCron, resolveStableWorkersDevOrigin, } from "@moinulmoin/eden-runtime-cloudflare";
+import { EDEN_AFFINITY_CONTRACT, callDeploymentControlRpc, createEveHostConfig, generateEveHostWorkerSource, parseEveScheduleCron, resolveStableWorkersDevOrigin, } from "@moinulmoin/eden-runtime-cloudflare";
 const execFileAsync = promisify(execFile);
 const require = createRequire(import.meta.url);
 const wranglerEntrypoint = require.resolve("wrangler");
@@ -32,6 +33,54 @@ export const DEFAULT_EVE_NODE_IMAGE = Object.freeze({
 });
 /** The single tag Eden pushes to the managed Cloudflare registry per generation. */
 const EVE_REGISTRY_IMAGE_TAG = "candidate";
+function validateDeploymentDrainStates(value, ids) {
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        throw deploymentFailure("EVE_AFFINITY_DRAIN_UNPROVEN", "The authenticated World did not return deployment drain states.");
+    }
+    const states = value;
+    for (const id of ids) {
+        const state = states[id];
+        if (typeof state !== "object" || state === null ||
+            typeof state.drained !== "boolean" ||
+            [state.liveRuns, state.liveSessions, state.pendingMessages, state.unfinishedTransfers]
+                .some((count) => !Number.isSafeInteger(count) || count < 0) ||
+            state.drained !== (state.liveRuns + state.liveSessions + state.pendingMessages + state.unfinishedTransfers === 0)) {
+            throw deploymentFailure("EVE_AFFINITY_DRAIN_UNPROVEN", `The authenticated World returned an invalid drain state for ${id}.`);
+        }
+    }
+    return states;
+}
+const defaultDeploymentRpc = async (request) => {
+    // A successful Cloudflare secret write creates an active deployment, but
+    // existing stateless Worker isolates may briefly serve the preceding secret.
+    // Only the first read-only drain call following our own rotation may wait
+    // for that exact in-memory credential. All other failures remain terminal.
+    const activationRead = request.operation === "deployments.drainState";
+    const deadline = Date.now() + 60_000;
+    for (;;) {
+        const remaining = deadline - Date.now();
+        if (remaining <= 0) {
+            throw deploymentFailure("EVE_AFFINITY_CONTROL_ACTIVATION_TIMEOUT", "The freshly rotated deployment-control credential did not activate within 60 seconds; publication was refused.");
+        }
+        try {
+            return await callDeploymentControlRpc({
+                origin: request.origin,
+                token: request.controlToken,
+                operation: request.operation,
+                args: [{ deploymentIds: request.deploymentIds }],
+                signal: AbortSignal.timeout(remaining),
+            });
+        }
+        catch (error) {
+            if (!activationRead || typeof error !== "object" || error === null ||
+                !("status" in error) || error.status !== 401)
+                throw error;
+            const delay = Math.min(1_000, deadline - Date.now());
+            if (delay > 0)
+                await waitForActivation(delay);
+        }
+    }
+};
 function safeText(value) {
     return redactEveRuntimeOutput(value)
         .replace(/(?:^|[\s"'=])(?:Bearer|Token)\s+\S+/giu, "$1[redacted]")
@@ -65,6 +114,7 @@ function mapPackagingCheck(value) {
             case "DOCKER_PLATFORM_BLOCKED":
                 return "VAL-BUILD-005";
             case "EVE_SANDBOX_RESUME_PATCH":
+            case "EVE_SANDBOX_PROVIDER":
                 return value.id;
             default:
                 return `EVE-${value.id}`;
@@ -470,13 +520,13 @@ function safeDockerEnvironment() {
         DOCKER_CONTEXT: process.env.DOCKER_CONTEXT,
     };
 }
-async function readWranglerJson(args) {
+async function readWranglerJson(args, timeoutMs = 30_000) {
     try {
         const result = await execFileAsync(process.execPath, [wranglerEntrypoint, ...args], {
             env: safeWranglerEnvironment(),
             cwd: wranglerCwd,
             maxBuffer: 2 * 1024 * 1024,
-            timeout: 30_000,
+            timeout: timeoutMs,
         });
         const parsed = JSON.parse(result.stdout.trim());
         return { value: parsed, failed: false };
@@ -812,11 +862,33 @@ async function resolveEveTargetOwnership(request, result) {
             evidence.containerNamespaceId === evidence.workerContainerNamespaceId);
     const remoteProven = evidence !== undefined && workerProven && containerProven;
     if (!remoteProven) {
+        const failures = [];
+        if (evidence === undefined)
+            failures.push("provider evidence unavailable");
+        if (result.target.observed?.worker === true) {
+            if (evidence?.settingsReadable !== true)
+                failures.push("Worker settings unreadable");
+            else if (evidence.workerDeploymentId === undefined)
+                failures.push("Worker deployment stamp absent");
+            else if (!recordedDeploymentIds.has(evidence.workerDeploymentId))
+                failures.push("Worker deployment stamp differs from recorded identities");
+        }
+        if (result.target.observed?.container === true) {
+            if (evidence?.containerSchedulingPolicy !== "durable_object")
+                failures.push("Container scheduling policy unproven");
+            if (evidence?.containerNamespaceId === undefined)
+                failures.push("Container namespace unreadable");
+            if (evidence?.workerContainerNamespaceId === undefined)
+                failures.push("Worker Container binding namespace unreadable");
+            if (evidence?.containerNamespaceId !== undefined && evidence.workerContainerNamespaceId !== undefined &&
+                evidence.containerNamespaceId !== evidence.workerContainerNamespaceId)
+                failures.push("Container and Worker binding namespaces differ");
+        }
         return {
             ...result,
             target: {
                 ...result.target,
-                message: "The exact Worker or Container target exists, and although a local Eden record matches, provider state cannot prove it is the one Eden deployed — the target may have been recreated outside Eden.",
+                message: `The exact Worker or Container target exists, and although a local Eden record matches, provider state cannot prove it is the one Eden deployed — the target may have been recreated outside Eden. Unproven: ${failures.join("; ")}.`,
                 remediation: "Inspect the Worker at its workers.dev origin and the recorded deployment history before redeploying; if it is not Eden's, deploy under a different --name or delete it yourself.",
             },
         };
@@ -994,11 +1066,17 @@ function transportIdentityMatches(expected, observed) {
         "generationId",
         "stableWorkersDevOrigin",
         "workerName",
-        "stableContainerInstanceName",
     ];
     if (!required.every((key) => observed[key] === expected[key])) {
         return false;
     }
+    const expectedInstance = expected.retainedDeployments === undefined ||
+        expected.deploymentId === "eden-cloudflare"
+        ? expected.stableContainerInstanceName
+        : `${expected.stableContainerInstanceName}:${expected.deploymentId}`;
+    if (observed.stableContainerInstanceName !== expectedInstance ||
+        observed.releaseId !== expected.releaseId)
+        return false;
     return expected.runtimeRevisionHandle === undefined
         ? observed.runtimeRevisionHandle === undefined
         : observed.runtimeRevisionHandle === expected.runtimeRevisionHandle;
@@ -1011,6 +1089,7 @@ function identityMatches(expected, observed) {
         "sourceDigest",
         "generationId",
         "deploymentId",
+        "releaseId",
         "environment",
         "name",
         "accountId",
@@ -1038,6 +1117,11 @@ function safeIdentity(identity) {
         sourceDigest: identity.sourceDigest,
         generationId: identity.generationId,
         deploymentId: identity.deploymentId,
+        releaseId: identity.releaseId,
+        eveVersion: identity.eveVersion,
+        affinityContract: identity.affinityContract,
+        retainedDeployments: identity.retainedDeployments,
+        pendingRetirements: identity.pendingRetirements,
         environment: identity.environment,
         name: identity.name,
         accountId: identity.accountId,
@@ -1280,6 +1364,7 @@ function responseIdentity(response, body) {
     read("sourceDigest", "x-eden-eve-source-digest");
     read("generationId", "x-eden-eve-generation-id");
     read("deploymentId", "x-eden-eve-deployment-id");
+    read("releaseId", "x-eden-eve-release-id");
     read("environment", "x-eden-eve-environment");
     read("name", "x-eden-eve-name");
     read("accountId", "x-eden-eve-account-id");
@@ -1340,7 +1425,7 @@ function defaultHealthRunner() {
                 // must wait until the *served container* verifiably runs this
                 // generation's image (the host stamps the header only after
                 // inspecting the running instance).
-                if (observedIdentity.startedDeploymentId !== request.identity.deploymentId) {
+                if (observedIdentity.startedDeploymentId !== (request.identity.releaseId ?? request.identity.deploymentId)) {
                     lastReason =
                         "The served Container has not verifiably started this deployment's image yet; waiting for the rollout to land.";
                     await wait();
@@ -1459,8 +1544,8 @@ async function promoteEveTargetPointer(deploymentRoot, pointerKey, generationRoo
     }
     return currentPath;
 }
-async function writeEveDeploymentRecord(candidate, identity, hostConfig, status, extra = {}) {
-    await writeFile(join(candidate.generationRoot, "deployment.json"), `${JSON.stringify({
+async function writeEveDeploymentRecord(candidate, identity, hostConfig, status, extra = {}, filename = "deployment.json") {
+    await writeFile(join(candidate.generationRoot, filename), `${JSON.stringify({
         version: 1,
         status,
         identity: safeIdentity(identity),
@@ -1473,6 +1558,10 @@ async function writeEveDeploymentRecord(candidate, identity, hostConfig, status,
         flag: "wx",
     });
 }
+async function deploymentRecordPath(generationRoot) {
+    const path = join(generationRoot, "deployment.json");
+    return await lstat(path).then(() => path, () => join(generationRoot, "deployment-intent.json"));
+}
 async function writeEveIndeterminateEvidence(candidate, evidence, extra = {}) {
     await writeFile(join(candidate.generationRoot, "deployment-attempt.json"), `${JSON.stringify({
         version: 1,
@@ -1537,6 +1626,14 @@ async function runEveDeployment(request, options, collected) {
     }
     const priorIdentity = prior?.identity;
     const priorDurableObjects = prior?.durableObjects;
+    const worldManifest = collected.workflowWorld === "@moinulmoin/eden-world-cloudflare"
+        ? await readInstalledManifest(candidate.snapshotRoot, collected.workflowWorld)
+        : undefined;
+    const affinityEnabled = worldManifest?.eden?.capabilities?.deploymentAffinity === true;
+    const worldRpcAuth = worldManifest?.eden?.capabilities?.worldRpcAuth === true;
+    if (!affinityEnabled && priorIdentity?.retainedDeployments !== undefined) {
+        throw deploymentFailure("EVE_AFFINITY_REQUIRED", "This target retains affinity deployments; install a World package declaring deploymentAffinity before updating it.");
+    }
     const superseded = isUpdate
         ? {
             generationId: priorIdentity?.generationId,
@@ -1552,8 +1649,12 @@ async function runEveDeployment(request, options, collected) {
         if (durableWorld) {
             resultWarnings.push({
                 id: "EVE_UPDATE_IN_FLIGHT",
-                message: "This update replaces the running Container; durable World runs in flight resume on the new code — Cloudflare has no deployment pinning, so keep step names and payload shapes backward compatible.",
-                remediation: "Let pending approvals and long runs settle before updating, or keep step names, queue names, and serialized payloads compatible across the change.",
+                message: affinityEnabled
+                    ? "This update retains pinned deployments until their sessions, queue messages, and transfers drain."
+                    : "This update replaces the running Container; an Eve version change can strand existing sessions because the installed World does not declare deployment affinity.",
+                remediation: affinityEnabled
+                    ? "End old sessions to allow their deployment images to retire."
+                    : "Let sessions settle before changing Eve versions, or install an affinity-capable World package.",
             });
         }
         if (prior?.worldCloudflare !==
@@ -1594,6 +1695,80 @@ async function runEveDeployment(request, options, collected) {
         throw deploymentFailure("EVE_IMAGE_IDENTITY_UNAVAILABLE", "The deploy candidate did not provide an immutable runtime image digest.");
     }
     const targetKey = stableDeploymentKey(collected.projectId, accountId, request.environment, request.name);
+    const releaseId = `eve-deploy-${randomUUID()}`;
+    let previousEveVersion = priorIdentity?.eveVersion;
+    if (previousEveVersion === undefined && prior !== undefined) {
+        previousEveVersion = (await readInstalledManifest(join(prior.generationRoot, "container/snapshot"), "eve"))?.version;
+    }
+    const retainedDeployments = {
+        ...priorIdentity?.retainedDeployments,
+    };
+    if (affinityEnabled && priorIdentity?.retainedDeployments === undefined &&
+        priorIdentity?.containerImage !== undefined && priorIdentity.generationId !== undefined) {
+        retainedDeployments["eden-cloudflare"] = {
+            image: priorIdentity.containerImage,
+            generationId: priorIdentity.generationId,
+            ...(previousEveVersion === undefined ? {} : { eveVersion: previousEveVersion }),
+            affinityContract: EDEN_AFFINITY_CONTRACT,
+            ...(priorIdentity.runtimeRevisionHandle === undefined ? {} : { runtimeRevisionHandle: priorIdentity.runtimeRevisionHandle }),
+        };
+    }
+    const matchingDeployment = Object.entries(retainedDeployments).find(([, entry]) => entry.eveVersion === candidate.eveVersion && entry.affinityContract === EDEN_AFFINITY_CONTRACT)?.[0];
+    const deploymentId = !affinityEnabled ? releaseId : matchingDeployment ??
+        `eden-affinity-${createHash("sha256").update(`${candidate.eveVersion}:${EDEN_AFFINITY_CONTRACT}`).digest("hex").slice(0, 24)}`;
+    const retiringDeployments = { ...priorIdentity?.pendingRetirements };
+    delete retiringDeployments[deploymentId];
+    if (priorIdentity?.deploymentId !== undefined)
+        delete retiringDeployments[priorIdentity.deploymentId];
+    for (const id of prior?.protectedDeploymentIds ?? [])
+        delete retiringDeployments[id];
+    const hasRetainedNoncurrentDeployments = priorIdentity?.retainedDeployments !== undefined &&
+        Object.keys(retainedDeployments).some((id) => id !== priorIdentity.deploymentId);
+    const controlToken = `${randomUUID()}${randomUUID()}`;
+    if (affinityEnabled && (hasRetainedNoncurrentDeployments || Object.keys(retiringDeployments).length > 0)) {
+        await (options.protectedStore ?? defaultProtectedStore(request.name)).put({
+            targetId: targetKey, revision: `eve-affinity-control-${randomUUID()}`,
+            inputIdentity: {
+                token: `eve-affinity-control-input-${randomUUID()}`,
+                byteLength: Buffer.byteLength(controlToken),
+                digest: createHash("sha256").update(controlToken).digest("hex"),
+            },
+            variableNames: ["EDEN_EVE_CONTROL_TOKEN"], values: { EDEN_EVE_CONTROL_TOKEN: controlToken },
+        });
+    }
+    if (affinityEnabled && hasRetainedNoncurrentDeployments) {
+        const ids = Object.keys(retainedDeployments);
+        const raw = await (options.deploymentRpc ?? defaultDeploymentRpc)({
+            origin: stableWorkersDevOrigin, operation: "deployments.drainState", deploymentIds: ids,
+            controlToken,
+        });
+        const states = validateDeploymentDrainStates(raw, ids);
+        const eligible = ids.filter((id) => id !== deploymentId && id !== priorIdentity.deploymentId &&
+            !prior?.protectedDeploymentIds?.includes(id) && states[id]?.drained === true);
+        const remainingCount = ids.length - eligible.length + (deploymentId in retainedDeployments ? 0 : 1);
+        if (remainingCount <= 10 && eligible.length > 0) {
+            // Drain snapshots are not fences. Retire only noncurrent targets, and
+            // obtain the World's durable admission fence before dropping routes.
+            const retired = await (options.deploymentRpc ?? defaultDeploymentRpc)({
+                origin: stableWorkersDevOrigin, operation: "deployments.retire",
+                deploymentIds: eligible, controlToken,
+            });
+            if (typeof retired !== "object" || retired === null || !("retired" in retired) ||
+                !Array.isArray(retired.retired) ||
+                eligible.some((id) => !retired.retired.includes(id))) {
+                throw deploymentFailure("EVE_AFFINITY_RETIRE_UNPROVEN", "The World did not prove the noncurrent deployments durably fenced for retirement.");
+            }
+            for (const id of eligible) {
+                retiringDeployments[id] = retainedDeployments[id];
+                delete retainedDeployments[id];
+            }
+        }
+        if (Object.keys(retainedDeployments).length + (deploymentId in retainedDeployments ? 0 : 1) > 10) {
+            const blockers = Object.entries(states).filter(([id]) => id in retainedDeployments)
+                .map(([id, state]) => `${id}: ${state.liveSessions} live sessions, ${state.liveRuns} live runs, ${state.pendingMessages} pending messages, ${state.unfinishedTransfers} unfinished transfers`);
+            throw deploymentFailure("EVE_AFFINITY_LIMIT", `Deployment refused before image/code publication: at most 10 affinity deployments may be retained. Blocking deployments: ${blockers.join("; ")}`);
+        }
+    }
     let imageReference = options.containerImageReference;
     if (imageReference !== undefined) {
         if (imageDigestFromReference(imageReference) !== imageDigest) {
@@ -1606,7 +1781,7 @@ async function runEveDeployment(request, options, collected) {
         if (localImageReference === undefined || localImageReference.length === 0) {
             throw deploymentFailure("EVE_IMAGE_IDENTITY_UNAVAILABLE", "The deploy candidate did not return an exact local image handle for publication.");
         }
-        const imageRepository = `eden-eve-${targetKey}-${candidate.generationId}`;
+        const imageRepository = `eden-eve-${targetKey}-${affinityEnabled ? deploymentId : candidate.generationId}`;
         const imageTag = `${imageRepository}:${EVE_REGISTRY_IMAGE_TAG}`;
         const targetImageReference = `registry.cloudflare.com/${accountId}/${imageRepository}@${imageDigest}`;
         const imagePublication = await (options.publishImage ??
@@ -1668,7 +1843,6 @@ async function runEveDeployment(request, options, collected) {
             throw deploymentFailure("DEPLOY_INDETERMINATE", reason);
         }
     }
-    const deploymentId = `eve-deploy-${randomUUID()}`;
     const containerApplicationName = boundedResourceName(request.name, "container");
     const stableContainerInstanceName = boundedResourceName(request.name, "instance");
     const runtimeVariableNames = candidate.runtimeVariableNames;
@@ -1677,6 +1851,24 @@ async function runEveDeployment(request, options, collected) {
         sourceDigest: candidate.sourceDigest,
         generationId: candidate.generationId,
         deploymentId,
+        releaseId,
+        eveVersion: candidate.eveVersion,
+        ...(affinityEnabled ? {
+            affinityContract: EDEN_AFFINITY_CONTRACT,
+            retainedDeployments: {
+                ...retainedDeployments,
+                [deploymentId]: {
+                    image: imageReference,
+                    generationId: candidate.generationId,
+                    eveVersion: candidate.eveVersion,
+                    affinityContract: EDEN_AFFINITY_CONTRACT,
+                    releaseId,
+                    worldRpcAuth,
+                    ...(runtimeInjection?.protectedHandle === undefined ? {} : { runtimeRevisionHandle: runtimeInjection.protectedHandle }),
+                },
+            },
+            pendingRetirements: retiringDeployments,
+        } : {}),
         environment: request.environment,
         name: request.name,
         accountId,
@@ -1697,6 +1889,11 @@ async function runEveDeployment(request, options, collected) {
         containerApplicationName: identity.containerApplicationName,
         stableContainerInstanceName: identity.stableContainerInstanceName,
         deploymentId: identity.deploymentId,
+        worldRpcAuth,
+        ...(identity.releaseId === undefined ? {} : { releaseId: identity.releaseId }),
+        ...(identity.eveVersion === undefined ? {} : { eveVersion: identity.eveVersion }),
+        ...(identity.affinityContract === undefined ? {} : { affinityContract: identity.affinityContract }),
+        ...(identity.retainedDeployments === undefined ? {} : { retainedDeployments: identity.retainedDeployments }),
         generationId: identity.generationId,
         stableWorkersDevOrigin: identity.stableWorkersDevOrigin,
         containerImage: identity.containerImage,
@@ -1752,6 +1949,7 @@ async function runEveDeployment(request, options, collected) {
                 throw error;
         }
     };
+    await writeEveDeploymentRecord(candidate, identity, hostConfig, "indeterminate", { evidence: "publication-intent" }, "deployment-intent.json");
     try {
         eveProgress(options, "publishing Worker and Container application");
         publication = await publishOne(publicationRequest);
@@ -1954,7 +2152,40 @@ async function runEveDeployment(request, options, collected) {
     await promoteEveTargetPointer(join(request.projectRoot, ".eden", "eve-deploy"), `${request.environment}-${request.name}`, candidate.generationRoot);
     await options.afterPromotion?.();
     let supersededImageCleanup;
-    if (isUpdate) {
+    if (affinityEnabled && Object.keys(retiringDeployments).length > 0) {
+        const ids = Object.keys(retiringDeployments);
+        const completedRetirements = [];
+        try {
+            const result = await (options.deploymentRpc ?? defaultDeploymentRpc)({
+                origin: stableWorkersDevOrigin, operation: "deployments.retire", deploymentIds: ids,
+                controlToken,
+            });
+            if (typeof result !== "object" || result === null ||
+                !("retired" in result) || !Array.isArray(result.retired) ||
+                ids.some((id) => !result.retired.includes(id)))
+                throw new Error("Retirement was not proven.");
+            for (const [id, retained] of Object.entries(retiringDeployments)) {
+                const repository = ownedRegistryRepository({
+                    ...identity, deploymentId: id, containerImage: retained.image, generationId: retained.generationId,
+                }, request.environment, request.name, accountId);
+                if (repository !== undefined && await (options.deleteRegistryRepository ??
+                    defaultRegistryRepositoryDelete)({ repository }) === "indeterminate") {
+                    throw new Error(`Repository deletion was not proven: ${repository}`);
+                }
+                completedRetirements.push(id);
+            }
+            supersededImageCleanup = check("VAL-LIFE-007", "passed", "Drained deployment instances and their owned registry repositories were retired.");
+        }
+        catch {
+            supersededImageCleanup = check("VAL-LIFE-007", "failed", "The deployment is healthy, but drained resource retirement was not proven; exact pending retirement records were retained for retry.", "Retry deploy to finish only recorded drained resource cleanup.");
+        }
+        if (completedRetirements.length > 0) {
+            // Keep the immutable deployment record as evidence, but exclude proven
+            // cleanup from the next deploy's active retry set.
+            await writeFile(join(candidate.generationRoot, "completed-retirements.json"), `${JSON.stringify(completedRetirements)}\n`, { encoding: "utf8", mode: 0o600, flag: "wx" });
+        }
+    }
+    if (isUpdate && !affinityEnabled) {
         // The superseded generation's registry repository is generation-scoped
         // and no longer referenced once CURRENT promotes this generation; only
         // then is it safe to delete. Every tag in the repository goes with it —
@@ -2053,6 +2284,22 @@ async function collectEvePreflight(request, options) {
             runtimeConfig,
         };
     }
+    const sandboxProvider = await checkEveSandboxProvider(request.projectRoot);
+    if (sandboxProvider !== undefined) {
+        checks.push(check(sandboxProvider.code, "failed", sandboxProvider.message, sandboxProvider.remediation));
+        return {
+            result: {
+                command: request.command === "deploy" ? "eve deploy" : "eve preflight",
+                ok: false,
+                environment: request.environment,
+                name: request.name,
+                checks,
+                warnings,
+                candidate: null,
+            },
+            runtimeConfig,
+        };
+    }
     warnings.push(...await collectEveSetupWarnings(request.projectRoot));
     eveProgress(options, "packaging project — snapshot, frozen install, eve build");
     const nodeImage = options.nodeImage ?? DEFAULT_EVE_NODE_IMAGE;
@@ -2495,7 +2742,7 @@ async function readEveDestroyRecord(projectRoot, environment, name) {
     if (generationRoot === undefined) {
         return readEveDestroyRecordFromGenerations(projectRoot, environment, name);
     }
-    const parsed = await parseEveDestroyRecord(join(generationRoot, "deployment.json"), environment, name);
+    const parsed = await parseEveDestroyRecord(await deploymentRecordPath(generationRoot), environment, name);
     return parsed === undefined
         ? undefined
         : { ...parsed, generationRoot };
@@ -2509,7 +2756,7 @@ async function readEveDestroyRecordFromGenerations(projectRoot, environment, nam
         const details = await lstat(generationRoot).catch(() => undefined);
         if (details === undefined || !details.isDirectory())
             continue;
-        const recordDetails = await lstat(join(generationRoot, "deployment.json")).catch(() => undefined);
+        const recordDetails = await lstat(await deploymentRecordPath(generationRoot)).catch(() => undefined);
         if (recordDetails !== undefined && recordDetails.isFile()) {
             withRecords.push({
                 generationRoot,
@@ -2519,7 +2766,7 @@ async function readEveDestroyRecordFromGenerations(projectRoot, environment, nam
     }
     withRecords.sort((left, right) => right.modifiedAt - left.modifiedAt);
     for (const { generationRoot } of withRecords) {
-        const parsed = await parseEveDestroyRecord(join(generationRoot, "deployment.json"), environment, name);
+        const parsed = await parseEveDestroyRecord(await deploymentRecordPath(generationRoot), environment, name);
         if (parsed !== undefined) {
             return { ...parsed, generationRoot };
         }
@@ -2564,7 +2811,35 @@ async function parseEveDestroyRecord(recordPath, environment, name) {
     if (identity.environment !== environment || identity.name !== name) {
         return undefined;
     }
+    const metadata = {};
+    for (const key of ["deploymentId", "eveVersion", "releaseId", "runtimeRevisionHandle"]) {
+        if (typeof identity[key] === "string")
+            Object.assign(metadata, { [key]: identity[key] });
+    }
+    if (typeof identity.affinityContract === "number")
+        Object.assign(metadata, { affinityContract: identity.affinityContract });
+    for (const key of ["retainedDeployments", "pendingRetirements"]) {
+        const value = identity[key];
+        if (value === undefined)
+            continue;
+        if (typeof value !== "object" || value === null || Array.isArray(value))
+            return undefined;
+        for (const [id, deployment] of Object.entries(value)) {
+            if (!/^(?:eden-cloudflare|eden-affinity-[a-f0-9]{24})$/u.test(id) ||
+                typeof deployment !== "object" || deployment === null ||
+                typeof deployment.image !== "string" || imageDigestFromReference(deployment.image) === undefined ||
+                typeof deployment.generationId !== "string" ||
+                (deployment.eveVersion !== undefined && typeof deployment.eveVersion !== "string") ||
+                (deployment.affinityContract !== undefined && typeof deployment.affinityContract !== "number") ||
+                (deployment.releaseId !== undefined && typeof deployment.releaseId !== "string") ||
+                (deployment.worldRpcAuth !== undefined && typeof deployment.worldRpcAuth !== "boolean") ||
+                (deployment.runtimeRevisionHandle !== undefined && typeof deployment.runtimeRevisionHandle !== "string"))
+                return undefined;
+        }
+        Object.assign(metadata, { [key]: value });
+    }
     const verified = {
+        ...metadata,
         workerName: identity.workerName,
         containerApplicationName: identity.containerApplicationName,
         stableContainerInstanceName: identity.stableContainerInstanceName,
@@ -2603,7 +2878,7 @@ async function readEveDeploymentRecord(projectRoot, environment, name, accountId
     const deploymentIds = new Set();
     for (const entry of entries) {
         const generationRoot = join(generationsRoot, entry);
-        const recordPath = join(generationRoot, "deployment.json");
+        const recordPath = await deploymentRecordPath(generationRoot);
         const details = await lstat(recordPath).catch(() => undefined);
         if (details === undefined || !details.isFile())
             continue;
@@ -2636,7 +2911,7 @@ async function readEveDeploymentRecord(projectRoot, environment, name, accountId
                 live = pinned;
             }
             else {
-                const parsed = await parseEveDeploymentRecord(join(generationRoot, "deployment.json"), environment, name);
+                const parsed = await parseEveDeploymentRecord(await deploymentRecordPath(generationRoot), environment, name);
                 if (parsed !== undefined &&
                     !((accountId !== undefined &&
                         parsed.identity.accountId !== accountId) ||
@@ -2652,10 +2927,31 @@ async function readEveDeploymentRecord(projectRoot, environment, name, accountId
     // Newest record carrying a usable DO history wins, regardless of its
     // deployment outcome: a tag it published must never be replayed.
     const historySource = scanned.find((entry) => entry.record.durableObjects !== undefined);
+    // CURRENT is only a health/promotion pointer. A newer uncertain publication
+    // may already serve sessions; preserve every such image until a later deploy
+    // can prove it drained, never infer absence from a failed health check.
+    const unresolved = scanned.filter((entry) => entry.modifiedAt > live.modifiedAt);
+    const retainedDeployments = { ...live.record.identity.retainedDeployments };
+    const pendingRetirements = { ...live.record.identity.pendingRetirements };
+    const protectedDeploymentIds = new Set();
+    if (live.record.identity.retainedDeployments === undefined) {
+        protectedDeploymentIds.add("eden-cloudflare");
+    }
+    for (const entry of unresolved.slice().reverse()) {
+        Object.assign(retainedDeployments, entry.record.identity.retainedDeployments);
+        Object.assign(pendingRetirements, entry.record.identity.pendingRetirements);
+        if (entry.record.deploymentId !== undefined)
+            protectedDeploymentIds.add(entry.record.deploymentId);
+    }
     return {
         recordPath: live.record.recordPath,
         generationRoot: live.generationRoot,
-        identity: live.record.identity,
+        identity: {
+            ...live.record.identity,
+            ...(Object.keys(retainedDeployments).length === 0 ? {} : { retainedDeployments }),
+            ...(Object.keys(pendingRetirements).length === 0 ? {} : { pendingRetirements }),
+        },
+        protectedDeploymentIds: [...protectedDeploymentIds],
         status: live.record.status,
         deploymentIds: [...deploymentIds],
         worldCloudflare: live.record.worldCloudflare,
@@ -2666,6 +2962,19 @@ async function parseEveDeploymentRecord(recordPath, environment, name) {
     const base = await parseEveDestroyRecord(recordPath, environment, name);
     if (base === undefined)
         return undefined;
+    let identity = base.identity;
+    try {
+        const completed = JSON.parse(await readFile(join(dirname(recordPath), "completed-retirements.json"), "utf8"));
+        if (Array.isArray(completed) && completed.every((id) => typeof id === "string")) {
+            const pendingRetirements = { ...identity.pendingRetirements };
+            for (const id of completed)
+                delete pendingRetirements[id];
+            identity = { ...identity, pendingRetirements };
+        }
+    }
+    catch {
+        // Missing or unreadable cleanup evidence must not suppress a retry.
+    }
     let parsed;
     try {
         parsed = JSON.parse(await readFile(recordPath, "utf8"));
@@ -2709,7 +3018,7 @@ async function parseEveDeploymentRecord(recordPath, environment, name) {
         Array.isArray(rawMigrations);
     const invalidHistory = () => ({
         recordPath,
-        identity: base.identity,
+        identity,
         status,
         deploymentId,
         worldCloudflare: rawVars?.EDEN_EVE_WORLD_CLOUDFLARE === true,
@@ -2736,7 +3045,7 @@ async function parseEveDeploymentRecord(recordPath, environment, name) {
     }
     return {
         recordPath,
-        identity: base.identity,
+        identity,
         status,
         deploymentId,
         worldCloudflare: rawVars?.EDEN_EVE_WORLD_CLOUDFLARE === true,
@@ -2758,7 +3067,7 @@ async function defaultDestroyTargetRead(request) {
             "images",
             "list",
             "--json",
-        ]);
+        ], WRANGLER_OPERATION_TIMEOUT_MS);
         const tagsByRepository = registryTagsByRepository(images.value);
         if (!images.failed && tagsByRepository !== undefined) {
             const present = [];
@@ -2837,12 +3146,13 @@ async function defaultContainerDelete(request) {
  * repository is deleted individually.
  */
 async function defaultRegistryRepositoryDelete(request) {
+    // Catalog reads include Cloudflare snapshot tags and can exceed 30 seconds.
     const images = await readWranglerJson([
         "containers",
         "images",
         "list",
         "--json",
-    ]);
+    ], WRANGLER_OPERATION_TIMEOUT_MS);
     const collection = jsonCollection(images.value);
     if (images.failed || collection === undefined)
         return "indeterminate";
@@ -2868,9 +3178,11 @@ async function defaultRegistryRepositoryDelete(request) {
             deletedAny = true;
             continue;
         }
-        if (!/(?:does not exist|not found|404)/iu.test(result.stderr)) {
-            return "indeterminate";
-        }
+    }
+    const after = await readWranglerJson(["containers", "images", "list", "--json"], WRANGLER_OPERATION_TIMEOUT_MS);
+    const remaining = after.failed ? undefined : registryTagsByRepository(after.value);
+    if (remaining === undefined || (remaining.get(request.repository)?.length ?? 0) > 0) {
+        return "indeterminate";
     }
     return deletedAny ? "deleted" : "absent";
 }
@@ -2888,13 +3200,13 @@ function ownedRegistryRepository(identity, environment, name, accountId) {
         identity.accountId !== accountId) {
         return undefined;
     }
-    const repository = `eden-eve-${stableDeploymentKey(identity.projectId, identity.accountId, environment, name)}-${identity.generationId}`;
-    const expected = `registry.cloudflare.com/${identity.accountId}/${repository}@`;
-    if (!identity.containerImage.startsWith(expected) ||
-        imageDigestFromReference(identity.containerImage) === undefined) {
+    const prefix = `eden-eve-${stableDeploymentKey(identity.projectId, identity.accountId, environment, name)}-`;
+    const suffixes = [identity.generationId];
+    if (identity.retainedDeployments !== undefined && identity.deploymentId !== undefined)
+        suffixes.push(identity.deploymentId);
+    if (imageDigestFromReference(identity.containerImage) === undefined)
         return undefined;
-    }
-    return repository;
+    return suffixes.map((suffix) => `${prefix}${suffix}`).find((repository) => identity.containerImage.startsWith(`registry.cloudflare.com/${identity.accountId}/${repository}@`));
 }
 /**
  * The registry repository an indeterminate deploy attempt provably pushed.
@@ -2947,17 +3259,31 @@ async function collectEveDestroyRegistryRepositories(projectRoot, environment, n
     const generationsRoot = join(projectRoot, ".eden", "eve-deploy", "generations");
     const entries = await readdir(generationsRoot).catch(() => []);
     const repositories = new Set();
+    const addRetained = (identity) => {
+        for (const [id, retained] of Object.entries({
+            ...identity.retainedDeployments, ...identity.pendingRetirements,
+        })) {
+            const repository = ownedRegistryRepository({
+                ...identity, deploymentId: id, containerImage: retained.image, generationId: retained.generationId,
+            }, environment, name, record.accountId);
+            if (repository !== undefined)
+                repositories.add(repository);
+        }
+    };
+    addRetained(record);
     const targetKey = record.projectId === undefined
         ? undefined
         : stableDeploymentKey(record.projectId, record.accountId, environment, name);
     for (const entry of entries) {
         const generationRoot = join(generationsRoot, entry);
-        const parsed = await parseEveDestroyRecord(join(generationRoot, "deployment.json"), environment, name);
+        const parsed = await parseEveDestroyRecord(await deploymentRecordPath(generationRoot), environment, name);
         const deployedRepository = parsed === undefined
             ? undefined
             : ownedRegistryRepository(parsed.identity, environment, name, record.accountId);
         if (deployedRepository !== undefined)
             repositories.add(deployedRepository);
+        if (parsed !== undefined)
+            addRetained(parsed.identity);
         if (targetKey === undefined)
             continue;
         const attemptRepository = await attemptRegistryRepository(join(generationRoot, "deployment-attempt.json"), record.accountId, targetKey);

package/dist/eve-packaging.d.ts

@@ -1,5 +1,5 @@
 import { type EveRuntimeInputIdentity } from "./eve-runtime-config.js";
-export type EvePackagingCode = "ROOT_INVALID" | "UNSUPPORTED_TOOLCHAIN" | "DEPENDENCY_AMBIGUITY" | "SOURCE_RACE" | "EVE_BUILD_FAILED" | "UNSUPPORTED_EVE_OUTPUT" | "RUNTIME_CLOSURE_INCOMPLETE" | "SECRET_EXCLUSION_FAILED" | "DOCKER_PLATFORM_BLOCKED" | "UNSUPPORTED_HOST_REQUIREMENT" | "EVE_HEALTH_FAILED" | "WORLD_MIGRATION_FAILED" | "CLEANUP_UNVERIFIED";
+export type EvePackagingCode = "ROOT_INVALID" | "UNSUPPORTED_TOOLCHAIN" | "DEPENDENCY_AMBIGUITY" | "SOURCE_RACE" | "EVE_BUILD_FAILED" | "EVE_SANDBOX_PROVIDER" | "UNSUPPORTED_EVE_OUTPUT" | "RUNTIME_CLOSURE_INCOMPLETE" | "SECRET_EXCLUSION_FAILED" | "DOCKER_PLATFORM_BLOCKED" | "UNSUPPORTED_HOST_REQUIREMENT" | "EVE_HEALTH_FAILED" | "WORLD_MIGRATION_FAILED" | "CLEANUP_UNVERIFIED";
 export interface EveRuntimeConfigExclusion {
     /**
      * This path is opaque. The packaging worker only uses its lexical identity
@@ -228,9 +228,10 @@ export interface EveProjectPackagingResult {
     readonly checks: readonly EvePackagingCheck[];
     /**
      * Outcome of the builder's temporary eve#4440 sandbox-resume patch:
-     * `applied` when the shipped just-bash binding carries it, `skipped` when
-     * the binding is a version Eden does not know, `absent` when this Eve
-     * build has no just-bash binding or packaging never reached the image.
+     * `applied` when the shipped just-bash binding carries it, `fixed` when the
+     * installed Eve already includes the upstream fix, `skipped` when the
+     * binding is a version Eden does not know, `absent` when this Eve build has
+     * no just-bash binding or packaging never reached the image.
      */
     readonly sandboxResumePatch: EveSandboxResumePatchStatus;
     readonly candidateImageId: string | null;
@@ -272,6 +273,25 @@ export declare const EVE_SANDBOX_RESUME_PATCH_KNOWN_SHA256 = "0ba0ac3a237c99af2f
 export declare const EVE_SANDBOX_RESUME_PATCH_LATEST_SHA256 = "ab8b1ad7398af8f6fd2a1e91eb0d1ff8d2b9b9afe1836234f36ce0e896791c45";
 /** Marker the patched binding always contains; proves the patch shipped. */
 export declare const EVE_SANDBOX_RESUME_PATCH_SIGNATURE = "edenRefreshJustBashSessionSkills";
+/**
+ * First Eve release whose just-bash provider keeps a session's files across
+ * template changes (vercel/eve#5132), so the patch is not needed from here on.
+ */
+export declare const EVE_SANDBOX_RESUME_FIXED_VERSION = "0.83.0";
+/**
+ * True when an installed Eve version already ships the eve#4440 fix. A
+ * prerelease of the fixed version sorts before it (semver), so it may predate
+ * the fix and keeps the patch.
+ */
+export declare function eveIncludesSandboxResumeFix(version: unknown): boolean;
+/**
+ * Early, source-level rejection of sandbox setups that cannot work in Eden's
+ * isolated builder: a native provider named in the sandbox module, or, on Eve
+ * 0.83.0 and later, DefaultSandbox (no module, or one that names it without
+ * JustBash). Anything it cannot recognize is left to
+ * checkPreparedJustBashTemplate, which inspects what `eve build` produced.
+ */
+export declare function checkEveSandboxProvider(projectRoot: string, resolvedVersion?: string): Promise<EvePackagingError | undefined>;
 /** The exact `resume()` implementation in Eve 0.68.0, 0.71.2, 0.72.1, and 0.79.1. */
 export declare const EVE_JUST_BASH_RESUME_ORIGINAL = "async resume(e,n,r){let i=requirePreparedJustBashArtifact(n),a=requireJustBashSessionState(r),o=createSandboxProviderIdentity({artifact:i,version:1}),s=sessionRootPath(e,i);if(a.generation!==o||a.rootPath!==s)throw Error(`just-bash session state is incompatible with this environment.`);if(!await pathExists(a.rootPath))throw Error(`just-bash session root \"${a.rootPath}\" no longer exists.`);return await openHandle(e,a.rootPath,t)}";
 /**
@@ -305,7 +325,7 @@ export declare const EVE_SANDBOX_RESUME_PATCH_HELPERS = "async function edenRefr
  */
 export declare const EVE_SANDBOX_RESUME_PATCH_SCRIPT: string;
 /** Outcome of the builder's sandbox-resume patch for the packaged image. */
-export type EveSandboxResumePatchStatus = "applied" | "skipped" | "absent";
+export type EveSandboxResumePatchStatus = "applied" | "fixed" | "skipped" | "absent";
 export declare function sha256(value: string | Buffer): string;
 export declare function jsonBytes(value: unknown): Buffer;
 export declare function isWithin(root: string, candidate: string): boolean;

package/dist/eve-packaging.js

@@ -48,6 +48,150 @@ export const EVE_SANDBOX_RESUME_PATCH_KNOWN_SHA256 = "0ba0ac3a237c99af2f67a6028f
 export const EVE_SANDBOX_RESUME_PATCH_LATEST_SHA256 = "ab8b1ad7398af8f6fd2a1e91eb0d1ff8d2b9b9afe1836234f36ce0e896791c45";
 /** Marker the patched binding always contains; proves the patch shipped. */
 export const EVE_SANDBOX_RESUME_PATCH_SIGNATURE = "edenRefreshJustBashSessionSkills";
+/**
+ * First Eve release whose just-bash provider keeps a session's files across
+ * template changes (vercel/eve#5132), so the patch is not needed from here on.
+ */
+export const EVE_SANDBOX_RESUME_FIXED_VERSION = "0.83.0";
+/** `major.minor.patch` of a version string; prerelease and build suffixes are dropped. */
+function parseEveRelease(version) {
+    const match = typeof version === "string"
+        ? /^(\d+)\.(\d+)\.(\d+)/u.exec(version)
+        : null;
+    return match === null
+        ? null
+        : [Number(match[1]), Number(match[2]), Number(match[3])];
+}
+/**
+ * True when an installed Eve version already ships the eve#4440 fix. A
+ * prerelease of the fixed version sorts before it (semver), so it may predate
+ * the fix and keeps the patch.
+ */
+export function eveIncludesSandboxResumeFix(version) {
+    const installed = parseEveRelease(version);
+    const fixed = parseEveRelease(EVE_SANDBOX_RESUME_FIXED_VERSION);
+    if (installed === null || fixed === null)
+        return false;
+    for (let index = 0; index < 3; index += 1) {
+        if (installed[index] !== fixed[index]) {
+            return (installed[index] ?? 0) > (fixed[index] ?? 0);
+        }
+    }
+    return typeof version === "string" && !/^\d+\.\d+\.\d+-/u.test(version);
+}
+/** Eve 0.83.0 and later no longer fall back to just-bash in production builds. */
+function eveRequiresExplicitJustBash(version) {
+    const release = parseEveRelease(version);
+    return release !== null && (release[0] > 0 || release[1] >= 83);
+}
+/**
+ * Eve reads its sandbox module from either path, with any source extension.
+ * When `agent/sandbox/` exists only the nested module counts: Eve 0.83–0.86
+ * silently ignores `agent/sandbox.ts` and 0.87+ fails the build.
+ */
+const EVE_SANDBOX_MODULE_PATHS = ["agent/sandbox", "agent/sandbox/sandbox"].flatMap((base) => ["ts", "mts", "cts", "tsx", "js", "mjs", "cjs", "jsx"].map((extension) => `${base}.${extension}`));
+function justBashRemediation(command, path) {
+    return `Run ${command} (production dependency), then create or replace ${path} with:\nimport { defineSandbox } from 'eve/sandbox';\nimport { JustBashSandbox } from 'eve/sandbox/just-bash';\nexport const environment = JustBashSandbox.environment();\nexport default defineSandbox(() => environment.open());\nCommit the module, package.json, and updated lockfile, then retry eden preflight. See docs/deploy.md. Do not set EVE_DEV.`;
+}
+/**
+ * Early, source-level rejection of sandbox setups that cannot work in Eden's
+ * isolated builder: a native provider named in the sandbox module, or, on Eve
+ * 0.83.0 and later, DefaultSandbox (no module, or one that names it without
+ * JustBash). Anything it cannot recognize is left to
+ * checkPreparedJustBashTemplate, which inspects what `eve build` produced.
+ */
+export async function checkEveSandboxProvider(projectRoot, resolvedVersion) {
+    const source = async (path) => readFile(join(projectRoot, path), "utf8").catch(() => "");
+    const json = async (path) => {
+        try {
+            const value = JSON.parse(await source(path));
+            return value !== null && typeof value === "object" && !Array.isArray(value)
+                ? value
+                : {};
+        }
+        catch {
+            return {};
+        }
+    };
+    const manifest = await json("package.json");
+    const dependencies = manifest.dependencies;
+    const lock = await json("package-lock.json");
+    const packages = lock.packages;
+    const pnpmLock = await source("pnpm-lock.yaml");
+    const pnpmVersion = /^\s{6}eve:\s*\r?\n\s{8}specifier:[^\n]*\r?\n\s{8}version:\s*['"]?(\d+\.\d+\.\d+(?:-[^('"\s]+)?)/mu
+        .exec(pnpmLock)?.[1];
+    const installed = await json("node_modules/eve/package.json");
+    const declared = typeof dependencies?.eve === "string"
+        ? /^[~^]?(\d+\.\d+\.\d+)/u.exec(dependencies.eve)?.[1]
+        : undefined;
+    const version = resolvedVersion ?? packages?.["node_modules/eve"]?.version ??
+        pnpmVersion ?? installed.version ?? declared;
+    const requiresExplicit = eveRequiresExplicitJustBash(version);
+    const sandboxDirectory = (await lstat(join(projectRoot, "agent/sandbox")).catch(() => undefined))
+        ?.isDirectory() === true;
+    let path;
+    for (const candidate of EVE_SANDBOX_MODULE_PATHS) {
+        if ((await lstat(join(projectRoot, candidate)).catch(() => undefined))?.isFile() === true) {
+            path = candidate;
+            break;
+        }
+    }
+    const module = path === undefined
+        ? ""
+        : (await source(path)).replace(/\/\*[\s\S]*?\*\/|\/\/[^\n]*/gu, "");
+    const otherProvider = /\b(DefaultSandbox|DockerSandbox|VercelSandbox|VmSandbox|VMSandbox)\b/u
+        .exec(module)?.[1];
+    const justBash = /import\s*\{[^}]*?\bJustBashSandbox(?:\s+as\s+(\w+))?\s*(?:,|\})[^;]*?from\s*["']eve\/sandbox\/just-bash["']/u
+        .exec(module);
+    const binding = justBash?.[1] ?? "JustBashSandbox";
+    const explicit = justBash !== null &&
+        new RegExp(`\\b${binding}\\s*\\.\\s*environment\\s*\\(`, "u").test(module);
+    const native = otherProvider !== undefined && otherProvider !== "DefaultSandbox";
+    const usesDefault = path === undefined || (otherProvider === "DefaultSandbox" && !explicit);
+    const shadowed = requiresExplicit && sandboxDirectory && path?.startsWith("agent/sandbox.") === true;
+    if (!native && !shadowed && !(requiresExplicit && usesDefault))
+        return undefined;
+    const target = shadowed || (path === undefined && sandboxDirectory)
+        ? "agent/sandbox/sandbox.ts"
+        : path ?? "agent/sandbox.ts";
+    const command = typeof manifest.packageManager === "string" &&
+        manifest.packageManager.startsWith("pnpm@")
+        ? "pnpm add just-bash"
+        : "npm install just-bash";
+    return new EvePackagingError({
+        code: "EVE_SANDBOX_PROVIDER",
+        subject: target,
+        reason: shadowed
+            ? `${String(path)} sits beside the agent/sandbox/ directory, where Eve ${String(version)} reads only agent/sandbox/sandbox.ts: Eve 0.83–0.86 ignores ${String(path)} and falls back to DefaultSandbox, and 0.87 and later fail the build.`
+            : native
+                ? `${target} selects ${otherProvider}, which Eden does not support; use explicit JustBash instead.`
+                : path === undefined
+                    ? `Eve ${String(version)} has no sandbox module, so it uses DefaultSandbox, which has no provider in Eden's isolated builder: production builds no longer fall back to just-bash.`
+                    : `${target} selects DefaultSandbox, which has no provider in Eden's isolated builder on Eve ${String(version)}: production builds no longer fall back to just-bash.`,
+        remediation: shadowed
+            ? `Move ${String(path)} to agent/sandbox/sandbox.ts (delete it instead if agent/sandbox/sandbox.ts already exists), then retry eden preflight.`
+            : justBashRemediation(command, target),
+    });
+}
+/**
+ * Ground truth after `eve build`: on Eve 0.83.0 and later an agent whose
+ * sandbox resolved to no provider prepares no template and would fail to open
+ * its sandbox on Cloudflare, however its sandbox module is written.
+ */
+async function checkPreparedJustBashTemplate(snapshotRoot, version) {
+    if (!eveRequiresExplicitJustBash(version))
+        return undefined;
+    const templatesPath = `${EVE_SANDBOX_CACHE_ROOT}/just-bash/templates`;
+    const templates = await readdir(join(snapshotRoot, templatesPath)).catch(() => []);
+    if (templates.length > 0)
+        return undefined;
+    return new EvePackagingError({
+        code: "EVE_SANDBOX_PROVIDER",
+        subject: templatesPath,
+        reason: `Eve ${version} built no just-bash sandbox template, so the agent's sandbox would fail to open on Cloudflare; its sandbox module does not resolve to JustBash.`,
+        remediation: justBashRemediation("npm install just-bash (or pnpm add just-bash)", "agent/sandbox.ts (agent/sandbox/sandbox.ts when agent/sandbox/ exists)"),
+    });
+}
 /** Path of the just-bash binding inside the resolved Eve package root. */
 const EVE_JUST_BASH_BINDING_PATH = "dist/src/execution/sandbox/bindings/just-bash.js";
 /** The exact `resume()` implementation in Eve 0.68.0, 0.71.2, 0.72.1, and 0.79.1. */
@@ -107,9 +251,23 @@ const KNOWN_PATCHES = ${JSON.stringify({
 const SIGNATURE = ${JSON.stringify(EVE_SANDBOX_RESUME_PATCH_SIGNATURE)};
 const BINDING_PATH = ${JSON.stringify(EVE_JUST_BASH_BINDING_PATH)};
 const HELPERS = ${JSON.stringify(EVE_SANDBOX_RESUME_PATCH_HELPERS)};
+const FIXED_VERSION = ${JSON.stringify(EVE_SANDBOX_RESUME_FIXED_VERSION)};
 function finish(outcome, detail) {
   console.log("eden-eve-sandbox-resume-patch: " + outcome + " (" + detail + ")");
 }
+function parseRelease(version) {
+  const match = typeof version === "string" ? /^(\\d+)\\.(\\d+)\\.(\\d+)/.exec(version) : null;
+  return match === null ? null : [Number(match[1]), Number(match[2]), Number(match[3])];
+}
+function includesFix(version) {
+  const installed = parseRelease(version);
+  const fixed = parseRelease(FIXED_VERSION);
+  if (installed === null || fixed === null) return false;
+  for (let index = 0; index < 3; index += 1) {
+    if (installed[index] !== fixed[index]) return installed[index] > fixed[index];
+  }
+  return !/^\\d+\\.\\d+\\.\\d+-/.test(version);
+}
 let packageJsonPath;
 try {
   packageJsonPath = fs.realpathSync("node_modules/eve/package.json");
@@ -125,6 +283,16 @@ try {
   finish("absent", "this eve build has no just-bash binding");
   process.exit(0);
 }
+let eveVersion;
+try {
+  eveVersion = JSON.parse(fs.readFileSync(packageJsonPath, "utf8")).version;
+} catch {
+  eveVersion = undefined;
+}
+if (!source.includes(SIGNATURE) && includesFix(eveVersion)) {
+  finish("fixed", "eve " + eveVersion + " includes the upstream fix for eve#4440");
+  process.exit(0);
+}
 if (source.includes(SIGNATURE)) {
   finish("applied", "already patched");
   process.exit(0);
@@ -1475,6 +1643,14 @@ async function scanGeneratedSandboxCache(snapshotRoot) {
             const relativePath = relativeDirectory.length === 0
                 ? entry.name
                 : `${relativeDirectory}/${entry.name}`;
+            if (relativeDirectory === "" && entry.name !== "just-bash") {
+                throw new EvePackagingError({
+                    code: "EVE_SANDBOX_PROVIDER",
+                    subject: `${EVE_SANDBOX_CACHE_ROOT}/${entry.name}`,
+                    reason: `The Eve build prepared a ${entry.name} sandbox template; Eden supports only just-bash templates.`,
+                    remediation: "Replace the sandbox module with the explicit JustBash environment in docs/deploy.md, run npm install just-bash (or pnpm add just-bash), commit the module and lockfile, then retry eden preflight without EVE_DEV.",
+                });
+            }
             const candidate = join(directory, entry.name);
             if (entry.isSymbolicLink()) {
                 throw new EvePackagingError({
@@ -1691,20 +1867,39 @@ function classifyNpmInstallFailure(stderr) {
         remediation: "Fix the reported npm failure; regenerate package-lock.json with the selected exact npm version if it is out of sync. Use public registry dependencies without .npmrc credentials or dependency build scripts.",
     });
 }
+/**
+ * The failing BuildKit step's own output (`#<step> <seconds> <line>`), last 20
+ * lines, so Eve's error reaches the user instead of a generic build failure.
+ */
+function failingDockerStepOutput(stderr) {
+    const step = [...stderr.matchAll(/^#(\d+) ERROR:/gmu)].at(-1)?.[1];
+    if (step === undefined)
+        return undefined;
+    const lines = [...stderr.matchAll(new RegExp(`^#${step} \\d+\\.\\d+ (.*)$`, "gmu"))]
+        .map((match) => (match[1] ?? "").trimEnd())
+        .filter((line) => line.length > 0)
+        .slice(-20);
+    if (lines.length === 0)
+        return undefined;
+    const output = lines.join("\n");
+    return output.length > 2000 ? `…${output.slice(-2000)}` : output;
+}
 function classifyEveBuildFailure(stderr) {
+    const output = failingDockerStepOutput(stderr);
+    const reported = output === undefined ? "" : `\nEve reported:\n${output}`;
     if (/\bjust-bash\b/u.test(stderr)) {
         return new EvePackagingError({
             code: "EVE_BUILD_FAILED",
             subject: "eve build",
-            reason: "The project-local Eve build failed inside the isolated Linux/amd64 builder because Eve's default sandbox needs just-bash where no Docker daemon or /dev/kvm exists.",
+            reason: `The project-local Eve build failed inside the isolated Linux/amd64 builder because Eve's default sandbox needs just-bash where no Docker daemon or /dev/kvm exists.${reported}`,
             remediation: "Declare just-bash as a production dependency of the Eve project, regenerate its package-manager lockfile, and retry.",
         });
     }
     return new EvePackagingError({
         code: "EVE_BUILD_FAILED",
         subject: "eve build",
-        reason: "The project-local Eve build failed inside the isolated Linux/amd64 builder.",
-        remediation: "Fix the project-local Eve build and retry without changing the authored project during packaging.",
+        reason: `The project-local Eve build failed inside the isolated Linux/amd64 builder.${reported}`,
+        remediation: "Fix the error Eve reported (run eve build locally to reproduce it) and retry.",
     });
 }
 function classifyDockerBuildFailure(error) {
@@ -1818,9 +2013,18 @@ async function detectEveSandboxResumePatch(snapshotRoot) {
     try {
         const packageJsonPath = await realpath(join(snapshotRoot, "node_modules/eve/package.json"));
         const binding = await readFile(join(dirname(packageJsonPath), EVE_JUST_BASH_BINDING_PATH), "utf8");
-        return binding.includes(EVE_SANDBOX_RESUME_PATCH_SIGNATURE)
-            ? "applied"
-            : "skipped";
+        if (binding.includes(EVE_SANDBOX_RESUME_PATCH_SIGNATURE))
+            return "applied";
+        const version = await readFile(packageJsonPath, "utf8")
+            .then((text) => {
+            const manifest = JSON.parse(text);
+            return typeof manifest === "object" && manifest !== null &&
+                "version" in manifest
+                ? manifest.version
+                : undefined;
+        })
+            .catch(() => undefined);
+        return eveIncludesSandboxResumeFix(version) ? "fixed" : "skipped";
     }
     catch {
         return "absent";
@@ -2028,6 +2232,9 @@ export async function buildEveProjectSnapshot(options) {
         const afterCopyRace = await sourceRaceErrorIfChanged(roots.canonicalRoot, initialInputs, initialRuntimeInputIdentity, options.runtimeConfig, resolve(options.artifactRoot), roots.requestedRoot);
         if (afterCopyRace !== undefined)
             return blockedResult(afterCopyRace, { writtenPaths });
+        const sandboxProvider = await checkEveSandboxProvider(snapshotRoot);
+        if (sandboxProvider !== undefined)
+            throw sandboxProvider;
         const nodeImage = options.nodeImage ?? options.builder.nodeImage;
         let actualDockerfilePath;
         if (nodeImage !== undefined) {
@@ -2094,9 +2301,15 @@ export async function buildEveProjectSnapshot(options) {
             return blockedResult(cleanupError ?? dependencyError, { writtenPaths });
         }
         const eve = await resolveProjectLocalEve(snapshotRoot);
+        const sandboxProviderAfterBuild = await checkEveSandboxProvider(snapshotRoot, eve.version);
+        if (sandboxProviderAfterBuild !== undefined)
+            throw sandboxProviderAfterBuild;
         const sandboxResumePatch = await detectEveSandboxResumePatch(snapshotRoot);
         const output = await scanGeneratedOutput(snapshotRoot);
         const sandboxCache = await scanGeneratedSandboxCache(snapshotRoot);
+        const preparedTemplate = await checkPreparedJustBashTemplate(snapshotRoot, eve.version);
+        if (preparedTemplate !== undefined)
+            throw preparedTemplate;
         await assertGeneratedTreesExcludeSecrets(snapshotRoot);
         const snapshotSourceDigest = await snapshotDigest(snapshotRoot);
         const runtimeManifestPath = join(generationRoot, "runtime-manifest.json");
@@ -2277,6 +2490,15 @@ export async function buildEveProjectSnapshot(options) {
                             remediation: null,
                         }]
                     : []),
+                ...(sandboxResumePatch === "fixed"
+                    ? [{
+                            id: "EVE_SANDBOX_RESUME_PATCH",
+                            status: "pass",
+                            subject: "eve-sandbox-resume",
+                            reason: `not needed: Eve ${EVE_SANDBOX_RESUME_FIXED_VERSION} and later include the fix for eve#4440`,
+                            remediation: null,
+                        }]
+                    : []),
             ],
             sandboxResumePatch,
             candidateImageId: buildResult.imageId ?? null,

package/dist/eve-runtime-config.d.ts

@@ -1,4 +1,4 @@
-export declare const EVE_RESERVED_HOST_VARIABLES: readonly ["HOST", "NITRO_HOST", "PORT", "NITRO_PORT", "NODE_ENV", "NODE_EXTRA_CA_CERTS", "WORKFLOW_LOCAL_BASE_URL", "EDEN_WORLD_URL", "EDEN_EVE_DEPLOYMENT_ID", "EDEN_EVE_GENERATION_ID"];
+export declare const EVE_RESERVED_HOST_VARIABLES: readonly ["HOST", "NITRO_HOST", "PORT", "NITRO_PORT", "NODE_ENV", "NODE_EXTRA_CA_CERTS", "WORKFLOW_LOCAL_BASE_URL", "EDEN_WORLD_URL", "EDEN_WORLD_TOKEN", "EDEN_EVE_WORLD_RPC_AUTH", "EDEN_EVE_DEPLOYMENT_ID", "EDEN_EVE_GENERATION_ID", "EDEN_EVE_RELEASE_ID", "EDEN_EVE_DEPLOYMENTS", "EDEN_AFFINITY_CONTRACT", "EVE_SCHEDULES_DISABLED", "EDEN_EVE_CONTROL_TOKEN"];
 export type EveReservedHostVariable = (typeof EVE_RESERVED_HOST_VARIABLES)[number];
 export declare const EVE_START_COMMAND: readonly ["./node_modules/.bin/eve", "start", "--host", "0.0.0.0", "--port", "8080"];
 export declare const EVE_HOST_ENVIRONMENT: Readonly<{

package/dist/eve-runtime-config.js

@@ -10,8 +10,15 @@ export const EVE_RESERVED_HOST_VARIABLES = Object.freeze([
     "NODE_EXTRA_CA_CERTS",
     "WORKFLOW_LOCAL_BASE_URL",
     "EDEN_WORLD_URL",
+    "EDEN_WORLD_TOKEN",
+    "EDEN_EVE_WORLD_RPC_AUTH",
     "EDEN_EVE_DEPLOYMENT_ID",
     "EDEN_EVE_GENERATION_ID",
+    "EDEN_EVE_RELEASE_ID",
+    "EDEN_EVE_DEPLOYMENTS",
+    "EDEN_AFFINITY_CONTRACT",
+    "EVE_SCHEDULES_DISABLED",
+    "EDEN_EVE_CONTROL_TOKEN",
 ]);
 export const EVE_START_COMMAND = Object.freeze([
     "./node_modules/.bin/eve",
@@ -196,11 +203,18 @@ function parseEnvironmentText(text) {
     }
     return Object.freeze(values);
 }
+/**
+ * Values shorter than this are not masked: substring masking of `1`, `8`, or
+ * `eve` garbled every message and matched Eden's own random revision IDs,
+ * failing deploys. Credentials are longer; short values are still delivered
+ * only through the protected channels, just not masked if a tool echoes them.
+ */
+const MIN_REDACTED_RUNTIME_VALUE_LENGTH = 8;
 class EveRuntimeRedactionRegistry {
     handle = `eve-runtime-redaction-${randomUUID()}`;
     values = new Set();
     register(value) {
-        if (value.length > 0)
+        if (value.length >= MIN_REDACTED_RUNTIME_VALUE_LENGTH)
             this.values.add(value);
     }
     redact(value) {

package/dist/eve-runtime-image.js

@@ -458,6 +458,7 @@ COPY node_modules /candidate/node_modules
 ${sandboxContextCopy}${sourceEntries.map((entry) => `COPY ${JSON.stringify([entry, `/candidate/${entry}`])}`).join("\n")}
 
 FROM --platform=linux/amd64 ${imageReference(nodeImage)} AS runtime
+RUN apt-get update && apt-get install -y --no-install-recommends python3 && rm -rf /var/lib/apt/lists/*
 WORKDIR /workspace
 ENV HOST=0.0.0.0 \\
     NITRO_HOST=0.0.0.0 \\
@@ -582,6 +583,8 @@ function runtimeContainerEnvironment(request) {
         ...(request.workflowWorld === "@moinulmoin/eden-world-cloudflare"
             ? {
                 EDEN_WORLD_URL: `${request.publicOrigin ?? "http://localhost:8080"}/__eden/world/rpc`,
+                EDEN_EVE_DEPLOYMENT_ID: `eden-smoke-${request.candidate.generationId}`,
+                EDEN_EVE_RELEASE_ID: `eden-smoke-${request.candidate.generationId}`,
                 CBOR_NATIVE_ACCELERATION_DISABLED: "true",
             }
             : {}),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moinulmoin/eden",
-  "version": "0.8.0",
+  "version": "0.10.0",
   "description": "Deploy existing Eve projects to your own Cloudflare account.",
   "keywords": [
     "ai",
@@ -31,7 +31,7 @@
     "NOTICE"
   ],
   "dependencies": {
-    "@moinulmoin/eden-runtime-cloudflare": "0.8.0",
+    "@moinulmoin/eden-runtime-cloudflare": "0.10.0",
     "wrangler": "4.147.0"
   },
   "devDependencies": {