@moinulmoin/eden 0.9.0 → 0.10.0

package/README.md

@@ -12,15 +12,15 @@ If you already have an Eve project, start with `eden deploy`.
 Use any one of these package managers:
 
 ```sh
-npm install --global @moinulmoin/eden@0.9.0
+npm install --global @moinulmoin/eden@0.10.0
 ```
 
 ```sh
-pnpm add --global @moinulmoin/eden@0.9.0
+pnpm add --global @moinulmoin/eden@0.10.0
 ```
 
 ```sh
-bun add --global @moinulmoin/eden@0.9.0
+bun add --global @moinulmoin/eden@0.10.0
 ```
 
 Then confirm the CLI is available:

package/dist/eve-control-plane.d.ts

@@ -128,6 +128,11 @@ export interface EveDeploymentIdentity {
     readonly sourceDigest: string;
     readonly generationId: string;
     readonly deploymentId: string;
+    readonly releaseId?: string;
+    readonly eveVersion?: string;
+    readonly affinityContract?: number;
+    readonly retainedDeployments?: Readonly<Record<string, EveAffinityDeployment>>;
+    readonly pendingRetirements?: Readonly<Record<string, EveAffinityDeployment>>;
     readonly environment: EveCliEnvironment;
     readonly name: string;
     readonly accountId: string;
@@ -144,6 +149,28 @@ export type EveDeploymentIdentityProof = Partial<EveDeploymentIdentity> & {
     /** The deployment the serving Container verifiably started under; set only by a deployed Eden host that proves its running image before stamping. */
     readonly startedDeploymentId?: string;
 };
+export interface EveAffinityDeployment {
+    readonly image: string;
+    readonly generationId: string;
+    readonly runtimeRevisionHandle?: string;
+    readonly eveVersion?: string;
+    readonly affinityContract?: number;
+    readonly releaseId?: string;
+    readonly worldRpcAuth?: boolean;
+}
+export interface EveDeploymentDrainState {
+    readonly liveRuns: number;
+    readonly liveSessions: number;
+    readonly pendingMessages: number;
+    readonly unfinishedTransfers: number;
+    readonly drained: boolean;
+}
+export type EveDeploymentRpcRunner = (request: {
+    readonly origin: string;
+    readonly operation: "deployments.drainState" | "deployments.retire";
+    readonly deploymentIds: readonly string[];
+    readonly controlToken: string;
+}) => Promise<unknown>;
 export interface EveDeploymentPublicationRequest {
     readonly identity: EveDeploymentIdentity;
     readonly hostConfig: EveHostConfig;
@@ -233,6 +260,7 @@ export interface EvePreflightOptions {
     readonly protectedStore?: EveRuntimeProtectedStore;
     readonly publish?: EveDeploymentPublicationRunner;
     readonly publishImage?: EveImagePublicationRunner;
+    readonly deploymentRpc?: EveDeploymentRpcRunner;
     readonly compensate?: EveDeploymentCompensationRunner;
     readonly health?: EveDeploymentHealthRunner;
     readonly afterPromotion?: () => void | Promise<void>;

package/dist/eve-control-plane.js

@@ -1,3 +1,4 @@
+import { setTimeout as waitForActivation } from "node:timers/promises";
 import { createRequire, } from "node:module";
 import { createHash, randomUUID, } from "node:crypto";
 import { join, dirname, relative, } from "node:path";
@@ -11,7 +12,7 @@ import { EveCliError, EVE_NAME_PATTERN, } from "./eve.js";
 import { buildEveProjectSnapshot, checkEveSandboxProvider, createDockerEveProjectBuilder, revalidateEveProjectCandidateInputs, EvePackagingError, IMAGE_ID_PATTERN, } from "./eve-packaging.js";
 import { buildEveRuntimeImage, discardEveRuntimeImage, revalidateEveRuntimeCandidate, validateEveHostRequirements, } from "./eve-runtime-image.js";
 import { EveRuntimeConfigError, prepareEveRuntimeInjection, redactEveRuntimeOutput, } from "./eve-runtime-config.js";
-import { createEveHostConfig, generateEveHostWorkerSource, parseEveScheduleCron, resolveStableWorkersDevOrigin, } from "@moinulmoin/eden-runtime-cloudflare";
+import { EDEN_AFFINITY_CONTRACT, callDeploymentControlRpc, createEveHostConfig, generateEveHostWorkerSource, parseEveScheduleCron, resolveStableWorkersDevOrigin, } from "@moinulmoin/eden-runtime-cloudflare";
 const execFileAsync = promisify(execFile);
 const require = createRequire(import.meta.url);
 const wranglerEntrypoint = require.resolve("wrangler");
@@ -32,6 +33,54 @@ export const DEFAULT_EVE_NODE_IMAGE = Object.freeze({
 });
 /** The single tag Eden pushes to the managed Cloudflare registry per generation. */
 const EVE_REGISTRY_IMAGE_TAG = "candidate";
+function validateDeploymentDrainStates(value, ids) {
+    if (typeof value !== "object" || value === null || Array.isArray(value)) {
+        throw deploymentFailure("EVE_AFFINITY_DRAIN_UNPROVEN", "The authenticated World did not return deployment drain states.");
+    }
+    const states = value;
+    for (const id of ids) {
+        const state = states[id];
+        if (typeof state !== "object" || state === null ||
+            typeof state.drained !== "boolean" ||
+            [state.liveRuns, state.liveSessions, state.pendingMessages, state.unfinishedTransfers]
+                .some((count) => !Number.isSafeInteger(count) || count < 0) ||
+            state.drained !== (state.liveRuns + state.liveSessions + state.pendingMessages + state.unfinishedTransfers === 0)) {
+            throw deploymentFailure("EVE_AFFINITY_DRAIN_UNPROVEN", `The authenticated World returned an invalid drain state for ${id}.`);
+        }
+    }
+    return states;
+}
+const defaultDeploymentRpc = async (request) => {
+    // A successful Cloudflare secret write creates an active deployment, but
+    // existing stateless Worker isolates may briefly serve the preceding secret.
+    // Only the first read-only drain call following our own rotation may wait
+    // for that exact in-memory credential. All other failures remain terminal.
+    const activationRead = request.operation === "deployments.drainState";
+    const deadline = Date.now() + 60_000;
+    for (;;) {
+        const remaining = deadline - Date.now();
+        if (remaining <= 0) {
+            throw deploymentFailure("EVE_AFFINITY_CONTROL_ACTIVATION_TIMEOUT", "The freshly rotated deployment-control credential did not activate within 60 seconds; publication was refused.");
+        }
+        try {
+            return await callDeploymentControlRpc({
+                origin: request.origin,
+                token: request.controlToken,
+                operation: request.operation,
+                args: [{ deploymentIds: request.deploymentIds }],
+                signal: AbortSignal.timeout(remaining),
+            });
+        }
+        catch (error) {
+            if (!activationRead || typeof error !== "object" || error === null ||
+                !("status" in error) || error.status !== 401)
+                throw error;
+            const delay = Math.min(1_000, deadline - Date.now());
+            if (delay > 0)
+                await waitForActivation(delay);
+        }
+    }
+};
 function safeText(value) {
     return redactEveRuntimeOutput(value)
         .replace(/(?:^|[\s"'=])(?:Bearer|Token)\s+\S+/giu, "$1[redacted]")
@@ -471,13 +520,13 @@ function safeDockerEnvironment() {
         DOCKER_CONTEXT: process.env.DOCKER_CONTEXT,
     };
 }
-async function readWranglerJson(args) {
+async function readWranglerJson(args, timeoutMs = 30_000) {
     try {
         const result = await execFileAsync(process.execPath, [wranglerEntrypoint, ...args], {
             env: safeWranglerEnvironment(),
             cwd: wranglerCwd,
             maxBuffer: 2 * 1024 * 1024,
-            timeout: 30_000,
+            timeout: timeoutMs,
         });
         const parsed = JSON.parse(result.stdout.trim());
         return { value: parsed, failed: false };
@@ -813,11 +862,33 @@ async function resolveEveTargetOwnership(request, result) {
             evidence.containerNamespaceId === evidence.workerContainerNamespaceId);
     const remoteProven = evidence !== undefined && workerProven && containerProven;
     if (!remoteProven) {
+        const failures = [];
+        if (evidence === undefined)
+            failures.push("provider evidence unavailable");
+        if (result.target.observed?.worker === true) {
+            if (evidence?.settingsReadable !== true)
+                failures.push("Worker settings unreadable");
+            else if (evidence.workerDeploymentId === undefined)
+                failures.push("Worker deployment stamp absent");
+            else if (!recordedDeploymentIds.has(evidence.workerDeploymentId))
+                failures.push("Worker deployment stamp differs from recorded identities");
+        }
+        if (result.target.observed?.container === true) {
+            if (evidence?.containerSchedulingPolicy !== "durable_object")
+                failures.push("Container scheduling policy unproven");
+            if (evidence?.containerNamespaceId === undefined)
+                failures.push("Container namespace unreadable");
+            if (evidence?.workerContainerNamespaceId === undefined)
+                failures.push("Worker Container binding namespace unreadable");
+            if (evidence?.containerNamespaceId !== undefined && evidence.workerContainerNamespaceId !== undefined &&
+                evidence.containerNamespaceId !== evidence.workerContainerNamespaceId)
+                failures.push("Container and Worker binding namespaces differ");
+        }
         return {
             ...result,
             target: {
                 ...result.target,
-                message: "The exact Worker or Container target exists, and although a local Eden record matches, provider state cannot prove it is the one Eden deployed — the target may have been recreated outside Eden.",
+                message: `The exact Worker or Container target exists, and although a local Eden record matches, provider state cannot prove it is the one Eden deployed — the target may have been recreated outside Eden. Unproven: ${failures.join("; ")}.`,
                 remediation: "Inspect the Worker at its workers.dev origin and the recorded deployment history before redeploying; if it is not Eden's, deploy under a different --name or delete it yourself.",
             },
         };
@@ -995,11 +1066,17 @@ function transportIdentityMatches(expected, observed) {
         "generationId",
         "stableWorkersDevOrigin",
         "workerName",
-        "stableContainerInstanceName",
     ];
     if (!required.every((key) => observed[key] === expected[key])) {
         return false;
     }
+    const expectedInstance = expected.retainedDeployments === undefined ||
+        expected.deploymentId === "eden-cloudflare"
+        ? expected.stableContainerInstanceName
+        : `${expected.stableContainerInstanceName}:${expected.deploymentId}`;
+    if (observed.stableContainerInstanceName !== expectedInstance ||
+        observed.releaseId !== expected.releaseId)
+        return false;
     return expected.runtimeRevisionHandle === undefined
         ? observed.runtimeRevisionHandle === undefined
         : observed.runtimeRevisionHandle === expected.runtimeRevisionHandle;
@@ -1012,6 +1089,7 @@ function identityMatches(expected, observed) {
         "sourceDigest",
         "generationId",
         "deploymentId",
+        "releaseId",
         "environment",
         "name",
         "accountId",
@@ -1039,6 +1117,11 @@ function safeIdentity(identity) {
         sourceDigest: identity.sourceDigest,
         generationId: identity.generationId,
         deploymentId: identity.deploymentId,
+        releaseId: identity.releaseId,
+        eveVersion: identity.eveVersion,
+        affinityContract: identity.affinityContract,
+        retainedDeployments: identity.retainedDeployments,
+        pendingRetirements: identity.pendingRetirements,
         environment: identity.environment,
         name: identity.name,
         accountId: identity.accountId,
@@ -1281,6 +1364,7 @@ function responseIdentity(response, body) {
     read("sourceDigest", "x-eden-eve-source-digest");
     read("generationId", "x-eden-eve-generation-id");
     read("deploymentId", "x-eden-eve-deployment-id");
+    read("releaseId", "x-eden-eve-release-id");
     read("environment", "x-eden-eve-environment");
     read("name", "x-eden-eve-name");
     read("accountId", "x-eden-eve-account-id");
@@ -1341,7 +1425,7 @@ function defaultHealthRunner() {
                 // must wait until the *served container* verifiably runs this
                 // generation's image (the host stamps the header only after
                 // inspecting the running instance).
-                if (observedIdentity.startedDeploymentId !== request.identity.deploymentId) {
+                if (observedIdentity.startedDeploymentId !== (request.identity.releaseId ?? request.identity.deploymentId)) {
                     lastReason =
                         "The served Container has not verifiably started this deployment's image yet; waiting for the rollout to land.";
                     await wait();
@@ -1460,8 +1544,8 @@ async function promoteEveTargetPointer(deploymentRoot, pointerKey, generationRoo
     }
     return currentPath;
 }
-async function writeEveDeploymentRecord(candidate, identity, hostConfig, status, extra = {}) {
-    await writeFile(join(candidate.generationRoot, "deployment.json"), `${JSON.stringify({
+async function writeEveDeploymentRecord(candidate, identity, hostConfig, status, extra = {}, filename = "deployment.json") {
+    await writeFile(join(candidate.generationRoot, filename), `${JSON.stringify({
         version: 1,
         status,
         identity: safeIdentity(identity),
@@ -1474,6 +1558,10 @@ async function writeEveDeploymentRecord(candidate, identity, hostConfig, status,
         flag: "wx",
     });
 }
+async function deploymentRecordPath(generationRoot) {
+    const path = join(generationRoot, "deployment.json");
+    return await lstat(path).then(() => path, () => join(generationRoot, "deployment-intent.json"));
+}
 async function writeEveIndeterminateEvidence(candidate, evidence, extra = {}) {
     await writeFile(join(candidate.generationRoot, "deployment-attempt.json"), `${JSON.stringify({
         version: 1,
@@ -1538,6 +1626,14 @@ async function runEveDeployment(request, options, collected) {
     }
     const priorIdentity = prior?.identity;
     const priorDurableObjects = prior?.durableObjects;
+    const worldManifest = collected.workflowWorld === "@moinulmoin/eden-world-cloudflare"
+        ? await readInstalledManifest(candidate.snapshotRoot, collected.workflowWorld)
+        : undefined;
+    const affinityEnabled = worldManifest?.eden?.capabilities?.deploymentAffinity === true;
+    const worldRpcAuth = worldManifest?.eden?.capabilities?.worldRpcAuth === true;
+    if (!affinityEnabled && priorIdentity?.retainedDeployments !== undefined) {
+        throw deploymentFailure("EVE_AFFINITY_REQUIRED", "This target retains affinity deployments; install a World package declaring deploymentAffinity before updating it.");
+    }
     const superseded = isUpdate
         ? {
             generationId: priorIdentity?.generationId,
@@ -1553,8 +1649,12 @@ async function runEveDeployment(request, options, collected) {
         if (durableWorld) {
             resultWarnings.push({
                 id: "EVE_UPDATE_IN_FLIGHT",
-                message: "This update replaces the running Container; durable World runs in flight resume on the new code — Cloudflare has no deployment pinning, so keep step names and payload shapes backward compatible.",
-                remediation: "Let pending approvals and long runs settle before updating, or keep step names, queue names, and serialized payloads compatible across the change.",
+                message: affinityEnabled
+                    ? "This update retains pinned deployments until their sessions, queue messages, and transfers drain."
+                    : "This update replaces the running Container; an Eve version change can strand existing sessions because the installed World does not declare deployment affinity.",
+                remediation: affinityEnabled
+                    ? "End old sessions to allow their deployment images to retire."
+                    : "Let sessions settle before changing Eve versions, or install an affinity-capable World package.",
             });
         }
         if (prior?.worldCloudflare !==
@@ -1595,6 +1695,80 @@ async function runEveDeployment(request, options, collected) {
         throw deploymentFailure("EVE_IMAGE_IDENTITY_UNAVAILABLE", "The deploy candidate did not provide an immutable runtime image digest.");
     }
     const targetKey = stableDeploymentKey(collected.projectId, accountId, request.environment, request.name);
+    const releaseId = `eve-deploy-${randomUUID()}`;
+    let previousEveVersion = priorIdentity?.eveVersion;
+    if (previousEveVersion === undefined && prior !== undefined) {
+        previousEveVersion = (await readInstalledManifest(join(prior.generationRoot, "container/snapshot"), "eve"))?.version;
+    }
+    const retainedDeployments = {
+        ...priorIdentity?.retainedDeployments,
+    };
+    if (affinityEnabled && priorIdentity?.retainedDeployments === undefined &&
+        priorIdentity?.containerImage !== undefined && priorIdentity.generationId !== undefined) {
+        retainedDeployments["eden-cloudflare"] = {
+            image: priorIdentity.containerImage,
+            generationId: priorIdentity.generationId,
+            ...(previousEveVersion === undefined ? {} : { eveVersion: previousEveVersion }),
+            affinityContract: EDEN_AFFINITY_CONTRACT,
+            ...(priorIdentity.runtimeRevisionHandle === undefined ? {} : { runtimeRevisionHandle: priorIdentity.runtimeRevisionHandle }),
+        };
+    }
+    const matchingDeployment = Object.entries(retainedDeployments).find(([, entry]) => entry.eveVersion === candidate.eveVersion && entry.affinityContract === EDEN_AFFINITY_CONTRACT)?.[0];
+    const deploymentId = !affinityEnabled ? releaseId : matchingDeployment ??
+        `eden-affinity-${createHash("sha256").update(`${candidate.eveVersion}:${EDEN_AFFINITY_CONTRACT}`).digest("hex").slice(0, 24)}`;
+    const retiringDeployments = { ...priorIdentity?.pendingRetirements };
+    delete retiringDeployments[deploymentId];
+    if (priorIdentity?.deploymentId !== undefined)
+        delete retiringDeployments[priorIdentity.deploymentId];
+    for (const id of prior?.protectedDeploymentIds ?? [])
+        delete retiringDeployments[id];
+    const hasRetainedNoncurrentDeployments = priorIdentity?.retainedDeployments !== undefined &&
+        Object.keys(retainedDeployments).some((id) => id !== priorIdentity.deploymentId);
+    const controlToken = `${randomUUID()}${randomUUID()}`;
+    if (affinityEnabled && (hasRetainedNoncurrentDeployments || Object.keys(retiringDeployments).length > 0)) {
+        await (options.protectedStore ?? defaultProtectedStore(request.name)).put({
+            targetId: targetKey, revision: `eve-affinity-control-${randomUUID()}`,
+            inputIdentity: {
+                token: `eve-affinity-control-input-${randomUUID()}`,
+                byteLength: Buffer.byteLength(controlToken),
+                digest: createHash("sha256").update(controlToken).digest("hex"),
+            },
+            variableNames: ["EDEN_EVE_CONTROL_TOKEN"], values: { EDEN_EVE_CONTROL_TOKEN: controlToken },
+        });
+    }
+    if (affinityEnabled && hasRetainedNoncurrentDeployments) {
+        const ids = Object.keys(retainedDeployments);
+        const raw = await (options.deploymentRpc ?? defaultDeploymentRpc)({
+            origin: stableWorkersDevOrigin, operation: "deployments.drainState", deploymentIds: ids,
+            controlToken,
+        });
+        const states = validateDeploymentDrainStates(raw, ids);
+        const eligible = ids.filter((id) => id !== deploymentId && id !== priorIdentity.deploymentId &&
+            !prior?.protectedDeploymentIds?.includes(id) && states[id]?.drained === true);
+        const remainingCount = ids.length - eligible.length + (deploymentId in retainedDeployments ? 0 : 1);
+        if (remainingCount <= 10 && eligible.length > 0) {
+            // Drain snapshots are not fences. Retire only noncurrent targets, and
+            // obtain the World's durable admission fence before dropping routes.
+            const retired = await (options.deploymentRpc ?? defaultDeploymentRpc)({
+                origin: stableWorkersDevOrigin, operation: "deployments.retire",
+                deploymentIds: eligible, controlToken,
+            });
+            if (typeof retired !== "object" || retired === null || !("retired" in retired) ||
+                !Array.isArray(retired.retired) ||
+                eligible.some((id) => !retired.retired.includes(id))) {
+                throw deploymentFailure("EVE_AFFINITY_RETIRE_UNPROVEN", "The World did not prove the noncurrent deployments durably fenced for retirement.");
+            }
+            for (const id of eligible) {
+                retiringDeployments[id] = retainedDeployments[id];
+                delete retainedDeployments[id];
+            }
+        }
+        if (Object.keys(retainedDeployments).length + (deploymentId in retainedDeployments ? 0 : 1) > 10) {
+            const blockers = Object.entries(states).filter(([id]) => id in retainedDeployments)
+                .map(([id, state]) => `${id}: ${state.liveSessions} live sessions, ${state.liveRuns} live runs, ${state.pendingMessages} pending messages, ${state.unfinishedTransfers} unfinished transfers`);
+            throw deploymentFailure("EVE_AFFINITY_LIMIT", `Deployment refused before image/code publication: at most 10 affinity deployments may be retained. Blocking deployments: ${blockers.join("; ")}`);
+        }
+    }
     let imageReference = options.containerImageReference;
     if (imageReference !== undefined) {
         if (imageDigestFromReference(imageReference) !== imageDigest) {
@@ -1607,7 +1781,7 @@ async function runEveDeployment(request, options, collected) {
         if (localImageReference === undefined || localImageReference.length === 0) {
             throw deploymentFailure("EVE_IMAGE_IDENTITY_UNAVAILABLE", "The deploy candidate did not return an exact local image handle for publication.");
         }
-        const imageRepository = `eden-eve-${targetKey}-${candidate.generationId}`;
+        const imageRepository = `eden-eve-${targetKey}-${affinityEnabled ? deploymentId : candidate.generationId}`;
         const imageTag = `${imageRepository}:${EVE_REGISTRY_IMAGE_TAG}`;
         const targetImageReference = `registry.cloudflare.com/${accountId}/${imageRepository}@${imageDigest}`;
         const imagePublication = await (options.publishImage ??
@@ -1669,7 +1843,6 @@ async function runEveDeployment(request, options, collected) {
             throw deploymentFailure("DEPLOY_INDETERMINATE", reason);
         }
     }
-    const deploymentId = `eve-deploy-${randomUUID()}`;
     const containerApplicationName = boundedResourceName(request.name, "container");
     const stableContainerInstanceName = boundedResourceName(request.name, "instance");
     const runtimeVariableNames = candidate.runtimeVariableNames;
@@ -1678,6 +1851,24 @@ async function runEveDeployment(request, options, collected) {
         sourceDigest: candidate.sourceDigest,
         generationId: candidate.generationId,
         deploymentId,
+        releaseId,
+        eveVersion: candidate.eveVersion,
+        ...(affinityEnabled ? {
+            affinityContract: EDEN_AFFINITY_CONTRACT,
+            retainedDeployments: {
+                ...retainedDeployments,
+                [deploymentId]: {
+                    image: imageReference,
+                    generationId: candidate.generationId,
+                    eveVersion: candidate.eveVersion,
+                    affinityContract: EDEN_AFFINITY_CONTRACT,
+                    releaseId,
+                    worldRpcAuth,
+                    ...(runtimeInjection?.protectedHandle === undefined ? {} : { runtimeRevisionHandle: runtimeInjection.protectedHandle }),
+                },
+            },
+            pendingRetirements: retiringDeployments,
+        } : {}),
         environment: request.environment,
         name: request.name,
         accountId,
@@ -1698,6 +1889,11 @@ async function runEveDeployment(request, options, collected) {
         containerApplicationName: identity.containerApplicationName,
         stableContainerInstanceName: identity.stableContainerInstanceName,
         deploymentId: identity.deploymentId,
+        worldRpcAuth,
+        ...(identity.releaseId === undefined ? {} : { releaseId: identity.releaseId }),
+        ...(identity.eveVersion === undefined ? {} : { eveVersion: identity.eveVersion }),
+        ...(identity.affinityContract === undefined ? {} : { affinityContract: identity.affinityContract }),
+        ...(identity.retainedDeployments === undefined ? {} : { retainedDeployments: identity.retainedDeployments }),
         generationId: identity.generationId,
         stableWorkersDevOrigin: identity.stableWorkersDevOrigin,
         containerImage: identity.containerImage,
@@ -1753,6 +1949,7 @@ async function runEveDeployment(request, options, collected) {
                 throw error;
         }
     };
+    await writeEveDeploymentRecord(candidate, identity, hostConfig, "indeterminate", { evidence: "publication-intent" }, "deployment-intent.json");
     try {
         eveProgress(options, "publishing Worker and Container application");
         publication = await publishOne(publicationRequest);
@@ -1955,7 +2152,40 @@ async function runEveDeployment(request, options, collected) {
     await promoteEveTargetPointer(join(request.projectRoot, ".eden", "eve-deploy"), `${request.environment}-${request.name}`, candidate.generationRoot);
     await options.afterPromotion?.();
     let supersededImageCleanup;
-    if (isUpdate) {
+    if (affinityEnabled && Object.keys(retiringDeployments).length > 0) {
+        const ids = Object.keys(retiringDeployments);
+        const completedRetirements = [];
+        try {
+            const result = await (options.deploymentRpc ?? defaultDeploymentRpc)({
+                origin: stableWorkersDevOrigin, operation: "deployments.retire", deploymentIds: ids,
+                controlToken,
+            });
+            if (typeof result !== "object" || result === null ||
+                !("retired" in result) || !Array.isArray(result.retired) ||
+                ids.some((id) => !result.retired.includes(id)))
+                throw new Error("Retirement was not proven.");
+            for (const [id, retained] of Object.entries(retiringDeployments)) {
+                const repository = ownedRegistryRepository({
+                    ...identity, deploymentId: id, containerImage: retained.image, generationId: retained.generationId,
+                }, request.environment, request.name, accountId);
+                if (repository !== undefined && await (options.deleteRegistryRepository ??
+                    defaultRegistryRepositoryDelete)({ repository }) === "indeterminate") {
+                    throw new Error(`Repository deletion was not proven: ${repository}`);
+                }
+                completedRetirements.push(id);
+            }
+            supersededImageCleanup = check("VAL-LIFE-007", "passed", "Drained deployment instances and their owned registry repositories were retired.");
+        }
+        catch {
+            supersededImageCleanup = check("VAL-LIFE-007", "failed", "The deployment is healthy, but drained resource retirement was not proven; exact pending retirement records were retained for retry.", "Retry deploy to finish only recorded drained resource cleanup.");
+        }
+        if (completedRetirements.length > 0) {
+            // Keep the immutable deployment record as evidence, but exclude proven
+            // cleanup from the next deploy's active retry set.
+            await writeFile(join(candidate.generationRoot, "completed-retirements.json"), `${JSON.stringify(completedRetirements)}\n`, { encoding: "utf8", mode: 0o600, flag: "wx" });
+        }
+    }
+    if (isUpdate && !affinityEnabled) {
         // The superseded generation's registry repository is generation-scoped
         // and no longer referenced once CURRENT promotes this generation; only
         // then is it safe to delete. Every tag in the repository goes with it —
@@ -2512,7 +2742,7 @@ async function readEveDestroyRecord(projectRoot, environment, name) {
     if (generationRoot === undefined) {
         return readEveDestroyRecordFromGenerations(projectRoot, environment, name);
     }
-    const parsed = await parseEveDestroyRecord(join(generationRoot, "deployment.json"), environment, name);
+    const parsed = await parseEveDestroyRecord(await deploymentRecordPath(generationRoot), environment, name);
     return parsed === undefined
         ? undefined
         : { ...parsed, generationRoot };
@@ -2526,7 +2756,7 @@ async function readEveDestroyRecordFromGenerations(projectRoot, environment, nam
         const details = await lstat(generationRoot).catch(() => undefined);
         if (details === undefined || !details.isDirectory())
             continue;
-        const recordDetails = await lstat(join(generationRoot, "deployment.json")).catch(() => undefined);
+        const recordDetails = await lstat(await deploymentRecordPath(generationRoot)).catch(() => undefined);
         if (recordDetails !== undefined && recordDetails.isFile()) {
             withRecords.push({
                 generationRoot,
@@ -2536,7 +2766,7 @@ async function readEveDestroyRecordFromGenerations(projectRoot, environment, nam
     }
     withRecords.sort((left, right) => right.modifiedAt - left.modifiedAt);
     for (const { generationRoot } of withRecords) {
-        const parsed = await parseEveDestroyRecord(join(generationRoot, "deployment.json"), environment, name);
+        const parsed = await parseEveDestroyRecord(await deploymentRecordPath(generationRoot), environment, name);
         if (parsed !== undefined) {
             return { ...parsed, generationRoot };
         }
@@ -2581,7 +2811,35 @@ async function parseEveDestroyRecord(recordPath, environment, name) {
     if (identity.environment !== environment || identity.name !== name) {
         return undefined;
     }
+    const metadata = {};
+    for (const key of ["deploymentId", "eveVersion", "releaseId", "runtimeRevisionHandle"]) {
+        if (typeof identity[key] === "string")
+            Object.assign(metadata, { [key]: identity[key] });
+    }
+    if (typeof identity.affinityContract === "number")
+        Object.assign(metadata, { affinityContract: identity.affinityContract });
+    for (const key of ["retainedDeployments", "pendingRetirements"]) {
+        const value = identity[key];
+        if (value === undefined)
+            continue;
+        if (typeof value !== "object" || value === null || Array.isArray(value))
+            return undefined;
+        for (const [id, deployment] of Object.entries(value)) {
+            if (!/^(?:eden-cloudflare|eden-affinity-[a-f0-9]{24})$/u.test(id) ||
+                typeof deployment !== "object" || deployment === null ||
+                typeof deployment.image !== "string" || imageDigestFromReference(deployment.image) === undefined ||
+                typeof deployment.generationId !== "string" ||
+                (deployment.eveVersion !== undefined && typeof deployment.eveVersion !== "string") ||
+                (deployment.affinityContract !== undefined && typeof deployment.affinityContract !== "number") ||
+                (deployment.releaseId !== undefined && typeof deployment.releaseId !== "string") ||
+                (deployment.worldRpcAuth !== undefined && typeof deployment.worldRpcAuth !== "boolean") ||
+                (deployment.runtimeRevisionHandle !== undefined && typeof deployment.runtimeRevisionHandle !== "string"))
+                return undefined;
+        }
+        Object.assign(metadata, { [key]: value });
+    }
     const verified = {
+        ...metadata,
         workerName: identity.workerName,
         containerApplicationName: identity.containerApplicationName,
         stableContainerInstanceName: identity.stableContainerInstanceName,
@@ -2620,7 +2878,7 @@ async function readEveDeploymentRecord(projectRoot, environment, name, accountId
     const deploymentIds = new Set();
     for (const entry of entries) {
         const generationRoot = join(generationsRoot, entry);
-        const recordPath = join(generationRoot, "deployment.json");
+        const recordPath = await deploymentRecordPath(generationRoot);
         const details = await lstat(recordPath).catch(() => undefined);
         if (details === undefined || !details.isFile())
             continue;
@@ -2653,7 +2911,7 @@ async function readEveDeploymentRecord(projectRoot, environment, name, accountId
                 live = pinned;
             }
             else {
-                const parsed = await parseEveDeploymentRecord(join(generationRoot, "deployment.json"), environment, name);
+                const parsed = await parseEveDeploymentRecord(await deploymentRecordPath(generationRoot), environment, name);
                 if (parsed !== undefined &&
                     !((accountId !== undefined &&
                         parsed.identity.accountId !== accountId) ||
@@ -2669,10 +2927,31 @@ async function readEveDeploymentRecord(projectRoot, environment, name, accountId
     // Newest record carrying a usable DO history wins, regardless of its
     // deployment outcome: a tag it published must never be replayed.
     const historySource = scanned.find((entry) => entry.record.durableObjects !== undefined);
+    // CURRENT is only a health/promotion pointer. A newer uncertain publication
+    // may already serve sessions; preserve every such image until a later deploy
+    // can prove it drained, never infer absence from a failed health check.
+    const unresolved = scanned.filter((entry) => entry.modifiedAt > live.modifiedAt);
+    const retainedDeployments = { ...live.record.identity.retainedDeployments };
+    const pendingRetirements = { ...live.record.identity.pendingRetirements };
+    const protectedDeploymentIds = new Set();
+    if (live.record.identity.retainedDeployments === undefined) {
+        protectedDeploymentIds.add("eden-cloudflare");
+    }
+    for (const entry of unresolved.slice().reverse()) {
+        Object.assign(retainedDeployments, entry.record.identity.retainedDeployments);
+        Object.assign(pendingRetirements, entry.record.identity.pendingRetirements);
+        if (entry.record.deploymentId !== undefined)
+            protectedDeploymentIds.add(entry.record.deploymentId);
+    }
     return {
         recordPath: live.record.recordPath,
         generationRoot: live.generationRoot,
-        identity: live.record.identity,
+        identity: {
+            ...live.record.identity,
+            ...(Object.keys(retainedDeployments).length === 0 ? {} : { retainedDeployments }),
+            ...(Object.keys(pendingRetirements).length === 0 ? {} : { pendingRetirements }),
+        },
+        protectedDeploymentIds: [...protectedDeploymentIds],
         status: live.record.status,
         deploymentIds: [...deploymentIds],
         worldCloudflare: live.record.worldCloudflare,
@@ -2683,6 +2962,19 @@ async function parseEveDeploymentRecord(recordPath, environment, name) {
     const base = await parseEveDestroyRecord(recordPath, environment, name);
     if (base === undefined)
         return undefined;
+    let identity = base.identity;
+    try {
+        const completed = JSON.parse(await readFile(join(dirname(recordPath), "completed-retirements.json"), "utf8"));
+        if (Array.isArray(completed) && completed.every((id) => typeof id === "string")) {
+            const pendingRetirements = { ...identity.pendingRetirements };
+            for (const id of completed)
+                delete pendingRetirements[id];
+            identity = { ...identity, pendingRetirements };
+        }
+    }
+    catch {
+        // Missing or unreadable cleanup evidence must not suppress a retry.
+    }
     let parsed;
     try {
         parsed = JSON.parse(await readFile(recordPath, "utf8"));
@@ -2726,7 +3018,7 @@ async function parseEveDeploymentRecord(recordPath, environment, name) {
         Array.isArray(rawMigrations);
     const invalidHistory = () => ({
         recordPath,
-        identity: base.identity,
+        identity,
         status,
         deploymentId,
         worldCloudflare: rawVars?.EDEN_EVE_WORLD_CLOUDFLARE === true,
@@ -2753,7 +3045,7 @@ async function parseEveDeploymentRecord(recordPath, environment, name) {
     }
     return {
         recordPath,
-        identity: base.identity,
+        identity,
         status,
         deploymentId,
         worldCloudflare: rawVars?.EDEN_EVE_WORLD_CLOUDFLARE === true,
@@ -2775,7 +3067,7 @@ async function defaultDestroyTargetRead(request) {
             "images",
             "list",
             "--json",
-        ]);
+        ], WRANGLER_OPERATION_TIMEOUT_MS);
         const tagsByRepository = registryTagsByRepository(images.value);
         if (!images.failed && tagsByRepository !== undefined) {
             const present = [];
@@ -2854,12 +3146,13 @@ async function defaultContainerDelete(request) {
  * repository is deleted individually.
  */
 async function defaultRegistryRepositoryDelete(request) {
+    // Catalog reads include Cloudflare snapshot tags and can exceed 30 seconds.
     const images = await readWranglerJson([
         "containers",
         "images",
         "list",
         "--json",
-    ]);
+    ], WRANGLER_OPERATION_TIMEOUT_MS);
     const collection = jsonCollection(images.value);
     if (images.failed || collection === undefined)
         return "indeterminate";
@@ -2885,9 +3178,11 @@ async function defaultRegistryRepositoryDelete(request) {
             deletedAny = true;
             continue;
         }
-        if (!/(?:does not exist|not found|404)/iu.test(result.stderr)) {
-            return "indeterminate";
-        }
+    }
+    const after = await readWranglerJson(["containers", "images", "list", "--json"], WRANGLER_OPERATION_TIMEOUT_MS);
+    const remaining = after.failed ? undefined : registryTagsByRepository(after.value);
+    if (remaining === undefined || (remaining.get(request.repository)?.length ?? 0) > 0) {
+        return "indeterminate";
     }
     return deletedAny ? "deleted" : "absent";
 }
@@ -2905,13 +3200,13 @@ function ownedRegistryRepository(identity, environment, name, accountId) {
         identity.accountId !== accountId) {
         return undefined;
     }
-    const repository = `eden-eve-${stableDeploymentKey(identity.projectId, identity.accountId, environment, name)}-${identity.generationId}`;
-    const expected = `registry.cloudflare.com/${identity.accountId}/${repository}@`;
-    if (!identity.containerImage.startsWith(expected) ||
-        imageDigestFromReference(identity.containerImage) === undefined) {
+    const prefix = `eden-eve-${stableDeploymentKey(identity.projectId, identity.accountId, environment, name)}-`;
+    const suffixes = [identity.generationId];
+    if (identity.retainedDeployments !== undefined && identity.deploymentId !== undefined)
+        suffixes.push(identity.deploymentId);
+    if (imageDigestFromReference(identity.containerImage) === undefined)
         return undefined;
-    }
-    return repository;
+    return suffixes.map((suffix) => `${prefix}${suffix}`).find((repository) => identity.containerImage.startsWith(`registry.cloudflare.com/${identity.accountId}/${repository}@`));
 }
 /**
  * The registry repository an indeterminate deploy attempt provably pushed.
@@ -2964,17 +3259,31 @@ async function collectEveDestroyRegistryRepositories(projectRoot, environment, n
     const generationsRoot = join(projectRoot, ".eden", "eve-deploy", "generations");
     const entries = await readdir(generationsRoot).catch(() => []);
     const repositories = new Set();
+    const addRetained = (identity) => {
+        for (const [id, retained] of Object.entries({
+            ...identity.retainedDeployments, ...identity.pendingRetirements,
+        })) {
+            const repository = ownedRegistryRepository({
+                ...identity, deploymentId: id, containerImage: retained.image, generationId: retained.generationId,
+            }, environment, name, record.accountId);
+            if (repository !== undefined)
+                repositories.add(repository);
+        }
+    };
+    addRetained(record);
     const targetKey = record.projectId === undefined
         ? undefined
         : stableDeploymentKey(record.projectId, record.accountId, environment, name);
     for (const entry of entries) {
         const generationRoot = join(generationsRoot, entry);
-        const parsed = await parseEveDestroyRecord(join(generationRoot, "deployment.json"), environment, name);
+        const parsed = await parseEveDestroyRecord(await deploymentRecordPath(generationRoot), environment, name);
         const deployedRepository = parsed === undefined
             ? undefined
             : ownedRegistryRepository(parsed.identity, environment, name, record.accountId);
         if (deployedRepository !== undefined)
             repositories.add(deployedRepository);
+        if (parsed !== undefined)
+            addRetained(parsed.identity);
         if (targetKey === undefined)
             continue;
         const attemptRepository = await attemptRegistryRepository(join(generationRoot, "deployment-attempt.json"), record.accountId, targetKey);

package/dist/eve-runtime-config.d.ts

@@ -1,4 +1,4 @@
-export declare const EVE_RESERVED_HOST_VARIABLES: readonly ["HOST", "NITRO_HOST", "PORT", "NITRO_PORT", "NODE_ENV", "NODE_EXTRA_CA_CERTS", "WORKFLOW_LOCAL_BASE_URL", "EDEN_WORLD_URL", "EDEN_EVE_DEPLOYMENT_ID", "EDEN_EVE_GENERATION_ID"];
+export declare const EVE_RESERVED_HOST_VARIABLES: readonly ["HOST", "NITRO_HOST", "PORT", "NITRO_PORT", "NODE_ENV", "NODE_EXTRA_CA_CERTS", "WORKFLOW_LOCAL_BASE_URL", "EDEN_WORLD_URL", "EDEN_WORLD_TOKEN", "EDEN_EVE_WORLD_RPC_AUTH", "EDEN_EVE_DEPLOYMENT_ID", "EDEN_EVE_GENERATION_ID", "EDEN_EVE_RELEASE_ID", "EDEN_EVE_DEPLOYMENTS", "EDEN_AFFINITY_CONTRACT", "EVE_SCHEDULES_DISABLED", "EDEN_EVE_CONTROL_TOKEN"];
 export type EveReservedHostVariable = (typeof EVE_RESERVED_HOST_VARIABLES)[number];
 export declare const EVE_START_COMMAND: readonly ["./node_modules/.bin/eve", "start", "--host", "0.0.0.0", "--port", "8080"];
 export declare const EVE_HOST_ENVIRONMENT: Readonly<{

package/dist/eve-runtime-config.js

@@ -10,8 +10,15 @@ export const EVE_RESERVED_HOST_VARIABLES = Object.freeze([
     "NODE_EXTRA_CA_CERTS",
     "WORKFLOW_LOCAL_BASE_URL",
     "EDEN_WORLD_URL",
+    "EDEN_WORLD_TOKEN",
+    "EDEN_EVE_WORLD_RPC_AUTH",
     "EDEN_EVE_DEPLOYMENT_ID",
     "EDEN_EVE_GENERATION_ID",
+    "EDEN_EVE_RELEASE_ID",
+    "EDEN_EVE_DEPLOYMENTS",
+    "EDEN_AFFINITY_CONTRACT",
+    "EVE_SCHEDULES_DISABLED",
+    "EDEN_EVE_CONTROL_TOKEN",
 ]);
 export const EVE_START_COMMAND = Object.freeze([
     "./node_modules/.bin/eve",

package/dist/eve-runtime-image.js

@@ -458,6 +458,7 @@ COPY node_modules /candidate/node_modules
 ${sandboxContextCopy}${sourceEntries.map((entry) => `COPY ${JSON.stringify([entry, `/candidate/${entry}`])}`).join("\n")}
 
 FROM --platform=linux/amd64 ${imageReference(nodeImage)} AS runtime
+RUN apt-get update && apt-get install -y --no-install-recommends python3 && rm -rf /var/lib/apt/lists/*
 WORKDIR /workspace
 ENV HOST=0.0.0.0 \\
     NITRO_HOST=0.0.0.0 \\
@@ -582,6 +583,8 @@ function runtimeContainerEnvironment(request) {
         ...(request.workflowWorld === "@moinulmoin/eden-world-cloudflare"
             ? {
                 EDEN_WORLD_URL: `${request.publicOrigin ?? "http://localhost:8080"}/__eden/world/rpc`,
+                EDEN_EVE_DEPLOYMENT_ID: `eden-smoke-${request.candidate.generationId}`,
+                EDEN_EVE_RELEASE_ID: `eden-smoke-${request.candidate.generationId}`,
                 CBOR_NATIVE_ACCELERATION_DISABLED: "true",
             }
             : {}),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moinulmoin/eden",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "Deploy existing Eve projects to your own Cloudflare account.",
   "keywords": [
     "ai",
@@ -31,7 +31,7 @@
     "NOTICE"
   ],
   "dependencies": {
-    "@moinulmoin/eden-runtime-cloudflare": "0.9.0",
+    "@moinulmoin/eden-runtime-cloudflare": "0.10.0",
     "wrangler": "4.147.0"
   },
   "devDependencies": {