@opennextjs/cloudflare 1.19.10 → 1.20.0

package/dist/api/cloudflare-context.d.ts

@@ -32,6 +32,8 @@ declare global {
         CF_PREVIEW_DOMAIN?: string;
         CF_WORKERS_SCRIPTS_API_TOKEN?: string;
         CF_ACCOUNT_ID?: string;
+        R2_ACCESS_KEY_ID?: string;
+        R2_SECRET_ACCESS_KEY?: string;
     }
 }
 export type CloudflareContext<CfProperties extends Record<string, unknown> = IncomingRequestCfProperties, Context = ExecutionContext> = {

package/dist/api/durable-objects/bucket-cache-purge.js

@@ -25,7 +25,7 @@ export class BucketCachePurge extends DurableObject {
             // Insert the tag into the sql table
             this.ctx.storage.sql.exec(`
         INSERT OR REPLACE INTO cache_purge (tag)
-        VALUES (?)`, [tag]);
+        VALUES (?)`, tag);
         }
         const nextAlarm = await this.ctx.storage.getAlarm();
         if (!nextAlarm) {
@@ -57,7 +57,7 @@ export class BucketCachePurge extends DurableObject {
             this.ctx.storage.sql.exec(`
         DELETE FROM cache_purge
         WHERE tag IN (${tags.map(() => "?").join(",")})
-      `, tags.map((row) => row.tag));
+      `, ...tags.map((row) => row.tag));
             if (tags.length < MAX_NUMBER_OF_TAGS_PER_PURGE) {
                 // If we have less than MAX_NUMBER_OF_TAGS_PER_PURGE tags, we can stop
                 tags = [];
@@ -70,6 +70,6 @@ export class BucketCachePurge extends DurableObject {
         `)
                     .toArray();
             }
-        } while (tags.length >= 0);
+        } while (tags.length > 0);
     }
 }

package/dist/cli/commands/deploy.d.ts

@@ -7,6 +7,7 @@ import type { WithWranglerArgs } from "./utils/utils.js";
  */
 export declare function deployCommand(args: WithWranglerArgs<{
     cacheChunkSize?: number;
+    rclone: boolean;
 }>): Promise<void>;
 /**
  * Add the `deploy` command to yargs configuration.

package/dist/cli/commands/deploy.js

@@ -24,6 +24,7 @@ export async function deployCommand(args) {
         environment: args.env,
         wranglerConfigPath: args.wranglerConfigPath,
         cacheChunkSize: args.cacheChunkSize,
+        useRclone: args.rclone,
         shouldUsePreviewId: false,
     }, envVars);
     const deploymentMapping = await getDeploymentMapping(buildOpts, config, envVars);

package/dist/cli/commands/populate-cache.d.ts

@@ -32,16 +32,25 @@ export type PopulateCacheOptions = {
     /**
      * Number of concurrent requests when populating the cache.
      * For KV this is the chunk size passed to `wrangler kv bulk put`.
-     * For R2 this is the number of concurrent requests to the local worker.
+     * For R2 this is the number of concurrent requests to the local worker or rclone transfers.
      *
      * @default 25
      */
     cacheChunkSize?: number;
+    /**
+     * Whether to use `rclone` instead of the worker-based R2 cache population path.
+     */
+    useRclone?: boolean;
     /**
      * Instructs Wrangler to use the preview namespace or ID defined in the Wrangler config for the remote target.
      */
     shouldUsePreviewId: boolean;
 };
+export declare function loadRclone(importRclone?: () => Promise<{
+    default: typeof import("rclone.js");
+}>): Promise<((...args: Array<string | object>) => import("child_process").ChildProcess) & Record<"test" | "checksum" | "link" | "version" | "config" | "copy" | "delete" | "about" | "authorize" | "backend" | "cat" | "check" | "cleanup" | "config create" | "config delete" | "config disconnect" | "config dump" | "config edit" | "config file" | "config password" | "config providers" | "config reconnect" | "config show" | "config update" | "config userinfo" | "copyto" | "copyurl" | "cryptcheck" | "cryptdecode" | "dedupe" | "deletefile" | "genautocomplete" | "genautocomplete bash" | "genautocomplete fish" | "genautocomplete zsh" | "gendocs" | "hashsum" | "help" | "listremotes" | "ls" | "lsd" | "lsf" | "lsjson" | "lsl" | "md5sum" | "mkdir" | "mount" | "move" | "moveto" | "ncdu" | "obscure" | "purge" | "rc" | "rcat" | "rcd" | "rmdir" | "rmdirs" | "selfupdate" | "serve" | "serve dlna" | "serve ftp" | "serve http" | "serve restic" | "serve sftp" | "serve webdav" | "settier" | "sha1sum" | "size" | "sync" | "touch" | "tree", (...args: Array<string | object>) => import("child_process").ChildProcess> & {
+    promises: ((...args: Array<string | object>) => Promise<Buffer<ArrayBufferLike>>) & Record<"test" | "checksum" | "link" | "version" | "config" | "copy" | "delete" | "about" | "authorize" | "backend" | "cat" | "check" | "cleanup" | "config create" | "config delete" | "config disconnect" | "config dump" | "config edit" | "config file" | "config password" | "config providers" | "config reconnect" | "config show" | "config update" | "config userinfo" | "copyto" | "copyurl" | "cryptcheck" | "cryptdecode" | "dedupe" | "deletefile" | "genautocomplete" | "genautocomplete bash" | "genautocomplete fish" | "genautocomplete zsh" | "gendocs" | "hashsum" | "help" | "listremotes" | "ls" | "lsd" | "lsf" | "lsjson" | "lsl" | "md5sum" | "mkdir" | "mount" | "move" | "moveto" | "ncdu" | "obscure" | "purge" | "rc" | "rcat" | "rcd" | "rmdir" | "rmdirs" | "selfupdate" | "serve" | "serve dlna" | "serve ftp" | "serve http" | "serve restic" | "serve sftp" | "serve webdav" | "settier" | "sha1sum" | "size" | "sync" | "touch" | "tree", (...args: Array<string | object>) => Promise<Buffer<ArrayBufferLike>>>;
+}>;
 /**
  * Add the `populateCache` command to yargs configuration, with nested commands for `local` and `remote`.
  *
@@ -56,4 +65,6 @@ export declare function withPopulateCacheOptions<T extends yargs.Argv>(args: T):
     env: string | undefined;
 } & {
     cacheChunkSize: number | undefined;
+} & {
+    rclone: boolean;
 }>;

package/dist/cli/commands/populate-cache.js

@@ -46,6 +46,7 @@ async function populateCacheCommand(target, args) {
         environment: args.env,
         wranglerConfigPath: args.wranglerConfigPath,
         cacheChunkSize: args.cacheChunkSize,
+        useRclone: args.rclone,
         shouldUsePreviewId: false,
     }, envVars);
 }
@@ -150,6 +151,13 @@ async function populateR2IncrementalCache(buildOpts, config, populateCacheOption
         logger.info("No cache assets to populate");
         return;
     }
+    if (populateCacheOptions.useRclone) {
+        if (populateCacheOptions.target !== "remote") {
+            throw new Error("The `--rclone` option can only be used when populating a remote R2 cache.");
+        }
+        await populateR2IncrementalCacheWithRclone(bucketName, prefix, assets, envVars, populateCacheOptions.cacheChunkSize);
+        return;
+    }
     const currentDir = path.dirname(fileURLToPath(import.meta.url));
     const handlerPath = path.join(currentDir, "../workers/r2-cache.js");
     const isRemote = populateCacheOptions.target === "remote";
@@ -204,6 +212,113 @@ async function populateR2IncrementalCache(buildOpts, config, populateCacheOption
     }
     logger.info(`Successfully populated cache with ${assets.length} entries`);
 }
+async function populateR2IncrementalCacheWithRclone(bucketName, prefix, assets, envVars, cacheChunkSize) {
+    const accessKey = envVars.R2_ACCESS_KEY_ID;
+    const secretKey = envVars.R2_SECRET_ACCESS_KEY;
+    const accountId = envVars.CF_ACCOUNT_ID;
+    if (!accessKey || !secretKey || !accountId) {
+        throw new Error("R2_ACCESS_KEY_ID, R2_SECRET_ACCESS_KEY, and CF_ACCOUNT_ID must be provided to use `rclone`");
+    }
+    const rclone = await loadRclone();
+    logger.info("\nPopulating remote R2 incremental cache using `rclone`...");
+    const configDir = await fsp.mkdtemp(path.join(os.tmpdir(), "rclone-config-"));
+    const configPath = path.join(configDir, "rclone.conf");
+    const stagingDir = await fsp.mkdtemp(path.join(os.tmpdir(), "r2-staging-"));
+    const transfers = Math.max(1, cacheChunkSize ?? 25);
+    const checkers = Math.max(1, Math.floor(transfers / 2));
+    try {
+        await fsp.writeFile(configPath, `[r2]\ntype = s3\nprovider = Cloudflare\naccess_key_id = ${accessKey}\nsecret_access_key = ${secretKey}\nendpoint = https://${accountId}.r2.cloudflarestorage.com\nacl = private\n`, { mode: 0o600 });
+        const rcloneEnv = {
+            ...process.env,
+            RCLONE_CONFIG: configPath,
+        };
+        await ensureRcloneExecutable(rclone, rcloneEnv);
+        await stageCacheAssets(assets, stagingDir, prefix, transfers);
+        await runRcloneCopy(rclone, stagingDir, `r2:${bucketName}`, {
+            progress: true,
+            transfers,
+            checkers,
+            env: rcloneEnv,
+            stdio: "inherit",
+        });
+    }
+    finally {
+        await Promise.allSettled([
+            fsp.rm(stagingDir, { recursive: true, force: true }),
+            fsp.rm(configDir, { recursive: true, force: true }),
+        ]);
+    }
+    logger.info(`Successfully populated cache with ${assets.length} entries`);
+}
+async function runRcloneCopy(rclone, source, destination, options) {
+    await new Promise((resolve, reject) => {
+        const child = rclone.copy(source, destination, options);
+        child.once("error", reject);
+        child.once("close", (code, signal) => {
+            if (code === 0) {
+                resolve();
+                return;
+            }
+            reject(new Error(`rclone exited ${signal ? `after receiving signal ${signal}` : `with code ${code ?? "unknown"}`}`));
+        });
+    });
+}
+async function stageCacheAssets(assets, stagingDir, prefix, maxConcurrency) {
+    const pending = new Set();
+    for (const asset of assets) {
+        const task = stageCacheAsset(asset, stagingDir, prefix).finally(() => pending.delete(task));
+        pending.add(task);
+        if (pending.size >= maxConcurrency) {
+            await Promise.race(pending);
+        }
+    }
+    await Promise.all(pending);
+}
+async function stageCacheAsset(asset, stagingDir, prefix) {
+    const cacheKey = computeCacheKey(asset.key, {
+        prefix,
+        buildId: asset.buildId,
+        cacheType: asset.isFetch ? "fetch" : "cache",
+    });
+    const destination = path.resolve(stagingDir, cacheKey);
+    const relativeDestination = path.relative(stagingDir, destination);
+    if (relativeDestination.startsWith(`..${path.sep}`) || path.isAbsolute(relativeDestination)) {
+        throw new Error(`Cannot stage R2 cache key outside the temporary directory: ${JSON.stringify(cacheKey)}`);
+    }
+    await fsp.mkdir(path.dirname(destination), { recursive: true });
+    try {
+        await fsp.link(asset.fullPath, destination);
+    }
+    catch (error) {
+        if (!(error instanceof Error) || !("code" in error) || error.code !== "EXDEV") {
+            throw error;
+        }
+        await fsp.copyFile(asset.fullPath, destination);
+    }
+}
+async function ensureRcloneExecutable(rclone, env) {
+    try {
+        await rclone.promises.version({ env });
+    }
+    catch (error) {
+        if (error instanceof Error && "code" in error && error.code === "ENOENT") {
+            throw new Error("The `rclone.js` executable is unavailable. pnpm users must allow its install script with `pnpm approve-builds`, select `rclone.js`, then run `pnpm rebuild rclone.js`.");
+        }
+        throw error;
+    }
+}
+export async function loadRclone(importRclone = () => import("rclone.js")) {
+    try {
+        return (await importRclone()).default;
+    }
+    catch (error) {
+        if (error instanceof Error &&
+            ("code" in error ? error.code === "ERR_MODULE_NOT_FOUND" : error.message.includes("rclone.js"))) {
+            throw new Error("The `--rclone` option requires the optional `rclone.js` peer dependency. Install it in your project before using this option.");
+        }
+        throw error;
+    }
+}
 /**
  * Sends cache entries to the R2 worker, one entry per request.
  *
@@ -262,11 +377,17 @@ async function sendEntryToR2Worker(options) {
                         "x-opennext-cache-key": key,
                         "content-length": fs.statSync(filename).size.toString(),
                         // Include Access Client ID and Secret if they are set in the environment,
-                        // to allow the worker to authenticate with the Cloudflare API when writing to R2.
+                        // so the helper worker can be reached through Cloudflare Access.
                         //
-                        // The Application at "open-next-cache-populate.<account>.workers.dev" should have a policy with:
-                        // - "Action" set to "Service Auth"
-                        // - "Any Access Service Token" or "Service Token" + a specific service token
+                        // If the workers.dev subdomain (or a parent route) is behind Cloudflare Access,
+                        // attach a "Service Auth" policy to the *existing* Access application that already
+                        // covers "open-next-cache-populate.<account>.workers.dev" — typically the
+                        // "*.<account>.workers.dev" wildcard application. Creating a separate application
+                        // scoped to this hostname has been observed to block the upload, even alongside
+                        // the wildcard app. The policy should have:
+                        //   - Action set to "Service Auth"
+                        //   - An Include rule for "Any Access Service Token" or a specific Service Token
+                        // See: https://opennext.js.org/cloudflare/cli#populating-remote-bindings-when-workers-are-protected-by-cloudflare-access
                         ...(process.env.CLOUDFLARE_ACCESS_CLIENT_ID && process.env.CLOUDFLARE_ACCESS_CLIENT_SECRET
                             ? {
                                 "CF-Access-Client-Id": process.env.CLOUDFLARE_ACCESS_CLIENT_ID,
@@ -425,8 +546,14 @@ export function addPopulateCacheCommand(y) {
         .demandCommand(1, 1));
 }
 export function withPopulateCacheOptions(args) {
-    return withWranglerOptions(args).options("cacheChunkSize", {
+    return withWranglerOptions(args)
+        .options("cacheChunkSize", {
         type: "number",
-        desc: "Number of entries per chunk when populating the cache",
+        desc: "Number of concurrent cache entries to process",
+    })
+        .options("rclone", {
+        type: "boolean",
+        default: false,
+        desc: "Use rclone to populate a remote R2 incremental cache",
     });
 }

package/dist/cli/commands/preview.d.ts

@@ -8,6 +8,7 @@ import type { WithWranglerArgs } from "./utils/utils.js";
 export declare function previewCommand(args: WithWranglerArgs<{
     cacheChunkSize?: number;
     remote: boolean;
+    rclone: boolean;
 }>): Promise<void>;
 /**
  * Add the `preview` command to yargs configuration.

package/dist/cli/commands/preview.js

@@ -22,6 +22,7 @@ export async function previewCommand(args) {
         environment: args.env,
         wranglerConfigPath: args.wranglerConfigPath,
         cacheChunkSize: args.cacheChunkSize,
+        useRclone: args.rclone,
         shouldUsePreviewId: args.remote,
     }, envVars);
     const result = runWrangler(buildOpts, ["dev", ...args.wranglerArgs], { logging: "all" });

package/dist/cli/commands/skew-protection.js

@@ -31,6 +31,8 @@ const MAX_NUMBER_OF_VERSIONS = 20;
 /** Maximum age of versions to list */
 const MAX_VERSION_AGE_DAYS = 7;
 const MS_PER_DAY = 24 * 3600 * 1000;
+/** Worker-version trigger types that produce a full upload (assets + code). */
+const UPLOAD_TRIGGER_TYPES = new Set(["upload", "version_upload"]);
 /**
  * Compute the deployment mapping for a deployment.
  *
@@ -174,11 +176,18 @@ export async function listWorkerVersions(scriptName, options) {
         })) {
             const id = version.id;
             const createdOn = version.metadata?.created_on;
+            const triggeredBy = version.metadata?.annotations?.["workers/triggered_by"];
             if (id && createdOn) {
                 const createdOnMs = new Date(createdOn).getTime();
                 if (createdOnMs < afterTimeMs) {
                     break;
                 }
+                // Skip metadata-only versions (e.g. secret/service_token triggers)
+                // that lack the static assets bundle. Versions with no annotation
+                // are kept for backward compatibility.
+                if (triggeredBy !== undefined && !UPLOAD_TRIGGER_TYPES.has(triggeredBy)) {
+                    continue;
+                }
                 versions.push({ id, createdOnMs });
                 if (versions.length >= maxNumberOfVersions) {
                     break;

package/dist/cli/commands/upload.d.ts

@@ -7,6 +7,7 @@ import type { WithWranglerArgs } from "./utils/utils.js";
  */
 export declare function uploadCommand(args: WithWranglerArgs<{
     cacheChunkSize?: number;
+    rclone: boolean;
 }>): Promise<void>;
 /**
  * Add the `upload` command to yargs configuration.

package/dist/cli/commands/upload.js

@@ -25,6 +25,7 @@ export async function uploadCommand(args) {
         environment: args.env,
         wranglerConfigPath: args.wranglerConfigPath,
         cacheChunkSize: args.cacheChunkSize,
+        useRclone: args.rclone,
         shouldUsePreviewId: false,
     }, envVars);
     const result = runWrangler(buildOpts, [

package/dist/cli/utils/ensure-r2-bucket.js

@@ -106,8 +106,15 @@ export async function ensureR2Bucket(projectDir, bucketName, jurisdiction) {
             }
         }
         const client = authCredentials.type === "api_key"
-            ? new Cloudflare({ apiKey: authCredentials.apiKey, apiEmail: authCredentials.apiEmail })
-            : new Cloudflare({ apiToken: authCredentials.token });
+            ? new Cloudflare({
+                apiKey: authCredentials.apiKey,
+                apiEmail: authCredentials.apiEmail,
+                defaultHeaders: { "Accept-Encoding": "identity" },
+            })
+            : new Cloudflare({
+                apiToken: authCredentials.token,
+                defaultHeaders: { "Accept-Encoding": "identity" },
+            });
         const accountId = await getAccountId(client);
         if (!accountId) {
             return { success: false, error: "Could not determine Cloudflare account ID" };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@opennextjs/cloudflare",
   "description": "Cloudflare builder for next apps",
-  "version": "1.19.10",
+  "version": "1.20.0",
   "type": "module",
   "bin": {
     "opennextjs-cloudflare": "dist/cli/index.js"
@@ -60,6 +60,7 @@
     "@types/mock-fs": "^4.13.4",
     "@types/node": "^22.12.0",
     "@types/picomatch": "^4.0.0",
+    "@types/rclone.js": "^0.6.1",
     "@types/yargs": "^17.0.33",
     "diff": "^8.0.2",
     "esbuild": "^0.27.0",
@@ -71,6 +72,7 @@
     "mock-fs": "^5.4.1",
     "next": "^15.5.18",
     "picomatch": "^4.0.2",
+    "rclone.js": "^0.6.6",
     "rimraf": "^6.0.1",
     "typescript": "^5.9.3",
     "typescript-eslint": "^8.48.0",
@@ -78,8 +80,14 @@
   },
   "peerDependencies": {
     "next": ">=15.5.18 <16 || >=16.2.6",
+    "rclone.js": "^0.6.6",
     "wrangler": "^4.86.0"
   },
+  "peerDependenciesMeta": {
+    "rclone.js": {
+      "optional": true
+    }
+  },
   "scripts": {
     "clean": "rimraf dist",
     "build": "pnpm clean && tsc",