@opennextjs/cloudflare 1.19.9 → 1.19.11

package/dist/cli/commands/populate-cache.js

@@ -261,6 +261,24 @@ async function sendEntryToR2Worker(options) {
                     headers: {
                         "x-opennext-cache-key": key,
                         "content-length": fs.statSync(filename).size.toString(),
+                        // Include Access Client ID and Secret if they are set in the environment,
+                        // so the helper worker can be reached through Cloudflare Access.
+                        //
+                        // If the workers.dev subdomain (or a parent route) is behind Cloudflare Access,
+                        // attach a "Service Auth" policy to the *existing* Access application that already
+                        // covers "open-next-cache-populate.<account>.workers.dev" — typically the
+                        // "*.<account>.workers.dev" wildcard application. Creating a separate application
+                        // scoped to this hostname has been observed to block the upload, even alongside
+                        // the wildcard app. The policy should have:
+                        //   - Action set to "Service Auth"
+                        //   - An Include rule for "Any Access Service Token" or a specific Service Token
+                        // See: https://opennext.js.org/cloudflare/cli#populating-remote-bindings-when-workers-are-protected-by-cloudflare-access
+                        ...(process.env.CLOUDFLARE_ACCESS_CLIENT_ID && process.env.CLOUDFLARE_ACCESS_CLIENT_SECRET
+                            ? {
+                                "CF-Access-Client-Id": process.env.CLOUDFLARE_ACCESS_CLIENT_ID,
+                                "CF-Access-Client-Secret": process.env.CLOUDFLARE_ACCESS_CLIENT_SECRET,
+                            }
+                            : {}),
                     },
                     body: Readable.toWeb(fs.createReadStream(filename)),
                     signal: AbortSignal.timeout(60_000),

package/dist/cli/commands/skew-protection.js

@@ -31,6 +31,8 @@ const MAX_NUMBER_OF_VERSIONS = 20;
 /** Maximum age of versions to list */
 const MAX_VERSION_AGE_DAYS = 7;
 const MS_PER_DAY = 24 * 3600 * 1000;
+/** Worker-version trigger types that produce a full upload (assets + code). */
+const UPLOAD_TRIGGER_TYPES = new Set(["upload", "version_upload"]);
 /**
  * Compute the deployment mapping for a deployment.
  *
@@ -174,11 +176,18 @@ export async function listWorkerVersions(scriptName, options) {
         })) {
             const id = version.id;
             const createdOn = version.metadata?.created_on;
+            const triggeredBy = version.metadata?.annotations?.["workers/triggered_by"];
             if (id && createdOn) {
                 const createdOnMs = new Date(createdOn).getTime();
                 if (createdOnMs < afterTimeMs) {
                     break;
                 }
+                // Skip metadata-only versions (e.g. secret/service_token triggers)
+                // that lack the static assets bundle. Versions with no annotation
+                // are kept for backward compatibility.
+                if (triggeredBy !== undefined && !UPLOAD_TRIGGER_TYPES.has(triggeredBy)) {
+                    continue;
+                }
                 versions.push({ id, createdOnMs });
                 if (versions.length >= maxNumberOfVersions) {
                     break;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@opennextjs/cloudflare",
   "description": "Cloudflare builder for next apps",
-  "version": "1.19.9",
+  "version": "1.19.11",
   "type": "module",
   "bin": {
     "opennextjs-cloudflare": "dist/cli/index.js"