@package-broker/cli 2.0.0-rc.1 → 2.0.0-rc.2

package/dist/commands/cloudflare/deploy.js

@@ -4,13 +4,24 @@ import { dirname, extname, isAbsolute, relative, resolve, sep } from 'node:path'
 import { createOtlpExporter } from '@package-broker/core/platform/otlp';
 import { parseUiManifest } from '@package-broker/core/platform/ui-manifest';
 import { TRACE_FIELDS, validatePlatformPorts, } from '@package-broker/core/platform/port-config';
-import { PLUGIN_BINDABLE_PORTS } from '@package-broker/core/plugin';
+import { PLUGIN_BINDABLE_PORTS, providerSecretName, } from '@package-broker/core/plugin';
+import { parseRuntimeProviders, planProviders, } from '@package-broker/plugin-sso-oidc/definitions';
+import { snapshotIdentityDescriptor } from '@package-broker/core/kernel/registry';
+import { orgContext } from '@package-broker/core/db/port';
+import { isValidTrustAnchor } from '@package-broker/core/identity/port';
+import { createOrganizationBootstrap } from '@package-broker/db-sqlite/repositories/organization';
+import { readProviderBinding } from '@package-broker/db-sqlite/repositories/provider-binding';
+import { DbError } from '@package-broker/core/db/errors';
+import { createD1HttpExecutor, isLostResponse } from '../../cloudflare/d1-http-executor.js';
 import { assertPrebuiltConfiguration, materializePrebuilt, prebuiltEnvelope, removePrebuilt, } from '../../prebuilt.js';
 import { builtRouteProblems, loadBuiltMigrations } from '../built-manifest.js';
+import { validateProvidersDocument } from './providers-file.js';
 import { normalizeQueueConsumer } from './queue-consumer.js';
 import { assertMigrationsApplied } from './migrations-check.js';
 import { d1BindingId, workerSettingsDifferences } from './worker-settings.js';
 import { CloudflareApi, CloudflareError, cloudflareCredentials, commandEnvelope, failCommand, object, wasNotSent, } from './api.js';
+import { resolveZone } from './zone.js';
+import { routeConflict } from './routes.js';
 import { InventoryStore, InventoryTransaction, digest, installIdentity, recordDeploymentHistory, DeploymentHistoryCapacityError, safeBuildInfo, } from './inventory.js';
 export function tracesMetadata(traces) {
     if (traces === undefined)
@@ -21,11 +32,24 @@ export function tracesMetadata(traces) {
 }
 const COMPATIBILITY = { compatibility_date: '2026-10-01', compatibility_flags: ['nodejs_compat'] };
 const ASSET_CONFIG = { run_worker_first: true, html_handling: 'none', not_found_handling: 'none' };
+const PREVIEW_BINDING_FIELDS = {
+    d1: 'id',
+    r2_bucket: 'bucket_name',
+    queue: 'queue_name',
+    analytics_engine: 'dataset',
+    plain_text: 'text',
+    secret_text: null,
+    assets: null,
+};
 const uuid = (v) => typeof v === 'string' &&
     /^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/i.test(v);
 const safeId = (v) => typeof v === 'string' && /^[a-zA-Z0-9_-]{1,128}$/.test(v);
-const invalid = () => {
-    throw new CloudflareError('invalid_input', 2, false, 'deploy');
+const inputMessages = new WeakMap();
+const invalid = (message) => {
+    const error = new CloudflareError('invalid_input', 2, false, 'deploy');
+    if (message)
+        inputMessages.set(error, message);
+    throw error;
 };
 const conflict = (field, ...fields) => {
     throw new CloudflareError('configuration_conflict', 8, false, 'deploy', null, null, null, null, [
@@ -36,12 +60,161 @@ const conflict = (field, ...fields) => {
 const unknown = () => {
     throw new CloudflareError('outcome_unknown', 6, false, 'deploy');
 };
+export function assertProvidersAccepted(option, identity) {
+    if (option?.kind !== 'set' || identity?.runtimeProviders)
+        return;
+    const message = identity
+        ? 'Cannot set providers: artifact runtimeProviders is false'
+        : 'Cannot set providers on a legacy artifact without identity metadata';
+    try {
+        invalid(message);
+    }
+    catch (error) {
+        throw Object.assign(error, { message });
+    }
+}
+function desiredProviders(option, identity, live) {
+    if (option?.kind === 'set') {
+        assertProvidersAccepted(option, identity);
+        return option.value;
+    }
+    if (option?.kind === 'remove')
+        return null;
+    const found = (live?.bindings ?? [])
+        .map(object)
+        .filter((b) => b.name === 'PB_IDP_PROVIDERS');
+    if (!found.length)
+        return null;
+    try {
+        const binding = found[0];
+        if (found.length !== 1 || binding.type !== 'plain_text' || typeof binding.text !== 'string')
+            throw new Error();
+        validateProvidersDocument(binding.text, 'deploy', true);
+        return binding.text;
+    }
+    catch {
+        return invalid('live PB_IDP_PROVIDERS is not valid; pass --providers <file> or --providers none');
+    }
+}
+function planned({ id, kind, anchor }) {
+    const value = anchor.slice(anchor.indexOf(':') + 1);
+    const slash = value.indexOf('/');
+    return kind === 'oidc'
+        ? { id, kind, issuer: value }
+        : { id, kind, teamDomain: value.slice(0, slash), audience: value.slice(slash + 1) };
+}
+function identityDigest(descriptor, providers) {
+    return descriptor === null && providers === null
+        ? null
+        : digest(canonical({ descriptor, providers }));
+}
+function providerPlan(descriptor, providersText) {
+    let runtime = parseRuntimeProviders(undefined);
+    if (descriptor.runtimeProviders)
+        try {
+            runtime = parseRuntimeProviders(providersText ?? undefined);
+        }
+        catch {
+            runtime = { ...runtime, documentProblem: 'unreadable' };
+        }
+    const plan = planProviders(descriptor.compiled.map(planned), runtime);
+    return { runtime, plan };
+}
+function effectiveAnchors(descriptor, providersText) {
+    if (descriptor === null)
+        return [];
+    return providerPlan(descriptor, providersText).plan.effective.map((entry) => ({
+        id: entry.id,
+        anchor: entry.kind === 'oidc'
+            ? `oidc:${entry.issuer}`
+            : `access:${entry.teamDomain}/${entry.audience}`,
+    }));
+}
+const MISSING_SCHEMA = /\bno such table: (?:main\.)?organization\b/;
+async function anchorPreflight(connection, databaseId, anchors, missingSchemaSkips) {
+    let changed;
+    try {
+        if (typeof databaseId !== 'string' || databaseId === '')
+            throw new TypeError('no database');
+        const executor = createD1HttpExecutor({ ...connection, databaseId });
+        let organization;
+        try {
+            organization = await createOrganizationBootstrap(executor).findSingleton();
+        }
+        catch (error) {
+            if (missingSchemaSkips && missingSchema(error))
+                return 'skipped';
+            throw error;
+        }
+        if (organization === null)
+            return 'checked';
+        const ctx = orgContext(organization.id);
+        for (const { id, anchor } of anchors) {
+            const binding = await readProviderBinding(executor, ctx, id);
+            if (binding === null)
+                continue;
+            if (typeof binding.anchor !== 'string' || !isValidTrustAnchor(binding.anchor))
+                throw new TypeError('malformed provider binding');
+            if (binding.anchor !== anchor) {
+                changed = id;
+                break;
+            }
+        }
+    }
+    catch {
+        throw new CloudflareError('provider_failure', 1, false, 'deploy');
+    }
+    if (changed === undefined)
+        return 'checked';
+    const message = `Provider ${changed} is bound to a different trust anchor; run pb admin rebind-provider before deploying this definition`;
+    const error = new CloudflareError('provider_anchor_changed', 2, false, 'deploy');
+    inputMessages.set(error, message);
+    throw Object.assign(error, { message });
+}
+function missingSchema(error) {
+    return (error instanceof DbError &&
+        error.kind === 'unknown' &&
+        !isLostResponse(error) &&
+        MISSING_SCHEMA.test(error.message));
+}
+export function dryRunIdentity(descriptor, providersText, identityHash, skippedChecks = []) {
+    if (descriptor === null)
+        return null;
+    const { runtime, plan } = providerPlan(descriptor, providersText);
+    return {
+        providers: plan.effective.map((entry) => ({
+            id: entry.id,
+            type: entry.kind,
+            source: runtime.accepted.includes(entry) ? 'runtime' : 'compiled',
+        })),
+        overrides: [...plan.overridden],
+        displaced: [
+            ...plan.displaced.map(({ compiled: id, by }) => ({ id, reason: 'displaced', by })),
+            ...plan.suppressed.map((id) => ({ id, reason: 'suppressed', by: null })),
+            ...plan.overflow.map((id) => ({ id, reason: 'overflow', by: null })),
+        ],
+        runtime_providers_applied: descriptor.runtimeProviders,
+        runtime_document_problem: runtime.documentProblem,
+        providers_sha256: providersText === null ? null : digest(providersText),
+        identity_sha256: identityHash,
+        skipped_checks: skippedChecks,
+    };
+}
+function frozenProviders(attempt) {
+    const value = attempt.providers_text ?? null;
+    if ((value === null ? null : digest(value)) !== (attempt.providers_sha256 ?? null))
+        return conflict('providers');
+    const parsed = parseRuntimeProviders(value ?? undefined);
+    if (parsed.documentProblem !== null || parsed.rejected.length)
+        return invalid('Frozen PB_IDP_PROVIDERS is not valid');
+    return value;
+}
 function canonical(value) {
     if (Array.isArray(value))
         return `[${value.map(canonical).join(',')}]`;
     if (value && typeof value === 'object')
         return `{${Object.entries(value)
-            .sort(([a], [b]) => a.localeCompare(b))
+            .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))
             .map(([k, v]) => `${JSON.stringify(k)}:${canonical(v)}`)
             .join(',')}}`;
     return JSON.stringify(value);
@@ -126,6 +299,10 @@ export async function validateDeploymentArtifact(out) {
             return invalid();
         const info = safeBuildInfo(JSON.parse((await read('build-info.json')).toString('utf8')));
         const manifest = object(JSON.parse((await read('generated/manifest.json')).toString('utf8')));
+        const hasIdentity = Object.hasOwn(manifest, 'identity');
+        const identity = hasIdentity ? snapshotIdentityDescriptor(manifest.identity) : null;
+        if (hasIdentity && identity === null)
+            return invalid();
         if (manifest.schemaVersion !== 1 ||
             manifest.platform !== 'cloudflare' ||
             !Array.isArray(manifest.plugins) ||
@@ -194,7 +371,16 @@ export async function validateDeploymentArtifact(out) {
             assets: ASSET_CONFIG,
             ports,
         }));
-        return { module, info, ports, assets, assetsHash: exactAssetsHash, artifactHash, migrations };
+        return {
+            module,
+            info,
+            ports,
+            assets,
+            assetsHash: exactAssetsHash,
+            artifactHash,
+            migrations,
+            identity,
+        };
     }
     catch {
         return invalid();
@@ -203,6 +389,12 @@ export async function validateDeploymentArtifact(out) {
 export const unverifiedDeployContract = {
     versionsCreateScript: false,
     secretInheritance: false,
+    preview: async () => {
+        throw new CloudflareError('capability_unknown', 1, false, 'deploy');
+    },
+    domainZone: async () => {
+        throw new CloudflareError('domain_zone_not_supported', 1, false, 'deploy');
+    },
 };
 /** Cloudflare's direct-upload example hashes base64 bytes plus the extension without its dot. */
 export function cloudflareAssetHash(bytes, name) {
@@ -214,7 +406,56 @@ export function cloudflareAssetHash(bytes, name) {
 export const cloudflareDeployContract = {
     versionsCreateScript: false,
     secretInheritance: true,
+    domainZone: resolveZone,
     assetHash: cloudflareAssetHash,
+    preview: async (api, script, version) => {
+        try {
+            if (!uuid(version) || !/^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(script) || script.length > 54)
+                return invalid();
+            const result = object((await api.request(`/workers/scripts/${script}/versions/${version}`)).result);
+            if (!uuid(result.id))
+                throw new CloudflareError('provider_failure', 1, false, 'deploy');
+            if (result.id !== version)
+                return conflict('preview');
+            const resources = object(result.resources);
+            if (resources.bindings === undefined)
+                return conflict('preview');
+            if (!Array.isArray(resources.bindings))
+                throw new CloudflareError('provider_failure', 1, false, 'deploy');
+            if (!resources.bindings.length)
+                return conflict('preview');
+            const names = new Set();
+            for (const raw of resources.bindings) {
+                const binding = object(raw);
+                if (typeof binding.type !== 'string' || typeof binding.name !== 'string' || !binding.name)
+                    throw new CloudflareError('provider_failure', 1, false, 'deploy');
+                if (!Object.hasOwn(PREVIEW_BINDING_FIELDS, binding.type) || names.has(binding.name))
+                    return conflict('preview');
+                names.add(binding.name);
+                const field = PREVIEW_BINDING_FIELDS[binding.type];
+                if (field && typeof binding[field] !== 'string')
+                    throw new CloudflareError('provider_failure', 1, false, 'deploy');
+                if (field && field !== 'text' && !binding[field])
+                    return conflict('preview');
+                if (binding.type === 'secret_text' &&
+                    (Object.hasOwn(binding, 'text') || Object.hasOwn(binding, 'value')))
+                    return conflict('preview');
+            }
+            const workerOrigin = await workersDevOrigin(api, script);
+            return {
+                version_id: result.id,
+                url: `https://${version.slice(0, 8).toLowerCase()}-${new URL(workerOrigin).hostname}`,
+                bindings_verified: true,
+            };
+        }
+        catch (error) {
+            if (!(error instanceof CloudflareError) || error.stage === 'deploy')
+                throw error;
+            const staged = new CloudflareError(error.code, error.exitCode, error.retryable, 'deploy', error.status, error.check, error.providerCode, error.source, error.fields);
+            staged.message = error.message;
+            throw staged;
+        }
+    },
     createScript: async (api, script, form) => {
         const result = object((await api.request(`/workers/scripts/${script}`, 'PUT', form)).result);
         if (result.id !== script)
@@ -259,7 +500,7 @@ function distribution(a) {
 async function endpoints(api, base) {
     const r = object((await api.request(`${base}/subdomain`)).result);
     if (typeof r.enabled !== 'boolean' || typeof r.previews_enabled !== 'boolean')
-        throw new CloudflareError('capability_unknown');
+        throw new CloudflareError('provider_failure');
     return { enabled: r.enabled, previews_enabled: r.previews_enabled };
 }
 function routeInput(raw, script) {
@@ -281,7 +522,7 @@ function routeInput(raw, script) {
 function secretNames(o) {
     const names = [...(o.secret ?? []), ...(o.secrets === undefined ? [] : o.secrets.split('\n'))];
     if (new Set(names).size !== names.length ||
-        names.some((n) => !/^[A-Z][A-Z0-9_]{0,127}$/.test(n) || n === 'PB_TOKEN_PEPPER'))
+        names.some((n) => !/^[A-Z][A-Z0-9_]{0,127}$/.test(n) || ['PB_TOKEN_PEPPER', 'PB_IDP_PROVIDERS'].includes(n)))
         return invalid();
     return names.sort();
 }
@@ -506,23 +747,16 @@ async function readSettings(api, base, j, routes, domain, workerExists = true, m
     for (const zone of new Set([...routes.map((r) => r.zone_id), ...managedZones])) {
         const listed = await zoneRoutes(api, zone);
         for (const r of listed) {
-            if (r.script !== j.identity.script_name && typeof r.pattern === 'string') {
-                const attachedHost = r.pattern.replace(/^https?:\/\//, '').split('/')[0];
-                if (routes.some((x) => {
-                    const wanted = x.pattern.replace(/^https?:\/\//, '').split('/')[0];
-                    return (attachedHost === '*' ||
-                        attachedHost === wanted ||
-                        (attachedHost.startsWith('*.') && wanted.endsWith(attachedHost.slice(1))));
-                }))
-                    return conflict('routes');
-            }
-            if (r.script === j.identity.script_name ||
-                routes.some((x) => x.zone_id === zone && x.pattern === r.pattern)) {
-                if (r.script !== j.identity.script_name ||
-                    !safeId(r.id) ||
+            const reason = routeConflict(zone, r, routes, j.identity.script_name);
+            if (reason)
+                return conflict('routes', `routes:${reason}`, ...(typeof r.id === 'string' && /^[a-f0-9]{32}$/.test(r.id)
+                    ? [`routes:route_id:${r.id}`]
+                    : []));
+            if (r.script === j.identity.script_name) {
+                if (!safeId(r.id) ||
                     typeof r.pattern !== 'string' ||
                     !/^[a-zA-Z0-9*./:-]{1,256}$/.test(r.pattern))
-                    return conflict('routes');
+                    return conflict('routes', 'routes:own_invalid');
                 foundRoutes.push({ id: r.id, zone_id: zone, pattern: r.pattern, script: r.script });
             }
         }
@@ -536,20 +770,8 @@ async function readSettings(api, base, j, routes, domain, workerExists = true, m
         domain: foundDomain,
     };
 }
-async function zoneRoutes(api, zone) {
-    // Zone APIs must never be sent beneath the accounts prefix.
-    const all = [];
-    for (let page = 1; page <= 10000; page++) {
-        const r = await api.requestZone(zone, `/workers/routes?page=${page}&per_page=100`);
-        if (!Array.isArray(r.result))
-            return conflict('routes');
-        all.push(...r.result.map(object));
-        if (r.result_info?.total_pages === page || r.result_info?.total_count === all.length)
-            return all;
-        if (typeof r.result_info?.total_pages !== 'number' || r.result_info.total_pages < page)
-            return conflict('routes');
-    }
-    return conflict('routes');
+export async function zoneRoutes(api, zone) {
+    return api.snapshotZone(zone, '/workers/routes');
 }
 function bindings(j, ports, url) {
     const b = [
@@ -697,7 +919,7 @@ export async function reconcileCandidatePreview(api, store, j) {
 /** Smoke owns this finally block. Persisted intent also covers process interruption. */
 export async function withCandidatePreview(api, store, j, contract, probe) {
     const a = j.deployment?.attempt;
-    if (!a?.version_id || a.requested_rollout === 100 || !contract.preview)
+    if (!a?.version_id || a.requested_rollout === 100)
         return invalid();
     await reconcileCandidatePreview(api, store, j);
     const base = `/workers/scripts/${j.identity.script_name}`;
@@ -1057,12 +1279,15 @@ export async function deploy(o, operations = {}) {
         if (requestedRoutes.some((r) => r.pattern.replace(/^https:\/\//, '').split('/')[0] !== new URL(url).hostname))
             return invalid();
         const artifact = await validateDeploymentArtifact(out);
+        if (o.providers?.kind === 'set')
+            desiredProviders(o.providers, artifact.identity, null);
         const endpointEnv = artifact.ports?.observability.endpointEnv;
         const headersEnv = artifact.ports?.observability.headersEnv;
         const generatedNames = [
             'DB',
             'DEPLOYMENT_ID',
             'PB_PUBLIC_URL',
+            'PB_IDP_PROVIDERS',
             'ASSETS',
             ...(artifact.ports
                 ? [
@@ -1164,6 +1389,12 @@ export async function deploy(o, operations = {}) {
         if (journal.deployment && journal.deployment.attempt.preview !== 'disabled') {
             if (o.dryRun) {
                 output.plan.push({ stage: 'deploy', action: 'reconcile_preview_cleanup' });
+                const known = o.providers?.kind === 'set'
+                    ? o.providers.value
+                    : o.providers?.kind === 'remove'
+                        ? null
+                        : undefined;
+                output.identity = dryRunIdentity(artifact.identity, known ?? null, known === undefined ? null : identityDigest(artifact.identity, known), known === undefined ? ['live_providers'] : []);
                 output.status = 'planned';
                 return succeed();
             }
@@ -1205,22 +1436,22 @@ export async function deploy(o, operations = {}) {
             return conflict('deployment');
         if (!current.versions.length && rollout !== 100)
             return invalid();
+        let prior;
         if (current.versions.length === 1) {
-            const prior = object((await api.request(`${base}/versions/${current.versions[0].version_id}`)).result);
+            prior = object((await api.request(`${base}/versions/${current.versions[0].version_id}`)).result);
             if (prior.id !== current.versions[0].version_id)
                 return conflict('version_id');
             const annotations = object(prior.annotations);
             if (annotations['pb-maintenance-shell'] === 'true')
                 throw new CloudflareError('capability_unknown', 1, false, 'deploy');
         }
+        const workerOrigin = !url || rollout < 100 ? await workersDevOrigin(api, identity.script_name) : null;
         if (!url)
-            url = await workersDevOrigin(api, identity.script_name);
+            url = workerOrigin;
         if (!exists && !contract.versionsCreateScript && !contract.createScript)
             throw new CloudflareError('capability_unknown');
         if (!contract.assetHash)
             throw new CloudflareError('capability_unknown');
-        if (rollout < 100 && !contract.preview)
-            throw new CloudflareError('capability_unknown');
         const custom = !!(o.domain || requestedRoutes.length || o.publicUrl);
         const policy = { enabled: !custom, previews_enabled: false };
         const journalled = journal.deployment;
@@ -1243,7 +1474,68 @@ export async function deploy(o, operations = {}) {
             return invalid();
         if (installedNames.length && !contract.secretInheritance)
             throw new CloudflareError('capability_unknown');
+        const priorAttempt = journal.deployment?.attempt;
+        const resuming = priorAttempt &&
+            [
+                'preparing_upload',
+                'upload_pending',
+                'uploaded',
+                'configuring',
+                'activation_pending',
+            ].includes(priorAttempt.phase);
+        if (resuming) {
+            if (priorAttempt.artifact_sha256 !== artifact.artifactHash)
+                return conflict('artifact_sha256');
+            if (priorAttempt.requested_rollout !== rollout)
+                return conflict('requested_rollout');
+        }
+        else if (current.versions.length > 1 && recordedVerified?.requested_rollout !== rollout)
+            return conflict('deployment');
+        const removeSecret = () => invalid('Remove the secret first: wrangler secret delete PB_IDP_PROVIDERS');
+        if (installedNames.includes('PB_IDP_PROVIDERS'))
+            return removeSecret();
+        const sources = [];
+        for (const version of current.versions) {
+            const result = prior ?? object((await api.request(`${base}/versions/${version.version_id}`)).result);
+            if (result.id !== version.version_id)
+                return conflict('version_id');
+            const resources = object(result.resources ?? {});
+            if (!Array.isArray(resources.bindings))
+                return conflict('providers');
+            if (resources.bindings
+                .map(object)
+                .some((b) => b.name === 'PB_IDP_PROVIDERS' && b.type === 'secret_text'))
+                return removeSecret();
+            sources.push(resources);
+        }
+        const frozen = resuming ? frozenProviders(priorAttempt) : null;
+        let providersText = frozen;
+        if (o.providers?.kind === 'set' || o.providers?.kind === 'remove') {
+            providersText = desiredProviders(o.providers, artifact.identity, null);
+            if (resuming) {
+                if (providersText !== frozen &&
+                    !(o.providers.kind === 'set' &&
+                        frozen !== null &&
+                        validateProvidersDocument(frozen).value === providersText))
+                    return conflict('settings_sha256');
+                providersText = frozen;
+            }
+        }
+        else if (!resuming) {
+            if (sources.some((r) => r.bindings.map(object).some((b) => b.name === 'PB_IDP_PROVIDERS')))
+                checkManaged();
+            const values = sources.map((r) => desiredProviders(o.providers, artifact.identity, r));
+            if (new Set(values).size > 1)
+                return conflict('providers');
+            providersText = values[0] ?? null;
+        }
+        const identityHash = identityDigest(artifact.identity, providersText);
+        const anchors = effectiveAnchors(artifact.identity, providersText);
+        if (o.dryRun)
+            output.identity = dryRunIdentity(artifact.identity, providersText, identityHash);
         const plainBindings = bindings(journal, artifact.ports, url);
+        if (providersText !== null)
+            plainBindings.push({ type: 'plain_text', name: 'PB_IDP_PROVIDERS', text: providersText });
         if (endpointEnv) {
             if (selectedSecrets.includes(endpointEnv) || installedNames.includes(endpointEnv))
                 return invalid();
@@ -1252,6 +1544,21 @@ export async function deploy(o, operations = {}) {
         const collisionNames = new Set(plainBindings.map((b) => b.name));
         if ([...selectedSecrets, ...installedNames].some((n) => collisionNames.has(n)))
             return invalid();
+        const pending = journal.deployment?.attempt;
+        const pendingNames = pending &&
+            ['upload_pending', 'uploaded', 'configuring', 'activation_pending'].includes(pending.phase)
+            ? pending.secret_names
+            : [];
+        const missingSecrets = [
+            ...new Set(parseRuntimeProviders(providersText ?? undefined)
+                .accepted.filter((p) => p.kind === 'oidc')
+                .map((p) => providerSecretName(p.id, 'CLIENT_SECRET'))),
+        ].filter((name) => !installedNames.includes(name) &&
+            !pendingNames.includes(name) &&
+            !(selectedSecrets.includes(name) && o.env[name]));
+        if (missingSecrets.length)
+            return invalid(`Missing provider secrets: ${missingSecrets.join(', ')}; deliver with --secret <ENV_NAME> or --secrets <ENV_NAMES>`);
+        output.checks.push({ name: 'provider_secrets', status: 'verified' });
         const updates = [];
         for (const name of selectedSecrets) {
             if ((name === 'PB_MASTER_KEY' || name === 'PB_MASTER_KEY_PREVIOUS') &&
@@ -1265,25 +1572,26 @@ export async function deploy(o, operations = {}) {
             else if (!installedNames.includes(name))
                 return invalid();
         }
-        const pending = journal.deployment?.attempt;
-        const pendingNames = pending &&
-            ['upload_pending', 'uploaded', 'configuring', 'activation_pending'].includes(pending.phase)
-            ? pending.secret_names
-            : [];
         const allNames = [
             ...new Set([...installedNames, ...pendingNames, ...updates.map((b) => String(b.name))]),
         ].sort();
+        const variableCount = new Set([
+            ...plainBindings.filter((b) => b.type === 'plain_text').map((b) => String(b.name)),
+            ...allNames,
+        ]).size;
+        const variableLimit = o.workersPaid ? 128 : 64;
+        if (variableCount > variableLimit)
+            return invalid(`Worker environment variable count ${variableCount} exceeds limit ${variableLimit}`);
+        output.checks.push({ name: 'variable_budget', status: 'verified' });
         if (!allNames.includes('PB_MASTER_KEY'))
             return invalid();
         if (headersEnv && !allNames.includes(headersEnv))
             return invalid();
         let domain = live.domain;
         if (o.domain && !domain) {
-            if (!contract.domainZone)
-                throw new CloudflareError('capability_unknown');
             const zone = await contract.domainZone(api, o.domain);
             if (!/^[a-f0-9]{32}$/.test(zone))
-                throw new CloudflareError('capability_unknown');
+                throw new CloudflareError('provider_failure', 1, false, 'deploy');
             domain = {
                 id: null,
                 zone_id: zone,
@@ -1319,7 +1627,6 @@ export async function deploy(o, operations = {}) {
             ledgerHash,
         }));
         const priorJournal = journal.deployment;
-        const priorAttempt = priorJournal?.attempt;
         const verified = priorAttempt?.phase === 'verified' && priorAttempt.smoke === 'passed'
             ? priorAttempt
             : (priorJournal?.last_verified ?? null);
@@ -1332,6 +1639,9 @@ export async function deploy(o, operations = {}) {
             livePlain !== undefined &&
             plainBindings.every((b) => livePlain.some((x) => equal(x, b))) &&
             livePlain.length === plainBindings.length;
+        if (anchors.length &&
+            (await anchorPreflight({ ...auth, ...(o.fetch ? { fetch: o.fetch } : {}) }, journal.resources.d1?.id, anchors, o.dryRun === true)) === 'skipped')
+            output.identity?.skipped_checks.push('anchor_preflight');
         if (verified &&
             plainMatch &&
             verified.artifact_sha256 === artifact.artifactHash &&
@@ -1347,37 +1657,36 @@ export async function deploy(o, operations = {}) {
             output.status = o.dryRun ? 'planned' : 'ok';
             return succeed();
         }
-        const resuming = priorAttempt &&
-            [
-                'preparing_upload',
-                'upload_pending',
-                'uploaded',
-                'configuring',
-                'activation_pending',
-            ].includes(priorAttempt.phase);
+        if (rollout < 100 &&
+            !resuming &&
+            (identityHash !== (verified?.identity_sha256 ?? null) ||
+                (identityHash !== null &&
+                    priorAttempt &&
+                    priorAttempt !== verified &&
+                    (!verified || !equal(current.versions, distribution(verified))))))
+            return invalid('partial rollout is not allowed when SSO provider configuration changes; deploy with --rollout 100 first');
         if (resuming &&
             (priorAttempt.phase !== 'preparing_upload' || priorAttempt.script_creation !== undefined) &&
             updates.some((b) => b.name !== 'PB_MASTER_KEY' && b.name !== 'PB_MASTER_KEY_PREVIOUS'))
             return conflict('bindings:secret_text');
         if (resuming) {
-            if (priorAttempt.artifact_sha256 !== artifact.artifactHash)
-                return conflict('artifact_sha256');
             if (priorAttempt.settings_sha256 !== settingsHash)
                 return conflict('settings_sha256');
-            if (priorAttempt.requested_rollout !== rollout)
-                return conflict('requested_rollout');
         }
-        if (!resuming) {
-            if (current.versions.length > 1)
-                return conflict('deployment');
-            let managed = priorAttempt?.intended_settings ?? verified?.intended_settings;
+        if (!resuming && current.versions.length > 1)
+            return conflict('deployment');
+        checkManaged();
+        function checkManaged() {
+            if (resuming)
+                return;
+            let managed = priorAttempt?.intended_settings ?? recordedVerified?.intended_settings;
             if (priorAttempt?.phase === 'failed' || priorAttempt?.phase === 'rolled_back')
                 managed =
                     restoredSnapshot(priorAttempt, priorAttempt.phase === 'failed' && equal(current, beforeCandidate(priorAttempt))
                         ? live
                         : undefined) ?? conflict('managed_settings');
-            if (live.routes.some((r) => !intended.routes.some((x) => x.zone_id === r.zone_id && x.pattern === r.pattern)))
-                return conflict('routes');
+            if (live.routes.some((r) => !requestedRoutes.some((x) => x.zone_id === r.zone_id && x.pattern === r.pattern)))
+                return conflict('routes', 'routes:unmanaged_own');
             // Never take over pre-existing attachments without a previous managed receipt.
             if ((live.consumer || live.schedules.length || live.routes.length || live.domain) &&
                 (!managed || !matchesManaged(live, managed)))
@@ -1407,14 +1716,19 @@ export async function deploy(o, operations = {}) {
             return succeed();
         }
         let a;
-        if (resuming)
+        if (resuming) {
             a = priorAttempt;
+            a.identity_sha256 = identityHash;
+        }
         else {
             a = {
                 operation_id: randomUUID(),
                 artifact_sha256: artifact.artifactHash,
                 assets_sha256: artifact.assetsHash,
                 settings_sha256: settingsHash,
+                providers_sha256: providersText === null ? null : digest(providersText),
+                identity_sha256: identityHash,
+                ...(providersText === null ? {} : { providers_text: providersText }),
                 secret_names: allNames,
                 build_info: artifact.info,
                 version_id: null,
@@ -1557,14 +1871,20 @@ export async function deploy(o, operations = {}) {
         if (!a.version_id)
             return unknown();
         await version(api, base, a.version_id, a, allNames, plainBindings);
+        if (providersText !== null) {
+            recordDeploymentHistory(journal.deployment, {
+                plainBinding: { name: 'PB_IDP_PROVIDERS', text: providersText },
+            });
+            await save(store, journal, now);
+        }
         if (rollout < 100) {
             const preview = await contract.preview(api, identity.script_name, a.version_id);
             if (preview.version_id !== a.version_id || !preview.bindings_verified)
                 return conflict('preview');
             const probeUrl = origin(preview.url);
-            if (!probeUrl.endsWith('.workers.dev') ||
-                probeUrl === url ||
-                !new URL(probeUrl).hostname.startsWith(`${a.version_id}-`))
+            const host = new URL(probeUrl).hostname;
+            const prefix = a.version_id.slice(0, 8).toLowerCase();
+            if (host !== `${prefix}-${new URL(workerOrigin).hostname}`)
                 return conflict('preview');
             a.candidate_probe_url = probeUrl;
             await save(store, journal, now);
@@ -1587,13 +1907,13 @@ export async function deploy(o, operations = {}) {
             if (!equal(part(expected), part(a.prior_settings)) &&
                 !equal(part(expected), part(a.intended_settings)) &&
                 !(kind === 'endpoints' && equal(expected.endpoints, restrictivePolicy(a))))
-                return conflict(kind === 'consumer' ? 'queue_consumer' : kind);
+                return conflict(kind === 'consumer' ? 'queue_consumer' : kind, ...(kind === 'routes' ? ['routes:drift'] : []));
         }
         for (const kind of ['consumer', 'schedules', 'routes', 'domain']) {
             const before = await readSettings(api, base, journal, requestedRoutes, o.domain, true, managedZones);
             const part = (v) => withoutIds(v)[kind];
             if (!equal(part(before), part(expected)) && !equal(part(before), part(a.intended_settings)))
-                return conflict(kind === 'consumer' ? 'queue_consumer' : kind);
+                return conflict(kind === 'consumer' ? 'queue_consumer' : kind, ...(kind === 'routes' ? ['routes:drift'] : []));
             if (!equal(part(before), part(a.intended_settings))) {
                 const change = {
                     kind,
@@ -1615,7 +1935,7 @@ export async function deploy(o, operations = {}) {
             }
             const observed = await readSettings(api, base, journal, requestedRoutes, o.domain, true, managedZones);
             if (!equal(part(observed), part(a.intended_settings)))
-                return conflict(kind === 'consumer' ? 'queue_consumer' : kind);
+                return conflict(kind === 'consumer' ? 'queue_consumer' : kind, ...(kind === 'routes' ? ['routes:drift'] : []));
             expected = { ...expected, [kind]: observed[kind] };
             a.intended_settings = { ...a.intended_settings, [kind]: observed[kind] };
             if (!equal(withoutIds(observed), withoutIds(expected)))
@@ -1722,7 +2042,9 @@ export async function deploy(o, operations = {}) {
             : failure instanceof CloudflareError && failure.stage === 'prebuilt'
                 ? failure
                 : failure instanceof CloudflareError
-                    ? new CloudflareError(failure.code, failure.exitCode, failure.retryable, 'deploy', failure.status, failure.check, failure.providerCode, failure.source, failure.fields)
+                    ? Object.assign(new CloudflareError(failure.code, failure.exitCode, failure.retryable, 'deploy', failure.status, failure.check, failure.providerCode, failure.source, failure.fields), {
+                        message: inputMessages.get(failure) ?? new CloudflareError(failure.code).message,
+                    })
                     : new CloudflareError('provider_failure', 1, false, 'deploy')));
         return result;
     }