@void/deploy-cloudflare 0.20.0 → 0.20.1

package/dist/index.d.mts

@@ -70,7 +70,9 @@ export declare function assertCloudflareDurableObjectLifecycleSupported(options:
   apiBaseUrl: string;
   readMigrationTag?: (options: CloudflareWorkerMigrationTagOptions) => Promise<string | null>;
 }): Promise<void>;
-export declare function assertCloudflareBindingsPreserved(before: ExistingCloudflareWorker, after: ExistingCloudflareWorker, approvedKv?: ReadonlyArray<ApprovedCloudflareKvBinding>): void;
+export declare function assertCloudflareBindingsPreserved(before: ExistingCloudflareWorker, after: ExistingCloudflareWorker, approvedKv?: ReadonlyArray<ApprovedCloudflareKvBinding>, options?: {
+  staticAssetsBinding?: string;
+}): void;
 /** Preserve the existing Worker, allowing only explicitly approved KV additions. */
 export declare function assertExistingCloudflareConfig(existing: ExistingCloudflareWorker, config: Record<string, unknown>, built?: boolean, approvedKv?: ReadonlyArray<ApprovedCloudflareKvBinding>): void;
 //#endregion

package/dist/index.mjs

@@ -81,12 +81,34 @@ function resolveD1MigrateTarget(config, binding) {
 	};
 }
 //#endregion
+//#region src/secret-draft.ts
+/**
+* `wrangler secret put` creates a fetch-only draft before attaching a first secret to a Worker.
+* Accept that draft as first-deployment proof only when its complete deployable shape contains no
+* application code configuration or non-secret resource that an ordinary deploy could own.
+*/
+function isWranglerSecretOnlyDraft(entry) {
+	if (!isRecord$1(entry.annotations)) return false;
+	const annotationKeys = Object.keys(entry.annotations);
+	if (entry.annotations["workers/triggered_by"] !== "secret" || annotationKeys.some((key) => key !== "workers/triggered_by")) return false;
+	if (!isRecord$1(entry.resources)) return false;
+	const { bindings, script, script_runtime: scriptRuntime } = entry.resources;
+	if (!Array.isArray(bindings) || bindings.length === 0 || !bindings.every((binding) => isRecord$1(binding) && typeof binding.name === "string" && binding.name.length > 0 && binding.type === "secret_text" && Object.keys(binding).every((key) => key === "name" || key === "type"))) return false;
+	if (!isRecord$1(script) || !Array.isArray(script.handlers) || script.handlers.length !== 1 || script.handlers[0] !== "fetch" || script.placement_mode !== void 0) return false;
+	if (!isRecord$1(scriptRuntime)) return false;
+	const runtimeKeys = Object.keys(scriptRuntime);
+	return scriptRuntime.usage_model === "standard" && (scriptRuntime.limits === void 0 || isRecord$1(scriptRuntime.limits) && Object.keys(scriptRuntime.limits).length === 0) && runtimeKeys.every((key) => key === "usage_model" || key === "limits");
+}
+function isRecord$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+//#endregion
 //#region src/existing.ts
 /** Read the deployed version, not the most recently uploaded candidate. */
 async function readExistingCloudflareWorker(options) {
 	const worker = await readCloudflareWorker(options, false);
 	if (!worker) throw new Error(`Cloudflare Worker "${options.workerName}" does not have an active version.`);
-	return worker;
+	return worker.snapshot;
 }
 async function readCloudflareWorker(options, allowMissing) {
 	const target = [
@@ -132,10 +154,13 @@ async function readCloudflareWorker(options, allowMissing) {
 	const after = options.versionId ? deployment : await read(["deployments", "status"]);
 	if (after === null || !isDeepStrictEqual(deployment.versions, after.versions)) throw new Error("Cloudflare production changed while linking. Retry from the current deployment.");
 	return {
-		versionId,
-		bindings: resources.bindings,
-		runtime: resources.script_runtime,
-		script: resources.script
+		snapshot: {
+			versionId,
+			bindings: resources.bindings,
+			runtime: resources.script_runtime,
+			script: resources.script
+		},
+		isSecretOnlyDraft: isWranglerSecretOnlyDraft(version)
 	};
 }
 /** Parse legacy version-detail shapes; this is not authoritative Worker migration state. */
@@ -219,7 +244,8 @@ async function assertCloudflareDurableObjectLifecycleSupported(options) {
 	const activeTag = await readMigrationTag(migrationOptions);
 	const after = await readCloudflareWorker(options, false);
 	const afterTag = await readMigrationTag(migrationOptions);
-	if (!after || after.versionId !== existing.versionId || afterTag !== activeTag) throw new Error("Cloudflare production or Durable Object migration state changed during verification. Retry from the current deployment.");
+	if (!after || after.snapshot.versionId !== existing.snapshot.versionId || afterTag !== activeTag) throw new Error("Cloudflare production or Durable Object migration state changed during verification. Retry from the current deployment.");
+	if (activeTag === null && existing.isSecretOnlyDraft && after.isSecretOnlyDraft) return;
 	const activeIndex = activeTag === null ? -1 : migrations.findIndex((migration) => migration.tag === activeTag);
 	const pending = migrations.slice(activeIndex + 1).filter((migration) => migration.changesClasses);
 	if (pending.length === 0) return;
@@ -251,7 +277,9 @@ function parseDurableObjectMigrations(value) {
 function isMissingWorkerOutput$1(output) {
 	return /\[code:\s*10007\]/i.test(output) || /no deployments|\bworker\b.*\b(?:does not exist|not found)\b/i.test(output);
 }
-function assertCloudflareBindingsPreserved(before, after, approvedKv = []) {
+function assertCloudflareBindingsPreserved(before, after, approvedKv = [], options = {}) {
+	const staticAssetsBinding = isAssetsOnlyWorker(before) ? options.staticAssetsBinding : void 0;
+	const addsAssetsBinding = staticAssetsBinding !== void 0 && !before.bindings.some((binding) => binding.name === staticAssetsBinding);
 	const additions = newApprovedKvBindings(before, approvedKv);
 	for (const addition of additions) {
 		const matches = after.bindings.filter((binding) => binding.name === addition.binding);
@@ -259,12 +287,24 @@ function assertCloudflareBindingsPreserved(before, after, approvedKv = []) {
 	}
 	const preservedBindings = after.bindings.filter((binding) => !additions.some((addition) => addition.binding === binding.name));
 	const sorted = (bindings) => [...bindings].sort((a, b) => String(a.name).localeCompare(String(b.name)));
-	if (!isDeepStrictEqual(sorted(before.bindings), sorted(preservedBindings))) throw new Error("The uploaded version did not preserve the existing Worker bindings and variables. It has not been activated.");
+	const expectedBindings = addsAssetsBinding ? [...before.bindings, {
+		type: "assets",
+		name: staticAssetsBinding
+	}] : before.bindings;
+	if (staticAssetsBinding !== void 0 && !after.bindings.some((binding) => binding.type === "assets" && binding.name === staticAssetsBinding) || !isDeepStrictEqual(sorted(expectedBindings), sorted(preservedBindings))) throw new Error("The uploaded version did not preserve the existing Worker bindings and variables. It has not been activated.");
 	const handlers = (worker) => {
-		const value = worker.script.handlers;
+		const value = existingWorkerHandlers(worker);
 		return Array.isArray(value) && value.every((handler) => typeof handler === "string") ? [...new Set(value)].sort() : null;
 	};
-	if (!isDeepStrictEqual(handlers(before), handlers(after))) throw new Error("The uploaded version did not preserve the existing Worker event handlers. It has not been activated.");
+	const expectedHandlers = staticAssetsBinding !== void 0 ? ["fetch"] : handlers(before);
+	if (!isDeepStrictEqual(expectedHandlers, handlers(after))) throw new Error("The uploaded version did not preserve the existing Worker event handlers. It has not been activated.");
+}
+function isAssetsOnlyWorker(worker) {
+	const handlers = worker.script.handlers;
+	return record(worker.runtime.assets) && (handlers === null || Array.isArray(handlers) && handlers.length === 0);
+}
+function existingWorkerHandlers(worker) {
+	return isAssetsOnlyWorker(worker) ? [] : worker.script.handlers;
 }
 /** Preserve the existing Worker, allowing only explicitly approved KV additions. */
 function assertExistingCloudflareConfig(existing, config, built = false, approvedKv = []) {
@@ -280,7 +320,7 @@ function assertExistingCloudflareConfig(existing, config, built = false, approve
 			kv_namespaces: entries.filter((entry) => !record(entry) || !additions.some((addition) => addition.binding === entry.binding))
 		};
 	}
-	const handlers = existing.script.handlers;
+	const handlers = existingWorkerHandlers(existing);
 	if (!Array.isArray(handlers) || handlers.some((handler) => handler !== "fetch" && handler !== "scheduled")) throw new Error("Linking an existing Worker currently supports fetch and scheduled handlers only. Queue and Durable Object handlers need a separate migration.");
 	for (const field of [
 		"durable_objects",
@@ -1178,9 +1218,9 @@ async function activateCloudflareVersionWithSecretsFile(options) {
 		"--experimental-auto-create=false"
 	], { capture: true }));
 	if (!isCleanCommandExit(upload)) {
-		const output = `${upload.stdout}\n${upload.stderr}`;
+		const output = stripVTControlCharacters(`${upload.stdout}\n${upload.stderr}`);
 		const cloudflareErrorCode = parseCloudflareErrorCode(output);
-		const isBootstrapError = cloudflareErrorCode === DURABLE_MIGRATION_VERSION_ERROR || /cannot upload a new version of a worker that does not yet exist/i.test(output);
+		const isBootstrapError = cloudflareErrorCode === DURABLE_MIGRATION_VERSION_ERROR || /This\s+Worker\s+has\s+a\s+pending\s+Durable\s+Object\s+migration,\s+which\s+cannot\s+be\s+applied\s+by\s+`wrangler\s+versions\s+upload`/i.test(output) || /cannot upload a new version of a worker that does not yet exist/i.test(output);
 		if (!options.preserveTriggers && isBootstrapError && (previous.versionId === null || options.allowFirstDeploymentBootstrap === true || await previousIsSecretOnlyDraft())) return bootstrapFirstDeployment({
 			...options,
 			message
@@ -1514,10 +1554,27 @@ async function readCloudflareVersionInspection(options, commonArgs, versionId) {
 		if (!Array.isArray(versions)) return null;
 		for (const entry of versions) {
 			if (!isRecord(entry) || entry.id !== versionId) continue;
-			const message = (isRecord(entry.annotations) ? entry.annotations : void 0)?.["workers/message"];
+			const annotations = isRecord(entry.annotations) ? entry.annotations : void 0;
+			const message = annotations?.["workers/message"];
+			let draft = entry;
+			if (annotations?.["workers/triggered_by"] === "secret" && Object.keys(annotations).length === 1 && !isRecord(entry.resources)) {
+				const inspection = await Promise.resolve(options.runWrangler([
+					"versions",
+					"view",
+					versionId,
+					...commonArgs,
+					"--name",
+					options.workerName,
+					"--json"
+				], { capture: true }));
+				if (isCleanCommandExit(inspection)) {
+					const inspected = JSON.parse(inspection.stdout);
+					if (isRecord(inspected) && inspected.id === versionId) draft = inspected;
+				}
+			}
 			return {
 				metadata: typeof message === "string" ? parseCloudflareVersionMessage(message) : null,
-				isSecretOnlyDraft: isWranglerSecretOnlyDraft(entry)
+				isSecretOnlyDraft: isWranglerSecretOnlyDraft(draft)
 			};
 		}
 	} catch {
@@ -1593,23 +1650,6 @@ async function readCloudflareVersionSecretBindings(options, commonArgs, versionI
 	}
 }
 /**
-* `wrangler secret put` creates a fetch-only draft before attaching a first secret to a Worker.
-* Accept that draft as first-deployment proof only when its complete deployable shape contains no
-* application code configuration or non-secret resource that an ordinary deploy could own.
-*/
-function isWranglerSecretOnlyDraft(entry) {
-	if (!isRecord(entry.annotations)) return false;
-	const annotationKeys = Object.keys(entry.annotations);
-	if (entry.annotations["workers/triggered_by"] !== "secret" || annotationKeys.some((key) => key !== "workers/triggered_by")) return false;
-	if (!isRecord(entry.resources)) return false;
-	const { bindings, script, script_runtime: scriptRuntime } = entry.resources;
-	if (!Array.isArray(bindings) || bindings.length === 0 || !bindings.every((binding) => isRecord(binding) && typeof binding.name === "string" && binding.name.length > 0 && binding.type === "secret_text" && Object.keys(binding).every((key) => key === "name" || key === "type"))) return false;
-	if (!isRecord(script) || !Array.isArray(script.handlers) || script.handlers.length !== 1 || script.handlers[0] !== "fetch" || script.placement_mode !== void 0) return false;
-	if (!isRecord(scriptRuntime)) return false;
-	const runtimeKeys = Object.keys(scriptRuntime);
-	return scriptRuntime.usage_model === "standard" && isRecord(scriptRuntime.limits) && Object.keys(scriptRuntime.limits).length === 0 && runtimeKeys.every((key) => key === "usage_model" || key === "limits");
-}
-/**
 * The Versions API cannot create a Worker or its initial Durable Object migration history, and
 * some accounts do not expose a version preview until their first ordinary deployment. A
 * brand-new Worker can therefore need one ordinary deploy before later releases use preview-first

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@void/deploy-cloudflare",
-  "version": "0.20.0",
+  "version": "0.20.1",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/voidzero-dev/void.git",
@@ -20,7 +20,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@void/deploy-core": "0.20.0",
+    "@void/deploy-core": "0.20.1",
     "jsonc-parser": "3.3.1"
   },
   "devDependencies": {