@void/deploy-cloudflare 0.20.0 → 0.20.2

package/dist/index.d.mts

@@ -70,7 +70,9 @@ export declare function assertCloudflareDurableObjectLifecycleSupported(options:
   apiBaseUrl: string;
   readMigrationTag?: (options: CloudflareWorkerMigrationTagOptions) => Promise<string | null>;
 }): Promise<void>;
-export declare function assertCloudflareBindingsPreserved(before: ExistingCloudflareWorker, after: ExistingCloudflareWorker, approvedKv?: ReadonlyArray<ApprovedCloudflareKvBinding>): void;
+export declare function assertCloudflareBindingsPreserved(before: ExistingCloudflareWorker, after: ExistingCloudflareWorker, approvedKv?: ReadonlyArray<ApprovedCloudflareKvBinding>, options?: {
+  staticAssetsBinding?: string;
+}): void;
 /** Preserve the existing Worker, allowing only explicitly approved KV additions. */
 export declare function assertExistingCloudflareConfig(existing: ExistingCloudflareWorker, config: Record<string, unknown>, built?: boolean, approvedKv?: ReadonlyArray<ApprovedCloudflareKvBinding>): void;
 //#endregion
@@ -319,4 +321,23 @@ export declare function normalizeWorkersDevSubdomain(value: string | undefined):
 /** Extract the account subdomain from a Wrangler-reported workers.dev URL. */
 export declare function extractWorkersDevSubdomain(url: string): string | undefined;
 //#endregion
+//#region src/metadata.d.ts
+/**
+ * Share one authenticated transport for the activator's read-only metadata calls.
+ * Writes and unsupported commands retain the pinned Wrangler runner. Responses
+ * keep its JSON contract so activation and concurrency checks remain unchanged.
+ */
+export declare function createCloudflareMetadataRunner(options: {
+  runWrangler: CloudflareCommandRunner;
+  accountId: string;
+  apiBaseUrl: string;
+  workerName: string;
+  configPath?: string;
+  getToken: () => Promise<string | null>;
+  verifyUploader: () => boolean;
+  fetch?: typeof globalThis.fetch;
+  /** Environment used to decide whether Wrangler's proxy-aware transport is required. */
+  env?: Readonly<Record<string, string | undefined>>;
+}): CloudflareCommandRunner;
+//#endregion
 export type { ApprovedCloudflareKvBinding, CloudflareCommandResult, CloudflareCommandRunner, CloudflareDeployExecution, CloudflareFrameworkDeployConfig, CloudflareStaticDeployConfig, CloudflareTrafficConfig, CloudflareTriggerConfig, CloudflareTriggerStabilization, CloudflareVersionActivation, CloudflareVersionActivationOptions, CloudflareVersionMetadata, CloudflareWorkerMigrationTagOptions, ExistingCloudflareWorker };

package/dist/index.mjs

@@ -81,12 +81,34 @@ function resolveD1MigrateTarget(config, binding) {
 	};
 }
 //#endregion
+//#region src/secret-draft.ts
+/**
+* `wrangler secret put` creates a fetch-only draft before attaching a first secret to a Worker.
+* Accept that draft as first-deployment proof only when its complete deployable shape contains no
+* application code configuration or non-secret resource that an ordinary deploy could own.
+*/
+function isWranglerSecretOnlyDraft(entry) {
+	if (!isRecord$1(entry.annotations)) return false;
+	const annotationKeys = Object.keys(entry.annotations);
+	if (entry.annotations["workers/triggered_by"] !== "secret" || annotationKeys.some((key) => key !== "workers/triggered_by")) return false;
+	if (!isRecord$1(entry.resources)) return false;
+	const { bindings, script, script_runtime: scriptRuntime } = entry.resources;
+	if (!Array.isArray(bindings) || bindings.length === 0 || !bindings.every((binding) => isRecord$1(binding) && typeof binding.name === "string" && binding.name.length > 0 && binding.type === "secret_text" && Object.keys(binding).every((key) => key === "name" || key === "type"))) return false;
+	if (!isRecord$1(script) || !Array.isArray(script.handlers) || script.handlers.length !== 1 || script.handlers[0] !== "fetch" || script.placement_mode !== void 0) return false;
+	if (!isRecord$1(scriptRuntime)) return false;
+	const runtimeKeys = Object.keys(scriptRuntime);
+	return scriptRuntime.usage_model === "standard" && (scriptRuntime.limits === void 0 || isRecord$1(scriptRuntime.limits) && Object.keys(scriptRuntime.limits).length === 0) && runtimeKeys.every((key) => key === "usage_model" || key === "limits");
+}
+function isRecord$1(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+//#endregion
 //#region src/existing.ts
 /** Read the deployed version, not the most recently uploaded candidate. */
 async function readExistingCloudflareWorker(options) {
 	const worker = await readCloudflareWorker(options, false);
 	if (!worker) throw new Error(`Cloudflare Worker "${options.workerName}" does not have an active version.`);
-	return worker;
+	return worker.snapshot;
 }
 async function readCloudflareWorker(options, allowMissing) {
 	const target = [
@@ -108,7 +130,7 @@ async function readCloudflareWorker(options, allowMissing) {
 		}
 		try {
 			const value = JSON.parse(result.stdout);
-			if (record(value)) return value;
+			if (record$1(value)) return value;
 		} catch {}
 		throw new Error("Cloudflare returned an invalid existing Worker response.");
 	};
@@ -119,7 +141,7 @@ async function readCloudflareWorker(options, allowMissing) {
 	if (deployment === null) return null;
 	const versions = deployment.versions;
 	if (allowMissing && Array.isArray(versions) && versions.length === 0) return null;
-	if (!Array.isArray(versions) || versions.length !== 1 || !record(versions[0]) || versions[0].percentage !== 100 || typeof versions[0].version_id !== "string") throw new Error("The existing Worker must have one deployed version receiving all traffic. Finish any gradual rollout before linking.");
+	if (!Array.isArray(versions) || versions.length !== 1 || !record$1(versions[0]) || versions[0].percentage !== 100 || typeof versions[0].version_id !== "string") throw new Error("The existing Worker must have one deployed version receiving all traffic. Finish any gradual rollout before linking.");
 	const versionId = versions[0].version_id;
 	const version = await read([
 		"versions",
@@ -128,24 +150,27 @@ async function readCloudflareWorker(options, allowMissing) {
 	]);
 	if (version === null) throw new Error("Cloudflare did not return the existing Worker configuration.");
 	const resources = version.resources;
-	if (version.id !== versionId || !record(resources) || !Array.isArray(resources.bindings) || !resources.bindings.every(record) || !record(resources.script_runtime) || !record(resources.script)) throw new Error("Cloudflare did not return the existing Worker configuration.");
+	if (version.id !== versionId || !record$1(resources) || !Array.isArray(resources.bindings) || !resources.bindings.every(record$1) || !record$1(resources.script_runtime) || !record$1(resources.script)) throw new Error("Cloudflare did not return the existing Worker configuration.");
 	const after = options.versionId ? deployment : await read(["deployments", "status"]);
 	if (after === null || !isDeepStrictEqual(deployment.versions, after.versions)) throw new Error("Cloudflare production changed while linking. Retry from the current deployment.");
 	return {
-		versionId,
-		bindings: resources.bindings,
-		runtime: resources.script_runtime,
-		script: resources.script
+		snapshot: {
+			versionId,
+			bindings: resources.bindings,
+			runtime: resources.script_runtime,
+			script: resources.script
+		},
+		isSecretOnlyDraft: isWranglerSecretOnlyDraft(version)
 	};
 }
 /** Parse legacy version-detail shapes; this is not authoritative Worker migration state. */
 function readCloudflareVersionMigrationTag(version) {
-	if (!record(version)) return null;
-	const resources = record(version.resources) ? version.resources : void 0;
+	if (!record$1(version)) return null;
+	const resources = record$1(version.resources) ? version.resources : void 0;
 	const tag = [
-		resources && record(resources.script_runtime) ? resources.script_runtime.migration_tag : null,
-		resources && record(resources.script) ? resources.script.migration_tag : null,
-		record(version.script) ? version.script.migration_tag : null,
+		resources && record$1(resources.script_runtime) ? resources.script_runtime.migration_tag : null,
+		resources && record$1(resources.script) ? resources.script.migration_tag : null,
+		record$1(version.script) ? version.script.migration_tag : null,
 		version.migration_tag
 	].find((candidate) => typeof candidate === "string");
 	return typeof tag === "string" && tag.length > 0 ? tag : null;
@@ -170,9 +195,9 @@ async function readCloudflareWorkerMigrationTag(options) {
 	} catch {
 		throw new Error(`Cloudflare returned an invalid Durable Object migration response for Worker "${options.workerName}".`);
 	}
-	if (!response.ok || !record(body) || body.success !== true || !Array.isArray(body.result)) throw new Error(`Could not verify Durable Object migration state for Cloudflare Worker "${options.workerName}".`);
-	const worker = body.result.find((candidate) => record(candidate) && candidate.id === options.workerName);
-	if (!record(worker)) throw new Error(`Cloudflare did not return migration state for Worker "${options.workerName}".`);
+	if (!response.ok || !record$1(body) || body.success !== true || !Array.isArray(body.result)) throw new Error(`Could not verify Durable Object migration state for Cloudflare Worker "${options.workerName}".`);
+	const worker = body.result.find((candidate) => record$1(candidate) && candidate.id === options.workerName);
+	if (!record$1(worker)) throw new Error(`Cloudflare did not return migration state for Worker "${options.workerName}".`);
 	if (worker.migration_tag === void 0 || worker.migration_tag === null) return null;
 	if (typeof worker.migration_tag !== "string" || worker.migration_tag.length === 0) throw new Error(`Cloudflare returned an invalid Durable Object migration response for Worker "${options.workerName}".`);
 	return worker.migration_tag;
@@ -190,7 +215,7 @@ async function readCloudflareApiAuthentication(runWrangler) {
 	} catch {
 		throw new Error("Cloudflare returned an invalid authentication response.");
 	}
-	if (!record(value)) throw new Error("Cloudflare returned an invalid authentication response.");
+	if (!record$1(value)) throw new Error("Cloudflare returned an invalid authentication response.");
 	if ((value.type === "oauth" || value.type === "api_token") && typeof value.token === "string" && value.token.length > 0) return { Authorization: `Bearer ${value.token}` };
 	if (value.type === "api_key" && typeof value.key === "string" && value.key.length > 0 && typeof value.email === "string" && value.email.length > 0) return {
 		"X-Auth-Key": value.key,
@@ -219,7 +244,8 @@ async function assertCloudflareDurableObjectLifecycleSupported(options) {
 	const activeTag = await readMigrationTag(migrationOptions);
 	const after = await readCloudflareWorker(options, false);
 	const afterTag = await readMigrationTag(migrationOptions);
-	if (!after || after.versionId !== existing.versionId || afterTag !== activeTag) throw new Error("Cloudflare production or Durable Object migration state changed during verification. Retry from the current deployment.");
+	if (!after || after.snapshot.versionId !== existing.snapshot.versionId || afterTag !== activeTag) throw new Error("Cloudflare production or Durable Object migration state changed during verification. Retry from the current deployment.");
+	if (activeTag === null && existing.isSecretOnlyDraft && after.isSecretOnlyDraft) return;
 	const activeIndex = activeTag === null ? -1 : migrations.findIndex((migration) => migration.tag === activeTag);
 	const pending = migrations.slice(activeIndex + 1).filter((migration) => migration.changesClasses);
 	if (pending.length === 0) return;
@@ -234,7 +260,7 @@ function parseDurableObjectMigrations(value) {
 	if (value === void 0) return [];
 	if (!Array.isArray(value)) throw new Error("deploy: generated Cloudflare config has a malformed migrations field.");
 	return value.map((migration) => {
-		if (!record(migration) || typeof migration.tag !== "string") throw new Error("deploy: generated Cloudflare config has a malformed class migration.");
+		if (!record$1(migration) || typeof migration.tag !== "string") throw new Error("deploy: generated Cloudflare config has a malformed class migration.");
 		const fields = [
 			migration.new_classes,
 			migration.new_sqlite_classes,
@@ -251,7 +277,9 @@ function parseDurableObjectMigrations(value) {
 function isMissingWorkerOutput$1(output) {
 	return /\[code:\s*10007\]/i.test(output) || /no deployments|\bworker\b.*\b(?:does not exist|not found)\b/i.test(output);
 }
-function assertCloudflareBindingsPreserved(before, after, approvedKv = []) {
+function assertCloudflareBindingsPreserved(before, after, approvedKv = [], options = {}) {
+	const staticAssetsBinding = isAssetsOnlyWorker(before) ? options.staticAssetsBinding : void 0;
+	const addsAssetsBinding = staticAssetsBinding !== void 0 && !before.bindings.some((binding) => binding.name === staticAssetsBinding);
 	const additions = newApprovedKvBindings(before, approvedKv);
 	for (const addition of additions) {
 		const matches = after.bindings.filter((binding) => binding.name === addition.binding);
@@ -259,12 +287,24 @@ function assertCloudflareBindingsPreserved(before, after, approvedKv = []) {
 	}
 	const preservedBindings = after.bindings.filter((binding) => !additions.some((addition) => addition.binding === binding.name));
 	const sorted = (bindings) => [...bindings].sort((a, b) => String(a.name).localeCompare(String(b.name)));
-	if (!isDeepStrictEqual(sorted(before.bindings), sorted(preservedBindings))) throw new Error("The uploaded version did not preserve the existing Worker bindings and variables. It has not been activated.");
+	const expectedBindings = addsAssetsBinding ? [...before.bindings, {
+		type: "assets",
+		name: staticAssetsBinding
+	}] : before.bindings;
+	if (staticAssetsBinding !== void 0 && !after.bindings.some((binding) => binding.type === "assets" && binding.name === staticAssetsBinding) || !isDeepStrictEqual(sorted(expectedBindings), sorted(preservedBindings))) throw new Error("The uploaded version did not preserve the existing Worker bindings and variables. It has not been activated.");
 	const handlers = (worker) => {
-		const value = worker.script.handlers;
+		const value = existingWorkerHandlers(worker);
 		return Array.isArray(value) && value.every((handler) => typeof handler === "string") ? [...new Set(value)].sort() : null;
 	};
-	if (!isDeepStrictEqual(handlers(before), handlers(after))) throw new Error("The uploaded version did not preserve the existing Worker event handlers. It has not been activated.");
+	const expectedHandlers = staticAssetsBinding !== void 0 ? ["fetch"] : handlers(before);
+	if (!isDeepStrictEqual(expectedHandlers, handlers(after))) throw new Error("The uploaded version did not preserve the existing Worker event handlers. It has not been activated.");
+}
+function isAssetsOnlyWorker(worker) {
+	const handlers = worker.script.handlers;
+	return record$1(worker.runtime.assets) && (handlers === null || Array.isArray(handlers) && handlers.length === 0);
+}
+function existingWorkerHandlers(worker) {
+	return isAssetsOnlyWorker(worker) ? [] : worker.script.handlers;
 }
 /** Preserve the existing Worker, allowing only explicitly approved KV additions. */
 function assertExistingCloudflareConfig(existing, config, built = false, approvedKv = []) {
@@ -272,15 +312,15 @@ function assertExistingCloudflareConfig(existing, config, built = false, approve
 	if (additions.length > 0) {
 		const entries = config.kv_namespaces;
 		for (const addition of additions) {
-			const matches = Array.isArray(entries) ? entries.filter((entry) => record(entry) && entry.binding === addition.binding) : [];
+			const matches = Array.isArray(entries) ? entries.filter((entry) => record$1(entry) && entry.binding === addition.binding) : [];
 			if ((built || matches.length > 0) && (matches.length !== 1 || matches[0].id !== addition.id)) throw new Error(`Binding ${addition.binding} must reference its approved KV namespace when linking.`);
 		}
 		if (Array.isArray(entries)) config = {
 			...config,
-			kv_namespaces: entries.filter((entry) => !record(entry) || !additions.some((addition) => addition.binding === entry.binding))
+			kv_namespaces: entries.filter((entry) => !record$1(entry) || !additions.some((addition) => addition.binding === entry.binding))
 		};
 	}
-	const handlers = existing.script.handlers;
+	const handlers = existingWorkerHandlers(existing);
 	if (!Array.isArray(handlers) || handlers.some((handler) => handler !== "fetch" && handler !== "scheduled")) throw new Error("Linking an existing Worker currently supports fetch and scheduled handlers only. Queue and Durable Object handlers need a separate migration.");
 	for (const field of [
 		"durable_objects",
@@ -294,7 +334,7 @@ function assertExistingCloudflareConfig(existing, config, built = false, approve
 		const value = config[field];
 		if (hasContent(value)) throw new Error(`The existing Worker handoff cannot change ${field}. Keep this deployment limited to the existing site.`);
 	}
-	if (record(existing.runtime.exports) && Object.values(existing.runtime.exports).some((value) => record(value) && value.type !== "worker")) throw new Error("The existing Worker exports stateful classes. Migrate those classes separately before linking.");
+	if (record$1(existing.runtime.exports) && Object.values(existing.runtime.exports).some((value) => record$1(value) && value.type !== "worker")) throw new Error("The existing Worker exports stateful classes. Migrate those classes separately before linking.");
 	for (const field of [
 		"compatibility_date",
 		"compatibility_flags",
@@ -305,7 +345,7 @@ function assertExistingCloudflareConfig(existing, config, built = false, approve
 		const equal = field === "compatibility_flags" ? stringSetEqual(actual, expected) : isDeepStrictEqual(actual, expected);
 		if ((built || config[field] !== void 0) && !equal) throw new Error(`Keep the existing Worker's ${field} when linking. Update it in a later deployment.`);
 	}
-	const vars = record(config.vars) ? config.vars : {};
+	const vars = record$1(config.vars) ? config.vars : {};
 	const remote = new Map(existing.bindings.map((binding) => [binding.name, binding]));
 	for (const [name, value] of Object.entries(vars)) {
 		const binding = remote.get(name);
@@ -349,21 +389,21 @@ function assertExistingCloudflareConfig(existing, config, built = false, approve
 			"secret_key"
 		].includes(String(binding.type))) continue;
 		if (binding.type === "assets") {
-			if (built && (!record(config.assets) || config.assets.binding !== binding.name)) throw new Error(`Keep the existing assets binding ${binding.name} when linking.`);
+			if (built && (!record$1(config.assets) || config.assets.binding !== binding.name)) throw new Error(`Keep the existing assets binding ${binding.name} when linking.`);
 			continue;
 		}
 		const mapping = supported[String(binding.type)];
 		if (!mapping) throw new Error(`The existing binding ${binding.name} (${String(binding.type)}) is not yet supported when linking.`);
 		const [field, localId, remoteId] = mapping;
 		const entries = config[field];
-		const matches = Array.isArray(entries) ? entries.filter((entry) => record(entry) && entry.binding === binding.name) : [];
+		const matches = Array.isArray(entries) ? entries.filter((entry) => record$1(entry) && entry.binding === binding.name) : [];
 		const entry = matches[0];
-		if (matches.length !== 1 || !record(entry) || typeof binding[remoteId] !== "string" || entry[localId] !== binding[remoteId] || binding.type === "service" && ((entry.environment ?? "production") !== (binding.environment ?? "production") || entry.entrypoint !== binding.entrypoint) || binding.type === "r2_bucket" && (entry.jurisdiction ?? "default") !== (binding.jurisdiction ?? "default")) throw new Error(`Binding ${binding.name} must reference the existing Cloudflare resource when linking.`);
+		if (matches.length !== 1 || !record$1(entry) || typeof binding[remoteId] !== "string" || entry[localId] !== binding[remoteId] || binding.type === "service" && ((entry.environment ?? "production") !== (binding.environment ?? "production") || entry.entrypoint !== binding.entrypoint) || binding.type === "r2_bucket" && (entry.jurisdiction ?? "default") !== (binding.jurisdiction ?? "default")) throw new Error(`Binding ${binding.name} must reference the existing Cloudflare resource when linking.`);
 		found.add(binding.name);
 	}
 	for (const [field] of Object.values(supported)) {
 		const entries = config[field];
-		if (Array.isArray(entries) && entries.some((entry) => !record(entry) || !found.has(String(entry.binding)))) throw new Error(`Linking cannot add or replace ${field}. Use the existing resource bindings.`);
+		if (Array.isArray(entries) && entries.some((entry) => !record$1(entry) || !found.has(String(entry.binding)))) throw new Error(`Linking cannot add or replace ${field}. Use the existing resource bindings.`);
 	}
 }
 function newApprovedKvBindings(existing, approved) {
@@ -386,13 +426,13 @@ function stringSetEqual(left, right) {
 	if (!Array.isArray(left) || !left.every((value) => typeof value === "string") || !Array.isArray(right) || !right.every((value) => typeof value === "string")) return false;
 	return isDeepStrictEqual([...new Set(left)].sort(), [...new Set(right)].sort());
 }
-function record(value) {
+function record$1(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function hasContent(value) {
 	if (value === void 0 || value === null) return false;
 	if (Array.isArray(value)) return value.length > 0;
-	if (record(value)) return Object.values(value).some(hasContent);
+	if (record$1(value)) return Object.values(value).some(hasContent);
 	return true;
 }
 //#endregion
@@ -1126,10 +1166,10 @@ async function activateCloudflareVersionWithSecretsFile(options) {
 	}
 	const desiredMetadata = parseCloudflareVersionMessage(options.message);
 	let desiredTriggerConfig = desiredMetadata?.schema === 2 ? desiredMetadata.triggerConfig : options.configPath ? readCloudflareTriggerConfig(options.configPath) : triggerConfigFromWrangler({});
-	let previousVersion = previousVersionId && desiredMetadata?.schema === 2 ? await readCloudflareVersionInspection(options, commonArgs, previousVersionId) : null;
+	let previousVersion = previousVersionId && desiredMetadata?.schema === 2 ? await readCloudflareVersionInspection(options, commonArgs, previousVersionId, inheritanceBaseline?.map((version) => version.inspection)) : null;
 	async function previousIsSecretOnlyDraft() {
 		if (!previousVersionId) return false;
-		previousVersion ??= await readCloudflareVersionInspection(options, commonArgs, previousVersionId);
+		previousVersion ??= await readCloudflareVersionInspection(options, commonArgs, previousVersionId, inheritanceBaseline?.map((version) => version.inspection));
 		return previousVersion?.isSecretOnlyDraft === true;
 	}
 	const previousMetadata = desiredMetadata?.schema === 2 ? previousVersion?.metadata : null;
@@ -1178,9 +1218,9 @@ async function activateCloudflareVersionWithSecretsFile(options) {
 		"--experimental-auto-create=false"
 	], { capture: true }));
 	if (!isCleanCommandExit(upload)) {
-		const output = `${upload.stdout}\n${upload.stderr}`;
+		const output = stripVTControlCharacters(`${upload.stdout}\n${upload.stderr}`);
 		const cloudflareErrorCode = parseCloudflareErrorCode(output);
-		const isBootstrapError = cloudflareErrorCode === DURABLE_MIGRATION_VERSION_ERROR || /cannot upload a new version of a worker that does not yet exist/i.test(output);
+		const isBootstrapError = cloudflareErrorCode === DURABLE_MIGRATION_VERSION_ERROR || /This\s+Worker\s+has\s+a\s+pending\s+Durable\s+Object\s+migration,\s+which\s+cannot\s+be\s+applied\s+by\s+`wrangler\s+versions\s+upload`/i.test(output) || /cannot upload a new version of a worker that does not yet exist/i.test(output);
 		if (!options.preserveTriggers && isBootstrapError && (previous.versionId === null || options.allowFirstDeploymentBootstrap === true || await previousIsSecretOnlyDraft())) return bootstrapFirstDeployment({
 			...options,
 			message
@@ -1499,25 +1539,45 @@ async function restorePreviousVersionAndTriggers(options, commonArgs, previousVe
 async function readCloudflareVersionMetadata(options, commonArgs, versionId) {
 	return (await readCloudflareVersionInspection(options, commonArgs, versionId))?.metadata ?? null;
 }
-async function readCloudflareVersionInspection(options, commonArgs, versionId) {
-	const result = await Promise.resolve(options.runWrangler([
-		"versions",
-		"list",
-		...commonArgs,
-		"--name",
-		options.workerName,
-		"--json"
-	], { capture: true }));
-	if (!isCleanCommandExit(result)) return null;
+async function readCloudflareVersionInspection(options, commonArgs, versionId, knownVersions) {
 	try {
-		const versions = JSON.parse(result.stdout);
+		let versions = knownVersions;
+		if (versions === void 0) {
+			const result = await options.runWrangler([
+				"versions",
+				"list",
+				...commonArgs,
+				"--name",
+				options.workerName,
+				"--json"
+			], { capture: true });
+			if (!isCleanCommandExit(result)) return null;
+			versions = JSON.parse(result.stdout);
+		}
 		if (!Array.isArray(versions)) return null;
 		for (const entry of versions) {
 			if (!isRecord(entry) || entry.id !== versionId) continue;
-			const message = (isRecord(entry.annotations) ? entry.annotations : void 0)?.["workers/message"];
+			const annotations = isRecord(entry.annotations) ? entry.annotations : void 0;
+			const message = annotations?.["workers/message"];
+			let draft = entry;
+			if (annotations?.["workers/triggered_by"] === "secret" && Object.keys(annotations).length === 1 && !isRecord(entry.resources)) {
+				const inspection = await Promise.resolve(options.runWrangler([
+					"versions",
+					"view",
+					versionId,
+					...commonArgs,
+					"--name",
+					options.workerName,
+					"--json"
+				], { capture: true }));
+				if (isCleanCommandExit(inspection)) {
+					const inspected = JSON.parse(inspection.stdout);
+					if (isRecord(inspected) && inspected.id === versionId) draft = inspected;
+				}
+			}
 			return {
 				metadata: typeof message === "string" ? parseCloudflareVersionMessage(message) : null,
-				isSecretOnlyDraft: isWranglerSecretOnlyDraft(entry)
+				isSecretOnlyDraft: isWranglerSecretOnlyDraft(draft)
 			};
 		}
 	} catch {
@@ -1543,7 +1603,8 @@ async function readRecentCloudflareVersionIds(options, commonArgs) {
 		if (!Array.isArray(versions) || !versions.every((version) => isRecord(version) && typeof version.id === "string" && typeof version.number === "number" && Number.isSafeInteger(version.number))) return null;
 		return versions.map((version) => ({
 			id: version.id,
-			number: version.number
+			number: version.number,
+			inspection: version
 		}));
 	} catch {
 		return null;
@@ -1593,23 +1654,6 @@ async function readCloudflareVersionSecretBindings(options, commonArgs, versionI
 	}
 }
 /**
-* `wrangler secret put` creates a fetch-only draft before attaching a first secret to a Worker.
-* Accept that draft as first-deployment proof only when its complete deployable shape contains no
-* application code configuration or non-secret resource that an ordinary deploy could own.
-*/
-function isWranglerSecretOnlyDraft(entry) {
-	if (!isRecord(entry.annotations)) return false;
-	const annotationKeys = Object.keys(entry.annotations);
-	if (entry.annotations["workers/triggered_by"] !== "secret" || annotationKeys.some((key) => key !== "workers/triggered_by")) return false;
-	if (!isRecord(entry.resources)) return false;
-	const { bindings, script, script_runtime: scriptRuntime } = entry.resources;
-	if (!Array.isArray(bindings) || bindings.length === 0 || !bindings.every((binding) => isRecord(binding) && typeof binding.name === "string" && binding.name.length > 0 && binding.type === "secret_text" && Object.keys(binding).every((key) => key === "name" || key === "type"))) return false;
-	if (!isRecord(script) || !Array.isArray(script.handlers) || script.handlers.length !== 1 || script.handlers[0] !== "fetch" || script.placement_mode !== void 0) return false;
-	if (!isRecord(scriptRuntime)) return false;
-	const runtimeKeys = Object.keys(scriptRuntime);
-	return scriptRuntime.usage_model === "standard" && isRecord(scriptRuntime.limits) && Object.keys(scriptRuntime.limits).length === 0 && runtimeKeys.every((key) => key === "usage_model" || key === "limits");
-}
-/**
 * The Versions API cannot create a Worker or its initial Durable Object migration history, and
 * some accounts do not expose a version preview until their first ordinary deployment. A
 * brand-new Worker can therefore need one ordinary deploy before later releases use preview-first
@@ -1923,4 +1967,108 @@ function defaultSleep(milliseconds) {
 	return new Promise((resolve) => setTimeout(resolve, milliseconds));
 }
 //#endregion
-export { activateCloudflareVersion, assertCloudflareBindingsPreserved, assertCloudflareDurableObjectLifecycleSupported, assertExistingCloudflareConfig, deployCloudflareVersionTraffic, deployCloudflareVersionTriggers, encodeCloudflareVersionMessage, executeCloudflareDeploy, extractWorkersDevSubdomain, normalizeWorkersDevSubdomain, parseCloudflareVersionMessage, parseRootWranglerConfig, readBindingFieldPresence, readCloudflareTriggerConfig, readCloudflareVersionMigrationTag, readCloudflareWorkerMigrationTag, readConfigEntryString, readExistingCloudflareWorker, readStoredResourceName, readWranglerTopLevelString, renderCloudflareStaticEntry, resolveD1MigrateTarget, stabilizeCloudflareVersionTriggers, stageCloudflareStaticAssets, writeCloudflareFrameworkDeployConfig, writeCloudflareStaticDeployConfig };
+//#region src/metadata.ts
+/**
+* Share one authenticated transport for the activator's read-only metadata calls.
+* Writes and unsupported commands retain the pinned Wrangler runner. Responses
+* keep its JSON contract so activation and concurrency checks remain unchanged.
+*/
+function createCloudflareMetadataRunner(options) {
+	let tokenPromise;
+	const common = [
+		...options.configPath ? ["-c", options.configPath] : [],
+		"--env=",
+		"--name",
+		options.workerName,
+		"--json"
+	];
+	const prefix = `${options.apiBaseUrl.replace(/\/$/, "")}/accounts/${encodeURIComponent(options.accountId)}/workers/scripts/${encodeURIComponent(options.workerName)}`;
+	const fetcher = options.fetch ?? globalThis.fetch;
+	const proxyEnv = options.env ?? process.env;
+	const requiresWranglerProxy = Boolean(proxyEnv.https_proxy || proxyEnv.HTTPS_PROXY || proxyEnv.http_proxy || proxyEnv.HTTP_PROXY);
+	const refused = {
+		status: 1,
+		stdout: "",
+		stderr: "Cloudflare uploader integrity check failed.",
+		error: "uploader-changed"
+	};
+	const fallback = (args, runOptions) => options.verifyUploader() ? options.runWrangler(args, runOptions) : refused;
+	return async (args, runOptions) => {
+		let kind;
+		let resource;
+		let rest = [];
+		if (args[0] === "deployments" && args[1] === "status") {
+			kind = "deployment";
+			resource = "/deployments";
+			rest = args.slice(2);
+		} else if (args[0] === "versions" && args[1] === "list") {
+			kind = "versions";
+			resource = "/versions?deployable=true";
+			rest = args.slice(2);
+		} else if (args[0] === "versions" && args[1] === "view" && /^[0-9a-f-]{36}$/i.test(args[2] ?? "")) {
+			kind = "version";
+			resource = `/versions/${encodeURIComponent(args[2])}`;
+			rest = args.slice(3);
+		}
+		if (!kind || !runOptions.capture || rest.length !== common.length || rest.some((value, i) => value !== common[i])) return fallback(args, runOptions);
+		if (requiresWranglerProxy) return fallback(args, runOptions);
+		let response;
+		try {
+			if (!tokenPromise && !options.verifyUploader()) return refused;
+			const token = await (tokenPromise ??= options.getToken());
+			if (token) {
+				response = await fetcher(prefix + resource, {
+					headers: { Authorization: `Bearer ${token}` },
+					redirect: "manual",
+					signal: AbortSignal.timeout(1e4)
+				});
+				if (response.status === 401 || response.status === 403) tokenPromise = void 0;
+				if (response.ok) {
+					const body = await response.json();
+					if (record(body) && body.success === true && record(body.result)) {
+						const result = body.result;
+						if (kind === "deployment" && Array.isArray(result.deployments)) {
+							const latest = result.deployments[0];
+							if (result.deployments.length === 0) return {
+								status: 1,
+								stdout: "",
+								stderr: `The Worker ${options.workerName} has no deployments.`
+							};
+							if (record(latest) && Array.isArray(latest.versions)) return {
+								status: 0,
+								stdout: JSON.stringify(latest),
+								stderr: ""
+							};
+						}
+						if (kind === "version" && result.id === args[2]) return {
+							status: 0,
+							stdout: JSON.stringify(result),
+							stderr: ""
+						};
+						if (kind === "versions" && Array.isArray(result.items)) {
+							const items = result.items;
+							if (items.every((item) => record(item) && record(item.metadata) && typeof item.metadata.created_on === "string")) {
+								const sorted = items.sort((a, b) => a.metadata.created_on.localeCompare(b.metadata.created_on)).slice(-10);
+								return {
+									status: 0,
+									stdout: JSON.stringify(sorted),
+									stderr: ""
+								};
+							}
+						}
+					}
+				}
+			}
+		} catch {
+			tokenPromise = void 0;
+		} finally {
+			if (response && !response.bodyUsed) await response.body?.cancel().catch(() => {});
+		}
+		return fallback(args, runOptions);
+	};
+}
+function record(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+//#endregion
+export { activateCloudflareVersion, assertCloudflareBindingsPreserved, assertCloudflareDurableObjectLifecycleSupported, assertExistingCloudflareConfig, createCloudflareMetadataRunner, deployCloudflareVersionTraffic, deployCloudflareVersionTriggers, encodeCloudflareVersionMessage, executeCloudflareDeploy, extractWorkersDevSubdomain, normalizeWorkersDevSubdomain, parseCloudflareVersionMessage, parseRootWranglerConfig, readBindingFieldPresence, readCloudflareTriggerConfig, readCloudflareVersionMigrationTag, readCloudflareWorkerMigrationTag, readConfigEntryString, readExistingCloudflareWorker, readStoredResourceName, readWranglerTopLevelString, renderCloudflareStaticEntry, resolveD1MigrateTarget, stabilizeCloudflareVersionTriggers, stageCloudflareStaticAssets, writeCloudflareFrameworkDeployConfig, writeCloudflareStaticDeployConfig };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@void/deploy-cloudflare",
-  "version": "0.20.0",
+  "version": "0.20.2",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/voidzero-dev/void.git",
@@ -20,7 +20,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@void/deploy-core": "0.20.0",
+    "@void/deploy-core": "0.20.2",
     "jsonc-parser": "3.3.1"
   },
   "devDependencies": {