@void/deploy-cloudflare 0.20.0

package/dist/index.mjs

@@ -0,0 +1,1926 @@
+import { isDeepStrictEqual, stripVTControlCharacters } from "node:util";
+import { cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { SyntaxKind, applyEdits, createScanner, modify, parse, parseTree } from "jsonc-parser";
+import nodePath from "node:path";
+import { createHash } from "node:crypto";
+import { tmpdir } from "node:os";
+//#region src/config.ts
+/** Parse a root Wrangler JSON/JSONC config without accepting a partial parse. */
+function parseRootWranglerConfig(configPath) {
+	if (!existsSync(configPath)) return {};
+	let raw;
+	try {
+		raw = readFileSync(configPath, "utf-8");
+	} catch {
+		return {};
+	}
+	const content = raw.startsWith("") ? raw.slice(1) : raw;
+	const errors = [];
+	const parsed = parse(content, errors, { allowTrailingComma: true });
+	if (errors.length > 0 || typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) return {};
+	return parsed;
+}
+function readWranglerTopLevelString(config, field) {
+	const value = config[field];
+	return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+function readStoredResourceName(config, field, binding, nameField) {
+	const list = config[field];
+	if (!Array.isArray(list)) return;
+	for (const entry of list) if (entry && typeof entry === "object" && entry.binding === binding) {
+		const name = entry[nameField];
+		return typeof name === "string" && name.length > 0 ? name : void 0;
+	}
+}
+function readBindingFieldPresence(config, field, binding, key) {
+	const list = config[field];
+	if (!Array.isArray(list)) return {
+		present: false,
+		value: void 0
+	};
+	for (const entry of list) if (entry && typeof entry === "object" && entry.binding === binding) return Object.hasOwn(entry, key) ? {
+		present: true,
+		value: entry[key]
+	} : {
+		present: false,
+		value: void 0
+	};
+	return {
+		present: false,
+		value: void 0
+	};
+}
+function readConfigEntryString(entry, field) {
+	if (!entry || typeof entry !== "object") return;
+	const value = entry[field];
+	return typeof value === "string" && value.length > 0 ? value : void 0;
+}
+function resolveD1MigrateTarget(config, binding) {
+	const list = config.d1_databases;
+	if (!Array.isArray(list)) return {
+		ok: false,
+		reason: `the root config has no "d1_databases" array`
+	};
+	const validatedIndex = list.findIndex((entry) => readConfigEntryString(entry, "binding") === binding);
+	if (validatedIndex === -1) return {
+		ok: false,
+		reason: `no d1_databases entry has binding ${JSON.stringify(binding)}`
+	};
+	const validated = list[validatedIndex];
+	const token = readConfigEntryString(validated, "database_name") ?? binding;
+	for (let i = 0; i < validatedIndex; i++) {
+		const earlier = list[i];
+		if (readConfigEntryString(earlier, "database_name") === token || readConfigEntryString(earlier, "binding") === token) return {
+			ok: false,
+			reason: `an earlier d1_databases entry (binding ${JSON.stringify(readConfigEntryString(earlier, "binding"))}, database_name ${JSON.stringify(readConfigEntryString(earlier, "database_name"))}) also matches the token ${JSON.stringify(token)}, so wrangler would migrate it instead`
+		};
+	}
+	return {
+		ok: true,
+		token
+	};
+}
+//#endregion
+//#region src/existing.ts
+/** Read the deployed version, not the most recently uploaded candidate. */
+async function readExistingCloudflareWorker(options) {
+	const worker = await readCloudflareWorker(options, false);
+	if (!worker) throw new Error(`Cloudflare Worker "${options.workerName}" does not have an active version.`);
+	return worker;
+}
+async function readCloudflareWorker(options, allowMissing) {
+	const target = [
+		"-c",
+		options.configPath,
+		"--env=",
+		"--name",
+		options.workerName
+	];
+	const read = async (args, missingIsNull = false) => {
+		const result = await options.runWrangler([
+			...args,
+			...target,
+			"--json"
+		], { capture: true });
+		if (result.status !== 0 || result.signal || result.error) {
+			if (missingIsNull && isMissingWorkerOutput$1(`${result.stdout}\n${result.stderr}`)) return null;
+			throw new Error(`Could not verify existing Cloudflare Worker "${options.workerName}". Check the account, Worker name, and Cloudflare permissions before retrying.`);
+		}
+		try {
+			const value = JSON.parse(result.stdout);
+			if (record(value)) return value;
+		} catch {}
+		throw new Error("Cloudflare returned an invalid existing Worker response.");
+	};
+	const deployment = options.versionId ? { versions: [{
+		version_id: options.versionId,
+		percentage: 100
+	}] } : await read(["deployments", "status"], allowMissing);
+	if (deployment === null) return null;
+	const versions = deployment.versions;
+	if (allowMissing && Array.isArray(versions) && versions.length === 0) return null;
+	if (!Array.isArray(versions) || versions.length !== 1 || !record(versions[0]) || versions[0].percentage !== 100 || typeof versions[0].version_id !== "string") throw new Error("The existing Worker must have one deployed version receiving all traffic. Finish any gradual rollout before linking.");
+	const versionId = versions[0].version_id;
+	const version = await read([
+		"versions",
+		"view",
+		versionId
+	]);
+	if (version === null) throw new Error("Cloudflare did not return the existing Worker configuration.");
+	const resources = version.resources;
+	if (version.id !== versionId || !record(resources) || !Array.isArray(resources.bindings) || !resources.bindings.every(record) || !record(resources.script_runtime) || !record(resources.script)) throw new Error("Cloudflare did not return the existing Worker configuration.");
+	const after = options.versionId ? deployment : await read(["deployments", "status"]);
+	if (after === null || !isDeepStrictEqual(deployment.versions, after.versions)) throw new Error("Cloudflare production changed while linking. Retry from the current deployment.");
+	return {
+		versionId,
+		bindings: resources.bindings,
+		runtime: resources.script_runtime,
+		script: resources.script
+	};
+}
+/** Parse legacy version-detail shapes; this is not authoritative Worker migration state. */
+function readCloudflareVersionMigrationTag(version) {
+	if (!record(version)) return null;
+	const resources = record(version.resources) ? version.resources : void 0;
+	const tag = [
+		resources && record(resources.script_runtime) ? resources.script_runtime.migration_tag : null,
+		resources && record(resources.script) ? resources.script.migration_tag : null,
+		record(version.script) ? version.script.migration_tag : null,
+		version.migration_tag
+	].find((candidate) => typeof candidate === "string");
+	return typeof tag === "string" && tag.length > 0 ? tag : null;
+}
+/** Read the authoritative migration tag from Worker script metadata. */
+async function readCloudflareWorkerMigrationTag(options) {
+	const auth = await readCloudflareApiAuthentication(options.runWrangler);
+	const endpoint = `${options.apiBaseUrl.replace(/\/+$/, "")}/accounts/${encodeURIComponent(options.accountId)}/workers/scripts`;
+	let response;
+	try {
+		response = await fetch(endpoint, {
+			headers: auth,
+			redirect: "error",
+			signal: AbortSignal.timeout(3e4)
+		});
+	} catch {
+		throw new Error(`Could not verify Durable Object migration state for Cloudflare Worker "${options.workerName}".`);
+	}
+	let body;
+	try {
+		body = await response.json();
+	} catch {
+		throw new Error(`Cloudflare returned an invalid Durable Object migration response for Worker "${options.workerName}".`);
+	}
+	if (!response.ok || !record(body) || body.success !== true || !Array.isArray(body.result)) throw new Error(`Could not verify Durable Object migration state for Cloudflare Worker "${options.workerName}".`);
+	const worker = body.result.find((candidate) => record(candidate) && candidate.id === options.workerName);
+	if (!record(worker)) throw new Error(`Cloudflare did not return migration state for Worker "${options.workerName}".`);
+	if (worker.migration_tag === void 0 || worker.migration_tag === null) return null;
+	if (typeof worker.migration_tag !== "string" || worker.migration_tag.length === 0) throw new Error(`Cloudflare returned an invalid Durable Object migration response for Worker "${options.workerName}".`);
+	return worker.migration_tag;
+}
+async function readCloudflareApiAuthentication(runWrangler) {
+	const result = await runWrangler([
+		"auth",
+		"token",
+		"--json"
+	], { capture: true });
+	if (result.status !== 0 || result.signal || result.error) throw new Error("Could not read the authenticated Cloudflare session.");
+	let value;
+	try {
+		value = JSON.parse(result.stdout);
+	} catch {
+		throw new Error("Cloudflare returned an invalid authentication response.");
+	}
+	if (!record(value)) throw new Error("Cloudflare returned an invalid authentication response.");
+	if ((value.type === "oauth" || value.type === "api_token") && typeof value.token === "string" && value.token.length > 0) return { Authorization: `Bearer ${value.token}` };
+	if (value.type === "api_key" && typeof value.key === "string" && value.key.length > 0 && typeof value.email === "string" && value.email.length > 0) return {
+		"X-Auth-Key": value.key,
+		"X-Auth-Email": value.email
+	};
+	throw new Error("Cloudflare returned an invalid authentication response.");
+}
+/**
+* The Versions upload endpoint cannot safely apply a new Durable Object class migration to an
+* existing Worker in the native beta. Reject that pending lifecycle change before the caller
+* mutates a database or Worker secret; ordinary uploads whose migration tag is already active
+* continue normally.
+*/
+async function assertCloudflareDurableObjectLifecycleSupported(options) {
+	const migrations = parseDurableObjectMigrations(parseRootWranglerConfig(options.configPath).migrations);
+	if (!migrations.some((migration) => migration.changesClasses)) return;
+	const existing = await readCloudflareWorker(options, true);
+	if (!existing) return;
+	const readMigrationTag = options.readMigrationTag ?? readCloudflareWorkerMigrationTag;
+	const migrationOptions = {
+		runWrangler: options.runWrangler,
+		accountId: options.accountId,
+		apiBaseUrl: options.apiBaseUrl,
+		workerName: options.workerName
+	};
+	const activeTag = await readMigrationTag(migrationOptions);
+	const after = await readCloudflareWorker(options, false);
+	const afterTag = await readMigrationTag(migrationOptions);
+	if (!after || after.versionId !== existing.versionId || afterTag !== activeTag) throw new Error("Cloudflare production or Durable Object migration state changed during verification. Retry from the current deployment.");
+	const activeIndex = activeTag === null ? -1 : migrations.findIndex((migration) => migration.tag === activeTag);
+	const pending = migrations.slice(activeIndex + 1).filter((migration) => migration.changesClasses);
+	if (pending.length === 0) return;
+	throw new Error([
+		"deploy: native Cloudflare beta cannot apply a Durable Object class migration to an existing Worker.",
+		`Pending migration tag${pending.length === 1 ? "" : "s"}: ${pending.map((migration) => migration.tag).join(", ")}.`,
+		"Apply the class migration through a supported Cloudflare deployment workflow, then retry after that migration tag is active.",
+		"No database migration or Worker secret was changed."
+	].join("\n"));
+}
+function parseDurableObjectMigrations(value) {
+	if (value === void 0) return [];
+	if (!Array.isArray(value)) throw new Error("deploy: generated Cloudflare config has a malformed migrations field.");
+	return value.map((migration) => {
+		if (!record(migration) || typeof migration.tag !== "string") throw new Error("deploy: generated Cloudflare config has a malformed class migration.");
+		const fields = [
+			migration.new_classes,
+			migration.new_sqlite_classes,
+			migration.renamed_classes,
+			migration.deleted_classes
+		];
+		for (const field of fields) if (field !== void 0 && !Array.isArray(field)) throw new Error("deploy: generated Cloudflare config has a malformed class migration.");
+		return {
+			tag: migration.tag,
+			changesClasses: fields.some((field) => Array.isArray(field) && field.length > 0)
+		};
+	});
+}
+function isMissingWorkerOutput$1(output) {
+	return /\[code:\s*10007\]/i.test(output) || /no deployments|\bworker\b.*\b(?:does not exist|not found)\b/i.test(output);
+}
+function assertCloudflareBindingsPreserved(before, after, approvedKv = []) {
+	const additions = newApprovedKvBindings(before, approvedKv);
+	for (const addition of additions) {
+		const matches = after.bindings.filter((binding) => binding.name === addition.binding);
+		if (matches.length !== 1 || matches[0].type !== "kv_namespace" || matches[0].namespace_id !== addition.id) throw new Error(`The uploaded version did not use the approved KV namespace for ${addition.binding}. It has not been activated.`);
+	}
+	const preservedBindings = after.bindings.filter((binding) => !additions.some((addition) => addition.binding === binding.name));
+	const sorted = (bindings) => [...bindings].sort((a, b) => String(a.name).localeCompare(String(b.name)));
+	if (!isDeepStrictEqual(sorted(before.bindings), sorted(preservedBindings))) throw new Error("The uploaded version did not preserve the existing Worker bindings and variables. It has not been activated.");
+	const handlers = (worker) => {
+		const value = worker.script.handlers;
+		return Array.isArray(value) && value.every((handler) => typeof handler === "string") ? [...new Set(value)].sort() : null;
+	};
+	if (!isDeepStrictEqual(handlers(before), handlers(after))) throw new Error("The uploaded version did not preserve the existing Worker event handlers. It has not been activated.");
+}
+/** Preserve the existing Worker, allowing only explicitly approved KV additions. */
+function assertExistingCloudflareConfig(existing, config, built = false, approvedKv = []) {
+	const additions = newApprovedKvBindings(existing, approvedKv);
+	if (additions.length > 0) {
+		const entries = config.kv_namespaces;
+		for (const addition of additions) {
+			const matches = Array.isArray(entries) ? entries.filter((entry) => record(entry) && entry.binding === addition.binding) : [];
+			if ((built || matches.length > 0) && (matches.length !== 1 || matches[0].id !== addition.id)) throw new Error(`Binding ${addition.binding} must reference its approved KV namespace when linking.`);
+		}
+		if (Array.isArray(entries)) config = {
+			...config,
+			kv_namespaces: entries.filter((entry) => !record(entry) || !additions.some((addition) => addition.binding === entry.binding))
+		};
+	}
+	const handlers = existing.script.handlers;
+	if (!Array.isArray(handlers) || handlers.some((handler) => handler !== "fetch" && handler !== "scheduled")) throw new Error("Linking an existing Worker currently supports fetch and scheduled handlers only. Queue and Durable Object handlers need a separate migration.");
+	for (const field of [
+		"durable_objects",
+		"migrations",
+		"exports",
+		"containers",
+		"workflows",
+		"queues",
+		"triggers"
+	]) {
+		const value = config[field];
+		if (hasContent(value)) throw new Error(`The existing Worker handoff cannot change ${field}. Keep this deployment limited to the existing site.`);
+	}
+	if (record(existing.runtime.exports) && Object.values(existing.runtime.exports).some((value) => record(value) && value.type !== "worker")) throw new Error("The existing Worker exports stateful classes. Migrate those classes separately before linking.");
+	for (const field of [
+		"compatibility_date",
+		"compatibility_flags",
+		"limits"
+	]) {
+		const expected = existing.runtime[field] ?? (field === "compatibility_flags" ? [] : void 0);
+		const actual = config[field] ?? (field === "compatibility_flags" ? [] : void 0);
+		const equal = field === "compatibility_flags" ? stringSetEqual(actual, expected) : isDeepStrictEqual(actual, expected);
+		if ((built || config[field] !== void 0) && !equal) throw new Error(`Keep the existing Worker's ${field} when linking. Update it in a later deployment.`);
+	}
+	const vars = record(config.vars) ? config.vars : {};
+	const remote = new Map(existing.bindings.map((binding) => [binding.name, binding]));
+	for (const [name, value] of Object.entries(vars)) {
+		const binding = remote.get(name);
+		const expected = binding?.type === "plain_text" ? binding.text : binding?.type === "json" ? binding.json : void 0;
+		if (!binding || !["plain_text", "json"].includes(String(binding.type)) || !isDeepStrictEqual(value, expected)) throw new Error(`Variable ${name} differs from the existing Worker. Preserve production variables and secrets when linking.`);
+	}
+	const supported = {
+		d1: [
+			"d1_databases",
+			"database_id",
+			"id"
+		],
+		kv_namespace: [
+			"kv_namespaces",
+			"id",
+			"namespace_id"
+		],
+		r2_bucket: [
+			"r2_buckets",
+			"bucket_name",
+			"bucket_name"
+		],
+		service: [
+			"services",
+			"service",
+			"service"
+		],
+		hyperdrive: [
+			"hyperdrive",
+			"id",
+			"id"
+		]
+	};
+	const found = /* @__PURE__ */ new Set();
+	for (const binding of existing.bindings) {
+		if (typeof binding.name !== "string") throw new Error("Cloudflare returned a binding without a name.");
+		if ([
+			"plain_text",
+			"json",
+			"secret_text",
+			"secret_key"
+		].includes(String(binding.type))) continue;
+		if (binding.type === "assets") {
+			if (built && (!record(config.assets) || config.assets.binding !== binding.name)) throw new Error(`Keep the existing assets binding ${binding.name} when linking.`);
+			continue;
+		}
+		const mapping = supported[String(binding.type)];
+		if (!mapping) throw new Error(`The existing binding ${binding.name} (${String(binding.type)}) is not yet supported when linking.`);
+		const [field, localId, remoteId] = mapping;
+		const entries = config[field];
+		const matches = Array.isArray(entries) ? entries.filter((entry) => record(entry) && entry.binding === binding.name) : [];
+		const entry = matches[0];
+		if (matches.length !== 1 || !record(entry) || typeof binding[remoteId] !== "string" || entry[localId] !== binding[remoteId] || binding.type === "service" && ((entry.environment ?? "production") !== (binding.environment ?? "production") || entry.entrypoint !== binding.entrypoint) || binding.type === "r2_bucket" && (entry.jurisdiction ?? "default") !== (binding.jurisdiction ?? "default")) throw new Error(`Binding ${binding.name} must reference the existing Cloudflare resource when linking.`);
+		found.add(binding.name);
+	}
+	for (const [field] of Object.values(supported)) {
+		const entries = config[field];
+		if (Array.isArray(entries) && entries.some((entry) => !record(entry) || !found.has(String(entry.binding)))) throw new Error(`Linking cannot add or replace ${field}. Use the existing resource bindings.`);
+	}
+}
+function newApprovedKvBindings(existing, approved) {
+	const additions = [];
+	const names = /* @__PURE__ */ new Set();
+	for (const binding of approved) {
+		if (!binding.binding || names.has(binding.binding) || !/^[a-f0-9]{32}$/i.test(binding.id)) throw new Error("Invalid approved KV binding identity.");
+		names.add(binding.binding);
+		const previous = existing.bindings.filter((entry) => entry.name === binding.binding);
+		if (previous.length > 0) {
+			if (previous.length !== 1 || previous[0].type !== "kv_namespace" || previous[0].namespace_id !== binding.id) throw new Error(`The approved KV binding ${binding.binding} cannot replace an existing binding.`);
+		} else {
+			if (existing.bindings.some((entry) => entry.type === "kv_namespace" && entry.namespace_id === binding.id) || additions.some((entry) => entry.id === binding.id)) throw new Error(`The approved KV binding ${binding.binding} must use a separate namespace from existing bindings.`);
+			additions.push(binding);
+		}
+	}
+	return additions;
+}
+function stringSetEqual(left, right) {
+	if (!Array.isArray(left) || !left.every((value) => typeof value === "string") || !Array.isArray(right) || !right.every((value) => typeof value === "string")) return false;
+	return isDeepStrictEqual([...new Set(left)].sort(), [...new Set(right)].sort());
+}
+function record(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function hasContent(value) {
+	if (value === void 0 || value === null) return false;
+	if (Array.isArray(value)) return value.length > 0;
+	if (record(value)) return Object.values(value).some(hasContent);
+	return true;
+}
+//#endregion
+//#region src/execute.ts
+/** Upload the already-verified Worker artifact without Wrangler autoconfiguration. */
+async function executeCloudflareDeploy(options) {
+	if (!options.verifyUploader()) return {
+		ok: false,
+		reason: "uploader-changed"
+	};
+	const result = await Promise.resolve(options.runWrangler([
+		"deploy",
+		...options.configPath ? ["-c", options.configPath] : [],
+		"--env=",
+		"--experimental-provision=false",
+		"--experimental-auto-create=false",
+		"--autoconfig=false"
+	], { capture: false }));
+	if (!isCleanCommandExit$1(result)) return {
+		ok: false,
+		reason: "deploy-failed",
+		status: result.status
+	};
+	return { ok: true };
+}
+function isCleanCommandExit$1(result) {
+	return result.status === 0 && result.signal == null && (result.error == null || result.error === "");
+}
+//#endregion
+//#region ../../node_modules/.pnpm/pathslash@0.1.0/node_modules/pathslash/dist/index.mjs
+const BACKSLASH_RE = /\\/g;
+const isWindows = process.platform === "win32";
+/**
+* Flip backslashes to forward slashes, used to slash-ify `node:path.win32`
+* output. `\\?\` (extended-length) paths are left untouched: there a forward
+* slash is a literal character, not a separator.
+*/
+const toForwardSlash = (path) => path.startsWith("\\\\?\\") ? path : path.replace(BACKSLASH_RE, "/");
+const w = nodePath.win32;
+function slashed(fn) {
+	return (...args) => toForwardSlash(fn(...args));
+}
+const win32 = {
+	resolve: slashed(w.resolve),
+	normalize: slashed(w.normalize),
+	join: slashed(w.join),
+	relative: slashed(w.relative),
+	dirname: slashed(w.dirname),
+	format: slashed(w.format),
+	parse: (path) => {
+		const parsed = w.parse(path);
+		parsed.root = toForwardSlash(parsed.root);
+		parsed.dir = toForwardSlash(parsed.dir);
+		return parsed;
+	},
+	basename: w.basename,
+	extname: w.extname,
+	isAbsolute: w.isAbsolute,
+	matchesGlob: w.matchesGlob,
+	toNamespacedPath: w.toNamespacedPath,
+	delimiter: w.delimiter,
+	sep: "/"
+};
+const posix = { ...nodePath.posix };
+posix.posix = win32.posix = posix;
+posix.win32 = win32.win32 = win32;
+const { basename, delimiter, dirname, extname, format, isAbsolute, join, matchesGlob, normalize, parse: parse$1, relative, resolve, sep, toNamespacedPath } = isWindows ? win32 : posix;
+//#endregion
+//#region src/framework.ts
+/**
+* Point a standalone framework Worker at the canonical root Cloudflare state.
+*
+* Resource ids and deployment history remain in the user's root wrangler
+* config. The generated deploy pointer contains only a relative path back to
+* that file, so Wrangler uploads the exact config Void verifies.
+*/
+function writeCloudflareFrameworkDeployConfig(options) {
+	const initial = existsSync(options.configPath) ? readFileSync(options.configPath, "utf-8") : "{}\n";
+	let content = initial;
+	const upsert = (path, value) => {
+		content = applyEdits(content, modify(content, path, value, { formattingOptions: {
+			insertSpaces: true,
+			tabSize: 2,
+			eol: "\n"
+		} }));
+	};
+	upsert(["name"], options.name);
+	upsert(["account_id"], options.accountId);
+	upsert(["main"], options.main);
+	upsert(["compatibility_date"], options.compatibilityDate);
+	if (options.compatibilityFlags && options.compatibilityFlags.length > 0) {
+		const config = parse(content);
+		const current = Array.isArray(config.compatibility_flags) ? config.compatibility_flags.filter((flag) => typeof flag === "string") : [];
+		upsert(["compatibility_flags"], [.../* @__PURE__ */ new Set([...current, ...options.compatibilityFlags])]);
+	}
+	upsert(["no_bundle"], false);
+	upsert(["assets", "directory"], options.assetsDirectory);
+	upsert(["assets", "binding"], "ASSETS");
+	upsert(["assets", "run_worker_first"], true);
+	upsert(["assets", "not_found_handling"], "none");
+	if (options.crons !== void 0) upsert(["triggers", "crons"], [...options.crons]);
+	if (options.requiredSecrets && options.requiredSecrets.length > 0) {
+		const config = parse(content);
+		if (config.secrets !== void 0 && (typeof config.secrets !== "object" || config.secrets === null || Array.isArray(config.secrets))) throw new Error("Cloudflare framework config has a malformed secrets field.");
+		const required = config.secrets?.required;
+		if (required !== void 0 && (!Array.isArray(required) || !required.every((name) => typeof name === "string"))) throw new Error("Cloudflare framework config has a malformed secrets.required field.");
+		upsert(["secrets", "required"], [.../* @__PURE__ */ new Set([...required ?? [], ...options.requiredSecrets])]);
+	}
+	let changed = content !== initial;
+	if (changed) writeFileSync(options.configPath, content);
+	const pointer = `${JSON.stringify({
+		configPath: relative(dirname(options.deployPointerPath), options.configPath),
+		auxiliaryWorkers: []
+	}, null, 2)}\n`;
+	if ((existsSync(options.deployPointerPath) ? readFileSync(options.deployPointerPath, "utf-8") : null) !== pointer) {
+		mkdirSync(dirname(options.deployPointerPath), { recursive: true });
+		writeFileSync(options.deployPointerPath, pointer);
+		changed = true;
+	}
+	if (options.assetsIgnore && options.assetsIgnore.length > 0) {
+		const ignorePath = join(dirname(options.configPath), options.assetsDirectory, ".assetsignore");
+		const previousIgnore = existsSync(ignorePath) ? readFileSync(ignorePath, "utf-8") : null;
+		const existingLines = new Set((previousIgnore ?? "").split(/\r?\n/));
+		let ignore = previousIgnore ?? "";
+		if (ignore.length > 0 && !ignore.endsWith("\n") && !ignore.endsWith("\r")) ignore += "\n";
+		for (const pattern of options.assetsIgnore) if (!existingLines.has(pattern)) ignore += `${pattern}\n`;
+		if (previousIgnore !== ignore) {
+			writeFileSync(ignorePath, ignore);
+			changed = true;
+		}
+	}
+	return changed;
+}
+//#endregion
+//#region src/static.ts
+/** Generate the deterministic thin Worker entry bundled by Wrangler. */
+function renderCloudflareStaticEntry(options) {
+	const config = JSON.stringify({
+		...options.headerRules?.length ? { headerRules: options.headerRules } : {},
+		...options.redirectRules?.length ? { redirectRules: options.redirectRules } : {},
+		...options.fallbackRules?.length ? { fallbackRules: options.fallbackRules } : {}
+	});
+	return [
+		`import { createStaticEdgeHandler } from ${JSON.stringify(options.runtimeImport ?? "@void/edge")};`,
+		`export default createStaticEdgeHandler(${config});`,
+		""
+	].join("\n");
+}
+/**
+* Copy static assets into Void's deploy area without Cloudflare's reserved routing files.
+*
+* Void has already compiled the root `_headers` and `_redirects` files into the thin edge
+* Worker. Wrangler parses those files independently of `.assetsignore`, so uploading the source
+* directory would apply every rule twice and can reject valid Void fallbacks as redirect loops.
+*/
+function stageCloudflareStaticAssets(options) {
+	const sourceDirectory = resolve(options.sourceDirectory);
+	const destinationDirectory = resolve(options.destinationDirectory);
+	if (sourceDirectory === destinationDirectory) throw new Error("Cloudflare static asset staging requires distinct source and destination directories.");
+	const reserved = /* @__PURE__ */ new Set([join(sourceDirectory, "_headers"), join(sourceDirectory, "_redirects")]);
+	const isInsideDestination = (path) => {
+		const fromDestination = relative(destinationDirectory, resolve(path));
+		return fromDestination === "" || fromDestination !== ".." && !fromDestination.startsWith("../");
+	};
+	rmSync(destinationDirectory, {
+		recursive: true,
+		force: true
+	});
+	mkdirSync(dirname(destinationDirectory), { recursive: true });
+	cpSync(sourceDirectory, destinationDirectory, {
+		recursive: true,
+		filter(path) {
+			const absolute = resolve(path);
+			return !reserved.has(absolute) && !isInsideDestination(absolute);
+		}
+	});
+}
+/**
+* Persist the mutable Cloudflare target state without replacing comments,
+* Durable Object migrations, resource ids, or unrelated user configuration.
+*/
+function writeCloudflareStaticDeployConfig(options) {
+	const initial = existsSync(options.configPath) ? readFileSync(options.configPath, "utf-8") : "{}\n";
+	const hasBom = initial.startsWith("");
+	const source = hasBom ? initial.slice(1) : initial;
+	assertValidStaticConfig(source, options.configPath);
+	const originalComments = extractCommentTokens(source);
+	let content = source;
+	const upsert = (path, value) => {
+		const edits = modify(content, path, value, { formattingOptions: {
+			insertSpaces: true,
+			tabSize: 2,
+			eol: "\n"
+		} });
+		content = applyEdits(content, edits);
+	};
+	upsert(["name"], options.name);
+	upsert(["account_id"], options.accountId);
+	upsert(["main"], options.main);
+	upsert(["compatibility_date"], options.compatibilityDate);
+	upsert(["no_bundle"], false);
+	upsert(["assets", "directory"], options.assetsDirectory);
+	upsert(["assets", "binding"], "ASSETS");
+	upsert(["assets", "run_worker_first"], true);
+	upsert(["assets", "not_found_handling"], options.assetConfig.not_found_handling ?? "none");
+	upsert(["assets", "html_handling"], options.assetConfig.html_handling ?? "auto-trailing-slash");
+	upsert(["durable_objects", "bindings"], []);
+	upsert(["queues", "producers"], []);
+	upsert(["queues", "consumers"], []);
+	upsert(["triggers", "crons"], []);
+	upsert(["containers"], []);
+	upsert(["workflows"], []);
+	assertValidStaticConfig(content, options.configPath);
+	const droppedComment = findDroppedComment(originalComments, extractCommentTokens(content));
+	if (droppedComment !== void 0) throw new Error(`deploy: cannot update "${options.configPath}" without dropping comment ${JSON.stringify(droppedComment)}. Move comments out of worker-only configuration and retry.`);
+	const finalContent = hasBom ? `\uFEFF${content}` : content;
+	if (finalContent !== initial) {
+		writeFileSync(options.configPath, finalContent);
+		return true;
+	}
+	return false;
+}
+function assertValidStaticConfig(text, configPath) {
+	const errors = [];
+	const parsed = parse(text, errors, { allowTrailingComma: true });
+	const root = parseTree(text, void 0, { allowTrailingComma: true });
+	if (errors.length > 0 || !root || typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) throw new Error(`deploy: cannot update "${configPath}" — it is not valid JSON/JSONC. Fix the file and retry.`);
+	const walk = (node) => {
+		if (node.type === "object" && node.children) {
+			const seen = /* @__PURE__ */ new Set();
+			for (const property of node.children) {
+				const key = property.children?.[0]?.value;
+				if (typeof key !== "string") continue;
+				if (seen.has(key)) throw new Error(`deploy: cannot update "${configPath}" — duplicate key ${JSON.stringify(key)}. Wrangler reads the last duplicate while JSONC edits update the first. Remove the duplicate and retry.`);
+				seen.add(key);
+			}
+		}
+		node.children?.forEach(walk);
+	};
+	walk(root);
+}
+function extractCommentTokens(text) {
+	const scanner = createScanner(text, false);
+	const comments = [];
+	for (let kind = scanner.scan(); kind !== SyntaxKind.EOF; kind = scanner.scan()) if (kind === SyntaxKind.LineCommentTrivia || kind === SyntaxKind.BlockCommentTrivia) {
+		const offset = scanner.getTokenOffset();
+		comments.push(text.slice(offset, offset + scanner.getTokenLength()));
+	}
+	return comments;
+}
+function findDroppedComment(before, after) {
+	const counts = /* @__PURE__ */ new Map();
+	for (const token of after) counts.set(token, (counts.get(token) ?? 0) + 1);
+	for (const token of before) {
+		const remaining = counts.get(token) ?? 0;
+		if (remaining === 0) return token;
+		counts.set(token, remaining - 1);
+	}
+}
+//#endregion
+//#region src/diagnostics.ts
+const MAX_DIAGNOSTIC_LENGTH = 4096;
+const MAX_DIAGNOSTIC_LINES = 24;
+/** Keep the uploader's error, excluding stdout binding tables and redacting common credential formats. */
+function cloudflareCommandDiagnostic(result) {
+	const stderr = stripVTControlCharacters(result.stderr).replace(/\r\n?/g, "\n");
+	const stdout = stripVTControlCharacters(result.stdout).replace(/\r\n?/g, "\n");
+	let message = result.error || stderr;
+	for (const output of [stderr, stdout]) {
+		const marker = /(?:^|\n)[ \t]*(?:[✘×X][ \t]+)?\[ERROR\]\s*/i.exec(output);
+		if (marker) {
+			message = output.slice(marker.index + marker[0].length);
+			break;
+		}
+	}
+	message = stripVTControlCharacters(message).split(/\n\s*(?:🪵|Logs (?:were )?written|If you think this is a bug)/)[0].trim();
+	if (!message) return;
+	message = message.replace(/\b(Bearer|Basic)\s+\S+/gi, "$1 [redacted]").replace(/([?&](?:X-Amz-[A-Za-z0-9-]+|signature|sig|token|access_token|key)=)[^&\s]+/gi, "$1[redacted]").replace(/\b([a-z][a-z0-9+.-]*:\/\/)[^\s/@]+:[^\s/@]*@/gi, "$1[redacted]@").replace(/(\b(?:CLOUDFLARE_API_TOKEN|CF_ACCESS_CLIENT_SECRET|access_token|refresh_token|api[_-]?(?:key|token)|password|secret)\b["']?\s*[:=]\s*)(?:"[^"]*"|'[^']*'|[^\s,;]+)/gi, "$1[redacted]");
+	const bounded = message.split("\n").slice(0, MAX_DIAGNOSTIC_LINES).join("\n").slice(0, MAX_DIAGNOSTIC_LENGTH);
+	return bounded.length < message.length ? `${bounded}\n[diagnostic truncated]` : bounded;
+}
+//#endregion
+//#region src/version.ts
+const VERSION_ID_RE = /(?:Worker|Current) Version ID:\s*([0-9a-f]{8}-[0-9a-f-]{27})/i;
+const PREVIEW_URL_RE = /Version Preview(?: Alias)? URL:\s*(https:\/\/\S+)/i;
+const WORKERS_DEV_URL_RE = /(https:\/\/[a-z0-9.-]+\.workers\.dev(?:\/[^\s]*)?)/i;
+const CLOUDFLARE_ERROR_CODE_RE = /\[code:\s*(\d+)\]/i;
+const DURABLE_MIGRATION_VERSION_ERROR = 10211;
+/** Encode migration state into Cloudflare's version annotation for safe rollback diagnostics. */
+function encodeCloudflareVersionMessage(migrations, triggerConfig) {
+	return `void:${JSON.stringify(triggerConfig ? {
+		schema: 2,
+		migrations,
+		triggerConfig
+	} : {
+		schema: 1,
+		migrations
+	})}`;
+}
+/** Read migration state written by {@link encodeCloudflareVersionMessage}. */
+function parseCloudflareVersionMessage(message) {
+	if (!message?.startsWith("void:")) return null;
+	try {
+		const value = JSON.parse(message.slice(5));
+		if (value.schema !== 1 && value.schema !== 2 || !Array.isArray(value.migrations) || !value.migrations.every((migration) => typeof migration === "string")) return null;
+		if (value.schema === 1) return {
+			schema: 1,
+			migrations: value.migrations
+		};
+		const triggerConfig = parseTriggerConfig(value.triggerConfig);
+		return triggerConfig ? {
+			schema: 2,
+			migrations: value.migrations,
+			triggerConfig
+		} : null;
+	} catch {
+		return null;
+	}
+}
+/**
+* Capture every configuration surface mutated by `wrangler triggers deploy` — routes,
+* workers.dev / preview flags, crons, queue consumers, workflows, and Email Routing addresses.
+*/
+function readCloudflareTriggerConfig(configPath, sourceConfigPath) {
+	const result = triggerConfigFromWrangler(parseRootWranglerConfig(configPath));
+	if (!sourceConfigPath) return result;
+	const source = parseRootWranglerConfig(sourceConfigPath);
+	return {
+		...result,
+		settingsHash: nonVersionedSettingsHash(source),
+		...source.route === void 0 && source.routes === void 0 ? { preserveRoutes: true } : {},
+		...source.workers_dev === void 0 ? { preserveWorkersDev: true } : {},
+		...source.preview_urls === void 0 ? { preservePreviewUrls: true } : {}
+	};
+}
+/** Apply a version's persisted trigger state using an isolated temporary Wrangler config. */
+async function deployCloudflareVersionTriggers(options) {
+	if (options.triggerConfig.preserve) return {
+		status: 0,
+		stdout: "",
+		stderr: ""
+	};
+	const config = triggerWranglerConfig(pickWranglerTriggerContext(options.configPath ? parseRootWranglerConfig(options.configPath) : {}), triggerConfigWithRemovedWorkflowSchedules(options.workerName, options.triggerConfig, options.previousTriggerConfig), options.manageRoutes);
+	const directory = mkdtempSync(join(tmpdir(), "void-version-triggers-"));
+	const configPath = join(directory, "wrangler.json");
+	try {
+		writeFileSync(configPath, `${JSON.stringify(config, null, 2)}\n`, { mode: 384 });
+		const deployed = await options.runWrangler([
+			"triggers",
+			"deploy",
+			"-c",
+			configPath,
+			"--env=",
+			"--name",
+			options.workerName
+		], { capture: false });
+		if (!isCleanCommandExit(deployed)) return deployed;
+		for (const queue of removedQueueConsumers(options.triggerConfig, options.previousTriggerConfig)) {
+			const removed = await options.runWrangler([
+				"queues",
+				"consumer",
+				"remove",
+				queue,
+				options.workerName,
+				"-c",
+				configPath,
+				"--env="
+			], { capture: false });
+			if (!isCleanCommandExit(removed)) return removed;
+		}
+		if (options.manageRoutes !== false && !options.triggerConfig.preserveRoutes && hasCustomDomains(options.previousTriggerConfig?.routes) && !hasCustomDomains(options.triggerConfig.routes)) {
+			if (!options.publishEmptyCustomDomains) return {
+				status: 1,
+				stdout: "",
+				stderr: "Wrangler cannot publish an empty Custom Domain set and no direct publisher was available."
+			};
+			const published = await options.publishEmptyCustomDomains();
+			if (!isCleanCommandExit(published)) return published;
+		}
+		return deployed;
+	} finally {
+		rmSync(directory, {
+			recursive: true,
+			force: true
+		});
+	}
+}
+function pickWranglerTriggerContext(source) {
+	const result = {};
+	for (const key of [
+		"account_id",
+		"name",
+		"legacy_env",
+		"send_metrics",
+		"compliance_region"
+	]) if (Object.hasOwn(source, key)) result[key] = source[key];
+	return result;
+}
+/**
+* Reconcile triggers to the version that actually owns production traffic.
+*
+* Worker Version activation and `wrangler triggers deploy` are separate Cloudflare operations.
+* Another deploy or rollback can therefore take ownership between them. Re-read ownership before
+* and after every trigger publication and, when it changes, repair the new owner's immutable
+* schema-2 snapshot. The bounded loop fails closed if traffic never stabilizes.
+*/
+async function stabilizeCloudflareVersionTriggers(options) {
+	const commonArgs = [...options.configPath ? ["-c", options.configPath] : [], "--env="];
+	let cleanupBaseline = mergeTriggerCleanupBaselines(options.previousTriggerConfig, options.targetTriggerConfig);
+	const attempts = Math.max(1, options.attempts ?? 4);
+	for (let attempt = 0; attempt < attempts; attempt++) {
+		const owner = await readCurrentProductionVersion(options, commonArgs);
+		if (owner.kind === "failed") return {
+			ok: false,
+			reason: "status-failed",
+			status: owner.status
+		};
+		if (owner.kind === "split") return {
+			ok: false,
+			reason: "traffic-split"
+		};
+		if (!owner.versionId) return {
+			ok: false,
+			reason: "metadata-unavailable",
+			activeVersionId: null
+		};
+		const activeVersionId = owner.versionId;
+		let activeTriggerConfig = activeVersionId === options.targetVersionId ? options.targetTriggerConfig : options.knownTriggerConfigs?.[activeVersionId];
+		if (!activeTriggerConfig && activeVersionId !== options.targetVersionId) {
+			const metadata = await readCloudflareVersionMetadata(options, commonArgs, activeVersionId);
+			activeTriggerConfig = metadata?.schema === 2 ? metadata.triggerConfig : void 0;
+		}
+		if (!activeTriggerConfig) return {
+			ok: false,
+			reason: "metadata-unavailable",
+			activeVersionId
+		};
+		const triggers = await deployCloudflareVersionTriggers({
+			runWrangler: options.runWrangler,
+			workerName: options.workerName,
+			configPath: options.configPath,
+			triggerConfig: activeTriggerConfig,
+			previousTriggerConfig: cleanupBaseline,
+			publishEmptyCustomDomains: options.publishEmptyCustomDomains,
+			manageRoutes: options.manageRoutes
+		});
+		if (!isCleanCommandExit(triggers)) return {
+			ok: false,
+			reason: "triggers-failed",
+			status: triggers.status,
+			activeVersionId
+		};
+		cleanupBaseline = mergeTriggerCleanupBaselines(cleanupBaseline, activeTriggerConfig);
+		const after = await readCurrentProductionVersion(options, commonArgs);
+		if (after.kind === "failed") return {
+			ok: false,
+			reason: "status-failed",
+			status: after.status
+		};
+		if (after.kind === "split") return {
+			ok: false,
+			reason: "traffic-split"
+		};
+		if (after.versionId === activeVersionId) return {
+			ok: true,
+			activeVersionId,
+			targetOwnsTraffic: activeVersionId === options.targetVersionId
+		};
+	}
+	return {
+		ok: false,
+		reason: "status-failed"
+	};
+}
+function mergeTriggerCleanupBaselines(...configs) {
+	const present = configs.filter((config) => config !== void 0);
+	const unique = (values) => {
+		const seen = /* @__PURE__ */ new Set();
+		return values.filter((value) => {
+			const key = JSON.stringify(value);
+			if (seen.has(key)) return false;
+			seen.add(key);
+			return true;
+		});
+	};
+	const withAddresses = present.filter((config) => config.addresses !== void 0);
+	return {
+		workers_dev: present.some((config) => config.workers_dev),
+		preview_urls: present.some((config) => config.preview_urls),
+		routes: unique(present.flatMap((config) => config.routes)),
+		crons: unique(present.flatMap((config) => config.crons)),
+		queueConsumers: unique(present.flatMap((config) => config.queueConsumers)),
+		workflows: unique(present.flatMap((config) => config.workflows)),
+		...withAddresses.length === 0 ? {} : { addresses: [...new Set(withAddresses.flatMap((config) => config.addresses ?? []))] }
+	};
+}
+function removedQueueConsumers(desired, previous) {
+	if (!previous) return [];
+	const desiredQueues = new Set(queueConsumerNames(desired.queueConsumers));
+	return queueConsumerNames(previous.queueConsumers).filter((queue) => !desiredQueues.has(queue)).sort();
+}
+function queueConsumerNames(consumers) {
+	return [...new Set(consumers.flatMap((consumer) => isRecord(consumer) && typeof consumer.queue === "string" ? [consumer.queue] : []))];
+}
+function triggerConfigWithQueueConsumerCleanup(previous, cleanup) {
+	const queues = [...new Set((cleanup ?? []).filter((queue) => queue.length > 0))];
+	if (queues.length === 0) return previous;
+	const base = previous ?? {
+		workers_dev: false,
+		preview_urls: false,
+		routes: [],
+		crons: [],
+		queueConsumers: [],
+		workflows: []
+	};
+	return {
+		...base,
+		queueConsumers: [...base.queueConsumers, ...queues.filter((queue) => !queueConsumerNames(base.queueConsumers).includes(queue)).map((queue) => ({ queue }))]
+	};
+}
+function triggerConfigWithRemovedWorkflowSchedules(workerName, desired, previous) {
+	if (!previous) return desired;
+	const desiredNames = new Set(desired.workflows.flatMap((workflow) => isRecord(workflow) && typeof workflow.name === "string" ? [workflow.name] : []));
+	const removed = previous.workflows.flatMap((workflow) => {
+		if (!isRecord(workflow) || typeof workflow.name !== "string" || typeof workflow.class_name !== "string" || desiredNames.has(workflow.name) || typeof workflow.script_name === "string" && workflow.script_name !== workerName) return [];
+		return [{
+			...workflow,
+			schedules: []
+		}];
+	});
+	return removed.length === 0 ? desired : {
+		...desired,
+		workflows: [...desired.workflows, ...removed]
+	};
+}
+function hasCustomDomains(routes) {
+	return routes?.some((route) => isRecord(route) && route.custom_domain === true) === true;
+}
+/** Select a configured HTTPS route that is guaranteed to cover /__void/ready. */
+function customRouteReadinessUrl(routes) {
+	for (const route of routes) {
+		const pattern = typeof route === "string" ? route : isRecord(route) && typeof route.pattern === "string" ? route.pattern : void 0;
+		if (!pattern) continue;
+		const customDomain = isRecord(route) && route.custom_domain === true;
+		const withoutScheme = pattern.replace(/^https?:\/\//i, "");
+		const slash = withoutScheme.indexOf("/");
+		const hostname = (slash < 0 ? withoutScheme : withoutScheme.slice(0, slash)).trim();
+		const path = slash < 0 ? "" : withoutScheme.slice(slash);
+		if (!hostname || hostname.includes("*") || !customDomain && path !== "/*" && path !== "*") continue;
+		return `https://${hostname}`;
+	}
+}
+function triggerConfigFromWrangler(config) {
+	const triggers = isRecord(config.triggers) ? config.triggers : {};
+	const queues = isRecord(config.queues) ? config.queues : {};
+	const routes = Array.isArray(config.routes) ? config.routes : config.route === void 0 ? [] : [config.route];
+	const workersDev = typeof config.workers_dev === "boolean" ? config.workers_dev : routes.length === 0;
+	const addresses = readEmailAddresses(config.addresses);
+	return {
+		...config.routes === void 0 && config.route === void 0 ? { preserveRoutes: true } : {},
+		...config.workers_dev === void 0 ? { preserveWorkersDev: true } : {},
+		...config.preview_urls === void 0 ? { preservePreviewUrls: true } : {},
+		settingsHash: nonVersionedSettingsHash(config),
+		workers_dev: workersDev,
+		preview_urls: typeof config.preview_urls === "boolean" ? config.preview_urls : workersDev,
+		routes,
+		crons: Array.isArray(triggers.crons) ? triggers.crons : [],
+		queueConsumers: Array.isArray(queues.consumers) ? queues.consumers : [],
+		workflows: Array.isArray(config.workflows) ? config.workflows : [],
+		...addresses === void 0 ? {} : { addresses }
+	};
+}
+/** A well-formed `addresses` array, or `undefined` when the field is absent or malformed. */
+function readEmailAddresses(value) {
+	return Array.isArray(value) && value.every((entry) => typeof entry === "string") ? value : void 0;
+}
+function nonVersionedSettingsHash(config) {
+	const settings = Object.fromEntries([
+		"logpush",
+		"observability",
+		"tail_consumers",
+		"streaming_tail_consumers"
+	].filter((key) => config[key] !== void 0).map((key) => [key, config[key]]));
+	return createHash("sha256").update(stableJson(settings)).digest("hex");
+}
+function stableJson(value) {
+	if (Array.isArray(value)) return `[${value.map(stableJson).join(",")}]`;
+	if (isRecord(value)) return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${stableJson(value[key])}`).join(",")}}`;
+	return JSON.stringify(value);
+}
+function parseTriggerConfig(value) {
+	if (value === void 0) return null;
+	if (!isRecord(value)) return null;
+	if ([
+		"preserve",
+		"preserveRoutes",
+		"preserveWorkersDev",
+		"preservePreviewUrls"
+	].some((key) => value[key] !== void 0 && typeof value[key] !== "boolean") || value.settingsHash !== void 0 && typeof value.settingsHash !== "string" || typeof value.workers_dev !== "boolean" || typeof value.preview_urls !== "boolean" || !Array.isArray(value.routes) || !Array.isArray(value.crons) || !Array.isArray(value.queueConsumers) || !Array.isArray(value.workflows) || value.addresses !== void 0 && readEmailAddresses(value.addresses) === void 0) return null;
+	return {
+		...value.preserve === true ? { preserve: true } : {},
+		...value.preserveRoutes === true ? { preserveRoutes: true } : {},
+		...value.preserveWorkersDev === true ? { preserveWorkersDev: true } : {},
+		...value.preservePreviewUrls === true ? { preservePreviewUrls: true } : {},
+		...typeof value.settingsHash === "string" ? { settingsHash: value.settingsHash } : {},
+		workers_dev: value.workers_dev,
+		preview_urls: value.preview_urls,
+		routes: value.routes,
+		crons: value.crons,
+		queueConsumers: value.queueConsumers,
+		workflows: value.workflows,
+		...value.addresses === void 0 ? {} : { addresses: value.addresses }
+	};
+}
+function triggerWranglerConfig(base, triggerConfig, manageRoutes = true) {
+	const triggers = isRecord(base.triggers) ? { ...base.triggers } : {};
+	const queues = isRecord(base.queues) ? { ...base.queues } : {};
+	triggers.crons = [...triggerConfig.crons];
+	queues.consumers = [...triggerConfig.queueConsumers];
+	const config = {
+		...base,
+		triggers,
+		queues,
+		workflows: [...triggerConfig.workflows],
+		workers_dev: triggerConfig.workers_dev,
+		preview_urls: triggerConfig.preview_urls
+	};
+	if (manageRoutes && !triggerConfig.preserveRoutes) config.routes = [...triggerConfig.routes];
+	if (triggerConfig.addresses !== void 0) config.addresses = [...triggerConfig.addresses];
+	if (triggerConfig.preserveWorkersDev) delete config.workers_dev;
+	if (triggerConfig.preservePreviewUrls) delete config.preview_urls;
+	delete config.route;
+	return config;
+}
+function resolvePreservedTraffic(desired, previous, workerExists) {
+	if ((desired.preserveRoutes || desired.preserveWorkersDev || desired.preservePreviewUrls) && workerExists && !previous) return null;
+	return {
+		...desired.preserve ? { preserve: true } : {},
+		...desired.settingsHash ? { settingsHash: desired.settingsHash } : {},
+		workers_dev: desired.preserveWorkersDev ? previous?.workers_dev ?? desired.workers_dev : desired.workers_dev,
+		preview_urls: desired.preservePreviewUrls ? previous?.preview_urls ?? desired.preview_urls : desired.preview_urls,
+		routes: desired.preserveRoutes ? previous?.routes ?? desired.routes : desired.routes,
+		crons: desired.crons,
+		queueConsumers: desired.queueConsumers,
+		workflows: desired.workflows,
+		...desired.addresses === void 0 ? {} : { addresses: desired.addresses }
+	};
+}
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+/** Upload, probe, and atomically activate a verified Worker Version. */
+async function activateCloudflareVersion(options) {
+	const candidateSecrets = Object.entries(options.candidateSecrets ?? {});
+	if (candidateSecrets.length === 0) return activateCloudflareVersionWithSecretsFile(options);
+	const directory = mkdtempSync(join(tmpdir(), "void-version-secrets-"));
+	const path = join(directory, "secrets.json");
+	try {
+		writeFileSync(path, `${JSON.stringify(Object.fromEntries(candidateSecrets))}\n`, { mode: 384 });
+		return await activateCloudflareVersionWithSecretsFile({
+			...options,
+			candidateSecretsFilePath: path
+		});
+	} finally {
+		rmSync(directory, {
+			recursive: true,
+			force: true
+		});
+	}
+}
+async function activateCloudflareVersionWithSecretsFile(options) {
+	const commonArgs = [...options.configPath ? ["-c", options.configPath] : [], "--env="];
+	if (!options.verifyUploader()) return {
+		ok: false,
+		reason: "uploader-changed"
+	};
+	const previous = await readCurrentProductionVersion(options, commonArgs);
+	if (previous.kind === "failed") return {
+		ok: false,
+		reason: "status-failed",
+		status: previous.status
+	};
+	if (previous.kind === "split") return {
+		ok: false,
+		reason: "traffic-split-unsupported"
+	};
+	if (options.expectedPreviousVersionId !== void 0 && previous.versionId !== options.expectedPreviousVersionId) return {
+		ok: false,
+		reason: "deployment-changed",
+		activeVersionId: previous.versionId,
+		rollback: "not-needed"
+	};
+	if (!options.verifyUploader()) return {
+		ok: false,
+		reason: "uploader-changed"
+	};
+	const previousVersionId = previous.versionId;
+	let inheritanceBaseline;
+	if (options.expectedPreviousVersionId !== void 0 || options.verifyInheritedSecrets === true) {
+		const recent = await readRecentCloudflareVersionIds(options, commonArgs);
+		if (recent === null) return {
+			ok: false,
+			reason: "inheritance-source-unavailable"
+		};
+		const latestVersionId = recent.at(-1)?.id ?? null;
+		if (options.expectedPreviousVersionId !== void 0) {
+			const activeIndex = recent.findIndex((version) => version.id === previous.versionId);
+			const inheritedChain = activeIndex < 0 ? [] : recent.slice(activeIndex);
+			const inheritedCandidates = inheritedChain.slice(1).map((version) => version.id);
+			if (!(inheritedChain.length > 0 && inheritedChain.every((version, index) => index === 0 || version.number === inheritedChain[index - 1].number + 1) && arraysEqual(inheritedCandidates, options.trustedInheritanceVersionIds ?? []))) return {
+				ok: false,
+				reason: "inheritance-source-changed",
+				activeVersionId: recent.at(-1)?.id ?? null,
+				rollback: "not-needed"
+			};
+		}
+		if (options.verifyInheritedSecrets === true && previous.versionId !== latestVersionId) {
+			const replacesAllRemoteSecrets = await candidateReplacesAllRemoteSecrets(options, commonArgs, previous.versionId, latestVersionId);
+			if (replacesAllRemoteSecrets === null) return {
+				ok: false,
+				reason: "inheritance-source-unavailable"
+			};
+			if (!replacesAllRemoteSecrets) return {
+				ok: false,
+				reason: "inheritance-source-changed",
+				activeVersionId: latestVersionId,
+				rollback: "not-needed"
+			};
+		}
+		inheritanceBaseline = recent;
+	}
+	const desiredMetadata = parseCloudflareVersionMessage(options.message);
+	let desiredTriggerConfig = desiredMetadata?.schema === 2 ? desiredMetadata.triggerConfig : options.configPath ? readCloudflareTriggerConfig(options.configPath) : triggerConfigFromWrangler({});
+	let previousVersion = previousVersionId && desiredMetadata?.schema === 2 ? await readCloudflareVersionInspection(options, commonArgs, previousVersionId) : null;
+	async function previousIsSecretOnlyDraft() {
+		if (!previousVersionId) return false;
+		previousVersion ??= await readCloudflareVersionInspection(options, commonArgs, previousVersionId);
+		return previousVersion?.isSecretOnlyDraft === true;
+	}
+	const previousMetadata = desiredMetadata?.schema === 2 ? previousVersion?.metadata : null;
+	const continuesOpaqueTriggerPreservation = !options.preserveTriggers && !options.previousTrafficConfig && previousMetadata?.schema === 2 && previousMetadata.triggerConfig.preserve === true && desiredTriggerConfig.settingsHash === previousMetadata.triggerConfig.settingsHash && (desiredTriggerConfig.preserveRoutes === true || desiredTriggerConfig.preserveWorkersDev === true || desiredTriggerConfig.preservePreviewUrls === true) && (desiredTriggerConfig.preserveRoutes === true || isDeepStrictEqual(desiredTriggerConfig.routes, previousMetadata.triggerConfig.routes)) && (desiredTriggerConfig.preserveWorkersDev === true || desiredTriggerConfig.workers_dev === previousMetadata.triggerConfig.workers_dev) && (desiredTriggerConfig.preservePreviewUrls === true || desiredTriggerConfig.preview_urls === previousMetadata.triggerConfig.preview_urls) && desiredTriggerConfig.crons.length === 0 && desiredTriggerConfig.queueConsumers.length === 0 && desiredTriggerConfig.workflows.length === 0;
+	const previousTrafficConfig = options.previousTrafficConfig ?? (previousMetadata?.schema === 2 && previousMetadata.triggerConfig.preserve !== true ? {
+		workers_dev: previousMetadata.triggerConfig.workers_dev,
+		preview_urls: previousMetadata.triggerConfig.preview_urls,
+		routes: previousMetadata.triggerConfig.routes
+	} : void 0);
+	if (continuesOpaqueTriggerPreservation) desiredTriggerConfig = {
+		...desiredTriggerConfig,
+		preserve: true
+	};
+	else if (!options.preserveTriggers && desiredMetadata?.schema === 2) {
+		const resolved = resolvePreservedTraffic(desiredTriggerConfig, previousTrafficConfig, previous.versionId !== null && !await previousIsSecretOnlyDraft());
+		if (!resolved) return {
+			ok: false,
+			reason: "traffic-preservation-unavailable",
+			previousVersionId: previous.versionId,
+			rollback: "not-needed"
+		};
+		desiredTriggerConfig = resolved;
+	}
+	const message = desiredMetadata?.schema === 2 ? encodeCloudflareVersionMessage(desiredMetadata.migrations, desiredTriggerConfig) : options.message;
+	const versionedPreviousTriggerConfig = previousMetadata?.schema === 2 ? previousMetadata.triggerConfig : void 0;
+	const versionedPreviousTriggerConfigWithTraffic = versionedPreviousTriggerConfig && previousTrafficConfig ? {
+		...versionedPreviousTriggerConfig,
+		...previousTrafficConfig
+	} : versionedPreviousTriggerConfig;
+	const previousTriggerConfig = triggerConfigWithQueueConsumerCleanup(versionedPreviousTriggerConfigWithTraffic, options.queueConsumerCleanup);
+	const alias = `void-ready-${Date.now().toString(36)}`;
+	const upload = await Promise.resolve(options.runWrangler([
+		"versions",
+		"upload",
+		...commonArgs,
+		"--name",
+		options.workerName,
+		"--message",
+		message,
+		...options.candidateSecretsFilePath ? ["--secrets-file", options.candidateSecretsFilePath] : [],
+		...options.assetsDirectoryOverride ? ["--assets", options.assetsDirectoryOverride] : [],
+		"--preview-alias",
+		alias,
+		"--strict",
+		"--experimental-provision=false",
+		"--experimental-auto-create=false"
+	], { capture: true }));
+	if (!isCleanCommandExit(upload)) {
+		const output = `${upload.stdout}\n${upload.stderr}`;
+		const cloudflareErrorCode = parseCloudflareErrorCode(output);
+		const isBootstrapError = cloudflareErrorCode === DURABLE_MIGRATION_VERSION_ERROR || /cannot upload a new version of a worker that does not yet exist/i.test(output);
+		if (!options.preserveTriggers && isBootstrapError && (previous.versionId === null || options.allowFirstDeploymentBootstrap === true || await previousIsSecretOnlyDraft())) return bootstrapFirstDeployment({
+			...options,
+			message
+		}, commonArgs, previous.versionId);
+		return {
+			ok: false,
+			reason: "upload-failed",
+			status: upload.status,
+			...commandDiagnosticFields(upload),
+			...cloudflareErrorCode === void 0 ? {} : { cloudflareErrorCode },
+			...isContainersUnavailable(output) ? { containersUnavailable: true } : {}
+		};
+	}
+	const output = `${upload.stdout}\n${upload.stderr}`;
+	const versionId = output.match(VERSION_ID_RE)?.[1];
+	if (!versionId) return {
+		ok: false,
+		reason: "upload-output-invalid"
+	};
+	if (inheritanceBaseline) {
+		const recent = await readRecentCloudflareVersionIds(options, commonArgs);
+		const previousLatest = inheritanceBaseline.at(-1);
+		const expected = [...inheritanceBaseline.map((version) => version.id), versionId].slice(-10);
+		if (recent === null) return {
+			ok: false,
+			reason: "inheritance-source-unavailable",
+			versionId,
+			previousVersionId: previous.versionId,
+			rollback: "not-needed"
+		};
+		const uploadedVersion = recent.at(-1);
+		if (!uploadedVersion || uploadedVersion.id !== versionId || uploadedVersion.number !== (previousLatest?.number ?? 0) + 1 || !arraysEqual(recent.map((version) => version.id), expected)) return {
+			ok: false,
+			reason: "inheritance-source-changed",
+			versionId,
+			previousVersionId: previous.versionId,
+			activeVersionId: uploadedVersion?.id ?? null,
+			rollback: "not-needed"
+		};
+	}
+	await options.validateUploadedVersion?.(versionId);
+	if (options.recordVerifiedCandidate) {
+		if (!options.validateUploadedVersion) throw new Error("A Worker candidate cannot be recorded without validating its upload.");
+		await options.recordVerifiedCandidate(versionId);
+	}
+	const reportedPreviewUrl = output.match(PREVIEW_URL_RE)?.[1];
+	let authenticatedWorkersDevSubdomain = reportedPreviewUrl ? extractWorkersDevSubdomain(reportedPreviewUrl) : void 0;
+	let readinessUrl = reportedPreviewUrl;
+	let readinessUsesCustomRoute = false;
+	let stagedVersionOverride = false;
+	if (!readinessUrl) {
+		if (!options.preserveTriggers && (previous.versionId === null || options.allowFirstDeploymentBootstrap === true || await previousIsSecretOnlyDraft())) return bootstrapFirstDeployment({
+			...options,
+			message
+		}, commonArgs, previous.versionId);
+		readinessUrl = desiredTriggerConfig.workers_dev ? workersDevReadinessUrl(options.workerName, options.workersDevSubdomain) : customRouteReadinessUrl(desiredTriggerConfig.routes);
+		readinessUsesCustomRoute = !desiredTriggerConfig.workers_dev && readinessUrl !== void 0;
+		if (!readinessUrl) return {
+			ok: false,
+			reason: "preview-unavailable",
+			versionId,
+			previousVersionId: previous.versionId
+		};
+		const fallbackSubdomain = extractWorkersDevSubdomain(readinessUrl);
+		if (fallbackSubdomain && fallbackSubdomain === options.readinessHeadersWorkersDevSubdomain) authenticatedWorkersDevSubdomain = fallbackSubdomain;
+		if (!options.verifyUploader()) return {
+			ok: false,
+			reason: "uploader-changed",
+			versionId,
+			previousVersionId: previous.versionId,
+			rollback: "not-needed"
+		};
+		const stagingOwnerFailure = await verifyReadinessStagingOwner(options, commonArgs, previous.versionId, versionId);
+		if (stagingOwnerFailure) return stagingOwnerFailure;
+		const staged = await deployVersionPercentages(options, commonArgs, [`${previous.versionId}@100`, `${versionId}@0`], message);
+		if (!isCleanCommandExit(staged)) return {
+			ok: false,
+			reason: "readiness-staging-failed",
+			status: staged.status,
+			versionId,
+			previousVersionId: previous.versionId,
+			rollback: "not-needed"
+		};
+		stagedVersionOverride = true;
+	}
+	let ready = await probeReadiness(`${readinessUrl.replace(/\/$/, "")}/__void/ready`, options.workerName, readinessUsesCustomRoute ? void 0 : options.readinessHeaders, authenticatedWorkersDevSubdomain, stagedVersionOverride ? versionId : void 0, options.fetch ?? globalThis.fetch, options.sleep ?? defaultSleep, options.readinessAttempts ?? 6);
+	if (ready === "access-denied" && !stagedVersionOverride && previous.versionId !== null) {
+		const stableReadinessUrl = desiredTriggerConfig.workers_dev ? workersDevReadinessUrl(options.workerName, extractWorkersDevSubdomain(readinessUrl) ?? options.workersDevSubdomain) : customRouteReadinessUrl(desiredTriggerConfig.routes);
+		if (stableReadinessUrl && stableReadinessUrl !== readinessUrl) {
+			if (!options.verifyUploader()) return {
+				ok: false,
+				reason: "uploader-changed",
+				versionId,
+				previousVersionId: previous.versionId,
+				rollback: "not-needed"
+			};
+			const stagingOwnerFailure = await verifyReadinessStagingOwner(options, commonArgs, previous.versionId, versionId);
+			if (stagingOwnerFailure) return stagingOwnerFailure;
+			const staged = await deployVersionPercentages(options, commonArgs, [`${previous.versionId}@100`, `${versionId}@0`], message);
+			if (!isCleanCommandExit(staged)) return {
+				ok: false,
+				reason: "readiness-staging-failed",
+				status: staged.status,
+				versionId,
+				previousVersionId: previous.versionId,
+				rollback: "not-needed"
+			};
+			readinessUrl = stableReadinessUrl;
+			authenticatedWorkersDevSubdomain = extractWorkersDevSubdomain(stableReadinessUrl);
+			readinessUsesCustomRoute = !desiredTriggerConfig.workers_dev;
+			stagedVersionOverride = true;
+			ready = await probeReadiness(`${readinessUrl.replace(/\/$/, "")}/__void/ready`, options.workerName, readinessUsesCustomRoute ? void 0 : options.readinessHeaders, authenticatedWorkersDevSubdomain, versionId, options.fetch ?? globalThis.fetch, options.sleep ?? defaultSleep, options.readinessAttempts ?? 6);
+		}
+	}
+	if (ready !== "ready") return {
+		ok: false,
+		reason: ready === "access-denied" ? "readiness-access-denied" : "readiness-failed",
+		versionId,
+		previousVersionId: previous.versionId,
+		rollback: stagedVersionOverride ? await restorePreviousVersion(options, commonArgs, previous.versionId, "readiness failed", [stagedVersionPercentages(previous.versionId, versionId)]) : "not-needed"
+	};
+	if (!options.verifyUploader()) return {
+		ok: false,
+		reason: "uploader-changed",
+		versionId,
+		previousVersionId: previous.versionId,
+		rollback: stagedVersionOverride ? await restorePreviousVersion(options, commonArgs, previous.versionId, "uploader verification failed", [stagedVersionPercentages(previous.versionId, versionId)]) : "not-needed"
+	};
+	const ownerBeforeActivation = await readCurrentProductionVersion(options, commonArgs);
+	if (ownerBeforeActivation.kind === "failed") return {
+		ok: false,
+		reason: "status-failed",
+		status: ownerBeforeActivation.status,
+		versionId,
+		previousVersionId: previous.versionId
+	};
+	if (ownerBeforeActivation.kind === "split") return {
+		ok: false,
+		reason: "traffic-split-unsupported",
+		versionId,
+		previousVersionId: previous.versionId
+	};
+	const expectedTrafficBeforeActivation = stagedVersionOverride ? stagedVersionPercentages(previous.versionId, versionId) : previous.versionId ? [{
+		versionId: previous.versionId,
+		percentage: 100
+	}] : [];
+	if (ownerBeforeActivation.versionId !== previous.versionId || !productionVersionPercentagesEqual(ownerBeforeActivation.versions, expectedTrafficBeforeActivation)) return {
+		ok: false,
+		reason: "deployment-changed",
+		versionId,
+		previousVersionId: previous.versionId,
+		activeVersionId: ownerBeforeActivation.versionId,
+		rollback: "not-needed",
+		triggerRepair: "succeeded"
+	};
+	const activate = await deployVersionPercentages(options, commonArgs, [`${versionId}@100`], message);
+	if (!isCleanCommandExit(activate)) return {
+		ok: false,
+		reason: "activation-failed",
+		status: activate.status,
+		versionId,
+		previousVersionId: previous.versionId,
+		rollback: stagedVersionOverride ? await restorePreviousVersion(options, commonArgs, previous.versionId, "version activation failed", [stagedVersionPercentages(previous.versionId, versionId), [{
+			versionId,
+			percentage: 100
+		}]]) : "not-needed"
+	};
+	if (!options.verifyUploader()) return {
+		ok: false,
+		reason: "uploader-changed",
+		versionId,
+		previousVersionId: previous.versionId,
+		rollback: previous.versionId ? "unsafe" : "unavailable"
+	};
+	if (options.preserveTriggers) {
+		const owner = await readCurrentProductionVersion(options, commonArgs);
+		if (owner.kind !== "ok" || owner.versionId !== versionId) return {
+			ok: false,
+			reason: "deployment-changed",
+			versionId,
+			previousVersionId: previous.versionId,
+			...owner.kind === "ok" ? { activeVersionId: owner.versionId } : {},
+			rollback: "not-needed"
+		};
+		return {
+			ok: true,
+			versionId,
+			previousVersionId: previous.versionId,
+			previewUrl: publishedCloudflareUrl(options.workerName, desiredTriggerConfig, readinessUrl),
+			preservedTriggers: true,
+			...workersDevSubdomainResult(readinessUrl)
+		};
+	}
+	const knownTriggerConfigs = { [versionId]: desiredTriggerConfig };
+	if (previous.versionId && previousTriggerConfig) knownTriggerConfigs[previous.versionId] = previousTriggerConfig;
+	const triggers = await stabilizeCloudflareVersionTriggers({
+		runWrangler: options.runWrangler,
+		workerName: options.workerName,
+		configPath: options.configPath,
+		targetVersionId: versionId,
+		targetTriggerConfig: desiredTriggerConfig,
+		previousTriggerConfig,
+		knownTriggerConfigs,
+		publishEmptyCustomDomains: options.publishEmptyCustomDomains
+	});
+	if (!triggers.ok) {
+		if (triggers.activeVersionId && triggers.activeVersionId !== versionId) return {
+			ok: false,
+			reason: "deployment-changed",
+			status: triggers.status,
+			versionId,
+			previousVersionId: previous.versionId,
+			activeVersionId: triggers.activeVersionId,
+			rollback: "not-needed",
+			triggerRepair: triggers.reason === "metadata-unavailable" ? "unavailable" : "failed"
+		};
+		if (!triggers.activeVersionId) return {
+			ok: false,
+			reason: "triggers-failed",
+			status: triggers.status,
+			versionId,
+			previousVersionId: previous.versionId,
+			rollback: "unsafe"
+		};
+		const ownerBeforeCompensation = await readCurrentProductionVersion(options, commonArgs);
+		if (ownerBeforeCompensation.kind !== "ok" || ownerBeforeCompensation.versionId === null) return {
+			ok: false,
+			reason: "triggers-failed",
+			status: triggers.status,
+			versionId,
+			previousVersionId: previous.versionId,
+			rollback: "unsafe"
+		};
+		if (ownerBeforeCompensation.versionId !== versionId) {
+			const repair = await stabilizeCloudflareVersionTriggers({
+				runWrangler: options.runWrangler,
+				workerName: options.workerName,
+				configPath: options.configPath,
+				targetVersionId: versionId,
+				targetTriggerConfig: desiredTriggerConfig,
+				previousTriggerConfig,
+				knownTriggerConfigs,
+				publishEmptyCustomDomains: options.publishEmptyCustomDomains
+			});
+			return {
+				ok: false,
+				reason: "deployment-changed",
+				status: triggers.status,
+				versionId,
+				previousVersionId: previous.versionId,
+				activeVersionId: repair.activeVersionId ?? ownerBeforeCompensation.versionId,
+				rollback: "not-needed",
+				triggerRepair: repair.ok ? "succeeded" : repair.reason === "metadata-unavailable" ? "unavailable" : "failed"
+			};
+		}
+		const rollback = await restorePreviousVersionAndTriggers(options, commonArgs, previous.versionId, "trigger activation failed", desiredTriggerConfig, versionId, versionedPreviousTriggerConfigWithTraffic);
+		return {
+			ok: false,
+			reason: "triggers-failed",
+			status: triggers.status,
+			versionId,
+			previousVersionId: previous.versionId,
+			rollback
+		};
+	}
+	if (!triggers.targetOwnsTraffic) return {
+		ok: false,
+		reason: "deployment-changed",
+		versionId,
+		previousVersionId: previous.versionId,
+		activeVersionId: triggers.activeVersionId,
+		rollback: "not-needed",
+		triggerRepair: "succeeded"
+	};
+	return {
+		ok: true,
+		versionId,
+		previewUrl: publishedCloudflareUrl(options.workerName, desiredTriggerConfig, readinessUrl),
+		previousVersionId: previous.versionId,
+		...desiredTriggerConfig.preserve ? { preservedTriggers: true } : {},
+		...!desiredTriggerConfig.preserve ? { trafficConfig: {
+			workers_dev: desiredTriggerConfig.workers_dev,
+			preview_urls: desiredTriggerConfig.preview_urls,
+			routes: desiredTriggerConfig.routes
+		} } : {},
+		...workersDevSubdomainResult(readinessUrl)
+	};
+}
+async function restorePreviousVersionAndTriggers(options, commonArgs, previousVersionId, cause, failedTriggerConfig, failedVersionId, capturedTriggerConfig) {
+	const traffic = await restorePreviousVersion(options, commonArgs, previousVersionId, cause, [[{
+		versionId: failedVersionId,
+		percentage: 100
+	}]]);
+	if (traffic !== "succeeded" || !previousVersionId) return traffic;
+	if (!options.verifyUploader()) return "unsafe";
+	let targetTriggerConfig = capturedTriggerConfig;
+	if (!targetTriggerConfig) {
+		const metadata = await readCloudflareVersionMetadata(options, commonArgs, previousVersionId);
+		if (metadata?.schema !== 2) return "unavailable";
+		targetTriggerConfig = metadata.triggerConfig;
+	}
+	if (targetTriggerConfig.preserve) return "unavailable";
+	if (!options.verifyUploader()) return "unsafe";
+	const triggers = await stabilizeCloudflareVersionTriggers({
+		runWrangler: options.runWrangler,
+		workerName: options.workerName,
+		configPath: options.configPath,
+		targetVersionId: previousVersionId,
+		targetTriggerConfig,
+		previousTriggerConfig: failedTriggerConfig,
+		knownTriggerConfigs: { [previousVersionId]: targetTriggerConfig },
+		publishEmptyCustomDomains: options.publishEmptyCustomDomains
+	});
+	return triggers.ok && triggers.targetOwnsTraffic ? "succeeded" : "failed";
+}
+async function readCloudflareVersionMetadata(options, commonArgs, versionId) {
+	return (await readCloudflareVersionInspection(options, commonArgs, versionId))?.metadata ?? null;
+}
+async function readCloudflareVersionInspection(options, commonArgs, versionId) {
+	const result = await Promise.resolve(options.runWrangler([
+		"versions",
+		"list",
+		...commonArgs,
+		"--name",
+		options.workerName,
+		"--json"
+	], { capture: true }));
+	if (!isCleanCommandExit(result)) return null;
+	try {
+		const versions = JSON.parse(result.stdout);
+		if (!Array.isArray(versions)) return null;
+		for (const entry of versions) {
+			if (!isRecord(entry) || entry.id !== versionId) continue;
+			const message = (isRecord(entry.annotations) ? entry.annotations : void 0)?.["workers/message"];
+			return {
+				metadata: typeof message === "string" ? parseCloudflareVersionMessage(message) : null,
+				isSecretOnlyDraft: isWranglerSecretOnlyDraft(entry)
+			};
+		}
+	} catch {
+		return null;
+	}
+	return null;
+}
+async function readRecentCloudflareVersionIds(options, commonArgs) {
+	const result = await Promise.resolve(options.runWrangler([
+		"versions",
+		"list",
+		...commonArgs,
+		"--name",
+		options.workerName,
+		"--json"
+	], { capture: true }));
+	if (!isCleanCommandExit(result)) {
+		if (isMissingWorkerOutput(`${result.stdout}\n${result.stderr}`)) return [];
+		return null;
+	}
+	try {
+		const versions = JSON.parse(result.stdout);
+		if (!Array.isArray(versions) || !versions.every((version) => isRecord(version) && typeof version.id === "string" && typeof version.number === "number" && Number.isSafeInteger(version.number))) return null;
+		return versions.map((version) => ({
+			id: version.id,
+			number: version.number
+		}));
+	} catch {
+		return null;
+	}
+}
+function arraysEqual(left, right) {
+	return left.length === right.length && left.every((value, index) => value === right[index]);
+}
+async function candidateReplacesAllRemoteSecrets(options, commonArgs, activeVersionId, latestVersionId) {
+	const versionIds = [...new Set([activeVersionId, latestVersionId].filter(Boolean))];
+	const secretBindings = [];
+	for (const versionId of versionIds) {
+		const bindings = await readCloudflareVersionSecretBindings(options, commonArgs, versionId);
+		if (bindings === null) return null;
+		secretBindings.push(bindings);
+	}
+	return secretBindings.every((bindings) => bindings.every((binding) => binding.type === "secret_text" && Object.hasOwn(options.candidateSecrets ?? {}, binding.name)));
+}
+async function readCloudflareVersionSecretBindings(options, commonArgs, versionId) {
+	const result = await Promise.resolve(options.runWrangler([
+		"versions",
+		"view",
+		versionId,
+		...commonArgs,
+		"--name",
+		options.workerName,
+		"--json"
+	], { capture: true }));
+	if (!isCleanCommandExit(result)) return null;
+	try {
+		const version = JSON.parse(result.stdout);
+		if (!isRecord(version) || version.id !== versionId || !isRecord(version.resources)) return null;
+		const bindings = version.resources.bindings;
+		if (!Array.isArray(bindings) || !bindings.every(isRecord)) return null;
+		const secrets = [];
+		for (const binding of bindings) {
+			if (binding.type !== "secret_text" && binding.type !== "secret_key") continue;
+			if (typeof binding.name !== "string") return null;
+			secrets.push({
+				name: binding.name,
+				type: binding.type
+			});
+		}
+		return secrets;
+	} catch {
+		return null;
+	}
+}
+/**
+* `wrangler secret put` creates a fetch-only draft before attaching a first secret to a Worker.
+* Accept that draft as first-deployment proof only when its complete deployable shape contains no
+* application code configuration or non-secret resource that an ordinary deploy could own.
+*/
+function isWranglerSecretOnlyDraft(entry) {
+	if (!isRecord(entry.annotations)) return false;
+	const annotationKeys = Object.keys(entry.annotations);
+	if (entry.annotations["workers/triggered_by"] !== "secret" || annotationKeys.some((key) => key !== "workers/triggered_by")) return false;
+	if (!isRecord(entry.resources)) return false;
+	const { bindings, script, script_runtime: scriptRuntime } = entry.resources;
+	if (!Array.isArray(bindings) || bindings.length === 0 || !bindings.every((binding) => isRecord(binding) && typeof binding.name === "string" && binding.name.length > 0 && binding.type === "secret_text" && Object.keys(binding).every((key) => key === "name" || key === "type"))) return false;
+	if (!isRecord(script) || !Array.isArray(script.handlers) || script.handlers.length !== 1 || script.handlers[0] !== "fetch" || script.placement_mode !== void 0) return false;
+	if (!isRecord(scriptRuntime)) return false;
+	const runtimeKeys = Object.keys(scriptRuntime);
+	return scriptRuntime.usage_model === "standard" && isRecord(scriptRuntime.limits) && Object.keys(scriptRuntime.limits).length === 0 && runtimeKeys.every((key) => key === "usage_model" || key === "limits");
+}
+/**
+* The Versions API cannot create a Worker or its initial Durable Object migration history, and
+* some accounts do not expose a version preview until their first ordinary deployment. A
+* brand-new Worker can therefore need one ordinary deploy before later releases use preview-first
+* version activation. This fallback requires prior proof that no application had been deployed.
+*/
+async function bootstrapFirstDeployment(options, commonArgs, previousVersionId) {
+	if (!options.verifyUploader()) return {
+		ok: false,
+		reason: "uploader-changed"
+	};
+	const bootstrap = await Promise.resolve(options.runWrangler([
+		"deploy",
+		...commonArgs,
+		"--name",
+		options.workerName,
+		"--message",
+		options.message,
+		...options.candidateSecretsFilePath ? ["--secrets-file", options.candidateSecretsFilePath] : [],
+		...options.assetsDirectoryOverride ? ["--assets", options.assetsDirectoryOverride] : [],
+		"--strict",
+		"--experimental-provision=false",
+		"--experimental-auto-create=false",
+		"--autoconfig=false"
+	], { capture: true }));
+	const output = `${bootstrap.stdout}\n${bootstrap.stderr}`;
+	if (!isCleanCommandExit(bootstrap)) {
+		const cloudflareErrorCode = parseCloudflareErrorCode(output);
+		return {
+			ok: false,
+			reason: "bootstrap-failed",
+			status: bootstrap.status,
+			...commandDiagnosticFields(bootstrap),
+			...cloudflareErrorCode === void 0 ? {} : { cloudflareErrorCode },
+			...isContainersUnavailable(output) ? { containersUnavailable: true } : {}
+		};
+	}
+	const versionId = output.match(VERSION_ID_RE)?.[1];
+	const desiredMetadata = parseCloudflareVersionMessage(options.message);
+	const desiredTriggerConfig = desiredMetadata?.schema === 2 ? desiredMetadata.triggerConfig : options.configPath ? readCloudflareTriggerConfig(options.configPath) : triggerConfigFromWrangler({});
+	const reportedUrl = output.match(PREVIEW_URL_RE)?.[1] ?? output.match(WORKERS_DEV_URL_RE)?.[1];
+	const reportedOrConfiguredUrl = reportedUrl ?? (desiredTriggerConfig.workers_dev ? workersDevReadinessUrl(options.workerName, options.workersDevSubdomain) : customRouteReadinessUrl(desiredTriggerConfig.routes));
+	if (!versionId || !reportedOrConfiguredUrl) return {
+		ok: false,
+		reason: "bootstrap-output-invalid",
+		previousVersionId,
+		...versionId ? { versionId } : {}
+	};
+	const previewUrl = publishedCloudflareUrl(options.workerName, desiredTriggerConfig, reportedOrConfiguredUrl);
+	const ready = await probeReadiness(`${previewUrl.replace(/\/$/, "")}/__void/ready`, options.workerName, reportedUrl || desiredTriggerConfig.workers_dev ? options.readinessHeaders : void 0, extractWorkersDevSubdomain(previewUrl), void 0, options.fetch ?? globalThis.fetch, options.sleep ?? defaultSleep, options.readinessAttempts ?? 30, 6e4);
+	if (ready !== "ready") return {
+		ok: false,
+		reason: ready === "access-denied" ? "bootstrap-readiness-access-denied" : "bootstrap-readiness-failed",
+		versionId,
+		previousVersionId,
+		rollback: "unavailable"
+	};
+	return {
+		ok: true,
+		versionId,
+		previewUrl,
+		previousVersionId,
+		...workersDevSubdomainResult(previewUrl)
+	};
+}
+function parseCloudflareErrorCode(output) {
+	const value = output.match(CLOUDFLARE_ERROR_CODE_RE)?.[1];
+	return value === void 0 ? void 0 : Number(value);
+}
+function commandDiagnosticFields(result) {
+	const diagnostic = cloudflareCommandDiagnostic(result);
+	return diagnostic ? { diagnostic } : {};
+}
+function isMissingWorkerOutput(output) {
+	return parseCloudflareErrorCode(output) === 10007 || /no deployments|\bworker\b.*\b(?:does not exist|not found)\b/i.test(output);
+}
+/** Recognize the Containers account-entitlement failure Wrangler exposes during upload. */
+function isContainersUnavailable(output) {
+	return /\/containers\/me(?:\b|\?)/i.test(output) && /\b403\b/.test(output) || /Cloudflare Containers[^\n]*(?:Workers Paid|not (?:enabled|available)|subscription)/i.test(output);
+}
+async function readCurrentProductionVersion(options, commonArgs) {
+	const result = await Promise.resolve(options.runWrangler([
+		"deployments",
+		"status",
+		...commonArgs,
+		"--name",
+		options.workerName,
+		"--json"
+	], { capture: true }));
+	if (!isCleanCommandExit(result)) {
+		if (isMissingWorkerOutput(`${result.stdout}\n${result.stderr}`)) return {
+			kind: "ok",
+			versionId: null,
+			versions: []
+		};
+		return {
+			kind: "failed",
+			status: result.status
+		};
+	}
+	try {
+		const versions = (JSON.parse(result.stdout).versions ?? []).map((version) => ({
+			versionId: typeof version.version_id === "string" ? version.version_id : "",
+			percentage: Number(version.percentage)
+		}));
+		if (versions.some((version) => version.versionId.length === 0 || !Number.isFinite(version.percentage) || version.percentage < 0 || version.percentage > 100)) return {
+			kind: "failed",
+			status: result.status
+		};
+		const activeVersions = versions.filter((version) => version.percentage > 0);
+		if (activeVersions.length > 1 || activeVersions.length === 1 && activeVersions[0]?.percentage !== 100) return { kind: "split" };
+		return {
+			kind: "ok",
+			versionId: activeVersions[0]?.versionId ?? null,
+			versions
+		};
+	} catch {
+		return {
+			kind: "failed",
+			status: result.status
+		};
+	}
+}
+function productionVersionPercentagesEqual(actual, expected) {
+	return actual.length === expected.length && expected.every((entry) => actual.some((candidate) => candidate.versionId === entry.versionId && candidate.percentage === entry.percentage));
+}
+function stagedVersionPercentages(previousVersionId, versionId) {
+	return previousVersionId ? [{
+		versionId: previousVersionId,
+		percentage: 100
+	}, {
+		versionId,
+		percentage: 0
+	}] : [];
+}
+async function verifyReadinessStagingOwner(options, commonArgs, previousVersionId, versionId) {
+	const owner = await readCurrentProductionVersion(options, commonArgs);
+	if (owner.kind === "failed") return {
+		ok: false,
+		reason: "status-failed",
+		status: owner.status,
+		versionId,
+		previousVersionId,
+		rollback: "not-needed"
+	};
+	if (owner.kind === "split") return {
+		ok: false,
+		reason: "traffic-split-unsupported",
+		versionId,
+		previousVersionId,
+		rollback: "not-needed"
+	};
+	const expected = previousVersionId ? [{
+		versionId: previousVersionId,
+		percentage: 100
+	}] : [];
+	if (owner.versionId !== previousVersionId || !productionVersionPercentagesEqual(owner.versions, expected)) return {
+		ok: false,
+		reason: "deployment-changed",
+		versionId,
+		previousVersionId,
+		activeVersionId: owner.versionId,
+		rollback: "not-needed"
+	};
+	return null;
+}
+async function probeReadiness(url, workerName, readinessHeaders, authenticatedWorkersDevSubdomain, versionOverride, fetcher, sleep, attempts, timeoutMs = Number.POSITIVE_INFINITY) {
+	const headers = guardedReadinessHeaders(url, workerName, readinessHeaders, authenticatedWorkersDevSubdomain);
+	if (headers === null) return "failed";
+	const deadline = Date.now() + timeoutMs;
+	for (let attempt = 0; attempt < Math.max(1, attempts); attempt++) {
+		const remaining = deadline - Date.now();
+		if (remaining <= 0) break;
+		let response;
+		try {
+			response = await fetcher(url, {
+				headers: {
+					"user-agent": "void-deploy-readiness/1",
+					...headers,
+					...versionOverride ? { "Cloudflare-Workers-Version-Overrides": `${workerName}="${versionOverride}"` } : {}
+				},
+				redirect: "manual",
+				signal: AbortSignal.timeout(Math.max(1, Math.min(1e4, remaining)))
+			});
+			if (response.ok) {
+				if ((await response.json()).ready === true) return "ready";
+			} else if (await isCloudflareAccessDenial(response)) return "access-denied";
+		} catch {} finally {
+			if (response && !response.bodyUsed) await response.body?.cancel().catch(() => {});
+		}
+		if (attempt + 1 < attempts) {
+			const delay = Math.min(250 * 2 ** attempt, 2e3, deadline - Date.now());
+			if (delay > 0) await sleep(delay);
+		}
+	}
+	return "failed";
+}
+/** Never forward Access headers to a hostname that cannot be this Worker. */
+function guardedReadinessHeaders(url, workerName, headers, authenticatedWorkersDevSubdomain) {
+	if (!headers || Object.keys(headers).length === 0) return {};
+	try {
+		const parsed = new URL(url);
+		const firstLabel = parsed.hostname.toLowerCase().split(".")[0] ?? "";
+		const normalizedWorkerName = workerName.toLowerCase();
+		const subdomain = extractWorkersDevSubdomain(url);
+		if (parsed.protocol !== "https:" || !subdomain || subdomain !== authenticatedWorkersDevSubdomain || firstLabel !== normalizedWorkerName && !firstLabel.endsWith(`-${normalizedWorkerName}`)) return null;
+		return headers;
+	} catch {
+		return null;
+	}
+}
+async function isCloudflareAccessDenial(response) {
+	if (response.status >= 300 && response.status < 400 && response.headers.get("location")?.includes("/cdn-cgi/access/")) return true;
+	if (response.status !== 403) return false;
+	if (response.headers.get("cf-mitigated") === "challenge") return true;
+	try {
+		return /(?:error\s+code:\s*)?1050\b/i.test(await response.text());
+	} catch {
+		return false;
+	}
+}
+async function deployVersionPercentages(options, commonArgs, percentages, message) {
+	const metadata = parseCloudflareVersionMessage(message);
+	if ((options.preserveTriggers || metadata?.schema === 2 && metadata.triggerConfig.preserve) && options.configPath) return deployCloudflareVersionTraffic({
+		...options,
+		configPath: options.configPath,
+		percentages,
+		message
+	});
+	return options.runWrangler([
+		"versions",
+		"deploy",
+		...percentages,
+		...commonArgs,
+		"--name",
+		options.workerName,
+		"--message",
+		message,
+		"--yes"
+	], { capture: false });
+}
+/** Change version traffic without synchronizing Worker settings from local config. */
+async function deployCloudflareVersionTraffic(options) {
+	const config = pickWranglerTriggerContext(parseRootWranglerConfig(options.configPath));
+	const directory = mkdtempSync(join(tmpdir(), "void-version-traffic-"));
+	const path = join(directory, "wrangler.json");
+	try {
+		writeFileSync(path, JSON.stringify(config), { mode: 384 });
+		return await options.runWrangler([
+			"versions",
+			"deploy",
+			...options.percentages,
+			"-c",
+			path,
+			"--env=",
+			"--name",
+			options.workerName,
+			"--message",
+			options.message,
+			"--yes"
+		], { capture: false });
+	} finally {
+		rmSync(directory, {
+			recursive: true,
+			force: true
+		});
+	}
+}
+async function restorePreviousVersion(options, commonArgs, previousVersionId, cause, expectedOwnedTraffic) {
+	if (!previousVersionId) return "unavailable";
+	if (!options.verifyUploader()) return "unsafe";
+	const owner = await readCurrentProductionVersion(options, commonArgs);
+	if (owner.kind !== "ok" || !expectedOwnedTraffic.some((expected) => productionVersionPercentagesEqual(owner.versions, expected))) return "unsafe";
+	return isCleanCommandExit(await deployVersionPercentages(options, commonArgs, [`${previousVersionId}@100`], `Void automatic rollback after ${cause}.`)) ? "succeeded" : "failed";
+}
+function workersDevReadinessUrl(workerName, value) {
+	const subdomain = normalizeWorkersDevSubdomain(value);
+	if (!subdomain || !/^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(workerName)) return;
+	return `https://${workerName}.${subdomain}.workers.dev`;
+}
+/** Resolve the stable URL that owns production traffic after triggers are published. */
+function publishedCloudflareUrl(workerName, triggerConfig, fallbackUrl) {
+	if (triggerConfig.workers_dev) return workersDevReadinessUrl(workerName, extractWorkersDevSubdomain(fallbackUrl)) ?? fallbackUrl;
+	return customRouteReadinessUrl(triggerConfig.routes) ?? fallbackUrl;
+}
+/** Normalize an account workers.dev subdomain supplied by config or the environment. */
+function normalizeWorkersDevSubdomain(value) {
+	const normalized = value?.trim().toLowerCase().replace(/\.workers\.dev\/?$/, "");
+	if (!normalized || !/^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.fed)?$/.test(normalized)) return;
+	return normalized;
+}
+/** Extract the account subdomain from a Wrangler-reported workers.dev URL. */
+function extractWorkersDevSubdomain(url) {
+	try {
+		const labels = new URL(url).hostname.toLowerCase().split(".");
+		if (labels.at(-2) !== "workers" || labels.at(-1) !== "dev") return;
+		if (labels.length === 4) return normalizeWorkersDevSubdomain(labels[1]);
+		if (labels.length === 5 && labels[2] === "fed") return normalizeWorkersDevSubdomain(`${labels[1]}.fed`);
+		return;
+	} catch {
+		return;
+	}
+}
+function workersDevSubdomainResult(url) {
+	const workersDevSubdomain = extractWorkersDevSubdomain(url);
+	return workersDevSubdomain ? { workersDevSubdomain } : {};
+}
+function isCleanCommandExit(result) {
+	return result.status === 0 && result.signal == null && (result.error == null || result.error === "");
+}
+function defaultSleep(milliseconds) {
+	return new Promise((resolve) => setTimeout(resolve, milliseconds));
+}
+//#endregion
+export { activateCloudflareVersion, assertCloudflareBindingsPreserved, assertCloudflareDurableObjectLifecycleSupported, assertExistingCloudflareConfig, deployCloudflareVersionTraffic, deployCloudflareVersionTriggers, encodeCloudflareVersionMessage, executeCloudflareDeploy, extractWorkersDevSubdomain, normalizeWorkersDevSubdomain, parseCloudflareVersionMessage, parseRootWranglerConfig, readBindingFieldPresence, readCloudflareTriggerConfig, readCloudflareVersionMigrationTag, readCloudflareWorkerMigrationTag, readConfigEntryString, readExistingCloudflareWorker, readStoredResourceName, readWranglerTopLevelString, renderCloudflareStaticEntry, resolveD1MigrateTarget, stabilizeCloudflareVersionTriggers, stageCloudflareStaticAssets, writeCloudflareFrameworkDeployConfig, writeCloudflareStaticDeployConfig };