@void/deploy-cloudflare 0.20.1 → 0.20.2

package/dist/index.d.mts

@@ -321,4 +321,23 @@ export declare function normalizeWorkersDevSubdomain(value: string | undefined):
 /** Extract the account subdomain from a Wrangler-reported workers.dev URL. */
 export declare function extractWorkersDevSubdomain(url: string): string | undefined;
 //#endregion
+//#region src/metadata.d.ts
+/**
+ * Share one authenticated transport for the activator's read-only metadata calls.
+ * Writes and unsupported commands retain the pinned Wrangler runner. Responses
+ * keep its JSON contract so activation and concurrency checks remain unchanged.
+ */
+export declare function createCloudflareMetadataRunner(options: {
+  runWrangler: CloudflareCommandRunner;
+  accountId: string;
+  apiBaseUrl: string;
+  workerName: string;
+  configPath?: string;
+  getToken: () => Promise<string | null>;
+  verifyUploader: () => boolean;
+  fetch?: typeof globalThis.fetch;
+  /** Environment used to decide whether Wrangler's proxy-aware transport is required. */
+  env?: Readonly<Record<string, string | undefined>>;
+}): CloudflareCommandRunner;
+//#endregion
 export type { ApprovedCloudflareKvBinding, CloudflareCommandResult, CloudflareCommandRunner, CloudflareDeployExecution, CloudflareFrameworkDeployConfig, CloudflareStaticDeployConfig, CloudflareTrafficConfig, CloudflareTriggerConfig, CloudflareTriggerStabilization, CloudflareVersionActivation, CloudflareVersionActivationOptions, CloudflareVersionMetadata, CloudflareWorkerMigrationTagOptions, ExistingCloudflareWorker };

package/dist/index.mjs

@@ -130,7 +130,7 @@ async function readCloudflareWorker(options, allowMissing) {
 		}
 		try {
 			const value = JSON.parse(result.stdout);
-			if (record(value)) return value;
+			if (record$1(value)) return value;
 		} catch {}
 		throw new Error("Cloudflare returned an invalid existing Worker response.");
 	};
@@ -141,7 +141,7 @@ async function readCloudflareWorker(options, allowMissing) {
 	if (deployment === null) return null;
 	const versions = deployment.versions;
 	if (allowMissing && Array.isArray(versions) && versions.length === 0) return null;
-	if (!Array.isArray(versions) || versions.length !== 1 || !record(versions[0]) || versions[0].percentage !== 100 || typeof versions[0].version_id !== "string") throw new Error("The existing Worker must have one deployed version receiving all traffic. Finish any gradual rollout before linking.");
+	if (!Array.isArray(versions) || versions.length !== 1 || !record$1(versions[0]) || versions[0].percentage !== 100 || typeof versions[0].version_id !== "string") throw new Error("The existing Worker must have one deployed version receiving all traffic. Finish any gradual rollout before linking.");
 	const versionId = versions[0].version_id;
 	const version = await read([
 		"versions",
@@ -150,7 +150,7 @@ async function readCloudflareWorker(options, allowMissing) {
 	]);
 	if (version === null) throw new Error("Cloudflare did not return the existing Worker configuration.");
 	const resources = version.resources;
-	if (version.id !== versionId || !record(resources) || !Array.isArray(resources.bindings) || !resources.bindings.every(record) || !record(resources.script_runtime) || !record(resources.script)) throw new Error("Cloudflare did not return the existing Worker configuration.");
+	if (version.id !== versionId || !record$1(resources) || !Array.isArray(resources.bindings) || !resources.bindings.every(record$1) || !record$1(resources.script_runtime) || !record$1(resources.script)) throw new Error("Cloudflare did not return the existing Worker configuration.");
 	const after = options.versionId ? deployment : await read(["deployments", "status"]);
 	if (after === null || !isDeepStrictEqual(deployment.versions, after.versions)) throw new Error("Cloudflare production changed while linking. Retry from the current deployment.");
 	return {
@@ -165,12 +165,12 @@ async function readCloudflareWorker(options, allowMissing) {
 }
 /** Parse legacy version-detail shapes; this is not authoritative Worker migration state. */
 function readCloudflareVersionMigrationTag(version) {
-	if (!record(version)) return null;
-	const resources = record(version.resources) ? version.resources : void 0;
+	if (!record$1(version)) return null;
+	const resources = record$1(version.resources) ? version.resources : void 0;
 	const tag = [
-		resources && record(resources.script_runtime) ? resources.script_runtime.migration_tag : null,
-		resources && record(resources.script) ? resources.script.migration_tag : null,
-		record(version.script) ? version.script.migration_tag : null,
+		resources && record$1(resources.script_runtime) ? resources.script_runtime.migration_tag : null,
+		resources && record$1(resources.script) ? resources.script.migration_tag : null,
+		record$1(version.script) ? version.script.migration_tag : null,
 		version.migration_tag
 	].find((candidate) => typeof candidate === "string");
 	return typeof tag === "string" && tag.length > 0 ? tag : null;
@@ -195,9 +195,9 @@ async function readCloudflareWorkerMigrationTag(options) {
 	} catch {
 		throw new Error(`Cloudflare returned an invalid Durable Object migration response for Worker "${options.workerName}".`);
 	}
-	if (!response.ok || !record(body) || body.success !== true || !Array.isArray(body.result)) throw new Error(`Could not verify Durable Object migration state for Cloudflare Worker "${options.workerName}".`);
-	const worker = body.result.find((candidate) => record(candidate) && candidate.id === options.workerName);
-	if (!record(worker)) throw new Error(`Cloudflare did not return migration state for Worker "${options.workerName}".`);
+	if (!response.ok || !record$1(body) || body.success !== true || !Array.isArray(body.result)) throw new Error(`Could not verify Durable Object migration state for Cloudflare Worker "${options.workerName}".`);
+	const worker = body.result.find((candidate) => record$1(candidate) && candidate.id === options.workerName);
+	if (!record$1(worker)) throw new Error(`Cloudflare did not return migration state for Worker "${options.workerName}".`);
 	if (worker.migration_tag === void 0 || worker.migration_tag === null) return null;
 	if (typeof worker.migration_tag !== "string" || worker.migration_tag.length === 0) throw new Error(`Cloudflare returned an invalid Durable Object migration response for Worker "${options.workerName}".`);
 	return worker.migration_tag;
@@ -215,7 +215,7 @@ async function readCloudflareApiAuthentication(runWrangler) {
 	} catch {
 		throw new Error("Cloudflare returned an invalid authentication response.");
 	}
-	if (!record(value)) throw new Error("Cloudflare returned an invalid authentication response.");
+	if (!record$1(value)) throw new Error("Cloudflare returned an invalid authentication response.");
 	if ((value.type === "oauth" || value.type === "api_token") && typeof value.token === "string" && value.token.length > 0) return { Authorization: `Bearer ${value.token}` };
 	if (value.type === "api_key" && typeof value.key === "string" && value.key.length > 0 && typeof value.email === "string" && value.email.length > 0) return {
 		"X-Auth-Key": value.key,
@@ -260,7 +260,7 @@ function parseDurableObjectMigrations(value) {
 	if (value === void 0) return [];
 	if (!Array.isArray(value)) throw new Error("deploy: generated Cloudflare config has a malformed migrations field.");
 	return value.map((migration) => {
-		if (!record(migration) || typeof migration.tag !== "string") throw new Error("deploy: generated Cloudflare config has a malformed class migration.");
+		if (!record$1(migration) || typeof migration.tag !== "string") throw new Error("deploy: generated Cloudflare config has a malformed class migration.");
 		const fields = [
 			migration.new_classes,
 			migration.new_sqlite_classes,
@@ -301,7 +301,7 @@ function assertCloudflareBindingsPreserved(before, after, approvedKv = [], optio
 }
 function isAssetsOnlyWorker(worker) {
 	const handlers = worker.script.handlers;
-	return record(worker.runtime.assets) && (handlers === null || Array.isArray(handlers) && handlers.length === 0);
+	return record$1(worker.runtime.assets) && (handlers === null || Array.isArray(handlers) && handlers.length === 0);
 }
 function existingWorkerHandlers(worker) {
 	return isAssetsOnlyWorker(worker) ? [] : worker.script.handlers;
@@ -312,12 +312,12 @@ function assertExistingCloudflareConfig(existing, config, built = false, approve
 	if (additions.length > 0) {
 		const entries = config.kv_namespaces;
 		for (const addition of additions) {
-			const matches = Array.isArray(entries) ? entries.filter((entry) => record(entry) && entry.binding === addition.binding) : [];
+			const matches = Array.isArray(entries) ? entries.filter((entry) => record$1(entry) && entry.binding === addition.binding) : [];
 			if ((built || matches.length > 0) && (matches.length !== 1 || matches[0].id !== addition.id)) throw new Error(`Binding ${addition.binding} must reference its approved KV namespace when linking.`);
 		}
 		if (Array.isArray(entries)) config = {
 			...config,
-			kv_namespaces: entries.filter((entry) => !record(entry) || !additions.some((addition) => addition.binding === entry.binding))
+			kv_namespaces: entries.filter((entry) => !record$1(entry) || !additions.some((addition) => addition.binding === entry.binding))
 		};
 	}
 	const handlers = existingWorkerHandlers(existing);
@@ -334,7 +334,7 @@ function assertExistingCloudflareConfig(existing, config, built = false, approve
 		const value = config[field];
 		if (hasContent(value)) throw new Error(`The existing Worker handoff cannot change ${field}. Keep this deployment limited to the existing site.`);
 	}
-	if (record(existing.runtime.exports) && Object.values(existing.runtime.exports).some((value) => record(value) && value.type !== "worker")) throw new Error("The existing Worker exports stateful classes. Migrate those classes separately before linking.");
+	if (record$1(existing.runtime.exports) && Object.values(existing.runtime.exports).some((value) => record$1(value) && value.type !== "worker")) throw new Error("The existing Worker exports stateful classes. Migrate those classes separately before linking.");
 	for (const field of [
 		"compatibility_date",
 		"compatibility_flags",
@@ -345,7 +345,7 @@ function assertExistingCloudflareConfig(existing, config, built = false, approve
 		const equal = field === "compatibility_flags" ? stringSetEqual(actual, expected) : isDeepStrictEqual(actual, expected);
 		if ((built || config[field] !== void 0) && !equal) throw new Error(`Keep the existing Worker's ${field} when linking. Update it in a later deployment.`);
 	}
-	const vars = record(config.vars) ? config.vars : {};
+	const vars = record$1(config.vars) ? config.vars : {};
 	const remote = new Map(existing.bindings.map((binding) => [binding.name, binding]));
 	for (const [name, value] of Object.entries(vars)) {
 		const binding = remote.get(name);
@@ -389,21 +389,21 @@ function assertExistingCloudflareConfig(existing, config, built = false, approve
 			"secret_key"
 		].includes(String(binding.type))) continue;
 		if (binding.type === "assets") {
-			if (built && (!record(config.assets) || config.assets.binding !== binding.name)) throw new Error(`Keep the existing assets binding ${binding.name} when linking.`);
+			if (built && (!record$1(config.assets) || config.assets.binding !== binding.name)) throw new Error(`Keep the existing assets binding ${binding.name} when linking.`);
 			continue;
 		}
 		const mapping = supported[String(binding.type)];
 		if (!mapping) throw new Error(`The existing binding ${binding.name} (${String(binding.type)}) is not yet supported when linking.`);
 		const [field, localId, remoteId] = mapping;
 		const entries = config[field];
-		const matches = Array.isArray(entries) ? entries.filter((entry) => record(entry) && entry.binding === binding.name) : [];
+		const matches = Array.isArray(entries) ? entries.filter((entry) => record$1(entry) && entry.binding === binding.name) : [];
 		const entry = matches[0];
-		if (matches.length !== 1 || !record(entry) || typeof binding[remoteId] !== "string" || entry[localId] !== binding[remoteId] || binding.type === "service" && ((entry.environment ?? "production") !== (binding.environment ?? "production") || entry.entrypoint !== binding.entrypoint) || binding.type === "r2_bucket" && (entry.jurisdiction ?? "default") !== (binding.jurisdiction ?? "default")) throw new Error(`Binding ${binding.name} must reference the existing Cloudflare resource when linking.`);
+		if (matches.length !== 1 || !record$1(entry) || typeof binding[remoteId] !== "string" || entry[localId] !== binding[remoteId] || binding.type === "service" && ((entry.environment ?? "production") !== (binding.environment ?? "production") || entry.entrypoint !== binding.entrypoint) || binding.type === "r2_bucket" && (entry.jurisdiction ?? "default") !== (binding.jurisdiction ?? "default")) throw new Error(`Binding ${binding.name} must reference the existing Cloudflare resource when linking.`);
 		found.add(binding.name);
 	}
 	for (const [field] of Object.values(supported)) {
 		const entries = config[field];
-		if (Array.isArray(entries) && entries.some((entry) => !record(entry) || !found.has(String(entry.binding)))) throw new Error(`Linking cannot add or replace ${field}. Use the existing resource bindings.`);
+		if (Array.isArray(entries) && entries.some((entry) => !record$1(entry) || !found.has(String(entry.binding)))) throw new Error(`Linking cannot add or replace ${field}. Use the existing resource bindings.`);
 	}
 }
 function newApprovedKvBindings(existing, approved) {
@@ -426,13 +426,13 @@ function stringSetEqual(left, right) {
 	if (!Array.isArray(left) || !left.every((value) => typeof value === "string") || !Array.isArray(right) || !right.every((value) => typeof value === "string")) return false;
 	return isDeepStrictEqual([...new Set(left)].sort(), [...new Set(right)].sort());
 }
-function record(value) {
+function record$1(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 function hasContent(value) {
 	if (value === void 0 || value === null) return false;
 	if (Array.isArray(value)) return value.length > 0;
-	if (record(value)) return Object.values(value).some(hasContent);
+	if (record$1(value)) return Object.values(value).some(hasContent);
 	return true;
 }
 //#endregion
@@ -1166,10 +1166,10 @@ async function activateCloudflareVersionWithSecretsFile(options) {
 	}
 	const desiredMetadata = parseCloudflareVersionMessage(options.message);
 	let desiredTriggerConfig = desiredMetadata?.schema === 2 ? desiredMetadata.triggerConfig : options.configPath ? readCloudflareTriggerConfig(options.configPath) : triggerConfigFromWrangler({});
-	let previousVersion = previousVersionId && desiredMetadata?.schema === 2 ? await readCloudflareVersionInspection(options, commonArgs, previousVersionId) : null;
+	let previousVersion = previousVersionId && desiredMetadata?.schema === 2 ? await readCloudflareVersionInspection(options, commonArgs, previousVersionId, inheritanceBaseline?.map((version) => version.inspection)) : null;
 	async function previousIsSecretOnlyDraft() {
 		if (!previousVersionId) return false;
-		previousVersion ??= await readCloudflareVersionInspection(options, commonArgs, previousVersionId);
+		previousVersion ??= await readCloudflareVersionInspection(options, commonArgs, previousVersionId, inheritanceBaseline?.map((version) => version.inspection));
 		return previousVersion?.isSecretOnlyDraft === true;
 	}
 	const previousMetadata = desiredMetadata?.schema === 2 ? previousVersion?.metadata : null;
@@ -1539,18 +1539,21 @@ async function restorePreviousVersionAndTriggers(options, commonArgs, previousVe
 async function readCloudflareVersionMetadata(options, commonArgs, versionId) {
 	return (await readCloudflareVersionInspection(options, commonArgs, versionId))?.metadata ?? null;
 }
-async function readCloudflareVersionInspection(options, commonArgs, versionId) {
-	const result = await Promise.resolve(options.runWrangler([
-		"versions",
-		"list",
-		...commonArgs,
-		"--name",
-		options.workerName,
-		"--json"
-	], { capture: true }));
-	if (!isCleanCommandExit(result)) return null;
+async function readCloudflareVersionInspection(options, commonArgs, versionId, knownVersions) {
 	try {
-		const versions = JSON.parse(result.stdout);
+		let versions = knownVersions;
+		if (versions === void 0) {
+			const result = await options.runWrangler([
+				"versions",
+				"list",
+				...commonArgs,
+				"--name",
+				options.workerName,
+				"--json"
+			], { capture: true });
+			if (!isCleanCommandExit(result)) return null;
+			versions = JSON.parse(result.stdout);
+		}
 		if (!Array.isArray(versions)) return null;
 		for (const entry of versions) {
 			if (!isRecord(entry) || entry.id !== versionId) continue;
@@ -1600,7 +1603,8 @@ async function readRecentCloudflareVersionIds(options, commonArgs) {
 		if (!Array.isArray(versions) || !versions.every((version) => isRecord(version) && typeof version.id === "string" && typeof version.number === "number" && Number.isSafeInteger(version.number))) return null;
 		return versions.map((version) => ({
 			id: version.id,
-			number: version.number
+			number: version.number,
+			inspection: version
 		}));
 	} catch {
 		return null;
@@ -1963,4 +1967,108 @@ function defaultSleep(milliseconds) {
 	return new Promise((resolve) => setTimeout(resolve, milliseconds));
 }
 //#endregion
-export { activateCloudflareVersion, assertCloudflareBindingsPreserved, assertCloudflareDurableObjectLifecycleSupported, assertExistingCloudflareConfig, deployCloudflareVersionTraffic, deployCloudflareVersionTriggers, encodeCloudflareVersionMessage, executeCloudflareDeploy, extractWorkersDevSubdomain, normalizeWorkersDevSubdomain, parseCloudflareVersionMessage, parseRootWranglerConfig, readBindingFieldPresence, readCloudflareTriggerConfig, readCloudflareVersionMigrationTag, readCloudflareWorkerMigrationTag, readConfigEntryString, readExistingCloudflareWorker, readStoredResourceName, readWranglerTopLevelString, renderCloudflareStaticEntry, resolveD1MigrateTarget, stabilizeCloudflareVersionTriggers, stageCloudflareStaticAssets, writeCloudflareFrameworkDeployConfig, writeCloudflareStaticDeployConfig };
+//#region src/metadata.ts
+/**
+* Share one authenticated transport for the activator's read-only metadata calls.
+* Writes and unsupported commands retain the pinned Wrangler runner. Responses
+* keep its JSON contract so activation and concurrency checks remain unchanged.
+*/
+function createCloudflareMetadataRunner(options) {
+	let tokenPromise;
+	const common = [
+		...options.configPath ? ["-c", options.configPath] : [],
+		"--env=",
+		"--name",
+		options.workerName,
+		"--json"
+	];
+	const prefix = `${options.apiBaseUrl.replace(/\/$/, "")}/accounts/${encodeURIComponent(options.accountId)}/workers/scripts/${encodeURIComponent(options.workerName)}`;
+	const fetcher = options.fetch ?? globalThis.fetch;
+	const proxyEnv = options.env ?? process.env;
+	const requiresWranglerProxy = Boolean(proxyEnv.https_proxy || proxyEnv.HTTPS_PROXY || proxyEnv.http_proxy || proxyEnv.HTTP_PROXY);
+	const refused = {
+		status: 1,
+		stdout: "",
+		stderr: "Cloudflare uploader integrity check failed.",
+		error: "uploader-changed"
+	};
+	const fallback = (args, runOptions) => options.verifyUploader() ? options.runWrangler(args, runOptions) : refused;
+	return async (args, runOptions) => {
+		let kind;
+		let resource;
+		let rest = [];
+		if (args[0] === "deployments" && args[1] === "status") {
+			kind = "deployment";
+			resource = "/deployments";
+			rest = args.slice(2);
+		} else if (args[0] === "versions" && args[1] === "list") {
+			kind = "versions";
+			resource = "/versions?deployable=true";
+			rest = args.slice(2);
+		} else if (args[0] === "versions" && args[1] === "view" && /^[0-9a-f-]{36}$/i.test(args[2] ?? "")) {
+			kind = "version";
+			resource = `/versions/${encodeURIComponent(args[2])}`;
+			rest = args.slice(3);
+		}
+		if (!kind || !runOptions.capture || rest.length !== common.length || rest.some((value, i) => value !== common[i])) return fallback(args, runOptions);
+		if (requiresWranglerProxy) return fallback(args, runOptions);
+		let response;
+		try {
+			if (!tokenPromise && !options.verifyUploader()) return refused;
+			const token = await (tokenPromise ??= options.getToken());
+			if (token) {
+				response = await fetcher(prefix + resource, {
+					headers: { Authorization: `Bearer ${token}` },
+					redirect: "manual",
+					signal: AbortSignal.timeout(1e4)
+				});
+				if (response.status === 401 || response.status === 403) tokenPromise = void 0;
+				if (response.ok) {
+					const body = await response.json();
+					if (record(body) && body.success === true && record(body.result)) {
+						const result = body.result;
+						if (kind === "deployment" && Array.isArray(result.deployments)) {
+							const latest = result.deployments[0];
+							if (result.deployments.length === 0) return {
+								status: 1,
+								stdout: "",
+								stderr: `The Worker ${options.workerName} has no deployments.`
+							};
+							if (record(latest) && Array.isArray(latest.versions)) return {
+								status: 0,
+								stdout: JSON.stringify(latest),
+								stderr: ""
+							};
+						}
+						if (kind === "version" && result.id === args[2]) return {
+							status: 0,
+							stdout: JSON.stringify(result),
+							stderr: ""
+						};
+						if (kind === "versions" && Array.isArray(result.items)) {
+							const items = result.items;
+							if (items.every((item) => record(item) && record(item.metadata) && typeof item.metadata.created_on === "string")) {
+								const sorted = items.sort((a, b) => a.metadata.created_on.localeCompare(b.metadata.created_on)).slice(-10);
+								return {
+									status: 0,
+									stdout: JSON.stringify(sorted),
+									stderr: ""
+								};
+							}
+						}
+					}
+				}
+			}
+		} catch {
+			tokenPromise = void 0;
+		} finally {
+			if (response && !response.bodyUsed) await response.body?.cancel().catch(() => {});
+		}
+		return fallback(args, runOptions);
+	};
+}
+function record(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+//#endregion
+export { activateCloudflareVersion, assertCloudflareBindingsPreserved, assertCloudflareDurableObjectLifecycleSupported, assertExistingCloudflareConfig, createCloudflareMetadataRunner, deployCloudflareVersionTraffic, deployCloudflareVersionTriggers, encodeCloudflareVersionMessage, executeCloudflareDeploy, extractWorkersDevSubdomain, normalizeWorkersDevSubdomain, parseCloudflareVersionMessage, parseRootWranglerConfig, readBindingFieldPresence, readCloudflareTriggerConfig, readCloudflareVersionMigrationTag, readCloudflareWorkerMigrationTag, readConfigEntryString, readExistingCloudflareWorker, readStoredResourceName, readWranglerTopLevelString, renderCloudflareStaticEntry, resolveD1MigrateTarget, stabilizeCloudflareVersionTriggers, stageCloudflareStaticAssets, writeCloudflareFrameworkDeployConfig, writeCloudflareStaticDeployConfig };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@void/deploy-cloudflare",
-  "version": "0.20.1",
+  "version": "0.20.2",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/voidzero-dev/void.git",
@@ -20,7 +20,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@void/deploy-core": "0.20.1",
+    "@void/deploy-core": "0.20.2",
     "jsonc-parser": "3.3.1"
   },
   "devDependencies": {