@void/deploy-cloudflare 0.21.3 → 0.21.4

package/dist/index.d.mts

@@ -310,6 +310,11 @@ type CloudflareVersionActivationOptions = {
   readinessAttempts?: number;
   /** Verify that omitted remote secrets come from the active Worker Version before uploading. */
   verifyInheritedSecrets?: boolean;
+  /** Pin opaque secret bindings to the live version when an unpublished upload is newer. */
+  pinActiveSecrets?: (activeVersionId: string, bindings: ReadonlyArray<{
+    name: string;
+    type: "secret_text" | "secret_key";
+  }>) => Promise<boolean> | boolean;
   /** Explicitly publish an existing Durable Object Worker in one atomic operation. */
   atomic?: boolean;
   /**

package/dist/index.mjs

@@ -1175,6 +1175,7 @@ async function activateCloudflareVersionWithSecretsFile(options) {
 	};
 	const previousVersionId = previous.versionId;
 	let inheritanceBaseline;
+	let trustedCandidateChain = false;
 	if (options.expectedPreviousVersionId !== void 0 || options.verifyInheritedSecrets === true) {
 		const recent = await readRecentCloudflareVersionIds(options, commonArgs);
 		if (recent === null) return {
@@ -1186,26 +1187,29 @@ async function activateCloudflareVersionWithSecretsFile(options) {
 			const activeIndex = recent.findIndex((version) => version.id === previous.versionId);
 			const inheritedChain = activeIndex < 0 ? [] : recent.slice(activeIndex);
 			const inheritedCandidates = inheritedChain.slice(1).map((version) => version.id);
-			if (!(inheritedChain.length > 0 && inheritedChain.every((version, index) => index === 0 || version.number === inheritedChain[index - 1].number + 1) && arraysEqual(inheritedCandidates, options.trustedInheritanceVersionIds ?? []))) return {
+			trustedCandidateChain = options.trustedInheritanceVersionIds !== void 0 && options.trustedInheritanceVersionIds.length > 0 && arraysEqual(inheritedCandidates, options.trustedInheritanceVersionIds);
+			if (!(inheritedChain.length > 0 && inheritedChain.every((version, index) => index === 0 || version.number === inheritedChain[index - 1].number + 1) && (arraysEqual(inheritedCandidates, options.trustedInheritanceVersionIds ?? []) || options.pinActiveSecrets !== void 0))) return {
 				ok: false,
 				reason: "inheritance-source-changed",
 				activeVersionId: recent.at(-1)?.id ?? null,
 				rollback: "not-needed"
 			};
 		}
-		const trustedCandidateChain = options.trustedInheritanceVersionIds !== void 0 && options.trustedInheritanceVersionIds.length > 0 && previous.versionId !== latestVersionId;
 		if (options.verifyInheritedSecrets === true && previous.versionId !== latestVersionId && !trustedCandidateChain) {
 			const replacesAllRemoteSecrets = await candidateReplacesAllRemoteSecrets(options, commonArgs, previous.versionId, latestVersionId);
 			if (replacesAllRemoteSecrets === null) return {
 				ok: false,
 				reason: "inheritance-source-unavailable"
 			};
-			if (!replacesAllRemoteSecrets) return {
-				ok: false,
-				reason: "inheritance-source-changed",
-				activeVersionId: latestVersionId,
-				rollback: "not-needed"
-			};
+			if (!replacesAllRemoteSecrets) {
+				const activeSecrets = previous.versionId ? await readCloudflareVersionSecretBindings(options, commonArgs, previous.versionId) : null;
+				if (!activeSecrets || !options.pinActiveSecrets || !await options.pinActiveSecrets(previous.versionId, activeSecrets)) return {
+					ok: false,
+					reason: "inheritance-source-changed",
+					activeVersionId: latestVersionId,
+					rollback: "not-needed"
+				};
+			}
 		}
 		inheritanceBaseline = recent;
 	}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@void/deploy-cloudflare",
-  "version": "0.21.3",
+  "version": "0.21.4",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/voidzero-dev/void.git",
@@ -20,7 +20,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@void/deploy-core": "0.21.3",
+    "@void/deploy-core": "0.21.4",
     "jsonc-parser": "3.3.1"
   },
   "devDependencies": {