@void/deploy-cloudflare 0.21.8 → 0.22.0

package/dist/index.d.mts

@@ -168,6 +168,8 @@ type CloudflareVersionMetadata = Readonly<{
   schema: 2;
   migrations: ReadonlyArray<string>;
   triggerConfig: CloudflareTriggerConfig;
+  /** Digest of the complete Worker upload input, when supplied by the caller. */
+  contentHash?: string;
 }>;
 type CloudflareTriggerConfig = Readonly<{
   /** This version retained the existing triggers instead of publishing a snapshot. */
@@ -218,7 +220,7 @@ type CloudflareVersionActivation = {
   triggerRepair?: "succeeded" | "failed" | "unavailable";
 };
 /** Encode migration state into Cloudflare's version annotation for safe rollback diagnostics. */
-export declare function encodeCloudflareVersionMessage(migrations: ReadonlyArray<string>, triggerConfig?: CloudflareTriggerConfig): string;
+export declare function encodeCloudflareVersionMessage(migrations: ReadonlyArray<string>, triggerConfig?: CloudflareTriggerConfig, contentHash?: string): string;
 /** Read migration state written by {@link encodeCloudflareVersionMessage}. */
 export declare function parseCloudflareVersionMessage(message: string | null | undefined): CloudflareVersionMetadata | null;
 /**

package/dist/index.mjs

@@ -768,15 +768,17 @@ const WORKERS_DEV_URL_RE = /(https:\/\/[a-z0-9.-]+\.workers\.dev(?:\/[^\s]*)?)/i
 const CLOUDFLARE_ERROR_CODE_RE = /\[code:\s*(\d+)\]/i;
 const DURABLE_MIGRATION_VERSION_ERROR = 10211;
 /** Encode migration state into Cloudflare's version annotation for safe rollback diagnostics. */
-function encodeCloudflareVersionMessage(migrations, triggerConfig) {
-	return `void:${JSON.stringify(triggerConfig ? {
+function encodeCloudflareVersionMessage(migrations, triggerConfig, contentHash) {
+	const metadata = triggerConfig ? {
 		schema: 2,
 		migrations,
-		triggerConfig
+		triggerConfig,
+		...contentHash ? { contentHash } : {}
 	} : {
 		schema: 1,
 		migrations
-	})}`;
+	};
+	return `void:${JSON.stringify(metadata)}`;
 }
 /** Read migration state written by {@link encodeCloudflareVersionMessage}. */
 function parseCloudflareVersionMessage(message) {
@@ -789,11 +791,13 @@ function parseCloudflareVersionMessage(message) {
 			migrations: value.migrations
 		};
 		const triggerConfig = parseTriggerConfig(value.triggerConfig);
-		return triggerConfig ? {
+		if (!triggerConfig) return null;
+		return {
 			schema: 2,
 			migrations: value.migrations,
-			triggerConfig
-		} : null;
+			triggerConfig,
+			...typeof value.contentHash === "string" && /^[a-f0-9]{64}$/.test(value.contentHash) ? { contentHash: value.contentHash } : {}
+		};
 	} catch {
 		return null;
 	}
@@ -1182,8 +1186,10 @@ async function activateCloudflareVersionWithSecretsFile(options) {
 		reason: "uploader-changed"
 	};
 	const previousVersionId = previous.versionId;
+	const trustedInheritanceVersionIds = previousVersionId && options.trustedInheritanceVersionIds?.at(-1) === previousVersionId ? [] : options.trustedInheritanceVersionIds;
 	let inheritanceBaseline;
 	let trustedCandidateChain = false;
+	let activeSecretsPinned = false;
 	if (options.expectedPreviousVersionId !== void 0 || options.verifyInheritedSecrets === true) {
 		const recent = await readRecentCloudflareVersionIds(options, commonArgs);
 		if (recent === null) return {
@@ -1191,12 +1197,12 @@ async function activateCloudflareVersionWithSecretsFile(options) {
 			reason: "inheritance-source-unavailable"
 		};
 		const latestVersionId = recent.at(-1)?.id ?? null;
-		if (options.expectedPreviousVersionId !== void 0 || options.trustedInheritanceVersionIds !== void 0) {
+		if (options.expectedPreviousVersionId !== void 0 || trustedInheritanceVersionIds !== void 0) {
 			const activeIndex = recent.findIndex((version) => version.id === previous.versionId);
 			const inheritedChain = activeIndex < 0 ? [] : recent.slice(activeIndex);
 			const inheritedCandidates = inheritedChain.slice(1).map((version) => version.id);
-			trustedCandidateChain = options.trustedInheritanceVersionIds !== void 0 && options.trustedInheritanceVersionIds.length > 0 && arraysEqual(inheritedCandidates, options.trustedInheritanceVersionIds);
-			if (!(inheritedChain.length > 0 && inheritedChain.every((version, index) => index === 0 || version.number === inheritedChain[index - 1].number + 1) && (arraysEqual(inheritedCandidates, options.trustedInheritanceVersionIds ?? []) || options.pinActiveSecrets !== void 0))) return {
+			trustedCandidateChain = trustedInheritanceVersionIds !== void 0 && trustedInheritanceVersionIds.length > 0 && arraysEqual(inheritedCandidates, trustedInheritanceVersionIds);
+			if (!(inheritedChain.length > 0 && inheritedChain.every((version, index) => index === 0 || version.number === inheritedChain[index - 1].number + 1) && (arraysEqual(inheritedCandidates, trustedInheritanceVersionIds ?? []) || options.pinActiveSecrets !== void 0))) return {
 				ok: false,
 				reason: "inheritance-source-changed",
 				activeVersionId: recent.at(-1)?.id ?? null,
@@ -1217,6 +1223,7 @@ async function activateCloudflareVersionWithSecretsFile(options) {
 					activeVersionId: latestVersionId,
 					rollback: "not-needed"
 				};
+				activeSecretsPinned = true;
 			}
 		}
 		inheritanceBaseline = recent;
@@ -1258,10 +1265,16 @@ async function activateCloudflareVersionWithSecretsFile(options) {
 	} : versionedPreviousTriggerConfig;
 	const previousTriggerConfig = triggerConfigWithQueueConsumerCleanup(versionedPreviousTriggerConfigWithTraffic, options.queueConsumerCleanup);
 	const alias = `void-ready-${Date.now().toString(36)}`;
-	if (options.atomic && previous.versionId !== null) return bootstrapFirstDeployment({
-		...options,
-		message
-	}, commonArgs, previous.versionId, true);
+	if (options.atomic && previous.versionId !== null) {
+		if (!activeSecretsPinned && options.pinActiveSecrets) {
+			const activeSecrets = await readCloudflareVersionSecretBindings(options, commonArgs, previous.versionId);
+			if (activeSecrets?.length) await options.pinActiveSecrets(previous.versionId, activeSecrets);
+		}
+		return bootstrapFirstDeployment({
+			...options,
+			message
+		}, commonArgs, previous.versionId, true);
+	}
 	options.onProgress?.("Uploading the Worker and assets...");
 	const upload = await Promise.resolve(options.runWrangler([
 		"versions",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@void/deploy-cloudflare",
-  "version": "0.21.8",
+  "version": "0.22.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/voidzero-dev/void.git",
@@ -20,15 +20,15 @@
     "access": "public"
   },
   "dependencies": {
-    "@void/deploy-core": "0.21.8",
+    "@void/deploy-core": "0.22.0",
     "jsonc-parser": "3.3.1"
   },
   "devDependencies": {
     "@cloudflare/workers-types": "^4.20260702.1",
-    "@types/node": "^26.5.1",
+    "@types/node": "^26.6.3",
     "pathslash": "^0.1.0",
     "typescript": "7.0.2",
-    "vite-plus": "0.3.1"
+    "vite-plus": "1.0.0"
   },
   "scripts": {
     "build": "vp pack",