@void/deploy-cloudflare 0.21.9 → 0.23.0

package/dist/index.d.mts

@@ -1,13 +1,120 @@
 import { AssetConfig, HeaderRule, RedirectRule } from "@void/deploy-core";
+//#region src/operations.d.ts
+/** Typed provider operations shared by app deployment and platform installation. */
+type ConfigTarget = {
+  configPath?: string;
+};
+type WorkerTarget = ConfigTarget & {
+  workerName?: string;
+};
+type CloudflareOperation = ({
+  type: "auth.whoami" | "auth.login" | "auth.logout" | "auth.token";
+} & ConfigTarget) | ({
+  type: "d1.list" | "kv.namespace.list" | "containers.list";
+} & ConfigTarget) | ({
+  type: "d1.info";
+  name: string;
+} & ConfigTarget) | {
+  type: "d1.create";
+  name: string;
+  binding: string;
+  configPath: string;
+} | {
+  type: "d1.execute";
+  database: string;
+  sql: string;
+  configPath: string;
+} | {
+  type: "d1.migrations.list" | "d1.migrations.apply";
+  database: string;
+  configPath: string;
+} | {
+  type: "kv.namespace.create";
+  name: string;
+  binding: string;
+  configPath: string;
+} | ({
+  type: "r2.bucket.info";
+  name: string;
+} & ConfigTarget) | {
+  type: "r2.bucket.create";
+  name: string;
+  binding: string;
+  configPath: string;
+} | {
+  type: "hyperdrive.create";
+  name: string;
+  binding: string;
+  configPath: string;
+} | ({
+  type: "queues.info" | "queues.create";
+  name: string;
+} & ConfigTarget) | ({
+  type: "queues.consumer.remove";
+  queueName: string;
+  workerName: string;
+} & ConfigTarget) | ({
+  type: "email.routing.settings" | "email.routing.enable" | "email.routing.rules.list" | "email.sending.settings" | "email.sending.enable";
+  domain: string;
+} & ConfigTarget) | ({
+  type: "secret.list" | "secret.bulk";
+} & WorkerTarget) | ({
+  type: "secret.put" | "secret.delete";
+  name: string;
+} & WorkerTarget) | ({
+  type: "deployments.status" | "deployments.list" | "versions.list";
+} & WorkerTarget) | ({
+  type: "versions.view";
+  versionId: string;
+} & WorkerTarget) | ({
+  type: "versions.deploy";
+  versions: Array<{
+    versionId: string;
+    percentage: number;
+  }>;
+  message?: string;
+} & WorkerTarget) | ({
+  type: "versions.upload" | "worker.deploy";
+  message?: string;
+  secretsFilePath?: string;
+  assetsDirectory?: string;
+  previewAlias?: string;
+  noBundle?: boolean;
+} & WorkerTarget) | ({
+  type: "triggers.deploy";
+  assets?: boolean;
+} & WorkerTarget) | ({
+  type: "triggers.clear-crons" | "triggers.clear-domains";
+} & WorkerTarget) | ({
+  type: "tail";
+  search?: string;
+  versionId?: string;
+  status?: "error";
+} & WorkerTarget);
+type CloudflareUploadResult = {
+  versionId: string;
+  previewUrl?: string;
+  workersDevUrl?: string;
+};
+type CloudflareProviderError = {
+  code?: number;
+  message: string;
+};
+//#endregion
 //#region src/execute.d.ts
 type CloudflareCommandResult = {
+  /** Structured provider response. stdout is diagnostics only. */
+  data?: unknown;
+  errorCode?: number;
+  failure?: "not-found" | "durable-migration" | "containers-unavailable";
+  errors?: Array<CloudflareProviderError>;
   stdout: string;
   stderr: string;
   status: number;
   signal?: NodeJS.Signals | null;
   error?: string | null;
 };
-type CloudflareCommandRunner = (args: Array<string>, options: {
+type CloudflareCommandRunner = (operation: CloudflareOperation, options: {
   capture: boolean;
 }) => CloudflareCommandResult | Promise<CloudflareCommandResult>;
 type CloudflareDeployExecution = {
@@ -112,6 +219,7 @@ type CloudflareFrameworkDeployConfig = Readonly<{
   assetsIgnore?: ReadonlyArray<string>;
   crons?: ReadonlyArray<string>;
   requiredSecrets?: ReadonlyArray<string>;
+  versionMetadataBinding?: string;
   ai?: Readonly<{
     binding: string;
     gateway?: string;
@@ -142,6 +250,7 @@ export declare function renderCloudflareStaticEntry(options: {
   headerRules?: ReadonlyArray<HeaderRule>;
   redirectRules?: ReadonlyArray<RedirectRule>;
   fallbackRules?: ReadonlyArray<RedirectRule>;
+  versionMetadataBinding?: string;
 }): string;
 /**
  * Copy static assets into Void's deploy area without Cloudflare's reserved routing files.
@@ -314,6 +423,10 @@ type CloudflareVersionActivationOptions = {
   fetch?: typeof globalThis.fetch;
   sleep?: (milliseconds: number) => Promise<void>;
   readinessAttempts?: number;
+  /** Require readiness to report the uploaded Worker's actual version UUID. */
+  requireVersionMetadata?: boolean;
+  /** A binding-preserving handoff without metadata may use only a genuine version preview. */
+  requirePreviewForReadiness?: boolean;
   /** Verify that omitted remote secrets come from the active Worker Version before uploading. */
   verifyInheritedSecrets?: boolean;
   /** Pin opaque secret bindings to the live version when an unpublished upload is newer. */
@@ -364,4 +477,4 @@ export declare function createCloudflareMetadataRunner(options: {
   env?: Readonly<Record<string, string | undefined>>;
 }): CloudflareCommandRunner;
 //#endregion
-export type { ApprovedCloudflareKvBinding, CloudflareCommandResult, CloudflareCommandRunner, CloudflareDeployExecution, CloudflareFrameworkDeployConfig, CloudflareStaticDeployConfig, CloudflareTrafficConfig, CloudflareTriggerConfig, CloudflareTriggerStabilization, CloudflareVersionActivation, CloudflareVersionActivationOptions, CloudflareVersionMetadata, CloudflareWorkerMigrationTagOptions, ExistingCloudflareWorker };
+export type { ApprovedCloudflareKvBinding, CloudflareCommandResult, CloudflareCommandRunner, CloudflareDeployExecution, CloudflareFrameworkDeployConfig, CloudflareOperation, CloudflareProviderError, CloudflareStaticDeployConfig, CloudflareTrafficConfig, CloudflareTriggerConfig, CloudflareTriggerStabilization, CloudflareUploadResult, CloudflareVersionActivation, CloudflareVersionActivationOptions, CloudflareVersionMetadata, CloudflareWorkerMigrationTagOptions, ExistingCloudflareWorker };

package/dist/index.mjs

@@ -115,25 +115,18 @@ async function readExistingCloudflareWorker(options) {
 	return worker.snapshot;
 }
 async function readCloudflareWorker(options, allowMissing) {
-	const target = [
-		"-c",
-		options.configPath,
-		"--env=",
-		"--name",
-		options.workerName
-	];
-	const read = async (args, missingIsNull = false) => {
-		const result = await options.runWrangler([
-			...args,
-			...target,
-			"--json"
-		], { capture: true });
+	const target = {
+		configPath: options.configPath,
+		workerName: options.workerName
+	};
+	const read = async (operation, missingIsNull = false) => {
+		const result = await options.runWrangler(operation, { capture: true });
 		if (result.status !== 0 || result.signal || result.error) {
-			if (missingIsNull && isMissingWorkerOutput$1(`${result.stdout}\n${result.stderr}`)) return null;
+			if (missingIsNull && Number.isSafeInteger(result.status) && result.status >= 0 && result.signal == null && (result.error == null || result.error === "") && (result.failure === "not-found" || result.errorCode === 10007)) return null;
 			throw new CloudflareWorkerInspectionError(`Could not verify existing Cloudflare Worker "${options.workerName}". Check the account, Worker name, and Cloudflare permissions before retrying.`);
 		}
 		try {
-			const value = JSON.parse(result.stdout);
+			const value = result.data;
 			if (record$1(value)) return value;
 		} catch {}
 		throw new Error("Cloudflare returned an invalid existing Worker response.");
@@ -141,21 +134,27 @@ async function readCloudflareWorker(options, allowMissing) {
 	const deployment = options.versionId ? { versions: [{
 		version_id: options.versionId,
 		percentage: 100
-	}] } : await read(["deployments", "status"], allowMissing);
+	}] } : await read({
+		type: "deployments.status",
+		...target
+	}, allowMissing);
 	if (deployment === null) return null;
 	const versions = deployment.versions;
 	if (allowMissing && Array.isArray(versions) && versions.length === 0) return null;
 	if (!Array.isArray(versions) || versions.length !== 1 || !record$1(versions[0]) || versions[0].percentage !== 100 || typeof versions[0].version_id !== "string") throw new Error("The existing Worker must have one deployed version receiving all traffic. Finish any gradual rollout before linking.");
 	const versionId = versions[0].version_id;
-	const version = await read([
-		"versions",
-		"view",
-		versionId
-	]);
+	const version = await read({
+		type: "versions.view",
+		versionId,
+		...target
+	});
 	if (version === null) throw new Error("Cloudflare did not return the existing Worker configuration.");
 	const resources = version.resources;
 	if (version.id !== versionId || !record$1(resources) || !Array.isArray(resources.bindings) || !resources.bindings.every(record$1) || !record$1(resources.script_runtime) || !record$1(resources.script)) throw new Error("Cloudflare did not return the existing Worker configuration.");
-	const after = options.versionId ? deployment : await read(["deployments", "status"]);
+	const after = options.versionId ? deployment : await read({
+		type: "deployments.status",
+		...target
+	});
 	if (after === null || !isDeepStrictEqual(deployment.versions, after.versions)) throw new Error("Cloudflare production changed while linking. Retry from the current deployment.");
 	return {
 		snapshot: {
@@ -207,15 +206,11 @@ async function readCloudflareWorkerMigrationTag(options) {
 	return worker.migration_tag;
 }
 async function readCloudflareApiAuthentication(runWrangler) {
-	const result = await runWrangler([
-		"auth",
-		"token",
-		"--json"
-	], { capture: true });
+	const result = await runWrangler({ type: "auth.token" }, { capture: true });
 	if (result.status !== 0 || result.signal || result.error) throw new Error("Could not read the authenticated Cloudflare session.");
 	let value;
 	try {
-		value = JSON.parse(result.stdout);
+		value = result.data;
 	} catch {
 		throw new Error("Cloudflare returned an invalid authentication response.");
 	}
@@ -309,9 +304,6 @@ function declarativeClassesMatch(migrations, actualValue) {
 		return record$1(current) && current.type === "durable-object" && current.storage === storage;
 	});
 }
-function isMissingWorkerOutput$1(output) {
-	return /\[code:\s*10007\]/i.test(output) || /no deployments|\bworker\b.*\b(?:does not exist|not found)\b/i.test(output);
-}
 function assertCloudflareBindingsPreserved(before, after, approvedKv = [], options = {}) {
 	const staticAssetsBinding = isAssetsOnlyWorker(before) ? options.staticAssetsBinding : void 0;
 	const addsAssetsBinding = staticAssetsBinding !== void 0 && !before.bindings.some((binding) => binding.name === staticAssetsBinding);
@@ -381,6 +373,9 @@ function assertExistingCloudflareConfig(existing, config, built = false, approve
 		if ((built || config[field] !== void 0) && !equal) throw new Error(`Keep the existing Worker's ${field} when linking. Update it in a later deployment.`);
 	}
 	const vars = record$1(config.vars) ? config.vars : {};
+	const metadataBindings = existing.bindings.filter((binding) => binding.type === "version_metadata");
+	const metadata = record$1(config.version_metadata) ? config.version_metadata : void 0;
+	if (metadataBindings.length > 1 || metadataBindings.length === 1 && metadata?.binding !== metadataBindings[0].name || metadataBindings.length === 0 && config.version_metadata !== void 0) throw new Error("Keep the existing Worker version_metadata binding when linking; linking cannot add or replace it.");
 	const remote = new Map(existing.bindings.map((binding) => [binding.name, binding]));
 	for (const [name, value] of Object.entries(vars)) {
 		const binding = remote.get(name);
@@ -423,6 +418,7 @@ function assertExistingCloudflareConfig(existing, config, built = false, approve
 			"secret_text",
 			"secret_key"
 		].includes(String(binding.type))) continue;
+		if (binding.type === "version_metadata") continue;
 		if (binding.type === "assets") {
 			if (built && (!record$1(config.assets) || config.assets.binding !== binding.name)) throw new Error(`Keep the existing assets binding ${binding.name} when linking.`);
 			continue;
@@ -478,14 +474,10 @@ async function executeCloudflareDeploy(options) {
 		ok: false,
 		reason: "uploader-changed"
 	};
-	const result = await Promise.resolve(options.runWrangler([
-		"deploy",
-		...options.configPath ? ["-c", options.configPath] : [],
-		"--env=",
-		"--experimental-provision=false",
-		"--experimental-auto-create=false",
-		"--autoconfig=false"
-	], { capture: false }));
+	const result = await Promise.resolve(options.runWrangler({
+		type: "worker.deploy",
+		...options.configPath ? { configPath: options.configPath } : {}
+	}, { capture: false }));
 	if (!isCleanCommandExit$1(result)) return {
 		ok: false,
 		reason: "deploy-failed",
@@ -558,6 +550,7 @@ function writeCloudflareFrameworkDeployConfig(options) {
 	upsert(["account_id"], options.accountId);
 	upsert(["main"], options.main);
 	upsert(["compatibility_date"], options.compatibilityDate);
+	if (options.versionMetadataBinding && parse(content).version_metadata === void 0) upsert(["version_metadata"], { binding: options.versionMetadataBinding });
 	if (options.compatibilityFlags && options.compatibilityFlags.length > 0) {
 		const config = parse(content);
 		const current = Array.isArray(config.compatibility_flags) ? config.compatibility_flags.filter((flag) => typeof flag === "string") : [];
@@ -615,7 +608,8 @@ function renderCloudflareStaticEntry(options) {
 	const config = JSON.stringify({
 		...options.headerRules?.length ? { headerRules: options.headerRules } : {},
 		...options.redirectRules?.length ? { redirectRules: options.redirectRules } : {},
-		...options.fallbackRules?.length ? { fallbackRules: options.fallbackRules } : {}
+		...options.fallbackRules?.length ? { fallbackRules: options.fallbackRules } : {},
+		...options.versionMetadataBinding ? { versionMetadataBinding: options.versionMetadataBinding } : {}
 	});
 	return [
 		`import { createStaticEdgeHandler } from ${JSON.stringify(options.runtimeImport ?? "@void/edge")};`,
@@ -762,10 +756,6 @@ function cloudflareCommandDiagnostic(result) {
 }
 //#endregion
 //#region src/version.ts
-const VERSION_ID_RE = /(?:Worker|Current) Version ID:\s*([0-9a-f]{8}-[0-9a-f-]{27})/i;
-const PREVIEW_URL_RE = /Version Preview(?: Alias)? URL:\s*(https:\/\/\S+)/i;
-const WORKERS_DEV_URL_RE = /(https:\/\/[a-z0-9.-]+\.workers\.dev(?:\/[^\s]*)?)/i;
-const CLOUDFLARE_ERROR_CODE_RE = /\[code:\s*(\d+)\]/i;
 const DURABLE_MIGRATION_VERSION_ERROR = 10211;
 /** Encode migration state into Cloudflare's version annotation for safe rollback diagnostics. */
 function encodeCloudflareVersionMessage(migrations, triggerConfig, contentHash) {
@@ -830,31 +820,23 @@ async function deployCloudflareVersionTriggers(options) {
 	const configPath = join(directory, "wrangler.json");
 	try {
 		writeFileSync(configPath, `${JSON.stringify(config, null, 2)}\n`, { mode: 384 });
-		const deployed = await options.runWrangler([
-			"triggers",
-			"deploy",
-			"-c",
+		const deployed = await options.runWrangler({
+			type: "triggers.deploy",
 			configPath,
-			"--env=",
-			"--name",
-			options.workerName
-		], { capture: false });
+			workerName: options.workerName
+		}, { capture: false });
 		if (!isCleanCommandExit(deployed)) return deployed;
 		if (options.triggerConfig.crons.length === 0 && options.publishEmptyCrons) {
 			const published = await options.publishEmptyCrons();
 			if (!isCleanCommandExit(published)) return published;
 		}
 		for (const queue of removedQueueConsumers(options.triggerConfig, options.previousTriggerConfig)) {
-			const removed = await options.runWrangler([
-				"queues",
-				"consumer",
-				"remove",
-				queue,
-				options.workerName,
-				"-c",
-				configPath,
-				"--env="
-			], { capture: false });
+			const removed = await options.runWrangler({
+				type: "queues.consumer.remove",
+				queueName: queue,
+				workerName: options.workerName,
+				configPath
+			}, { capture: false });
 			if (!isCleanCommandExit(removed)) return removed;
 		}
 		if (options.manageRoutes !== false && !options.triggerConfig.preserveRoutes && hasCustomDomains(options.previousTriggerConfig?.routes) && !hasCustomDomains(options.triggerConfig.routes)) {
@@ -894,11 +876,11 @@ function pickWranglerTriggerContext(source) {
 * schema-2 snapshot. The bounded loop fails closed if traffic never stabilizes.
 */
 async function stabilizeCloudflareVersionTriggers(options) {
-	const commonArgs = [...options.configPath ? ["-c", options.configPath] : [], "--env="];
+	const configPath = options.configPath;
 	let cleanupBaseline = mergeTriggerCleanupBaselines(options.previousTriggerConfig, options.targetTriggerConfig);
 	const attempts = Math.max(1, options.attempts ?? 4);
 	for (let attempt = 0; attempt < attempts; attempt++) {
-		const owner = await readCurrentProductionVersion(options, commonArgs);
+		const owner = await readCurrentProductionVersion(options, configPath);
 		if (owner.kind === "failed") return {
 			ok: false,
 			reason: "status-failed",
@@ -916,7 +898,7 @@ async function stabilizeCloudflareVersionTriggers(options) {
 		const activeVersionId = owner.versionId;
 		let activeTriggerConfig = activeVersionId === options.targetVersionId ? options.targetTriggerConfig : options.knownTriggerConfigs?.[activeVersionId];
 		if (!activeTriggerConfig && activeVersionId !== options.targetVersionId) {
-			const metadata = await readCloudflareVersionMetadata(options, commonArgs, activeVersionId);
+			const metadata = await readCloudflareVersionMetadata(options, configPath, activeVersionId);
 			activeTriggerConfig = metadata?.schema === 2 ? metadata.triggerConfig : void 0;
 		}
 		if (!activeTriggerConfig) return {
@@ -941,7 +923,7 @@ async function stabilizeCloudflareVersionTriggers(options) {
 			activeVersionId
 		};
 		cleanupBaseline = mergeTriggerCleanupBaselines(cleanupBaseline, activeTriggerConfig);
-		const after = await readCurrentProductionVersion(options, commonArgs);
+		const after = await readCurrentProductionVersion(options, configPath);
 		if (after.kind === "failed") return {
 			ok: false,
 			reason: "status-failed",
@@ -1139,6 +1121,15 @@ function resolvePreservedTraffic(desired, previous, workerExists) {
 function isRecord(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
+function isCandidatePreviewUrl(value, workerName, versionId, alias) {
+	try {
+		const url = new URL(value);
+		const label = url.hostname.split(".")[0];
+		return url.protocol === "https:" && !url.username && !url.password && extractWorkersDevSubdomain(value) !== void 0 && (label === `${versionId.slice(0, 8)}-${workerName}` || label === `${alias}-${workerName}`);
+	} catch {
+		return false;
+	}
+}
 /** Upload, probe, and atomically activate a verified Worker Version. */
 async function activateCloudflareVersion(options) {
 	const candidateSecrets = Object.entries(options.candidateSecrets ?? {});
@@ -1159,13 +1150,13 @@ async function activateCloudflareVersion(options) {
 	}
 }
 async function activateCloudflareVersionWithSecretsFile(options) {
-	const commonArgs = [...options.configPath ? ["-c", options.configPath] : [], "--env="];
+	const configPath = options.configPath;
 	if (!options.verifyUploader()) return {
 		ok: false,
 		reason: "uploader-changed"
 	};
 	options.onProgress?.("Checking the current Worker deployment...");
-	const previous = await readCurrentProductionVersion(options, commonArgs);
+	const previous = await readCurrentProductionVersion(options, configPath);
 	if (previous.kind === "failed") return {
 		ok: false,
 		reason: "status-failed",
@@ -1186,22 +1177,30 @@ async function activateCloudflareVersionWithSecretsFile(options) {
 		reason: "uploader-changed"
 	};
 	const previousVersionId = previous.versionId;
+	if (options.atomic && options.requirePreviewForReadiness) return {
+		ok: false,
+		reason: "preview-unavailable",
+		previousVersionId,
+		rollback: "not-needed",
+		diagnostic: "This binding-preserving handoff requires a candidate preview before activation. Configure version metadata on the existing Worker or retry without atomic publication; production traffic is unchanged."
+	};
+	const trustedInheritanceVersionIds = previousVersionId && options.trustedInheritanceVersionIds?.at(-1) === previousVersionId ? [] : options.trustedInheritanceVersionIds;
 	let inheritanceBaseline;
 	let trustedCandidateChain = false;
 	let activeSecretsPinned = false;
 	if (options.expectedPreviousVersionId !== void 0 || options.verifyInheritedSecrets === true) {
-		const recent = await readRecentCloudflareVersionIds(options, commonArgs);
+		const recent = await readRecentCloudflareVersionIds(options, configPath);
 		if (recent === null) return {
 			ok: false,
 			reason: "inheritance-source-unavailable"
 		};
 		const latestVersionId = recent.at(-1)?.id ?? null;
-		if (options.expectedPreviousVersionId !== void 0 || options.trustedInheritanceVersionIds !== void 0) {
+		if (options.expectedPreviousVersionId !== void 0 || trustedInheritanceVersionIds !== void 0) {
 			const activeIndex = recent.findIndex((version) => version.id === previous.versionId);
 			const inheritedChain = activeIndex < 0 ? [] : recent.slice(activeIndex);
 			const inheritedCandidates = inheritedChain.slice(1).map((version) => version.id);
-			trustedCandidateChain = options.trustedInheritanceVersionIds !== void 0 && options.trustedInheritanceVersionIds.length > 0 && arraysEqual(inheritedCandidates, options.trustedInheritanceVersionIds);
-			if (!(inheritedChain.length > 0 && inheritedChain.every((version, index) => index === 0 || version.number === inheritedChain[index - 1].number + 1) && (arraysEqual(inheritedCandidates, options.trustedInheritanceVersionIds ?? []) || options.pinActiveSecrets !== void 0))) return {
+			trustedCandidateChain = trustedInheritanceVersionIds !== void 0 && trustedInheritanceVersionIds.length > 0 && arraysEqual(inheritedCandidates, trustedInheritanceVersionIds);
+			if (!(inheritedChain.length > 0 && inheritedChain.every((version, index) => index === 0 || version.number === inheritedChain[index - 1].number + 1) && (arraysEqual(inheritedCandidates, trustedInheritanceVersionIds ?? []) || options.pinActiveSecrets !== void 0))) return {
 				ok: false,
 				reason: "inheritance-source-changed",
 				activeVersionId: recent.at(-1)?.id ?? null,
@@ -1209,13 +1208,13 @@ async function activateCloudflareVersionWithSecretsFile(options) {
 			};
 		}
 		if (options.verifyInheritedSecrets === true && previous.versionId !== latestVersionId && !trustedCandidateChain) {
-			const replacesAllRemoteSecrets = await candidateReplacesAllRemoteSecrets(options, commonArgs, previous.versionId, latestVersionId);
+			const replacesAllRemoteSecrets = await candidateReplacesAllRemoteSecrets(options, configPath, previous.versionId, latestVersionId);
 			if (replacesAllRemoteSecrets === null) return {
 				ok: false,
 				reason: "inheritance-source-unavailable"
 			};
 			if (!replacesAllRemoteSecrets) {
-				const activeSecrets = previous.versionId ? await readCloudflareVersionSecretBindings(options, commonArgs, previous.versionId) : null;
+				const activeSecrets = previous.versionId ? await readCloudflareVersionSecretBindings(options, configPath, previous.versionId) : null;
 				if (!activeSecrets || !options.pinActiveSecrets || !await options.pinActiveSecrets(previous.versionId, activeSecrets)) return {
 					ok: false,
 					reason: "inheritance-source-changed",
@@ -1229,10 +1228,10 @@ async function activateCloudflareVersionWithSecretsFile(options) {
 	}
 	const desiredMetadata = parseCloudflareVersionMessage(options.message);
 	let desiredTriggerConfig = desiredMetadata?.schema === 2 ? desiredMetadata.triggerConfig : options.configPath ? readCloudflareTriggerConfig(options.configPath) : triggerConfigFromWrangler({});
-	let previousVersion = previousVersionId && desiredMetadata?.schema === 2 ? await readCloudflareVersionInspection(options, commonArgs, previousVersionId, inheritanceBaseline?.map((version) => version.inspection)) : null;
+	let previousVersion = previousVersionId && desiredMetadata?.schema === 2 ? await readCloudflareVersionInspection(options, configPath, previousVersionId, inheritanceBaseline?.map((version) => version.inspection)) : null;
 	async function previousIsSecretOnlyDraft() {
 		if (!previousVersionId) return false;
-		previousVersion ??= await readCloudflareVersionInspection(options, commonArgs, previousVersionId, inheritanceBaseline?.map((version) => version.inspection));
+		previousVersion ??= await readCloudflareVersionInspection(options, configPath, previousVersionId, inheritanceBaseline?.map((version) => version.inspection));
 		return previousVersion?.isSecretOnlyDraft === true;
 	}
 	const previousMetadata = desiredMetadata?.schema === 2 ? previousVersion?.metadata : null;
@@ -1266,57 +1265,49 @@ async function activateCloudflareVersionWithSecretsFile(options) {
 	const alias = `void-ready-${Date.now().toString(36)}`;
 	if (options.atomic && previous.versionId !== null) {
 		if (!activeSecretsPinned && options.pinActiveSecrets) {
-			const activeSecrets = await readCloudflareVersionSecretBindings(options, commonArgs, previous.versionId);
+			const activeSecrets = await readCloudflareVersionSecretBindings(options, configPath, previous.versionId);
 			if (activeSecrets?.length) await options.pinActiveSecrets(previous.versionId, activeSecrets);
 		}
 		return bootstrapFirstDeployment({
 			...options,
 			message
-		}, commonArgs, previous.versionId, true);
+		}, configPath, previous.versionId, true, previousTriggerConfig);
 	}
 	options.onProgress?.("Uploading the Worker and assets...");
-	const upload = await Promise.resolve(options.runWrangler([
-		"versions",
-		"upload",
-		...commonArgs,
-		"--name",
-		options.workerName,
-		"--message",
+	const upload = await Promise.resolve(options.runWrangler({
+		type: "versions.upload",
+		configPath,
+		workerName: options.workerName,
 		message,
-		...options.candidateSecretsFilePath ? ["--secrets-file", options.candidateSecretsFilePath] : [],
-		...options.assetsDirectoryOverride ? ["--assets", options.assetsDirectoryOverride] : [],
-		"--preview-alias",
-		alias,
-		"--strict",
-		"--experimental-provision=false",
-		"--experimental-auto-create=false"
-	], { capture: true }));
+		secretsFilePath: options.candidateSecretsFilePath,
+		assetsDirectory: options.assetsDirectoryOverride,
+		previewAlias: alias
+	}, { capture: true }));
 	if (!isCleanCommandExit(upload)) {
-		const output = stripVTControlCharacters(`${upload.stdout}\n${upload.stderr}`);
-		const cloudflareErrorCode = parseCloudflareErrorCode(output);
-		const isBootstrapError = cloudflareErrorCode === DURABLE_MIGRATION_VERSION_ERROR || /This\s+Worker\s+has\s+a\s+pending\s+Durable\s+Object\s+migration,\s+which\s+cannot\s+be\s+applied\s+by\s+`wrangler\s+versions\s+upload`/i.test(output) || /cannot upload a new version of a worker that does not yet exist/i.test(output);
+		const cloudflareErrorCode = upload.errorCode;
+		const isBootstrapError = isCompletedCommand(upload) && (upload.failure === "durable-migration" || upload.failure === "not-found" || cloudflareErrorCode === DURABLE_MIGRATION_VERSION_ERROR || cloudflareErrorCode === 10007);
 		if (!options.preserveTriggers && isBootstrapError && (previous.versionId === null || options.allowFirstDeploymentBootstrap === true || await previousIsSecretOnlyDraft())) return bootstrapFirstDeployment({
 			...options,
 			message
-		}, commonArgs, previous.versionId);
+		}, configPath, previous.versionId, false, previousTriggerConfig);
 		return {
 			ok: false,
 			reason: "upload-failed",
 			status: upload.status,
 			...commandDiagnosticFields(upload),
 			...cloudflareErrorCode === void 0 ? {} : { cloudflareErrorCode },
-			...isContainersUnavailable(output) ? { containersUnavailable: true } : {}
+			...isContainersUnavailable(upload) ? { containersUnavailable: true } : {}
 		};
 	}
-	const output = `${upload.stdout}\n${upload.stderr}`;
-	const versionId = output.match(VERSION_ID_RE)?.[1];
+	const uploaded = readUploadResult(upload);
+	const versionId = uploaded?.versionId;
 	if (!versionId) return {
 		ok: false,
 		reason: "upload-output-invalid"
 	};
 	options.onProgress?.("Verifying the uploaded Worker...");
 	if (inheritanceBaseline) {
-		const recent = await readRecentCloudflareVersionIds(options, commonArgs);
+		const recent = await readRecentCloudflareVersionIds(options, configPath);
 		const previousLatest = inheritanceBaseline.at(-1);
 		const expected = [...inheritanceBaseline.map((version) => version.id), versionId].slice(-10);
 		if (recent === null) return {
@@ -1341,7 +1332,15 @@ async function activateCloudflareVersionWithSecretsFile(options) {
 		if (!options.validateUploadedVersion && !inheritanceBaseline) throw new Error("A Worker candidate cannot be recorded without validating its upload and version sequence.");
 		await options.recordVerifiedCandidate(versionId, previous.versionId);
 	}
-	const reportedPreviewUrl = output.match(PREVIEW_URL_RE)?.[1];
+	const reportedPreviewUrl = desiredTriggerConfig.preview_urls || desiredTriggerConfig.preservePreviewUrls || desiredTriggerConfig.preserve ? uploaded?.previewUrl : void 0;
+	if (options.requirePreviewForReadiness && (!reportedPreviewUrl || !isCandidatePreviewUrl(reportedPreviewUrl, options.workerName, versionId, alias))) return {
+		ok: false,
+		reason: "preview-unavailable",
+		versionId,
+		previousVersionId,
+		rollback: "not-needed",
+		diagnostic: "This existing Worker has no version metadata binding and no genuine candidate preview URL. Keep its bindings unchanged; configure version metadata on the existing Worker or use an admitted version preview, then retry the handoff. Production traffic is unchanged."
+	};
 	let authenticatedWorkersDevSubdomain = reportedPreviewUrl ? extractWorkersDevSubdomain(reportedPreviewUrl) : void 0;
 	let readinessUrl = reportedPreviewUrl;
 	let readinessUsesCustomRoute = false;
@@ -1350,7 +1349,7 @@ async function activateCloudflareVersionWithSecretsFile(options) {
 		if (!options.preserveTriggers && (previous.versionId === null || options.allowFirstDeploymentBootstrap === true || await previousIsSecretOnlyDraft())) return bootstrapFirstDeployment({
 			...options,
 			message
-		}, commonArgs, previous.versionId);
+		}, configPath, previous.versionId, false, previousTriggerConfig);
 		readinessUrl = desiredTriggerConfig.workers_dev ? workersDevReadinessUrl(options.workerName, options.workersDevSubdomain) : customRouteReadinessUrl(desiredTriggerConfig.routes);
 		readinessUsesCustomRoute = !desiredTriggerConfig.workers_dev && readinessUrl !== void 0;
 		if (!readinessUrl) return {
@@ -1368,11 +1367,11 @@ async function activateCloudflareVersionWithSecretsFile(options) {
 			previousVersionId: previous.versionId,
 			rollback: "not-needed"
 		};
-		const stagingOwnerFailure = await verifyReadinessStagingOwner(options, commonArgs, previous.versionId, versionId);
+		const stagingOwnerFailure = await verifyReadinessStagingOwner(options, configPath, previous.versionId, versionId);
 		if (stagingOwnerFailure) return stagingOwnerFailure;
-		const staged = await deployVersionPercentages(options, commonArgs, [`${previous.versionId}@100`, `${versionId}@0`], message);
+		const staged = await deployVersionPercentages(options, configPath, [`${previous.versionId}@100`, `${versionId}@0`], message);
 		if (!isCleanCommandExit(staged)) {
-			const cloudflareErrorCode = parseCloudflareErrorCode(`${staged.stdout}\n${staged.stderr}`);
+			const cloudflareErrorCode = staged.errorCode;
 			return {
 				ok: false,
 				reason: "readiness-staging-failed",
@@ -1387,8 +1386,8 @@ async function activateCloudflareVersionWithSecretsFile(options) {
 		stagedVersionOverride = true;
 	}
 	options.onProgress?.("Waiting for the Worker to become ready...");
-	let ready = await probeReadiness(`${readinessUrl.replace(/\/$/, "")}/__void/ready`, options.workerName, readinessUsesCustomRoute ? void 0 : options.readinessHeaders, authenticatedWorkersDevSubdomain, stagedVersionOverride ? versionId : void 0, options.fetch ?? globalThis.fetch, options.sleep ?? defaultSleep, options.readinessAttempts ?? 6);
-	if (ready === "access-denied" && !stagedVersionOverride && previous.versionId !== null) {
+	let ready = await probeReadiness(`${readinessUrl.replace(/\/$/, "")}/__void/ready`, options.workerName, readinessUsesCustomRoute ? void 0 : options.readinessHeaders, authenticatedWorkersDevSubdomain, stagedVersionOverride ? versionId : void 0, options.fetch ?? globalThis.fetch, options.sleep ?? defaultSleep, options.readinessAttempts ?? 6, Number.POSITIVE_INFINITY, options.requireVersionMetadata ? versionId : void 0);
+	if (ready === "access-denied" && !stagedVersionOverride && previous.versionId !== null && !options.requirePreviewForReadiness) {
 		const stableReadinessUrl = desiredTriggerConfig.workers_dev ? workersDevReadinessUrl(options.workerName, extractWorkersDevSubdomain(readinessUrl) ?? options.workersDevSubdomain) : customRouteReadinessUrl(desiredTriggerConfig.routes);
 		if (stableReadinessUrl && stableReadinessUrl !== readinessUrl) {
 			if (!options.verifyUploader()) return {
@@ -1398,11 +1397,11 @@ async function activateCloudflareVersionWithSecretsFile(options) {
 				previousVersionId: previous.versionId,
 				rollback: "not-needed"
 			};
-			const stagingOwnerFailure = await verifyReadinessStagingOwner(options, commonArgs, previous.versionId, versionId);
+			const stagingOwnerFailure = await verifyReadinessStagingOwner(options, configPath, previous.versionId, versionId);
 			if (stagingOwnerFailure) return stagingOwnerFailure;
-			const staged = await deployVersionPercentages(options, commonArgs, [`${previous.versionId}@100`, `${versionId}@0`], message);
+			const staged = await deployVersionPercentages(options, configPath, [`${previous.versionId}@100`, `${versionId}@0`], message);
 			if (!isCleanCommandExit(staged)) {
-				const cloudflareErrorCode = parseCloudflareErrorCode(`${staged.stdout}\n${staged.stderr}`);
+				const cloudflareErrorCode = staged.errorCode;
 				return {
 					ok: false,
 					reason: "readiness-staging-failed",
@@ -1418,7 +1417,7 @@ async function activateCloudflareVersionWithSecretsFile(options) {
 			authenticatedWorkersDevSubdomain = extractWorkersDevSubdomain(stableReadinessUrl);
 			readinessUsesCustomRoute = !desiredTriggerConfig.workers_dev;
 			stagedVersionOverride = true;
-			ready = await probeReadiness(`${readinessUrl.replace(/\/$/, "")}/__void/ready`, options.workerName, readinessUsesCustomRoute ? void 0 : options.readinessHeaders, authenticatedWorkersDevSubdomain, versionId, options.fetch ?? globalThis.fetch, options.sleep ?? defaultSleep, options.readinessAttempts ?? 6);
+			ready = await probeReadiness(`${readinessUrl.replace(/\/$/, "")}/__void/ready`, options.workerName, readinessUsesCustomRoute ? void 0 : options.readinessHeaders, authenticatedWorkersDevSubdomain, versionId, options.fetch ?? globalThis.fetch, options.sleep ?? defaultSleep, options.readinessAttempts ?? 6, Number.POSITIVE_INFINITY, options.requireVersionMetadata ? versionId : void 0);
 		}
 	}
 	if (ready !== "ready") return {
@@ -1426,16 +1425,16 @@ async function activateCloudflareVersionWithSecretsFile(options) {
 		reason: ready === "access-denied" ? "readiness-access-denied" : "readiness-failed",
 		versionId,
 		previousVersionId: previous.versionId,
-		rollback: stagedVersionOverride ? await restorePreviousVersion(options, commonArgs, previous.versionId, "readiness failed", [stagedVersionPercentages(previous.versionId, versionId)]) : "not-needed"
+		rollback: stagedVersionOverride ? await restorePreviousVersion(options, configPath, previous.versionId, "readiness failed", [stagedVersionPercentages(previous.versionId, versionId)]) : "not-needed"
 	};
 	if (!options.verifyUploader()) return {
 		ok: false,
 		reason: "uploader-changed",
 		versionId,
 		previousVersionId: previous.versionId,
-		rollback: stagedVersionOverride ? await restorePreviousVersion(options, commonArgs, previous.versionId, "uploader verification failed", [stagedVersionPercentages(previous.versionId, versionId)]) : "not-needed"
+		rollback: stagedVersionOverride ? await restorePreviousVersion(options, configPath, previous.versionId, "uploader verification failed", [stagedVersionPercentages(previous.versionId, versionId)]) : "not-needed"
 	};
-	const ownerBeforeActivation = await readCurrentProductionVersion(options, commonArgs);
+	const ownerBeforeActivation = await readCurrentProductionVersion(options, configPath);
 	if (ownerBeforeActivation.kind === "failed") return {
 		ok: false,
 		reason: "status-failed",
@@ -1463,14 +1462,14 @@ async function activateCloudflareVersionWithSecretsFile(options) {
 		triggerRepair: "succeeded"
 	};
 	options.onProgress?.("Activating the Worker...");
-	const activate = await deployVersionPercentages(options, commonArgs, [`${versionId}@100`], message);
+	const activate = await deployVersionPercentages(options, configPath, [`${versionId}@100`], message);
 	if (!isCleanCommandExit(activate)) return {
 		ok: false,
 		reason: "activation-failed",
 		status: activate.status,
 		versionId,
 		previousVersionId: previous.versionId,
-		rollback: stagedVersionOverride ? await restorePreviousVersion(options, commonArgs, previous.versionId, "version activation failed", [stagedVersionPercentages(previous.versionId, versionId), [{
+		rollback: stagedVersionOverride ? await restorePreviousVersion(options, configPath, previous.versionId, "version activation failed", [stagedVersionPercentages(previous.versionId, versionId), [{
 			versionId,
 			percentage: 100
 		}]]) : "not-needed"
@@ -1483,7 +1482,7 @@ async function activateCloudflareVersionWithSecretsFile(options) {
 		rollback: previous.versionId ? "unsafe" : "unavailable"
 	};
 	if (options.preserveTriggers) {
-		const owner = await readCurrentProductionVersion(options, commonArgs);
+		const owner = await readCurrentProductionVersion(options, configPath);
 		if (owner.kind !== "ok" || owner.versionId !== versionId) return {
 			ok: false,
 			reason: "deployment-changed",
@@ -1534,7 +1533,7 @@ async function activateCloudflareVersionWithSecretsFile(options) {
 			previousVersionId: previous.versionId,
 			rollback: "unsafe"
 		};
-		const ownerBeforeCompensation = await readCurrentProductionVersion(options, commonArgs);
+		const ownerBeforeCompensation = await readCurrentProductionVersion(options, configPath);
 		if (ownerBeforeCompensation.kind !== "ok" || ownerBeforeCompensation.versionId === null) return {
 			ok: false,
 			reason: "triggers-failed",
@@ -1566,7 +1565,7 @@ async function activateCloudflareVersionWithSecretsFile(options) {
 				triggerRepair: repair.ok ? "succeeded" : repair.reason === "metadata-unavailable" ? "unavailable" : "failed"
 			};
 		}
-		const rollback = await restorePreviousVersionAndTriggers(options, commonArgs, previous.versionId, "trigger activation failed", desiredTriggerConfig, versionId, versionedPreviousTriggerConfigWithTraffic);
+		const rollback = await restorePreviousVersionAndTriggers(options, configPath, previous.versionId, "trigger activation failed", desiredTriggerConfig, versionId, versionedPreviousTriggerConfigWithTraffic);
 		return {
 			ok: false,
 			reason: "triggers-failed",
@@ -1599,8 +1598,8 @@ async function activateCloudflareVersionWithSecretsFile(options) {
 		...workersDevSubdomainResult(readinessUrl)
 	};
 }
-async function restorePreviousVersionAndTriggers(options, commonArgs, previousVersionId, cause, failedTriggerConfig, failedVersionId, capturedTriggerConfig) {
-	const traffic = await restorePreviousVersion(options, commonArgs, previousVersionId, cause, [[{
+async function restorePreviousVersionAndTriggers(options, configPath, previousVersionId, cause, failedTriggerConfig, failedVersionId, capturedTriggerConfig) {
+	const traffic = await restorePreviousVersion(options, configPath, previousVersionId, cause, [[{
 		versionId: failedVersionId,
 		percentage: 100
 	}]]);
@@ -1608,7 +1607,7 @@ async function restorePreviousVersionAndTriggers(options, commonArgs, previousVe
 	if (!options.verifyUploader()) return "unsafe";
 	let targetTriggerConfig = capturedTriggerConfig;
 	if (!targetTriggerConfig) {
-		const metadata = await readCloudflareVersionMetadata(options, commonArgs, previousVersionId);
+		const metadata = await readCloudflareVersionMetadata(options, configPath, previousVersionId);
 		if (metadata?.schema !== 2) return "unavailable";
 		targetTriggerConfig = metadata.triggerConfig;
 	}
@@ -1627,23 +1626,20 @@ async function restorePreviousVersionAndTriggers(options, commonArgs, previousVe
 	});
 	return triggers.ok && triggers.targetOwnsTraffic ? "succeeded" : "failed";
 }
-async function readCloudflareVersionMetadata(options, commonArgs, versionId) {
-	return (await readCloudflareVersionInspection(options, commonArgs, versionId))?.metadata ?? null;
+async function readCloudflareVersionMetadata(options, configPath, versionId) {
+	return (await readCloudflareVersionInspection(options, configPath, versionId))?.metadata ?? null;
 }
-async function readCloudflareVersionInspection(options, commonArgs, versionId, knownVersions) {
+async function readCloudflareVersionInspection(options, configPath, versionId, knownVersions) {
 	try {
 		let versions = knownVersions;
 		if (versions === void 0) {
-			const result = await options.runWrangler([
-				"versions",
-				"list",
-				...commonArgs,
-				"--name",
-				options.workerName,
-				"--json"
-			], { capture: true });
+			const result = await options.runWrangler({
+				type: "versions.list",
+				configPath,
+				workerName: options.workerName
+			}, { capture: true });
 			if (!isCleanCommandExit(result)) return null;
-			versions = JSON.parse(result.stdout);
+			versions = result.data;
 		}
 		if (!Array.isArray(versions)) return null;
 		for (const entry of versions) {
@@ -1652,17 +1648,14 @@ async function readCloudflareVersionInspection(options, commonArgs, versionId, k
 			const message = annotations?.["workers/message"];
 			let draft = entry;
 			if (annotations?.["workers/triggered_by"] === "secret" && Object.keys(annotations).length === 1 && !isRecord(entry.resources)) {
-				const inspection = await Promise.resolve(options.runWrangler([
-					"versions",
-					"view",
+				const inspection = await Promise.resolve(options.runWrangler({
+					type: "versions.view",
 					versionId,
-					...commonArgs,
-					"--name",
-					options.workerName,
-					"--json"
-				], { capture: true }));
+					configPath,
+					workerName: options.workerName
+				}, { capture: true }));
 				if (isCleanCommandExit(inspection)) {
-					const inspected = JSON.parse(inspection.stdout);
+					const inspected = inspection.data;
 					if (isRecord(inspected) && inspected.id === versionId) draft = inspected;
 				}
 			}
@@ -1676,21 +1669,18 @@ async function readCloudflareVersionInspection(options, commonArgs, versionId, k
 	}
 	return null;
 }
-async function readRecentCloudflareVersionIds(options, commonArgs) {
-	const result = await Promise.resolve(options.runWrangler([
-		"versions",
-		"list",
-		...commonArgs,
-		"--name",
-		options.workerName,
-		"--json"
-	], { capture: true }));
+async function readRecentCloudflareVersionIds(options, configPath) {
+	const result = await Promise.resolve(options.runWrangler({
+		type: "versions.list",
+		configPath,
+		workerName: options.workerName
+	}, { capture: true }));
 	if (!isCleanCommandExit(result)) {
-		if (isMissingWorkerOutput(`${result.stdout}\n${result.stderr}`)) return [];
+		if (isCompletedCommand(result) && (result.failure === "not-found" || result.errorCode === 10007)) return [];
 		return null;
 	}
 	try {
-		const versions = JSON.parse(result.stdout);
+		const versions = result.data;
 		if (!Array.isArray(versions) || !versions.every((version) => isRecord(version) && typeof version.id === "string" && typeof version.number === "number" && Number.isSafeInteger(version.number))) return null;
 		return versions.map((version) => ({
 			id: version.id,
@@ -1704,29 +1694,26 @@ async function readRecentCloudflareVersionIds(options, commonArgs) {
 function arraysEqual(left, right) {
 	return left.length === right.length && left.every((value, index) => value === right[index]);
 }
-async function candidateReplacesAllRemoteSecrets(options, commonArgs, activeVersionId, latestVersionId) {
+async function candidateReplacesAllRemoteSecrets(options, configPath, activeVersionId, latestVersionId) {
 	const versionIds = [...new Set([activeVersionId, latestVersionId].filter(Boolean))];
 	const secretBindings = [];
 	for (const versionId of versionIds) {
-		const bindings = await readCloudflareVersionSecretBindings(options, commonArgs, versionId);
+		const bindings = await readCloudflareVersionSecretBindings(options, configPath, versionId);
 		if (bindings === null) return null;
 		secretBindings.push(bindings);
 	}
 	return secretBindings.every((bindings) => bindings.every((binding) => binding.type === "secret_text" && Object.hasOwn(options.candidateSecrets ?? {}, binding.name)));
 }
-async function readCloudflareVersionSecretBindings(options, commonArgs, versionId) {
-	const result = await Promise.resolve(options.runWrangler([
-		"versions",
-		"view",
+async function readCloudflareVersionSecretBindings(options, configPath, versionId) {
+	const result = await Promise.resolve(options.runWrangler({
+		type: "versions.view",
 		versionId,
-		...commonArgs,
-		"--name",
-		options.workerName,
-		"--json"
-	], { capture: true }));
+		configPath,
+		workerName: options.workerName
+	}, { capture: true }));
 	if (!isCleanCommandExit(result)) return null;
 	try {
-		const version = JSON.parse(result.stdout);
+		const version = result.data;
 		if (!isRecord(version) || version.id !== versionId || !isRecord(version.resources)) return null;
 		const bindings = version.resources.bindings;
 		if (!Array.isArray(bindings) || !bindings.every(isRecord)) return null;
@@ -1750,13 +1737,13 @@ async function readCloudflareVersionSecretBindings(options, commonArgs, versionI
 * brand-new Worker can therefore need one ordinary deploy before later releases use preview-first
 * version activation. This fallback requires prior proof that no application had been deployed.
 */
-async function bootstrapFirstDeployment(options, commonArgs, previousVersionId, atomic = false) {
+async function bootstrapFirstDeployment(options, configPath, previousVersionId, atomic = false, previousTriggerConfig) {
 	if (!options.verifyUploader()) return {
 		ok: false,
 		reason: "uploader-changed"
 	};
 	if (atomic) {
-		const current = await readCurrentProductionVersion(options, commonArgs);
+		const current = await readCurrentProductionVersion(options, configPath);
 		if (current.kind === "failed") return {
 			ok: false,
 			reason: "status-failed",
@@ -1770,53 +1757,114 @@ async function bootstrapFirstDeployment(options, commonArgs, previousVersionId,
 		};
 	}
 	options.onProgress?.(atomic ? "Publishing the Worker atomically..." : "Publishing the first Worker deployment...");
-	const bootstrap = await Promise.resolve(options.runWrangler([
-		"deploy",
-		...commonArgs,
-		"--name",
-		options.workerName,
-		"--message",
-		options.message,
-		...options.candidateSecretsFilePath ? ["--secrets-file", options.candidateSecretsFilePath] : [],
-		...options.assetsDirectoryOverride ? ["--assets", options.assetsDirectoryOverride] : [],
-		"--strict",
-		"--experimental-provision=false",
-		"--experimental-auto-create=false",
-		"--autoconfig=false"
-	], { capture: true }));
-	const output = `${bootstrap.stdout}\n${bootstrap.stderr}`;
+	const bootstrap = await Promise.resolve(options.runWrangler({
+		type: "worker.deploy",
+		configPath,
+		workerName: options.workerName,
+		message: options.message,
+		secretsFilePath: options.candidateSecretsFilePath,
+		assetsDirectory: options.assetsDirectoryOverride
+	}, { capture: true }));
 	if (!isCleanCommandExit(bootstrap)) {
-		const cloudflareErrorCode = parseCloudflareErrorCode(output);
+		const cloudflareErrorCode = bootstrap.errorCode;
 		return {
 			ok: false,
 			reason: atomic ? "atomic-failed" : "bootstrap-failed",
 			status: bootstrap.status,
 			...commandDiagnosticFields(bootstrap),
 			...cloudflareErrorCode === void 0 ? {} : { cloudflareErrorCode },
-			...isContainersUnavailable(output) ? { containersUnavailable: true } : {}
+			...isContainersUnavailable(bootstrap) ? { containersUnavailable: true } : {}
 		};
 	}
-	const versionId = output.match(VERSION_ID_RE)?.[1];
+	const published = readUploadResult(bootstrap);
+	const versionId = published?.versionId;
 	const desiredMetadata = parseCloudflareVersionMessage(options.message);
 	const desiredTriggerConfig = desiredMetadata?.schema === 2 ? desiredMetadata.triggerConfig : options.configPath ? readCloudflareTriggerConfig(options.configPath) : triggerConfigFromWrangler({});
-	const reportedUrl = output.match(PREVIEW_URL_RE)?.[1] ?? output.match(WORKERS_DEV_URL_RE)?.[1];
-	const reportedOrConfiguredUrl = reportedUrl ?? (desiredTriggerConfig.workers_dev ? workersDevReadinessUrl(options.workerName, options.workersDevSubdomain) : customRouteReadinessUrl(desiredTriggerConfig.routes));
+	const reportedOrConfiguredUrl = published?.previewUrl ?? published?.workersDevUrl ?? (desiredTriggerConfig.workers_dev ? workersDevReadinessUrl(options.workerName, options.workersDevSubdomain) : customRouteReadinessUrl(desiredTriggerConfig.routes));
 	if (!versionId || !reportedOrConfiguredUrl) return {
 		ok: false,
 		reason: atomic ? "atomic-output-invalid" : "bootstrap-output-invalid",
 		previousVersionId,
 		...versionId ? { versionId } : {}
 	};
+	if (!options.verifyUploader()) return {
+		ok: false,
+		reason: "uploader-changed",
+		versionId,
+		previousVersionId,
+		rollback: "unsafe"
+	};
+	options.onProgress?.("Updating routes and triggers...");
+	const triggerOptions = {
+		runWrangler: options.runWrangler,
+		workerName: options.workerName,
+		configPath: options.configPath,
+		targetVersionId: versionId,
+		targetTriggerConfig: options.preserveTriggers ? {
+			...desiredTriggerConfig,
+			preserve: true
+		} : desiredTriggerConfig,
+		previousTriggerConfig,
+		...previousVersionId && previousTriggerConfig ? { knownTriggerConfigs: { [previousVersionId]: previousTriggerConfig } } : {},
+		publishEmptyCustomDomains: options.publishEmptyCustomDomains,
+		publishEmptyCrons: options.publishEmptyCrons
+	};
+	const triggers = await stabilizeCloudflareVersionTriggers(triggerOptions);
+	if (!triggers.ok || !triggers.targetOwnsTraffic) {
+		const superseded = triggers.activeVersionId !== void 0 && triggers.activeVersionId !== null && triggers.activeVersionId !== versionId;
+		return {
+			ok: false,
+			reason: superseded ? "deployment-changed" : "triggers-failed",
+			...!triggers.ok ? { status: triggers.status } : {},
+			versionId,
+			previousVersionId,
+			activeVersionId: triggers.activeVersionId,
+			rollback: superseded ? "not-needed" : triggers.activeVersionId ? "unavailable" : "unsafe",
+			...superseded ? { triggerRepair: triggers.ok ? "succeeded" : triggers.reason === "metadata-unavailable" ? "unavailable" : "failed" } : {}
+		};
+	}
 	const previewUrl = publishedCloudflareUrl(options.workerName, desiredTriggerConfig, reportedOrConfiguredUrl);
+	const usesCustomDomain = !desiredTriggerConfig.workers_dev && desiredTriggerConfig.routes.some((route) => isRecord(route) && route.custom_domain === true);
+	const customDomainBootstrap = !atomic && usesCustomDomain;
+	const readinessTimeoutMs = customDomainBootstrap ? 3e5 : 6e4;
 	options.onProgress?.("Waiting for the Worker to become ready...");
-	const ready = await probeReadiness(`${previewUrl.replace(/\/$/, "")}/__void/ready`, options.workerName, reportedUrl || desiredTriggerConfig.workers_dev ? options.readinessHeaders : void 0, extractWorkersDevSubdomain(previewUrl), void 0, options.fetch ?? globalThis.fetch, options.sleep ?? defaultSleep, options.readinessAttempts ?? 30, 6e4);
+	const ready = await probeReadiness(`${previewUrl.replace(/\/$/, "")}/__void/ready`, options.workerName, extractWorkersDevSubdomain(previewUrl) ? options.readinessHeaders : void 0, extractWorkersDevSubdomain(previewUrl), void 0, options.fetch ?? globalThis.fetch, options.sleep ?? defaultSleep, options.readinessAttempts ?? (customDomainBootstrap ? 150 : 30), readinessTimeoutMs, options.requireVersionMetadata ? versionId : void 0);
 	if (ready !== "ready") return {
 		ok: false,
 		reason: ready === "access-denied" ? atomic ? "atomic-readiness-access-denied" : "bootstrap-readiness-access-denied" : atomic ? "atomic-readiness-failed" : "bootstrap-readiness-failed",
 		versionId,
 		previousVersionId,
-		rollback: "unavailable"
+		rollback: "unavailable",
+		...ready === "failed" && usesCustomDomain ? { diagnostic: "The Custom Domain may still be propagating DNS or its TLS certificate. Check the configured domain in Cloudflare, then retry `void deploy --platform cloudflare` once its /__void/ready endpoint is reachable." } : {}
 	};
+	if (!options.verifyUploader()) return {
+		ok: false,
+		reason: "uploader-changed",
+		versionId,
+		previousVersionId,
+		rollback: "unsafe"
+	};
+	const ownerAfterReadiness = await readCurrentProductionVersion(options, configPath);
+	if (ownerAfterReadiness.kind === "failed") return {
+		ok: false,
+		reason: "status-failed",
+		status: ownerAfterReadiness.status,
+		versionId,
+		previousVersionId,
+		rollback: "unsafe"
+	};
+	if (ownerAfterReadiness.kind !== "ok" || ownerAfterReadiness.versionId !== versionId) {
+		const repair = await stabilizeCloudflareVersionTriggers(triggerOptions);
+		return {
+			ok: false,
+			reason: "deployment-changed",
+			versionId,
+			previousVersionId,
+			activeVersionId: repair.activeVersionId,
+			rollback: "not-needed",
+			triggerRepair: repair.ok ? "succeeded" : repair.reason === "metadata-unavailable" ? "unavailable" : "failed"
+		};
+	}
 	return {
 		ok: true,
 		versionId,
@@ -1830,32 +1878,36 @@ async function bootstrapFirstDeployment(options, commonArgs, previousVersionId,
 		...workersDevSubdomainResult(previewUrl)
 	};
 }
-function parseCloudflareErrorCode(output) {
-	const value = output.match(CLOUDFLARE_ERROR_CODE_RE)?.[1];
-	return value === void 0 ? void 0 : Number(value);
+function readUploadResult(result) {
+	const data = result.data;
+	if (!isRecord(data) || typeof data.versionId !== "string" || !/^[0-9a-f]{8}-[0-9a-f-]{27}$/i.test(data.versionId)) return null;
+	if (data.previewUrl !== void 0 && typeof data.previewUrl !== "string" || data.workersDevUrl !== void 0 && typeof data.workersDevUrl !== "string") return null;
+	return data;
+}
+function versionPercentages(values) {
+	return values.map((value) => {
+		const [versionId, percentage] = value.split("@");
+		return {
+			versionId,
+			percentage: Number(percentage)
+		};
+	});
 }
 function commandDiagnosticFields(result) {
 	const diagnostic = cloudflareCommandDiagnostic(result);
 	return diagnostic ? { diagnostic } : {};
 }
-function isMissingWorkerOutput(output) {
-	return parseCloudflareErrorCode(output) === 10007 || /no deployments|\bworker\b.*\b(?:does not exist|not found)\b/i.test(output);
-}
-/** Recognize the Containers account-entitlement failure Wrangler exposes during upload. */
-function isContainersUnavailable(output) {
-	return /\/containers\/me(?:\b|\?)/i.test(output) && /\b403\b/.test(output) || /Cloudflare Containers[^\n]*(?:Workers Paid|not (?:enabled|available)|subscription)/i.test(output);
-}
-async function readCurrentProductionVersion(options, commonArgs) {
-	const result = await Promise.resolve(options.runWrangler([
-		"deployments",
-		"status",
-		...commonArgs,
-		"--name",
-		options.workerName,
-		"--json"
-	], { capture: true }));
+function isContainersUnavailable(result) {
+	return result.failure === "containers-unavailable" || (result.errors?.some(({ message }) => /Cloudflare Containers[^\n]*(?:Workers Paid|not (?:enabled|available)|subscription)/i.test(message) || /\/containers\/me(?:\b|\?)/i.test(message) && /\b403\b/.test(message)) ?? false);
+}
+async function readCurrentProductionVersion(options, configPath) {
+	const result = await Promise.resolve(options.runWrangler({
+		type: "deployments.status",
+		configPath,
+		workerName: options.workerName
+	}, { capture: true }));
 	if (!isCleanCommandExit(result)) {
-		if (isMissingWorkerOutput(`${result.stdout}\n${result.stderr}`)) return {
+		if (isCompletedCommand(result) && (result.failure === "not-found" || result.errorCode === 10007)) return {
 			kind: "ok",
 			versionId: null,
 			versions: []
@@ -1866,7 +1918,7 @@ async function readCurrentProductionVersion(options, commonArgs) {
 		};
 	}
 	try {
-		const versions = (JSON.parse(result.stdout).versions ?? []).map((version) => ({
+		const versions = (result.data.versions ?? []).map((version) => ({
 			versionId: typeof version.version_id === "string" ? version.version_id : "",
 			percentage: Number(version.percentage)
 		}));
@@ -1900,8 +1952,8 @@ function stagedVersionPercentages(previousVersionId, versionId) {
 		percentage: 0
 	}] : [];
 }
-async function verifyReadinessStagingOwner(options, commonArgs, previousVersionId, versionId) {
-	const owner = await readCurrentProductionVersion(options, commonArgs);
+async function verifyReadinessStagingOwner(options, configPath, previousVersionId, versionId) {
+	const owner = await readCurrentProductionVersion(options, configPath);
 	if (owner.kind === "failed") return {
 		ok: false,
 		reason: "status-failed",
@@ -1931,7 +1983,7 @@ async function verifyReadinessStagingOwner(options, commonArgs, previousVersionI
 	};
 	return null;
 }
-async function probeReadiness(url, workerName, readinessHeaders, authenticatedWorkersDevSubdomain, versionOverride, fetcher, sleep, attempts, timeoutMs = Number.POSITIVE_INFINITY) {
+async function probeReadiness(url, workerName, readinessHeaders, authenticatedWorkersDevSubdomain, versionOverride, fetcher, sleep, attempts, timeoutMs = Number.POSITIVE_INFINITY, expectedVersionId) {
 	const headers = guardedReadinessHeaders(url, workerName, readinessHeaders, authenticatedWorkersDevSubdomain);
 	if (headers === null) return "failed";
 	const deadline = Date.now() + timeoutMs;
@@ -1950,7 +2002,8 @@ async function probeReadiness(url, workerName, readinessHeaders, authenticatedWo
 				signal: AbortSignal.timeout(Math.max(1, Math.min(1e4, remaining)))
 			});
 			if (response.ok) {
-				if ((await response.json()).ready === true) return "ready";
+				const body = await response.json();
+				if (body.ready === true && (expectedVersionId === void 0 || body.versionId === expectedVersionId)) return "ready";
 			} else if (await isCloudflareAccessDenial(response)) return "access-denied";
 		} catch {} finally {
 			if (response && !response.bodyUsed) await response.body?.cancel().catch(() => {});
@@ -1986,7 +2039,7 @@ async function isCloudflareAccessDenial(response) {
 		return false;
 	}
 }
-async function deployVersionPercentages(options, commonArgs, percentages, message) {
+async function deployVersionPercentages(options, configPath, percentages, message) {
 	const metadata = parseCloudflareVersionMessage(message);
 	if ((options.preserveTriggers || metadata?.schema === 2 && metadata.triggerConfig.preserve) && options.configPath) return deployCloudflareVersionTraffic({
 		...options,
@@ -1994,17 +2047,13 @@ async function deployVersionPercentages(options, commonArgs, percentages, messag
 		percentages,
 		message
 	});
-	return options.runWrangler([
-		"versions",
-		"deploy",
-		...percentages,
-		...commonArgs,
-		"--name",
-		options.workerName,
-		"--message",
-		message,
-		"--yes"
-	], { capture: false });
+	return options.runWrangler({
+		type: "versions.deploy",
+		versions: versionPercentages(percentages),
+		configPath,
+		workerName: options.workerName,
+		message
+	}, { capture: false });
 }
 /** Change version traffic without synchronizing Worker settings from local config. */
 async function deployCloudflareVersionTraffic(options) {
@@ -2013,19 +2062,13 @@ async function deployCloudflareVersionTraffic(options) {
 	const path = join(directory, "wrangler.json");
 	try {
 		writeFileSync(path, JSON.stringify(config), { mode: 384 });
-		return await options.runWrangler([
-			"versions",
-			"deploy",
-			...options.percentages,
-			"-c",
-			path,
-			"--env=",
-			"--name",
-			options.workerName,
-			"--message",
-			options.message,
-			"--yes"
-		], { capture: false });
+		return await options.runWrangler({
+			type: "versions.deploy",
+			versions: versionPercentages(options.percentages),
+			configPath: path,
+			workerName: options.workerName,
+			message: options.message
+		}, { capture: false });
 	} finally {
 		rmSync(directory, {
 			recursive: true,
@@ -2033,12 +2076,12 @@ async function deployCloudflareVersionTraffic(options) {
 		});
 	}
 }
-async function restorePreviousVersion(options, commonArgs, previousVersionId, cause, expectedOwnedTraffic) {
+async function restorePreviousVersion(options, configPath, previousVersionId, cause, expectedOwnedTraffic) {
 	if (!previousVersionId) return "unavailable";
 	if (!options.verifyUploader()) return "unsafe";
-	const owner = await readCurrentProductionVersion(options, commonArgs);
+	const owner = await readCurrentProductionVersion(options, configPath);
 	if (owner.kind !== "ok" || !expectedOwnedTraffic.some((expected) => productionVersionPercentagesEqual(owner.versions, expected))) return "unsafe";
-	return isCleanCommandExit(await deployVersionPercentages(options, commonArgs, [`${previousVersionId}@100`], `Void automatic rollback after ${cause}.`)) ? "succeeded" : "failed";
+	return isCleanCommandExit(await deployVersionPercentages(options, configPath, [`${previousVersionId}@100`], `Void automatic rollback after ${cause}.`)) ? "succeeded" : "failed";
 }
 function workersDevReadinessUrl(workerName, value) {
 	const subdomain = normalizeWorkersDevSubdomain(value);
@@ -2072,8 +2115,11 @@ function workersDevSubdomainResult(url) {
 	const workersDevSubdomain = extractWorkersDevSubdomain(url);
 	return workersDevSubdomain ? { workersDevSubdomain } : {};
 }
+function isCompletedCommand(result) {
+	return Number.isSafeInteger(result.status) && result.status >= 0 && result.signal == null && (result.error == null || result.error === "");
+}
 function isCleanCommandExit(result) {
-	return result.status === 0 && result.signal == null && (result.error == null || result.error === "");
+	return result.status === 0 && isCompletedCommand(result);
 }
 function defaultSleep(milliseconds) {
 	return new Promise((resolve) => setTimeout(resolve, milliseconds));
@@ -2087,13 +2133,6 @@ function defaultSleep(milliseconds) {
 */
 function createCloudflareMetadataRunner(options) {
 	let tokenPromise;
-	const common = [
-		...options.configPath ? ["-c", options.configPath] : [],
-		"--env=",
-		"--name",
-		options.workerName,
-		"--json"
-	];
 	const prefix = `${options.apiBaseUrl.replace(/\/$/, "")}/accounts/${encodeURIComponent(options.accountId)}/workers/scripts/${encodeURIComponent(options.workerName)}`;
 	const fetcher = options.fetch ?? globalThis.fetch;
 	const proxyEnv = options.env ?? process.env;
@@ -2104,26 +2143,22 @@ function createCloudflareMetadataRunner(options) {
 		stderr: "Cloudflare uploader integrity check failed.",
 		error: "uploader-changed"
 	};
-	const fallback = (args, runOptions) => options.verifyUploader() ? options.runWrangler(args, runOptions) : refused;
-	return async (args, runOptions) => {
+	const fallback = (operation, runOptions) => options.verifyUploader() ? options.runWrangler(operation, runOptions) : refused;
+	return async (operation, runOptions) => {
 		let kind;
 		let resource;
-		let rest = [];
-		if (args[0] === "deployments" && args[1] === "status") {
+		if (operation.type === "deployments.status") {
 			kind = "deployment";
 			resource = "/deployments";
-			rest = args.slice(2);
-		} else if (args[0] === "versions" && args[1] === "list") {
+		} else if (operation.type === "versions.list") {
 			kind = "versions";
 			resource = "/versions?deployable=true";
-			rest = args.slice(2);
-		} else if (args[0] === "versions" && args[1] === "view" && /^[0-9a-f-]{36}$/i.test(args[2] ?? "")) {
+		} else if (operation.type === "versions.view" && /^[0-9a-f-]{36}$/i.test(operation.versionId)) {
 			kind = "version";
-			resource = `/versions/${encodeURIComponent(args[2])}`;
-			rest = args.slice(3);
+			resource = "/versions/" + encodeURIComponent(operation.versionId);
 		}
-		if (!kind || !runOptions.capture || rest.length !== common.length || rest.some((value, i) => value !== common[i])) return fallback(args, runOptions);
-		if (requiresProxyTransport) return fallback(args, runOptions);
+		if (!kind || !runOptions.capture || !("workerName" in operation) || operation.workerName !== options.workerName || operation.configPath !== options.configPath) return fallback(operation, runOptions);
+		if (requiresProxyTransport) return fallback(operation, runOptions);
 		let response;
 		try {
 			if (!tokenPromise && !options.verifyUploader()) return refused;
@@ -2144,29 +2179,30 @@ function createCloudflareMetadataRunner(options) {
 							if (result.deployments.length === 0) return {
 								status: 1,
 								stdout: "",
-								stderr: `The Worker ${options.workerName} has no deployments.`
+								stderr: `The Worker ${options.workerName} has no deployments.`,
+								errorCode: 10007
 							};
 							if (record(latest) && Array.isArray(latest.versions)) return {
 								status: 0,
-								stdout: JSON.stringify(latest),
+								stdout: "",
+								data: latest,
 								stderr: ""
 							};
 						}
-						if (kind === "version" && result.id === args[2]) return {
+						if (operation.type === "versions.view" && result.id === operation.versionId) return {
 							status: 0,
-							stdout: JSON.stringify(result),
+							stdout: "",
+							data: result,
 							stderr: ""
 						};
 						if (kind === "versions" && Array.isArray(result.items)) {
 							const items = result.items;
-							if (items.every((item) => record(item) && record(item.metadata) && typeof item.metadata.created_on === "string")) {
-								const sorted = items.sort((a, b) => a.metadata.created_on.localeCompare(b.metadata.created_on)).slice(-10);
-								return {
-									status: 0,
-									stdout: JSON.stringify(sorted),
-									stderr: ""
-								};
-							}
+							if (items.every((item) => record(item) && record(item.metadata) && typeof item.metadata.created_on === "string")) return {
+								status: 0,
+								stdout: "",
+								data: items.sort((a, b) => a.metadata.created_on.localeCompare(b.metadata.created_on)).slice(-10),
+								stderr: ""
+							};
 						}
 					}
 				}
@@ -2176,7 +2212,7 @@ function createCloudflareMetadataRunner(options) {
 		} finally {
 			if (response && !response.bodyUsed) await response.body?.cancel().catch(() => {});
 		}
-		return fallback(args, runOptions);
+		return fallback(operation, runOptions);
 	};
 }
 function record(value) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@void/deploy-cloudflare",
-  "version": "0.21.9",
+  "version": "0.23.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/voidzero-dev/void.git",
@@ -20,15 +20,15 @@
     "access": "public"
   },
   "dependencies": {
-    "@void/deploy-core": "0.21.9",
+    "@void/deploy-core": "0.23.0",
     "jsonc-parser": "3.3.1"
   },
   "devDependencies": {
     "@cloudflare/workers-types": "^4.20260702.1",
-    "@types/node": "^26.5.1",
+    "@types/node": "^26.6.3",
     "pathslash": "^0.1.0",
     "typescript": "7.0.2",
-    "vite-plus": "0.3.1"
+    "vite-plus": "1.0.0"
   },
   "scripts": {
     "build": "vp pack",