@void/deploy-cloudflare 0.22.0 → 0.24.0

package/dist/index.mjs

@@ -99,6 +99,43 @@ function isWranglerSecretOnlyDraft(entry) {
 	const runtimeKeys = Object.keys(scriptRuntime);
 	return scriptRuntime.usage_model === "standard" && (scriptRuntime.limits === void 0 || isRecord$1(scriptRuntime.limits) && Object.keys(scriptRuntime.limits).length === 0) && runtimeKeys.every((key) => key === "usage_model" || key === "limits");
 }
+const VOID_SECRET_DRAFT_SOURCE = "export default { fetch() { return new Response(\"\"); } };\n";
+/** Prove a cf-created placeholder from the exact immutable version's source. */
+function isVoidSecretOnlyDraft(entry) {
+	const metadataFields = /* @__PURE__ */ new Set([
+		"id",
+		"number",
+		"startup_time_ms",
+		"created_on",
+		"source",
+		"author_id",
+		"author_email",
+		"urls",
+		"annotations",
+		"compatibility_date",
+		"usage_model",
+		"main_module",
+		"modules",
+		"bindings",
+		"env",
+		"resources"
+	]);
+	if (Object.keys(entry).some((key) => !metadataFields.has(key)) || entry.source !== "cf_cli" || !isRecord$1(entry.annotations) || Object.keys(entry.annotations).length !== 1 || entry.annotations["workers/triggered_by"] !== "secret" || entry.main_module !== "index.js" || !Array.isArray(entry.urls) || entry.urls.length !== 0 || !Array.isArray(entry.modules) || entry.modules.length !== 1 || !Array.isArray(entry.bindings) || entry.bindings.length === 0) return false;
+	const module = entry.modules[0];
+	if (!isRecord$1(module) || Object.keys(module).length !== 3 || module.name !== "index.js" || module.content_type !== "application/javascript+module" || module.content_base64 !== Buffer.from("export default { fetch() { return new Response(\"\"); } };\n").toString("base64")) return false;
+	const names = /* @__PURE__ */ new Set();
+	for (const binding of entry.bindings) {
+		if (!isRecord$1(binding) || Object.keys(binding).length !== 2 || typeof binding.name !== "string" || binding.name.length === 0 || names.has(binding.name) || binding.type !== "secret_text") return false;
+		names.add(binding.name);
+	}
+	if (entry.env !== void 0 && (!isRecord$1(entry.env) || Object.keys(entry.env).length !== names.size || Object.entries(entry.env).some(([name, binding]) => !names.has(name) || !isRecord$1(binding) || Object.keys(binding).length !== 1 || binding.type !== "secret_text"))) return false;
+	if (entry.resources !== void 0) {
+		if (!isRecord$1(entry.resources) || Object.keys(entry.resources).length !== 1) return false;
+		const bindings = entry.resources.bindings;
+		if (!Array.isArray(bindings) || !isDeepStrictEqual(bindings, entry.bindings)) return false;
+	}
+	return true;
+}
 function isRecord$1(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -114,26 +151,19 @@ async function readExistingCloudflareWorker(options) {
 	if (!worker) throw new Error(`Cloudflare Worker "${options.workerName}" does not have an active version.`);
 	return worker.snapshot;
 }
-async function readCloudflareWorker(options, allowMissing) {
-	const target = [
-		"-c",
-		options.configPath,
-		"--env=",
-		"--name",
-		options.workerName
-	];
-	const read = async (args, missingIsNull = false) => {
-		const result = await options.runWrangler([
-			...args,
-			...target,
-			"--json"
-		], { capture: true });
+async function readCloudflareWorker(options, allowMissing, proveSecretDraft = false) {
+	const target = {
+		configPath: options.configPath,
+		workerName: options.workerName
+	};
+	const read = async (operation, missingIsNull = false) => {
+		const result = await options.runWrangler(operation, { capture: true });
 		if (result.status !== 0 || result.signal || result.error) {
-			if (missingIsNull && isMissingWorkerOutput$1(`${result.stdout}\n${result.stderr}`)) return null;
+			if (missingIsNull && Number.isSafeInteger(result.status) && result.status >= 0 && result.signal == null && (result.error == null || result.error === "") && (result.failure === "not-found" || result.errorCode === 10007)) return null;
 			throw new CloudflareWorkerInspectionError(`Could not verify existing Cloudflare Worker "${options.workerName}". Check the account, Worker name, and Cloudflare permissions before retrying.`);
 		}
 		try {
-			const value = JSON.parse(result.stdout);
+			const value = result.data;
 			if (record$1(value)) return value;
 		} catch {}
 		throw new Error("Cloudflare returned an invalid existing Worker response.");
@@ -141,21 +171,37 @@ async function readCloudflareWorker(options, allowMissing) {
 	const deployment = options.versionId ? { versions: [{
 		version_id: options.versionId,
 		percentage: 100
-	}] } : await read(["deployments", "status"], allowMissing);
+	}] } : await read({
+		type: "deployments.status",
+		...target
+	}, allowMissing);
 	if (deployment === null) return null;
 	const versions = deployment.versions;
 	if (allowMissing && Array.isArray(versions) && versions.length === 0) return null;
 	if (!Array.isArray(versions) || versions.length !== 1 || !record$1(versions[0]) || versions[0].percentage !== 100 || typeof versions[0].version_id !== "string") throw new Error("The existing Worker must have one deployed version receiving all traffic. Finish any gradual rollout before linking.");
 	const versionId = versions[0].version_id;
-	const version = await read([
-		"versions",
-		"view",
-		versionId
-	]);
+	const version = await read({
+		type: "versions.view",
+		versionId,
+		...target
+	});
 	if (version === null) throw new Error("Cloudflare did not return the existing Worker configuration.");
 	const resources = version.resources;
 	if (version.id !== versionId || !record$1(resources) || !Array.isArray(resources.bindings) || !resources.bindings.every(record$1) || !record$1(resources.script_runtime) || !record$1(resources.script)) throw new Error("Cloudflare did not return the existing Worker configuration.");
-	const after = options.versionId ? deployment : await read(["deployments", "status"]);
+	let isSecretOnlyDraft = isWranglerSecretOnlyDraft(version);
+	if (proveSecretDraft && !isSecretOnlyDraft && record$1(version.annotations) && Object.keys(version.annotations).length === 1 && version.annotations["workers/triggered_by"] === "secret") {
+		const source = await read({
+			type: "versions.view",
+			versionId,
+			includeSource: true,
+			...target
+		});
+		if (source?.id === versionId) isSecretOnlyDraft = isVoidSecretOnlyDraft(source);
+	}
+	const after = options.versionId ? deployment : await read({
+		type: "deployments.status",
+		...target
+	});
 	if (after === null || !isDeepStrictEqual(deployment.versions, after.versions)) throw new Error("Cloudflare production changed while linking. Retry from the current deployment.");
 	return {
 		snapshot: {
@@ -164,7 +210,7 @@ async function readCloudflareWorker(options, allowMissing) {
 			runtime: resources.script_runtime,
 			script: resources.script
 		},
-		isSecretOnlyDraft: isWranglerSecretOnlyDraft(version)
+		isSecretOnlyDraft
 	};
 }
 /** Parse legacy version-detail shapes; this is not authoritative Worker migration state. */
@@ -207,15 +253,11 @@ async function readCloudflareWorkerMigrationTag(options) {
 	return worker.migration_tag;
 }
 async function readCloudflareApiAuthentication(runWrangler) {
-	const result = await runWrangler([
-		"auth",
-		"token",
-		"--json"
-	], { capture: true });
+	const result = await runWrangler({ type: "auth.token" }, { capture: true });
 	if (result.status !== 0 || result.signal || result.error) throw new Error("Could not read the authenticated Cloudflare session.");
 	let value;
 	try {
-		value = JSON.parse(result.stdout);
+		value = result.data;
 	} catch {
 		throw new Error("Cloudflare returned an invalid authentication response.");
 	}
@@ -236,7 +278,7 @@ async function readCloudflareApiAuthentication(runWrangler) {
 async function assertCloudflareDurableObjectLifecycleSupported(options) {
 	const migrations = parseDurableObjectMigrations(parseRootWranglerConfig(options.configPath).migrations);
 	if (!migrations.some((migration) => migration.changesClasses)) return;
-	const existing = await readCloudflareWorker(options, true);
+	const existing = await readCloudflareWorker(options, true, true);
 	if (!existing) return;
 	const readMigrationTag = options.readMigrationTag ?? readCloudflareWorkerMigrationTag;
 	const migrationOptions = {
@@ -246,7 +288,7 @@ async function assertCloudflareDurableObjectLifecycleSupported(options) {
 		workerName: options.workerName
 	};
 	const activeTag = await readMigrationTag(migrationOptions);
-	const after = await readCloudflareWorker(options, false);
+	const after = await readCloudflareWorker(options, false, true);
 	const afterTag = await readMigrationTag(migrationOptions);
 	if (!after || after.snapshot.versionId !== existing.snapshot.versionId || afterTag !== activeTag) throw new Error("Cloudflare production or Durable Object migration state changed during verification. Retry from the current deployment.");
 	if (activeTag === null && existing.isSecretOnlyDraft && after.isSecretOnlyDraft) return;
@@ -309,9 +351,6 @@ function declarativeClassesMatch(migrations, actualValue) {
 		return record$1(current) && current.type === "durable-object" && current.storage === storage;
 	});
 }
-function isMissingWorkerOutput$1(output) {
-	return /\[code:\s*10007\]/i.test(output) || /no deployments|\bworker\b.*\b(?:does not exist|not found)\b/i.test(output);
-}
 function assertCloudflareBindingsPreserved(before, after, approvedKv = [], options = {}) {
 	const staticAssetsBinding = isAssetsOnlyWorker(before) ? options.staticAssetsBinding : void 0;
 	const addsAssetsBinding = staticAssetsBinding !== void 0 && !before.bindings.some((binding) => binding.name === staticAssetsBinding);
@@ -381,6 +420,9 @@ function assertExistingCloudflareConfig(existing, config, built = false, approve
 		if ((built || config[field] !== void 0) && !equal) throw new Error(`Keep the existing Worker's ${field} when linking. Update it in a later deployment.`);
 	}
 	const vars = record$1(config.vars) ? config.vars : {};
+	const metadataBindings = existing.bindings.filter((binding) => binding.type === "version_metadata");
+	const metadata = record$1(config.version_metadata) ? config.version_metadata : void 0;
+	if (metadataBindings.length > 1 || metadataBindings.length === 1 && metadata?.binding !== metadataBindings[0].name || metadataBindings.length === 0 && config.version_metadata !== void 0) throw new Error("Keep the existing Worker version_metadata binding when linking; linking cannot add or replace it.");
 	const remote = new Map(existing.bindings.map((binding) => [binding.name, binding]));
 	for (const [name, value] of Object.entries(vars)) {
 		const binding = remote.get(name);
@@ -423,6 +465,7 @@ function assertExistingCloudflareConfig(existing, config, built = false, approve
 			"secret_text",
 			"secret_key"
 		].includes(String(binding.type))) continue;
+		if (binding.type === "version_metadata") continue;
 		if (binding.type === "assets") {
 			if (built && (!record$1(config.assets) || config.assets.binding !== binding.name)) throw new Error(`Keep the existing assets binding ${binding.name} when linking.`);
 			continue;
@@ -478,14 +521,10 @@ async function executeCloudflareDeploy(options) {
 		ok: false,
 		reason: "uploader-changed"
 	};
-	const result = await Promise.resolve(options.runWrangler([
-		"deploy",
-		...options.configPath ? ["-c", options.configPath] : [],
-		"--env=",
-		"--experimental-provision=false",
-		"--experimental-auto-create=false",
-		"--autoconfig=false"
-	], { capture: false }));
+	const result = await Promise.resolve(options.runWrangler({
+		type: "worker.deploy",
+		...options.configPath ? { configPath: options.configPath } : {}
+	}, { capture: false }));
 	if (!isCleanCommandExit$1(result)) return {
 		ok: false,
 		reason: "deploy-failed",
@@ -558,6 +597,7 @@ function writeCloudflareFrameworkDeployConfig(options) {
 	upsert(["account_id"], options.accountId);
 	upsert(["main"], options.main);
 	upsert(["compatibility_date"], options.compatibilityDate);
+	if (options.versionMetadataBinding && parse(content).version_metadata === void 0) upsert(["version_metadata"], { binding: options.versionMetadataBinding });
 	if (options.compatibilityFlags && options.compatibilityFlags.length > 0) {
 		const config = parse(content);
 		const current = Array.isArray(config.compatibility_flags) ? config.compatibility_flags.filter((flag) => typeof flag === "string") : [];
@@ -615,7 +655,8 @@ function renderCloudflareStaticEntry(options) {
 	const config = JSON.stringify({
 		...options.headerRules?.length ? { headerRules: options.headerRules } : {},
 		...options.redirectRules?.length ? { redirectRules: options.redirectRules } : {},
-		...options.fallbackRules?.length ? { fallbackRules: options.fallbackRules } : {}
+		...options.fallbackRules?.length ? { fallbackRules: options.fallbackRules } : {},
+		...options.versionMetadataBinding ? { versionMetadataBinding: options.versionMetadataBinding } : {}
 	});
 	return [
 		`import { createStaticEdgeHandler } from ${JSON.stringify(options.runtimeImport ?? "@void/edge")};`,
@@ -762,10 +803,6 @@ function cloudflareCommandDiagnostic(result) {
 }
 //#endregion
 //#region src/version.ts
-const VERSION_ID_RE = /(?:Worker|Current) Version ID:\s*([0-9a-f]{8}-[0-9a-f-]{27})/i;
-const PREVIEW_URL_RE = /Version Preview(?: Alias)? URL:\s*(https:\/\/\S+)/i;
-const WORKERS_DEV_URL_RE = /(https:\/\/[a-z0-9.-]+\.workers\.dev(?:\/[^\s]*)?)/i;
-const CLOUDFLARE_ERROR_CODE_RE = /\[code:\s*(\d+)\]/i;
 const DURABLE_MIGRATION_VERSION_ERROR = 10211;
 /** Encode migration state into Cloudflare's version annotation for safe rollback diagnostics. */
 function encodeCloudflareVersionMessage(migrations, triggerConfig, contentHash) {
@@ -830,31 +867,23 @@ async function deployCloudflareVersionTriggers(options) {
 	const configPath = join(directory, "wrangler.json");
 	try {
 		writeFileSync(configPath, `${JSON.stringify(config, null, 2)}\n`, { mode: 384 });
-		const deployed = await options.runWrangler([
-			"triggers",
-			"deploy",
-			"-c",
+		const deployed = await options.runWrangler({
+			type: "triggers.deploy",
 			configPath,
-			"--env=",
-			"--name",
-			options.workerName
-		], { capture: false });
+			workerName: options.workerName
+		}, { capture: false });
 		if (!isCleanCommandExit(deployed)) return deployed;
 		if (options.triggerConfig.crons.length === 0 && options.publishEmptyCrons) {
 			const published = await options.publishEmptyCrons();
 			if (!isCleanCommandExit(published)) return published;
 		}
 		for (const queue of removedQueueConsumers(options.triggerConfig, options.previousTriggerConfig)) {
-			const removed = await options.runWrangler([
-				"queues",
-				"consumer",
-				"remove",
-				queue,
-				options.workerName,
-				"-c",
-				configPath,
-				"--env="
-			], { capture: false });
+			const removed = await options.runWrangler({
+				type: "queues.consumer.remove",
+				queueName: queue,
+				workerName: options.workerName,
+				configPath
+			}, { capture: false });
 			if (!isCleanCommandExit(removed)) return removed;
 		}
 		if (options.manageRoutes !== false && !options.triggerConfig.preserveRoutes && hasCustomDomains(options.previousTriggerConfig?.routes) && !hasCustomDomains(options.triggerConfig.routes)) {
@@ -894,11 +923,11 @@ function pickWranglerTriggerContext(source) {
 * schema-2 snapshot. The bounded loop fails closed if traffic never stabilizes.
 */
 async function stabilizeCloudflareVersionTriggers(options) {
-	const commonArgs = [...options.configPath ? ["-c", options.configPath] : [], "--env="];
+	const configPath = options.configPath;
 	let cleanupBaseline = mergeTriggerCleanupBaselines(options.previousTriggerConfig, options.targetTriggerConfig);
 	const attempts = Math.max(1, options.attempts ?? 4);
 	for (let attempt = 0; attempt < attempts; attempt++) {
-		const owner = await readCurrentProductionVersion(options, commonArgs);
+		const owner = await readCurrentProductionVersion(options, configPath);
 		if (owner.kind === "failed") return {
 			ok: false,
 			reason: "status-failed",
@@ -916,7 +945,7 @@ async function stabilizeCloudflareVersionTriggers(options) {
 		const activeVersionId = owner.versionId;
 		let activeTriggerConfig = activeVersionId === options.targetVersionId ? options.targetTriggerConfig : options.knownTriggerConfigs?.[activeVersionId];
 		if (!activeTriggerConfig && activeVersionId !== options.targetVersionId) {
-			const metadata = await readCloudflareVersionMetadata(options, commonArgs, activeVersionId);
+			const metadata = await readCloudflareVersionMetadata(options, configPath, activeVersionId);
 			activeTriggerConfig = metadata?.schema === 2 ? metadata.triggerConfig : void 0;
 		}
 		if (!activeTriggerConfig) return {
@@ -941,7 +970,7 @@ async function stabilizeCloudflareVersionTriggers(options) {
 			activeVersionId
 		};
 		cleanupBaseline = mergeTriggerCleanupBaselines(cleanupBaseline, activeTriggerConfig);
-		const after = await readCurrentProductionVersion(options, commonArgs);
+		const after = await readCurrentProductionVersion(options, configPath);
 		if (after.kind === "failed") return {
 			ok: false,
 			reason: "status-failed",
@@ -1139,6 +1168,15 @@ function resolvePreservedTraffic(desired, previous, workerExists) {
 function isRecord(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
+function isCandidatePreviewUrl(value, workerName, versionId, alias) {
+	try {
+		const url = new URL(value);
+		const label = url.hostname.split(".")[0];
+		return url.protocol === "https:" && !url.username && !url.password && extractWorkersDevSubdomain(value) !== void 0 && (label === `${versionId.slice(0, 8)}-${workerName}` || label === `${alias}-${workerName}`);
+	} catch {
+		return false;
+	}
+}
 /** Upload, probe, and atomically activate a verified Worker Version. */
 async function activateCloudflareVersion(options) {
 	const candidateSecrets = Object.entries(options.candidateSecrets ?? {});
@@ -1159,13 +1197,13 @@ async function activateCloudflareVersion(options) {
 	}
 }
 async function activateCloudflareVersionWithSecretsFile(options) {
-	const commonArgs = [...options.configPath ? ["-c", options.configPath] : [], "--env="];
+	const configPath = options.configPath;
 	if (!options.verifyUploader()) return {
 		ok: false,
 		reason: "uploader-changed"
 	};
 	options.onProgress?.("Checking the current Worker deployment...");
-	const previous = await readCurrentProductionVersion(options, commonArgs);
+	const previous = await readCurrentProductionVersion(options, configPath);
 	if (previous.kind === "failed") return {
 		ok: false,
 		reason: "status-failed",
@@ -1186,12 +1224,20 @@ async function activateCloudflareVersionWithSecretsFile(options) {
 		reason: "uploader-changed"
 	};
 	const previousVersionId = previous.versionId;
+	if (options.atomic && options.requirePreviewForReadiness) return {
+		ok: false,
+		reason: "preview-unavailable",
+		previousVersionId,
+		rollback: "not-needed",
+		diagnostic: "This binding-preserving handoff requires a candidate preview before activation. Configure version metadata on the existing Worker or retry without atomic publication; production traffic is unchanged."
+	};
 	const trustedInheritanceVersionIds = previousVersionId && options.trustedInheritanceVersionIds?.at(-1) === previousVersionId ? [] : options.trustedInheritanceVersionIds;
 	let inheritanceBaseline;
 	let trustedCandidateChain = false;
 	let activeSecretsPinned = false;
+	let pinnedActiveSecrets;
 	if (options.expectedPreviousVersionId !== void 0 || options.verifyInheritedSecrets === true) {
-		const recent = await readRecentCloudflareVersionIds(options, commonArgs);
+		const recent = await readRecentCloudflareVersionIds(options, configPath);
 		if (recent === null) return {
 			ok: false,
 			reason: "inheritance-source-unavailable"
@@ -1210,13 +1256,13 @@ async function activateCloudflareVersionWithSecretsFile(options) {
 			};
 		}
 		if (options.verifyInheritedSecrets === true && previous.versionId !== latestVersionId && !trustedCandidateChain) {
-			const replacesAllRemoteSecrets = await candidateReplacesAllRemoteSecrets(options, commonArgs, previous.versionId, latestVersionId);
+			const replacesAllRemoteSecrets = await candidateReplacesAllRemoteSecrets(options, configPath, previous.versionId, latestVersionId);
 			if (replacesAllRemoteSecrets === null) return {
 				ok: false,
 				reason: "inheritance-source-unavailable"
 			};
 			if (!replacesAllRemoteSecrets) {
-				const activeSecrets = previous.versionId ? await readCloudflareVersionSecretBindings(options, commonArgs, previous.versionId) : null;
+				const activeSecrets = previous.versionId ? await readCloudflareVersionSecretBindings(options, configPath, previous.versionId) : null;
 				if (!activeSecrets || !options.pinActiveSecrets || !await options.pinActiveSecrets(previous.versionId, activeSecrets)) return {
 					ok: false,
 					reason: "inheritance-source-changed",
@@ -1224,16 +1270,17 @@ async function activateCloudflareVersionWithSecretsFile(options) {
 					rollback: "not-needed"
 				};
 				activeSecretsPinned = true;
+				pinnedActiveSecrets = activeSecrets;
 			}
 		}
 		inheritanceBaseline = recent;
 	}
 	const desiredMetadata = parseCloudflareVersionMessage(options.message);
 	let desiredTriggerConfig = desiredMetadata?.schema === 2 ? desiredMetadata.triggerConfig : options.configPath ? readCloudflareTriggerConfig(options.configPath) : triggerConfigFromWrangler({});
-	let previousVersion = previousVersionId && desiredMetadata?.schema === 2 ? await readCloudflareVersionInspection(options, commonArgs, previousVersionId, inheritanceBaseline?.map((version) => version.inspection)) : null;
+	let previousVersion = previousVersionId && desiredMetadata?.schema === 2 ? await readCloudflareVersionInspection(options, configPath, previousVersionId, inheritanceBaseline?.map((version) => version.inspection)) : null;
 	async function previousIsSecretOnlyDraft() {
 		if (!previousVersionId) return false;
-		previousVersion ??= await readCloudflareVersionInspection(options, commonArgs, previousVersionId, inheritanceBaseline?.map((version) => version.inspection));
+		previousVersion ??= await readCloudflareVersionInspection(options, configPath, previousVersionId, inheritanceBaseline?.map((version) => version.inspection));
 		return previousVersion?.isSecretOnlyDraft === true;
 	}
 	const previousMetadata = desiredMetadata?.schema === 2 ? previousVersion?.metadata : null;
@@ -1265,59 +1312,142 @@ async function activateCloudflareVersionWithSecretsFile(options) {
 	} : versionedPreviousTriggerConfig;
 	const previousTriggerConfig = triggerConfigWithQueueConsumerCleanup(versionedPreviousTriggerConfigWithTraffic, options.queueConsumerCleanup);
 	const alias = `void-ready-${Date.now().toString(36)}`;
-	if (options.atomic && previous.versionId !== null) {
-		if (!activeSecretsPinned && options.pinActiveSecrets) {
-			const activeSecrets = await readCloudflareVersionSecretBindings(options, commonArgs, previous.versionId);
-			if (activeSecrets?.length) await options.pinActiveSecrets(previous.versionId, activeSecrets);
+	const bootstrapVoidDraft = !options.preserveTriggers && !options.requirePreviewForReadiness && previousVersion?.isVoidSecretOnlyDraft === true;
+	if (previous.versionId !== null && (options.atomic || bootstrapVoidDraft)) {
+		if (bootstrapVoidDraft && !activeSecretsPinned && !options.pinActiveSecrets) return {
+			ok: false,
+			reason: "inheritance-source-unavailable"
+		};
+		if (bootstrapVoidDraft || !activeSecretsPinned && options.pinActiveSecrets) {
+			let activeSecrets;
+			try {
+				activeSecrets = await readCloudflareVersionSecretBindings(options, configPath, previous.versionId);
+			} catch {
+				return {
+					ok: false,
+					reason: "inheritance-source-unavailable"
+				};
+			}
+			if (activeSecrets === null) return {
+				ok: false,
+				reason: "inheritance-source-unavailable"
+			};
+			if (bootstrapVoidDraft && (activeSecrets.length === 0 || activeSecrets.some((secret) => secret.type !== "secret_text") || !arraysEqual(activeSecrets.map((secret) => secret.name).sort(), [...previousVersion.voidDraftSecretNames].sort()) || activeSecretsPinned && !isDeepStrictEqual([...activeSecrets].sort((a, b) => a.name.localeCompare(b.name)), [...pinnedActiveSecrets].sort((a, b) => a.name.localeCompare(b.name))))) return {
+				ok: false,
+				reason: "inheritance-source-changed"
+			};
+			if (!activeSecretsPinned && activeSecrets.length) {
+				let pinned;
+				try {
+					pinned = await options.pinActiveSecrets(previous.versionId, activeSecrets);
+				} catch {
+					return {
+						ok: false,
+						reason: "inheritance-source-unavailable"
+					};
+				}
+				if (!pinned) return {
+					ok: false,
+					reason: "inheritance-source-changed"
+				};
+			}
 		}
 		return bootstrapFirstDeployment({
 			...options,
 			message
-		}, commonArgs, previous.versionId, true);
+		}, configPath, previous.versionId, options.atomic === true, previousTriggerConfig);
+	}
+	if (previous.versionId !== null && !activeSecretsPinned && options.pinActiveSecrets && options.candidateSecretsFilePath === void 0) {
+		let activeSecrets;
+		try {
+			activeSecrets = await readCloudflareVersionSecretBindings(options, configPath, previous.versionId);
+		} catch {
+			return {
+				ok: false,
+				reason: "inheritance-source-unavailable"
+			};
+		}
+		if (activeSecrets === null) return {
+			ok: false,
+			reason: "inheritance-source-unavailable"
+		};
+		if (activeSecrets.some((secret) => !secret.name.trim() || secret.name.trim() !== secret.name) || new Set(activeSecrets.map((secret) => secret.name)).size !== activeSecrets.length) return {
+			ok: false,
+			reason: "inheritance-source-changed"
+		};
+		if (activeSecrets.length) {
+			let pinned;
+			try {
+				pinned = await options.pinActiveSecrets(previous.versionId, activeSecrets);
+			} catch {
+				return {
+					ok: false,
+					reason: "inheritance-source-unavailable"
+				};
+			}
+			if (!pinned) return {
+				ok: false,
+				reason: "inheritance-source-changed"
+			};
+			activeSecretsPinned = true;
+		}
+	}
+	if (activeSecretsPinned) {
+		if (!options.verifyUploader()) return {
+			ok: false,
+			reason: "uploader-changed"
+		};
+		const owner = await readCurrentProductionVersion(options, configPath);
+		if (owner.kind === "failed") return {
+			ok: false,
+			reason: "status-failed",
+			status: owner.status
+		};
+		if (owner.kind !== "ok" || owner.versionId !== previous.versionId || !productionVersionPercentagesEqual(owner.versions, [{
+			versionId: previous.versionId,
+			percentage: 100
+		}])) return {
+			ok: false,
+			reason: "deployment-changed",
+			activeVersionId: owner.kind === "ok" ? owner.versionId : null,
+			rollback: "not-needed"
+		};
 	}
 	options.onProgress?.("Uploading the Worker and assets...");
-	const upload = await Promise.resolve(options.runWrangler([
-		"versions",
-		"upload",
-		...commonArgs,
-		"--name",
-		options.workerName,
-		"--message",
+	const upload = await Promise.resolve(options.runWrangler({
+		type: "versions.upload",
+		configPath,
+		workerName: options.workerName,
 		message,
-		...options.candidateSecretsFilePath ? ["--secrets-file", options.candidateSecretsFilePath] : [],
-		...options.assetsDirectoryOverride ? ["--assets", options.assetsDirectoryOverride] : [],
-		"--preview-alias",
-		alias,
-		"--strict",
-		"--experimental-provision=false",
-		"--experimental-auto-create=false"
-	], { capture: true }));
+		secretsFilePath: options.candidateSecretsFilePath,
+		assetsDirectory: options.assetsDirectoryOverride,
+		previewAlias: alias
+	}, { capture: true }));
 	if (!isCleanCommandExit(upload)) {
-		const output = stripVTControlCharacters(`${upload.stdout}\n${upload.stderr}`);
-		const cloudflareErrorCode = parseCloudflareErrorCode(output);
-		const isBootstrapError = cloudflareErrorCode === DURABLE_MIGRATION_VERSION_ERROR || /This\s+Worker\s+has\s+a\s+pending\s+Durable\s+Object\s+migration,\s+which\s+cannot\s+be\s+applied\s+by\s+`wrangler\s+versions\s+upload`/i.test(output) || /cannot upload a new version of a worker that does not yet exist/i.test(output);
+		const cloudflareErrorCode = upload.errorCode;
+		const isBootstrapError = isCompletedCommand(upload) && (upload.failure === "durable-migration" || upload.failure === "not-found" || cloudflareErrorCode === DURABLE_MIGRATION_VERSION_ERROR || cloudflareErrorCode === 10007);
 		if (!options.preserveTriggers && isBootstrapError && (previous.versionId === null || options.allowFirstDeploymentBootstrap === true || await previousIsSecretOnlyDraft())) return bootstrapFirstDeployment({
 			...options,
 			message
-		}, commonArgs, previous.versionId);
+		}, configPath, previous.versionId, false, previousTriggerConfig);
 		return {
 			ok: false,
 			reason: "upload-failed",
 			status: upload.status,
 			...commandDiagnosticFields(upload),
 			...cloudflareErrorCode === void 0 ? {} : { cloudflareErrorCode },
-			...isContainersUnavailable(output) ? { containersUnavailable: true } : {}
+			...isContainersUnavailable(upload) ? { containersUnavailable: true } : {}
 		};
 	}
-	const output = `${upload.stdout}\n${upload.stderr}`;
-	const versionId = output.match(VERSION_ID_RE)?.[1];
+	const uploaded = readUploadResult(upload);
+	const versionId = uploaded?.versionId;
 	if (!versionId) return {
 		ok: false,
 		reason: "upload-output-invalid"
 	};
 	options.onProgress?.("Verifying the uploaded Worker...");
 	if (inheritanceBaseline) {
-		const recent = await readRecentCloudflareVersionIds(options, commonArgs);
+		const recent = await readRecentCloudflareVersionIds(options, configPath);
 		const previousLatest = inheritanceBaseline.at(-1);
 		const expected = [...inheritanceBaseline.map((version) => version.id), versionId].slice(-10);
 		if (recent === null) return {
@@ -1342,7 +1472,15 @@ async function activateCloudflareVersionWithSecretsFile(options) {
 		if (!options.validateUploadedVersion && !inheritanceBaseline) throw new Error("A Worker candidate cannot be recorded without validating its upload and version sequence.");
 		await options.recordVerifiedCandidate(versionId, previous.versionId);
 	}
-	const reportedPreviewUrl = output.match(PREVIEW_URL_RE)?.[1];
+	const reportedPreviewUrl = desiredTriggerConfig.preview_urls || desiredTriggerConfig.preservePreviewUrls || desiredTriggerConfig.preserve ? uploaded?.previewUrl : void 0;
+	if (options.requirePreviewForReadiness && (!reportedPreviewUrl || !isCandidatePreviewUrl(reportedPreviewUrl, options.workerName, versionId, alias))) return {
+		ok: false,
+		reason: "preview-unavailable",
+		versionId,
+		previousVersionId,
+		rollback: "not-needed",
+		diagnostic: "This existing Worker has no version metadata binding and no genuine candidate preview URL. Keep its bindings unchanged; configure version metadata on the existing Worker or use an admitted version preview, then retry the handoff. Production traffic is unchanged."
+	};
 	let authenticatedWorkersDevSubdomain = reportedPreviewUrl ? extractWorkersDevSubdomain(reportedPreviewUrl) : void 0;
 	let readinessUrl = reportedPreviewUrl;
 	let readinessUsesCustomRoute = false;
@@ -1351,7 +1489,7 @@ async function activateCloudflareVersionWithSecretsFile(options) {
 		if (!options.preserveTriggers && (previous.versionId === null || options.allowFirstDeploymentBootstrap === true || await previousIsSecretOnlyDraft())) return bootstrapFirstDeployment({
 			...options,
 			message
-		}, commonArgs, previous.versionId);
+		}, configPath, previous.versionId, false, previousTriggerConfig);
 		readinessUrl = desiredTriggerConfig.workers_dev ? workersDevReadinessUrl(options.workerName, options.workersDevSubdomain) : customRouteReadinessUrl(desiredTriggerConfig.routes);
 		readinessUsesCustomRoute = !desiredTriggerConfig.workers_dev && readinessUrl !== void 0;
 		if (!readinessUrl) return {
@@ -1369,11 +1507,11 @@ async function activateCloudflareVersionWithSecretsFile(options) {
 			previousVersionId: previous.versionId,
 			rollback: "not-needed"
 		};
-		const stagingOwnerFailure = await verifyReadinessStagingOwner(options, commonArgs, previous.versionId, versionId);
+		const stagingOwnerFailure = await verifyReadinessStagingOwner(options, configPath, previous.versionId, versionId);
 		if (stagingOwnerFailure) return stagingOwnerFailure;
-		const staged = await deployVersionPercentages(options, commonArgs, [`${previous.versionId}@100`, `${versionId}@0`], message);
+		const staged = await deployVersionPercentages(options, configPath, [`${previous.versionId}@100`, `${versionId}@0`], message);
 		if (!isCleanCommandExit(staged)) {
-			const cloudflareErrorCode = parseCloudflareErrorCode(`${staged.stdout}\n${staged.stderr}`);
+			const cloudflareErrorCode = staged.errorCode;
 			return {
 				ok: false,
 				reason: "readiness-staging-failed",
@@ -1388,8 +1526,8 @@ async function activateCloudflareVersionWithSecretsFile(options) {
 		stagedVersionOverride = true;
 	}
 	options.onProgress?.("Waiting for the Worker to become ready...");
-	let ready = await probeReadiness(`${readinessUrl.replace(/\/$/, "")}/__void/ready`, options.workerName, readinessUsesCustomRoute ? void 0 : options.readinessHeaders, authenticatedWorkersDevSubdomain, stagedVersionOverride ? versionId : void 0, options.fetch ?? globalThis.fetch, options.sleep ?? defaultSleep, options.readinessAttempts ?? 6);
-	if (ready === "access-denied" && !stagedVersionOverride && previous.versionId !== null) {
+	let ready = await probeReadiness(`${readinessUrl.replace(/\/$/, "")}/__void/ready`, options.workerName, readinessUsesCustomRoute ? void 0 : options.readinessHeaders, authenticatedWorkersDevSubdomain, stagedVersionOverride ? versionId : void 0, options.fetch ?? globalThis.fetch, options.sleep ?? defaultSleep, options.readinessAttempts ?? 6, Number.POSITIVE_INFINITY, options.requireVersionMetadata ? versionId : void 0);
+	if (ready === "access-denied" && !stagedVersionOverride && previous.versionId !== null && !options.requirePreviewForReadiness) {
 		const stableReadinessUrl = desiredTriggerConfig.workers_dev ? workersDevReadinessUrl(options.workerName, extractWorkersDevSubdomain(readinessUrl) ?? options.workersDevSubdomain) : customRouteReadinessUrl(desiredTriggerConfig.routes);
 		if (stableReadinessUrl && stableReadinessUrl !== readinessUrl) {
 			if (!options.verifyUploader()) return {
@@ -1399,11 +1537,11 @@ async function activateCloudflareVersionWithSecretsFile(options) {
 				previousVersionId: previous.versionId,
 				rollback: "not-needed"
 			};
-			const stagingOwnerFailure = await verifyReadinessStagingOwner(options, commonArgs, previous.versionId, versionId);
+			const stagingOwnerFailure = await verifyReadinessStagingOwner(options, configPath, previous.versionId, versionId);
 			if (stagingOwnerFailure) return stagingOwnerFailure;
-			const staged = await deployVersionPercentages(options, commonArgs, [`${previous.versionId}@100`, `${versionId}@0`], message);
+			const staged = await deployVersionPercentages(options, configPath, [`${previous.versionId}@100`, `${versionId}@0`], message);
 			if (!isCleanCommandExit(staged)) {
-				const cloudflareErrorCode = parseCloudflareErrorCode(`${staged.stdout}\n${staged.stderr}`);
+				const cloudflareErrorCode = staged.errorCode;
 				return {
 					ok: false,
 					reason: "readiness-staging-failed",
@@ -1419,7 +1557,7 @@ async function activateCloudflareVersionWithSecretsFile(options) {
 			authenticatedWorkersDevSubdomain = extractWorkersDevSubdomain(stableReadinessUrl);
 			readinessUsesCustomRoute = !desiredTriggerConfig.workers_dev;
 			stagedVersionOverride = true;
-			ready = await probeReadiness(`${readinessUrl.replace(/\/$/, "")}/__void/ready`, options.workerName, readinessUsesCustomRoute ? void 0 : options.readinessHeaders, authenticatedWorkersDevSubdomain, versionId, options.fetch ?? globalThis.fetch, options.sleep ?? defaultSleep, options.readinessAttempts ?? 6);
+			ready = await probeReadiness(`${readinessUrl.replace(/\/$/, "")}/__void/ready`, options.workerName, readinessUsesCustomRoute ? void 0 : options.readinessHeaders, authenticatedWorkersDevSubdomain, versionId, options.fetch ?? globalThis.fetch, options.sleep ?? defaultSleep, options.readinessAttempts ?? 6, Number.POSITIVE_INFINITY, options.requireVersionMetadata ? versionId : void 0);
 		}
 	}
 	if (ready !== "ready") return {
@@ -1427,16 +1565,16 @@ async function activateCloudflareVersionWithSecretsFile(options) {
 		reason: ready === "access-denied" ? "readiness-access-denied" : "readiness-failed",
 		versionId,
 		previousVersionId: previous.versionId,
-		rollback: stagedVersionOverride ? await restorePreviousVersion(options, commonArgs, previous.versionId, "readiness failed", [stagedVersionPercentages(previous.versionId, versionId)]) : "not-needed"
+		rollback: stagedVersionOverride ? await restorePreviousVersion(options, configPath, previous.versionId, "readiness failed", [stagedVersionPercentages(previous.versionId, versionId)]) : "not-needed"
 	};
 	if (!options.verifyUploader()) return {
 		ok: false,
 		reason: "uploader-changed",
 		versionId,
 		previousVersionId: previous.versionId,
-		rollback: stagedVersionOverride ? await restorePreviousVersion(options, commonArgs, previous.versionId, "uploader verification failed", [stagedVersionPercentages(previous.versionId, versionId)]) : "not-needed"
+		rollback: stagedVersionOverride ? await restorePreviousVersion(options, configPath, previous.versionId, "uploader verification failed", [stagedVersionPercentages(previous.versionId, versionId)]) : "not-needed"
 	};
-	const ownerBeforeActivation = await readCurrentProductionVersion(options, commonArgs);
+	const ownerBeforeActivation = await readCurrentProductionVersion(options, configPath);
 	if (ownerBeforeActivation.kind === "failed") return {
 		ok: false,
 		reason: "status-failed",
@@ -1464,14 +1602,14 @@ async function activateCloudflareVersionWithSecretsFile(options) {
 		triggerRepair: "succeeded"
 	};
 	options.onProgress?.("Activating the Worker...");
-	const activate = await deployVersionPercentages(options, commonArgs, [`${versionId}@100`], message);
+	const activate = await deployVersionPercentages(options, configPath, [`${versionId}@100`], message);
 	if (!isCleanCommandExit(activate)) return {
 		ok: false,
 		reason: "activation-failed",
 		status: activate.status,
 		versionId,
 		previousVersionId: previous.versionId,
-		rollback: stagedVersionOverride ? await restorePreviousVersion(options, commonArgs, previous.versionId, "version activation failed", [stagedVersionPercentages(previous.versionId, versionId), [{
+		rollback: stagedVersionOverride ? await restorePreviousVersion(options, configPath, previous.versionId, "version activation failed", [stagedVersionPercentages(previous.versionId, versionId), [{
 			versionId,
 			percentage: 100
 		}]]) : "not-needed"
@@ -1484,7 +1622,7 @@ async function activateCloudflareVersionWithSecretsFile(options) {
 		rollback: previous.versionId ? "unsafe" : "unavailable"
 	};
 	if (options.preserveTriggers) {
-		const owner = await readCurrentProductionVersion(options, commonArgs);
+		const owner = await readCurrentProductionVersion(options, configPath);
 		if (owner.kind !== "ok" || owner.versionId !== versionId) return {
 			ok: false,
 			reason: "deployment-changed",
@@ -1535,7 +1673,7 @@ async function activateCloudflareVersionWithSecretsFile(options) {
 			previousVersionId: previous.versionId,
 			rollback: "unsafe"
 		};
-		const ownerBeforeCompensation = await readCurrentProductionVersion(options, commonArgs);
+		const ownerBeforeCompensation = await readCurrentProductionVersion(options, configPath);
 		if (ownerBeforeCompensation.kind !== "ok" || ownerBeforeCompensation.versionId === null) return {
 			ok: false,
 			reason: "triggers-failed",
@@ -1567,7 +1705,7 @@ async function activateCloudflareVersionWithSecretsFile(options) {
 				triggerRepair: repair.ok ? "succeeded" : repair.reason === "metadata-unavailable" ? "unavailable" : "failed"
 			};
 		}
-		const rollback = await restorePreviousVersionAndTriggers(options, commonArgs, previous.versionId, "trigger activation failed", desiredTriggerConfig, versionId, versionedPreviousTriggerConfigWithTraffic);
+		const rollback = await restorePreviousVersionAndTriggers(options, configPath, previous.versionId, "trigger activation failed", desiredTriggerConfig, versionId, versionedPreviousTriggerConfigWithTraffic);
 		return {
 			ok: false,
 			reason: "triggers-failed",
@@ -1600,8 +1738,8 @@ async function activateCloudflareVersionWithSecretsFile(options) {
 		...workersDevSubdomainResult(readinessUrl)
 	};
 }
-async function restorePreviousVersionAndTriggers(options, commonArgs, previousVersionId, cause, failedTriggerConfig, failedVersionId, capturedTriggerConfig) {
-	const traffic = await restorePreviousVersion(options, commonArgs, previousVersionId, cause, [[{
+async function restorePreviousVersionAndTriggers(options, configPath, previousVersionId, cause, failedTriggerConfig, failedVersionId, capturedTriggerConfig) {
+	const traffic = await restorePreviousVersion(options, configPath, previousVersionId, cause, [[{
 		versionId: failedVersionId,
 		percentage: 100
 	}]]);
@@ -1609,7 +1747,7 @@ async function restorePreviousVersionAndTriggers(options, commonArgs, previousVe
 	if (!options.verifyUploader()) return "unsafe";
 	let targetTriggerConfig = capturedTriggerConfig;
 	if (!targetTriggerConfig) {
-		const metadata = await readCloudflareVersionMetadata(options, commonArgs, previousVersionId);
+		const metadata = await readCloudflareVersionMetadata(options, configPath, previousVersionId);
 		if (metadata?.schema !== 2) return "unavailable";
 		targetTriggerConfig = metadata.triggerConfig;
 	}
@@ -1628,23 +1766,20 @@ async function restorePreviousVersionAndTriggers(options, commonArgs, previousVe
 	});
 	return triggers.ok && triggers.targetOwnsTraffic ? "succeeded" : "failed";
 }
-async function readCloudflareVersionMetadata(options, commonArgs, versionId) {
-	return (await readCloudflareVersionInspection(options, commonArgs, versionId))?.metadata ?? null;
+async function readCloudflareVersionMetadata(options, configPath, versionId) {
+	return (await readCloudflareVersionInspection(options, configPath, versionId))?.metadata ?? null;
 }
-async function readCloudflareVersionInspection(options, commonArgs, versionId, knownVersions) {
+async function readCloudflareVersionInspection(options, configPath, versionId, knownVersions) {
 	try {
 		let versions = knownVersions;
 		if (versions === void 0) {
-			const result = await options.runWrangler([
-				"versions",
-				"list",
-				...commonArgs,
-				"--name",
-				options.workerName,
-				"--json"
-			], { capture: true });
+			const result = await options.runWrangler({
+				type: "versions.list",
+				configPath,
+				workerName: options.workerName
+			}, { capture: true });
 			if (!isCleanCommandExit(result)) return null;
-			versions = JSON.parse(result.stdout);
+			versions = result.data;
 		}
 		if (!Array.isArray(versions)) return null;
 		for (const entry of versions) {
@@ -1652,24 +1787,25 @@ async function readCloudflareVersionInspection(options, commonArgs, versionId, k
 			const annotations = isRecord(entry.annotations) ? entry.annotations : void 0;
 			const message = annotations?.["workers/message"];
 			let draft = entry;
-			if (annotations?.["workers/triggered_by"] === "secret" && Object.keys(annotations).length === 1 && !isRecord(entry.resources)) {
-				const inspection = await Promise.resolve(options.runWrangler([
-					"versions",
-					"view",
+			if (annotations?.["workers/triggered_by"] === "secret" && Object.keys(annotations).length === 1 && !isWranglerSecretOnlyDraft(entry)) {
+				const inspection = await Promise.resolve(options.runWrangler({
+					type: "versions.view",
 					versionId,
-					...commonArgs,
-					"--name",
-					options.workerName,
-					"--json"
-				], { capture: true }));
+					configPath,
+					workerName: options.workerName,
+					includeSource: true
+				}, { capture: true }));
 				if (isCleanCommandExit(inspection)) {
-					const inspected = JSON.parse(inspection.stdout);
+					const inspected = inspection.data;
 					if (isRecord(inspected) && inspected.id === versionId) draft = inspected;
 				}
 			}
+			const isVoidDraft = isVoidSecretOnlyDraft(draft);
 			return {
 				metadata: typeof message === "string" ? parseCloudflareVersionMessage(message) : null,
-				isSecretOnlyDraft: isWranglerSecretOnlyDraft(draft)
+				isSecretOnlyDraft: isWranglerSecretOnlyDraft(draft) || isVoidSecretOnlyDraft(draft),
+				isVoidSecretOnlyDraft: isVoidDraft,
+				voidDraftSecretNames: isVoidDraft ? draft.bindings.map((binding) => binding.name) : null
 			};
 		}
 	} catch {
@@ -1677,21 +1813,18 @@ async function readCloudflareVersionInspection(options, commonArgs, versionId, k
 	}
 	return null;
 }
-async function readRecentCloudflareVersionIds(options, commonArgs) {
-	const result = await Promise.resolve(options.runWrangler([
-		"versions",
-		"list",
-		...commonArgs,
-		"--name",
-		options.workerName,
-		"--json"
-	], { capture: true }));
+async function readRecentCloudflareVersionIds(options, configPath) {
+	const result = await Promise.resolve(options.runWrangler({
+		type: "versions.list",
+		configPath,
+		workerName: options.workerName
+	}, { capture: true }));
 	if (!isCleanCommandExit(result)) {
-		if (isMissingWorkerOutput(`${result.stdout}\n${result.stderr}`)) return [];
+		if (isCompletedCommand(result) && (result.failure === "not-found" || result.errorCode === 10007)) return [];
 		return null;
 	}
 	try {
-		const versions = JSON.parse(result.stdout);
+		const versions = result.data;
 		if (!Array.isArray(versions) || !versions.every((version) => isRecord(version) && typeof version.id === "string" && typeof version.number === "number" && Number.isSafeInteger(version.number))) return null;
 		return versions.map((version) => ({
 			id: version.id,
@@ -1705,29 +1838,26 @@ async function readRecentCloudflareVersionIds(options, commonArgs) {
 function arraysEqual(left, right) {
 	return left.length === right.length && left.every((value, index) => value === right[index]);
 }
-async function candidateReplacesAllRemoteSecrets(options, commonArgs, activeVersionId, latestVersionId) {
+async function candidateReplacesAllRemoteSecrets(options, configPath, activeVersionId, latestVersionId) {
 	const versionIds = [...new Set([activeVersionId, latestVersionId].filter(Boolean))];
 	const secretBindings = [];
 	for (const versionId of versionIds) {
-		const bindings = await readCloudflareVersionSecretBindings(options, commonArgs, versionId);
+		const bindings = await readCloudflareVersionSecretBindings(options, configPath, versionId);
 		if (bindings === null) return null;
 		secretBindings.push(bindings);
 	}
 	return secretBindings.every((bindings) => bindings.every((binding) => binding.type === "secret_text" && Object.hasOwn(options.candidateSecrets ?? {}, binding.name)));
 }
-async function readCloudflareVersionSecretBindings(options, commonArgs, versionId) {
-	const result = await Promise.resolve(options.runWrangler([
-		"versions",
-		"view",
+async function readCloudflareVersionSecretBindings(options, configPath, versionId) {
+	const result = await Promise.resolve(options.runWrangler({
+		type: "versions.view",
 		versionId,
-		...commonArgs,
-		"--name",
-		options.workerName,
-		"--json"
-	], { capture: true }));
+		configPath,
+		workerName: options.workerName
+	}, { capture: true }));
 	if (!isCleanCommandExit(result)) return null;
 	try {
-		const version = JSON.parse(result.stdout);
+		const version = result.data;
 		if (!isRecord(version) || version.id !== versionId || !isRecord(version.resources)) return null;
 		const bindings = version.resources.bindings;
 		if (!Array.isArray(bindings) || !bindings.every(isRecord)) return null;
@@ -1751,19 +1881,22 @@ async function readCloudflareVersionSecretBindings(options, commonArgs, versionI
 * brand-new Worker can therefore need one ordinary deploy before later releases use preview-first
 * version activation. This fallback requires prior proof that no application had been deployed.
 */
-async function bootstrapFirstDeployment(options, commonArgs, previousVersionId, atomic = false) {
+async function bootstrapFirstDeployment(options, configPath, previousVersionId, atomic = false, previousTriggerConfig) {
 	if (!options.verifyUploader()) return {
 		ok: false,
 		reason: "uploader-changed"
 	};
-	if (atomic) {
-		const current = await readCurrentProductionVersion(options, commonArgs);
+	{
+		const current = await readCurrentProductionVersion(options, configPath);
 		if (current.kind === "failed") return {
 			ok: false,
 			reason: "status-failed",
 			status: current.status
 		};
-		if (current.kind !== "ok" || current.versionId !== previousVersionId) return {
+		if (current.kind !== "ok" || current.versionId !== previousVersionId || !productionVersionPercentagesEqual(current.versions, previousVersionId ? [{
+			versionId: previousVersionId,
+			percentage: 100
+		}] : [])) return {
 			ok: false,
 			reason: "deployment-changed",
 			activeVersionId: current.kind === "ok" ? current.versionId : null,
@@ -1771,53 +1904,172 @@ async function bootstrapFirstDeployment(options, commonArgs, previousVersionId,
 		};
 	}
 	options.onProgress?.(atomic ? "Publishing the Worker atomically..." : "Publishing the first Worker deployment...");
-	const bootstrap = await Promise.resolve(options.runWrangler([
-		"deploy",
-		...commonArgs,
-		"--name",
-		options.workerName,
-		"--message",
-		options.message,
-		...options.candidateSecretsFilePath ? ["--secrets-file", options.candidateSecretsFilePath] : [],
-		...options.assetsDirectoryOverride ? ["--assets", options.assetsDirectoryOverride] : [],
-		"--strict",
-		"--experimental-provision=false",
-		"--experimental-auto-create=false",
-		"--autoconfig=false"
-	], { capture: true }));
-	const output = `${bootstrap.stdout}\n${bootstrap.stderr}`;
+	const bootstrap = await Promise.resolve(options.runWrangler({
+		type: "worker.deploy",
+		configPath,
+		workerName: options.workerName,
+		message: options.message,
+		secretsFilePath: options.candidateSecretsFilePath,
+		assetsDirectory: options.assetsDirectoryOverride
+	}, { capture: true }));
 	if (!isCleanCommandExit(bootstrap)) {
-		const cloudflareErrorCode = parseCloudflareErrorCode(output);
+		const cloudflareErrorCode = bootstrap.errorCode;
 		return {
 			ok: false,
 			reason: atomic ? "atomic-failed" : "bootstrap-failed",
 			status: bootstrap.status,
 			...commandDiagnosticFields(bootstrap),
 			...cloudflareErrorCode === void 0 ? {} : { cloudflareErrorCode },
-			...isContainersUnavailable(output) ? { containersUnavailable: true } : {}
+			...isContainersUnavailable(bootstrap) ? { containersUnavailable: true } : {}
 		};
 	}
-	const versionId = output.match(VERSION_ID_RE)?.[1];
+	const published = readUploadResult(bootstrap);
+	const versionId = published?.versionId;
 	const desiredMetadata = parseCloudflareVersionMessage(options.message);
 	const desiredTriggerConfig = desiredMetadata?.schema === 2 ? desiredMetadata.triggerConfig : options.configPath ? readCloudflareTriggerConfig(options.configPath) : triggerConfigFromWrangler({});
-	const reportedUrl = output.match(PREVIEW_URL_RE)?.[1] ?? output.match(WORKERS_DEV_URL_RE)?.[1];
-	const reportedOrConfiguredUrl = reportedUrl ?? (desiredTriggerConfig.workers_dev ? workersDevReadinessUrl(options.workerName, options.workersDevSubdomain) : customRouteReadinessUrl(desiredTriggerConfig.routes));
+	const reportedOrConfiguredUrl = published?.previewUrl ?? published?.workersDevUrl ?? (desiredTriggerConfig.workers_dev ? workersDevReadinessUrl(options.workerName, options.workersDevSubdomain) : customRouteReadinessUrl(desiredTriggerConfig.routes));
 	if (!versionId || !reportedOrConfiguredUrl) return {
 		ok: false,
 		reason: atomic ? "atomic-output-invalid" : "bootstrap-output-invalid",
 		previousVersionId,
 		...versionId ? { versionId } : {}
 	};
+	if (!options.verifyUploader()) return {
+		ok: false,
+		reason: "uploader-changed",
+		versionId,
+		previousVersionId,
+		rollback: "unsafe"
+	};
+	const triggerOptions = {
+		runWrangler: options.runWrangler,
+		workerName: options.workerName,
+		configPath: options.configPath,
+		targetVersionId: versionId,
+		targetTriggerConfig: options.preserveTriggers ? {
+			...desiredTriggerConfig,
+			preserve: true
+		} : desiredTriggerConfig,
+		previousTriggerConfig,
+		...previousVersionId && previousTriggerConfig ? { knownTriggerConfigs: { [previousVersionId]: previousTriggerConfig } } : {},
+		publishEmptyCustomDomains: options.publishEmptyCustomDomains,
+		publishEmptyCrons: options.publishEmptyCrons
+	};
+	const verifyPublishedOwner = async () => {
+		const owner = await readCurrentProductionVersion(options, configPath);
+		if (owner.kind === "failed") return {
+			ok: false,
+			reason: "status-failed",
+			status: owner.status,
+			versionId,
+			previousVersionId,
+			rollback: "unsafe"
+		};
+		if (owner.kind !== "ok" || owner.versionId !== versionId || !productionVersionPercentagesEqual(owner.versions, [{
+			versionId,
+			percentage: 100
+		}])) {
+			const repair = owner.kind === "ok" && owner.versionId && owner.versionId !== versionId && options.verifyUploader() ? await stabilizeCloudflareVersionTriggers({
+				...triggerOptions,
+				targetTriggerConfig: {
+					...desiredTriggerConfig,
+					preserve: true
+				}
+			}) : null;
+			return {
+				ok: false,
+				reason: "deployment-changed",
+				versionId,
+				previousVersionId,
+				activeVersionId: repair?.activeVersionId ?? (owner.kind === "ok" ? owner.versionId : null),
+				rollback: "not-needed",
+				...repair ? { triggerRepair: repair.ok && !repair.targetOwnsTraffic ? "succeeded" : !repair.ok && repair.reason !== "metadata-unavailable" ? "failed" : "unavailable" } : {}
+			};
+		}
+		return null;
+	};
+	const publishedOwnerFailure = await verifyPublishedOwner();
+	if (publishedOwnerFailure) return publishedOwnerFailure;
+	if (options.validateUploadedVersion || options.recordVerifiedCandidate) {
+		options.onProgress?.("Verifying the uploaded Worker...");
+		try {
+			await options.validateUploadedVersion?.(versionId);
+			const validatedOwnerFailure = await verifyPublishedOwner();
+			if (validatedOwnerFailure) return validatedOwnerFailure;
+			if (options.recordVerifiedCandidate) {
+				if (!options.validateUploadedVersion && !options.verifyInheritedSecrets && options.expectedPreviousVersionId === void 0) throw new Error("The bootstrap upload has no verified candidate checkpoint.");
+				await options.recordVerifiedCandidate(versionId, previousVersionId);
+			}
+		} catch {
+			return {
+				ok: false,
+				reason: atomic ? "atomic-failed" : "bootstrap-failed",
+				versionId,
+				previousVersionId,
+				rollback: "unavailable",
+				diagnostic: `Worker version ${versionId} was published, but its upload validation or candidate checkpoint failed. Inspect the current Worker deployment before retrying.`
+			};
+		}
+		const checkpointOwnerFailure = await verifyPublishedOwner();
+		if (checkpointOwnerFailure) return checkpointOwnerFailure;
+	}
+	options.onProgress?.("Updating routes and triggers...");
+	const triggers = await stabilizeCloudflareVersionTriggers(triggerOptions);
+	if (!triggers.ok || !triggers.targetOwnsTraffic) {
+		const superseded = triggers.activeVersionId !== void 0 && triggers.activeVersionId !== null && triggers.activeVersionId !== versionId;
+		return {
+			ok: false,
+			reason: superseded ? "deployment-changed" : "triggers-failed",
+			...!triggers.ok ? { status: triggers.status } : {},
+			versionId,
+			previousVersionId,
+			activeVersionId: triggers.activeVersionId,
+			rollback: superseded ? "not-needed" : triggers.activeVersionId ? "unavailable" : "unsafe",
+			...superseded ? { triggerRepair: triggers.ok ? "succeeded" : triggers.reason === "metadata-unavailable" ? "unavailable" : "failed" } : {}
+		};
+	}
 	const previewUrl = publishedCloudflareUrl(options.workerName, desiredTriggerConfig, reportedOrConfiguredUrl);
+	const usesCustomDomain = !desiredTriggerConfig.workers_dev && desiredTriggerConfig.routes.some((route) => isRecord(route) && route.custom_domain === true);
+	const customDomainBootstrap = !atomic && usesCustomDomain;
+	const readinessTimeoutMs = customDomainBootstrap ? 3e5 : 6e4;
 	options.onProgress?.("Waiting for the Worker to become ready...");
-	const ready = await probeReadiness(`${previewUrl.replace(/\/$/, "")}/__void/ready`, options.workerName, reportedUrl || desiredTriggerConfig.workers_dev ? options.readinessHeaders : void 0, extractWorkersDevSubdomain(previewUrl), void 0, options.fetch ?? globalThis.fetch, options.sleep ?? defaultSleep, options.readinessAttempts ?? 30, 6e4);
+	const ready = await probeReadiness(`${previewUrl.replace(/\/$/, "")}/__void/ready`, options.workerName, extractWorkersDevSubdomain(previewUrl) ? options.readinessHeaders : void 0, extractWorkersDevSubdomain(previewUrl), void 0, options.fetch ?? globalThis.fetch, options.sleep ?? defaultSleep, options.readinessAttempts ?? (customDomainBootstrap ? 150 : 30), readinessTimeoutMs, options.requireVersionMetadata ? versionId : void 0);
 	if (ready !== "ready") return {
 		ok: false,
 		reason: ready === "access-denied" ? atomic ? "atomic-readiness-access-denied" : "bootstrap-readiness-access-denied" : atomic ? "atomic-readiness-failed" : "bootstrap-readiness-failed",
 		versionId,
 		previousVersionId,
-		rollback: "unavailable"
+		rollback: "unavailable",
+		...ready === "failed" && usesCustomDomain ? { diagnostic: "The Custom Domain may still be propagating DNS or its TLS certificate. Check the configured domain in Cloudflare, then retry `void deploy --platform cloudflare` once its /__void/ready endpoint is reachable." } : {}
+	};
+	if (!options.verifyUploader()) return {
+		ok: false,
+		reason: "uploader-changed",
+		versionId,
+		previousVersionId,
+		rollback: "unsafe"
 	};
+	const ownerAfterReadiness = await readCurrentProductionVersion(options, configPath);
+	if (ownerAfterReadiness.kind === "failed") return {
+		ok: false,
+		reason: "status-failed",
+		status: ownerAfterReadiness.status,
+		versionId,
+		previousVersionId,
+		rollback: "unsafe"
+	};
+	if (ownerAfterReadiness.kind !== "ok" || ownerAfterReadiness.versionId !== versionId) {
+		const repair = await stabilizeCloudflareVersionTriggers(triggerOptions);
+		return {
+			ok: false,
+			reason: "deployment-changed",
+			versionId,
+			previousVersionId,
+			activeVersionId: repair.activeVersionId,
+			rollback: "not-needed",
+			triggerRepair: repair.ok ? "succeeded" : repair.reason === "metadata-unavailable" ? "unavailable" : "failed"
+		};
+	}
 	return {
 		ok: true,
 		versionId,
@@ -1831,32 +2083,36 @@ async function bootstrapFirstDeployment(options, commonArgs, previousVersionId,
 		...workersDevSubdomainResult(previewUrl)
 	};
 }
-function parseCloudflareErrorCode(output) {
-	const value = output.match(CLOUDFLARE_ERROR_CODE_RE)?.[1];
-	return value === void 0 ? void 0 : Number(value);
+function readUploadResult(result) {
+	const data = result.data;
+	if (!isRecord(data) || typeof data.versionId !== "string" || !/^[0-9a-f]{8}-[0-9a-f-]{27}$/i.test(data.versionId)) return null;
+	if (data.previewUrl !== void 0 && typeof data.previewUrl !== "string" || data.workersDevUrl !== void 0 && typeof data.workersDevUrl !== "string") return null;
+	return data;
+}
+function versionPercentages(values) {
+	return values.map((value) => {
+		const [versionId, percentage] = value.split("@");
+		return {
+			versionId,
+			percentage: Number(percentage)
+		};
+	});
 }
 function commandDiagnosticFields(result) {
 	const diagnostic = cloudflareCommandDiagnostic(result);
 	return diagnostic ? { diagnostic } : {};
 }
-function isMissingWorkerOutput(output) {
-	return parseCloudflareErrorCode(output) === 10007 || /no deployments|\bworker\b.*\b(?:does not exist|not found)\b/i.test(output);
-}
-/** Recognize the Containers account-entitlement failure Wrangler exposes during upload. */
-function isContainersUnavailable(output) {
-	return /\/containers\/me(?:\b|\?)/i.test(output) && /\b403\b/.test(output) || /Cloudflare Containers[^\n]*(?:Workers Paid|not (?:enabled|available)|subscription)/i.test(output);
-}
-async function readCurrentProductionVersion(options, commonArgs) {
-	const result = await Promise.resolve(options.runWrangler([
-		"deployments",
-		"status",
-		...commonArgs,
-		"--name",
-		options.workerName,
-		"--json"
-	], { capture: true }));
+function isContainersUnavailable(result) {
+	return result.failure === "containers-unavailable" || (result.errors?.some(({ message }) => /Cloudflare Containers[^\n]*(?:Workers Paid|not (?:enabled|available)|subscription)/i.test(message) || /\/containers\/me(?:\b|\?)/i.test(message) && /\b403\b/.test(message)) ?? false);
+}
+async function readCurrentProductionVersion(options, configPath) {
+	const result = await Promise.resolve(options.runWrangler({
+		type: "deployments.status",
+		configPath,
+		workerName: options.workerName
+	}, { capture: true }));
 	if (!isCleanCommandExit(result)) {
-		if (isMissingWorkerOutput(`${result.stdout}\n${result.stderr}`)) return {
+		if (isCompletedCommand(result) && (result.failure === "not-found" || result.errorCode === 10007)) return {
 			kind: "ok",
 			versionId: null,
 			versions: []
@@ -1867,7 +2123,7 @@ async function readCurrentProductionVersion(options, commonArgs) {
 		};
 	}
 	try {
-		const versions = (JSON.parse(result.stdout).versions ?? []).map((version) => ({
+		const versions = (result.data.versions ?? []).map((version) => ({
 			versionId: typeof version.version_id === "string" ? version.version_id : "",
 			percentage: Number(version.percentage)
 		}));
@@ -1901,8 +2157,8 @@ function stagedVersionPercentages(previousVersionId, versionId) {
 		percentage: 0
 	}] : [];
 }
-async function verifyReadinessStagingOwner(options, commonArgs, previousVersionId, versionId) {
-	const owner = await readCurrentProductionVersion(options, commonArgs);
+async function verifyReadinessStagingOwner(options, configPath, previousVersionId, versionId) {
+	const owner = await readCurrentProductionVersion(options, configPath);
 	if (owner.kind === "failed") return {
 		ok: false,
 		reason: "status-failed",
@@ -1932,7 +2188,7 @@ async function verifyReadinessStagingOwner(options, commonArgs, previousVersionI
 	};
 	return null;
 }
-async function probeReadiness(url, workerName, readinessHeaders, authenticatedWorkersDevSubdomain, versionOverride, fetcher, sleep, attempts, timeoutMs = Number.POSITIVE_INFINITY) {
+async function probeReadiness(url, workerName, readinessHeaders, authenticatedWorkersDevSubdomain, versionOverride, fetcher, sleep, attempts, timeoutMs = Number.POSITIVE_INFINITY, expectedVersionId) {
 	const headers = guardedReadinessHeaders(url, workerName, readinessHeaders, authenticatedWorkersDevSubdomain);
 	if (headers === null) return "failed";
 	const deadline = Date.now() + timeoutMs;
@@ -1951,7 +2207,8 @@ async function probeReadiness(url, workerName, readinessHeaders, authenticatedWo
 				signal: AbortSignal.timeout(Math.max(1, Math.min(1e4, remaining)))
 			});
 			if (response.ok) {
-				if ((await response.json()).ready === true) return "ready";
+				const body = await response.json();
+				if (body.ready === true && (expectedVersionId === void 0 || body.versionId === expectedVersionId)) return "ready";
 			} else if (await isCloudflareAccessDenial(response)) return "access-denied";
 		} catch {} finally {
 			if (response && !response.bodyUsed) await response.body?.cancel().catch(() => {});
@@ -1987,7 +2244,7 @@ async function isCloudflareAccessDenial(response) {
 		return false;
 	}
 }
-async function deployVersionPercentages(options, commonArgs, percentages, message) {
+async function deployVersionPercentages(options, configPath, percentages, message) {
 	const metadata = parseCloudflareVersionMessage(message);
 	if ((options.preserveTriggers || metadata?.schema === 2 && metadata.triggerConfig.preserve) && options.configPath) return deployCloudflareVersionTraffic({
 		...options,
@@ -1995,17 +2252,13 @@ async function deployVersionPercentages(options, commonArgs, percentages, messag
 		percentages,
 		message
 	});
-	return options.runWrangler([
-		"versions",
-		"deploy",
-		...percentages,
-		...commonArgs,
-		"--name",
-		options.workerName,
-		"--message",
-		message,
-		"--yes"
-	], { capture: false });
+	return options.runWrangler({
+		type: "versions.deploy",
+		versions: versionPercentages(percentages),
+		configPath,
+		workerName: options.workerName,
+		message
+	}, { capture: false });
 }
 /** Change version traffic without synchronizing Worker settings from local config. */
 async function deployCloudflareVersionTraffic(options) {
@@ -2014,19 +2267,13 @@ async function deployCloudflareVersionTraffic(options) {
 	const path = join(directory, "wrangler.json");
 	try {
 		writeFileSync(path, JSON.stringify(config), { mode: 384 });
-		return await options.runWrangler([
-			"versions",
-			"deploy",
-			...options.percentages,
-			"-c",
-			path,
-			"--env=",
-			"--name",
-			options.workerName,
-			"--message",
-			options.message,
-			"--yes"
-		], { capture: false });
+		return await options.runWrangler({
+			type: "versions.deploy",
+			versions: versionPercentages(options.percentages),
+			configPath: path,
+			workerName: options.workerName,
+			message: options.message
+		}, { capture: false });
 	} finally {
 		rmSync(directory, {
 			recursive: true,
@@ -2034,12 +2281,12 @@ async function deployCloudflareVersionTraffic(options) {
 		});
 	}
 }
-async function restorePreviousVersion(options, commonArgs, previousVersionId, cause, expectedOwnedTraffic) {
+async function restorePreviousVersion(options, configPath, previousVersionId, cause, expectedOwnedTraffic) {
 	if (!previousVersionId) return "unavailable";
 	if (!options.verifyUploader()) return "unsafe";
-	const owner = await readCurrentProductionVersion(options, commonArgs);
+	const owner = await readCurrentProductionVersion(options, configPath);
 	if (owner.kind !== "ok" || !expectedOwnedTraffic.some((expected) => productionVersionPercentagesEqual(owner.versions, expected))) return "unsafe";
-	return isCleanCommandExit(await deployVersionPercentages(options, commonArgs, [`${previousVersionId}@100`], `Void automatic rollback after ${cause}.`)) ? "succeeded" : "failed";
+	return isCleanCommandExit(await deployVersionPercentages(options, configPath, [`${previousVersionId}@100`], `Void automatic rollback after ${cause}.`)) ? "succeeded" : "failed";
 }
 function workersDevReadinessUrl(workerName, value) {
 	const subdomain = normalizeWorkersDevSubdomain(value);
@@ -2073,8 +2320,11 @@ function workersDevSubdomainResult(url) {
 	const workersDevSubdomain = extractWorkersDevSubdomain(url);
 	return workersDevSubdomain ? { workersDevSubdomain } : {};
 }
+function isCompletedCommand(result) {
+	return Number.isSafeInteger(result.status) && result.status >= 0 && result.signal == null && (result.error == null || result.error === "");
+}
 function isCleanCommandExit(result) {
-	return result.status === 0 && result.signal == null && (result.error == null || result.error === "");
+	return result.status === 0 && isCompletedCommand(result);
 }
 function defaultSleep(milliseconds) {
 	return new Promise((resolve) => setTimeout(resolve, milliseconds));
@@ -2088,13 +2338,6 @@ function defaultSleep(milliseconds) {
 */
 function createCloudflareMetadataRunner(options) {
 	let tokenPromise;
-	const common = [
-		...options.configPath ? ["-c", options.configPath] : [],
-		"--env=",
-		"--name",
-		options.workerName,
-		"--json"
-	];
 	const prefix = `${options.apiBaseUrl.replace(/\/$/, "")}/accounts/${encodeURIComponent(options.accountId)}/workers/scripts/${encodeURIComponent(options.workerName)}`;
 	const fetcher = options.fetch ?? globalThis.fetch;
 	const proxyEnv = options.env ?? process.env;
@@ -2105,26 +2348,22 @@ function createCloudflareMetadataRunner(options) {
 		stderr: "Cloudflare uploader integrity check failed.",
 		error: "uploader-changed"
 	};
-	const fallback = (args, runOptions) => options.verifyUploader() ? options.runWrangler(args, runOptions) : refused;
-	return async (args, runOptions) => {
+	const fallback = (operation, runOptions) => options.verifyUploader() ? options.runWrangler(operation, runOptions) : refused;
+	return async (operation, runOptions) => {
 		let kind;
 		let resource;
-		let rest = [];
-		if (args[0] === "deployments" && args[1] === "status") {
+		if (operation.type === "deployments.status") {
 			kind = "deployment";
 			resource = "/deployments";
-			rest = args.slice(2);
-		} else if (args[0] === "versions" && args[1] === "list") {
+		} else if (operation.type === "versions.list") {
 			kind = "versions";
 			resource = "/versions?deployable=true";
-			rest = args.slice(2);
-		} else if (args[0] === "versions" && args[1] === "view" && /^[0-9a-f-]{36}$/i.test(args[2] ?? "")) {
+		} else if (operation.type === "versions.view" && !operation.includeSource && /^[0-9a-f-]{36}$/i.test(operation.versionId)) {
 			kind = "version";
-			resource = `/versions/${encodeURIComponent(args[2])}`;
-			rest = args.slice(3);
+			resource = "/versions/" + encodeURIComponent(operation.versionId);
 		}
-		if (!kind || !runOptions.capture || rest.length !== common.length || rest.some((value, i) => value !== common[i])) return fallback(args, runOptions);
-		if (requiresProxyTransport) return fallback(args, runOptions);
+		if (!kind || !runOptions.capture || !("workerName" in operation) || operation.workerName !== options.workerName || operation.configPath !== options.configPath) return fallback(operation, runOptions);
+		if (requiresProxyTransport) return fallback(operation, runOptions);
 		let response;
 		try {
 			if (!tokenPromise && !options.verifyUploader()) return refused;
@@ -2145,29 +2384,30 @@ function createCloudflareMetadataRunner(options) {
 							if (result.deployments.length === 0) return {
 								status: 1,
 								stdout: "",
-								stderr: `The Worker ${options.workerName} has no deployments.`
+								stderr: `The Worker ${options.workerName} has no deployments.`,
+								errorCode: 10007
 							};
 							if (record(latest) && Array.isArray(latest.versions)) return {
 								status: 0,
-								stdout: JSON.stringify(latest),
+								stdout: "",
+								data: latest,
 								stderr: ""
 							};
 						}
-						if (kind === "version" && result.id === args[2]) return {
+						if (operation.type === "versions.view" && result.id === operation.versionId) return {
 							status: 0,
-							stdout: JSON.stringify(result),
+							stdout: "",
+							data: result,
 							stderr: ""
 						};
 						if (kind === "versions" && Array.isArray(result.items)) {
 							const items = result.items;
-							if (items.every((item) => record(item) && record(item.metadata) && typeof item.metadata.created_on === "string")) {
-								const sorted = items.sort((a, b) => a.metadata.created_on.localeCompare(b.metadata.created_on)).slice(-10);
-								return {
-									status: 0,
-									stdout: JSON.stringify(sorted),
-									stderr: ""
-								};
-							}
+							if (items.every((item) => record(item) && record(item.metadata) && typeof item.metadata.created_on === "string")) return {
+								status: 0,
+								stdout: "",
+								data: items.sort((a, b) => a.metadata.created_on.localeCompare(b.metadata.created_on)).slice(-10),
+								stderr: ""
+							};
 						}
 					}
 				}
@@ -2177,11 +2417,11 @@ function createCloudflareMetadataRunner(options) {
 		} finally {
 			if (response && !response.bodyUsed) await response.body?.cancel().catch(() => {});
 		}
-		return fallback(args, runOptions);
+		return fallback(operation, runOptions);
 	};
 }
 function record(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 //#endregion
-export { CloudflareWorkerInspectionError, activateCloudflareVersion, assertCloudflareBindingsPreserved, assertCloudflareDurableObjectLifecycleSupported, assertExistingCloudflareConfig, createCloudflareMetadataRunner, deployCloudflareVersionTraffic, deployCloudflareVersionTriggers, encodeCloudflareVersionMessage, executeCloudflareDeploy, extractWorkersDevSubdomain, normalizeWorkersDevSubdomain, parseCloudflareVersionMessage, parseRootWranglerConfig, readBindingFieldPresence, readCloudflareTriggerConfig, readCloudflareVersionMigrationTag, readCloudflareWorkerMigrationTag, readConfigEntryString, readExistingCloudflareWorker, readStoredResourceName, readWranglerTopLevelString, renderCloudflareStaticEntry, resolveD1MigrateTarget, stabilizeCloudflareVersionTriggers, stageCloudflareStaticAssets, writeCloudflareFrameworkDeployConfig, writeCloudflareStaticDeployConfig };
+export { CloudflareWorkerInspectionError, VOID_SECRET_DRAFT_SOURCE, activateCloudflareVersion, assertCloudflareBindingsPreserved, assertCloudflareDurableObjectLifecycleSupported, assertExistingCloudflareConfig, createCloudflareMetadataRunner, deployCloudflareVersionTraffic, deployCloudflareVersionTriggers, encodeCloudflareVersionMessage, executeCloudflareDeploy, extractWorkersDevSubdomain, normalizeWorkersDevSubdomain, parseCloudflareVersionMessage, parseRootWranglerConfig, readBindingFieldPresence, readCloudflareTriggerConfig, readCloudflareVersionMigrationTag, readCloudflareWorkerMigrationTag, readConfigEntryString, readExistingCloudflareWorker, readStoredResourceName, readWranglerTopLevelString, renderCloudflareStaticEntry, resolveD1MigrateTarget, stabilizeCloudflareVersionTriggers, stageCloudflareStaticAssets, writeCloudflareFrameworkDeployConfig, writeCloudflareStaticDeployConfig };