@void/deploy-cloudflare 0.23.0 → 0.24.0

package/dist/index.d.mts

@@ -66,6 +66,7 @@ type CloudflareOperation = ({
 } & WorkerTarget) | ({
   type: "versions.view";
   versionId: string;
+  includeSource?: boolean;
 } & WorkerTarget) | ({
   type: "versions.deploy";
   versions: Array<{
@@ -429,7 +430,7 @@ type CloudflareVersionActivationOptions = {
   requirePreviewForReadiness?: boolean;
   /** Verify that omitted remote secrets come from the active Worker Version before uploading. */
   verifyInheritedSecrets?: boolean;
-  /** Pin opaque secret bindings to the live version when an unpublished upload is newer. */
+  /** Pin inherited opaque secret bindings to the inspected live version before uploading. */
   pinActiveSecrets?: (activeVersionId: string, bindings: ReadonlyArray<{
     name: string;
     type: "secret_text" | "secret_key";
@@ -477,4 +478,7 @@ export declare function createCloudflareMetadataRunner(options: {
   env?: Readonly<Record<string, string | undefined>>;
 }): CloudflareCommandRunner;
 //#endregion
+//#region src/secret-draft.d.ts
+export declare const VOID_SECRET_DRAFT_SOURCE = "export default { fetch() { return new Response(\"\"); } };\n";
+//#endregion
 export type { ApprovedCloudflareKvBinding, CloudflareCommandResult, CloudflareCommandRunner, CloudflareDeployExecution, CloudflareFrameworkDeployConfig, CloudflareOperation, CloudflareProviderError, CloudflareStaticDeployConfig, CloudflareTrafficConfig, CloudflareTriggerConfig, CloudflareTriggerStabilization, CloudflareUploadResult, CloudflareVersionActivation, CloudflareVersionActivationOptions, CloudflareVersionMetadata, CloudflareWorkerMigrationTagOptions, ExistingCloudflareWorker };

package/dist/index.mjs

@@ -99,6 +99,43 @@ function isWranglerSecretOnlyDraft(entry) {
 	const runtimeKeys = Object.keys(scriptRuntime);
 	return scriptRuntime.usage_model === "standard" && (scriptRuntime.limits === void 0 || isRecord$1(scriptRuntime.limits) && Object.keys(scriptRuntime.limits).length === 0) && runtimeKeys.every((key) => key === "usage_model" || key === "limits");
 }
+const VOID_SECRET_DRAFT_SOURCE = "export default { fetch() { return new Response(\"\"); } };\n";
+/** Prove a cf-created placeholder from the exact immutable version's source. */
+function isVoidSecretOnlyDraft(entry) {
+	const metadataFields = /* @__PURE__ */ new Set([
+		"id",
+		"number",
+		"startup_time_ms",
+		"created_on",
+		"source",
+		"author_id",
+		"author_email",
+		"urls",
+		"annotations",
+		"compatibility_date",
+		"usage_model",
+		"main_module",
+		"modules",
+		"bindings",
+		"env",
+		"resources"
+	]);
+	if (Object.keys(entry).some((key) => !metadataFields.has(key)) || entry.source !== "cf_cli" || !isRecord$1(entry.annotations) || Object.keys(entry.annotations).length !== 1 || entry.annotations["workers/triggered_by"] !== "secret" || entry.main_module !== "index.js" || !Array.isArray(entry.urls) || entry.urls.length !== 0 || !Array.isArray(entry.modules) || entry.modules.length !== 1 || !Array.isArray(entry.bindings) || entry.bindings.length === 0) return false;
+	const module = entry.modules[0];
+	if (!isRecord$1(module) || Object.keys(module).length !== 3 || module.name !== "index.js" || module.content_type !== "application/javascript+module" || module.content_base64 !== Buffer.from("export default { fetch() { return new Response(\"\"); } };\n").toString("base64")) return false;
+	const names = /* @__PURE__ */ new Set();
+	for (const binding of entry.bindings) {
+		if (!isRecord$1(binding) || Object.keys(binding).length !== 2 || typeof binding.name !== "string" || binding.name.length === 0 || names.has(binding.name) || binding.type !== "secret_text") return false;
+		names.add(binding.name);
+	}
+	if (entry.env !== void 0 && (!isRecord$1(entry.env) || Object.keys(entry.env).length !== names.size || Object.entries(entry.env).some(([name, binding]) => !names.has(name) || !isRecord$1(binding) || Object.keys(binding).length !== 1 || binding.type !== "secret_text"))) return false;
+	if (entry.resources !== void 0) {
+		if (!isRecord$1(entry.resources) || Object.keys(entry.resources).length !== 1) return false;
+		const bindings = entry.resources.bindings;
+		if (!Array.isArray(bindings) || !isDeepStrictEqual(bindings, entry.bindings)) return false;
+	}
+	return true;
+}
 function isRecord$1(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
@@ -114,7 +151,7 @@ async function readExistingCloudflareWorker(options) {
 	if (!worker) throw new Error(`Cloudflare Worker "${options.workerName}" does not have an active version.`);
 	return worker.snapshot;
 }
-async function readCloudflareWorker(options, allowMissing) {
+async function readCloudflareWorker(options, allowMissing, proveSecretDraft = false) {
 	const target = {
 		configPath: options.configPath,
 		workerName: options.workerName
@@ -151,6 +188,16 @@ async function readCloudflareWorker(options, allowMissing) {
 	if (version === null) throw new Error("Cloudflare did not return the existing Worker configuration.");
 	const resources = version.resources;
 	if (version.id !== versionId || !record$1(resources) || !Array.isArray(resources.bindings) || !resources.bindings.every(record$1) || !record$1(resources.script_runtime) || !record$1(resources.script)) throw new Error("Cloudflare did not return the existing Worker configuration.");
+	let isSecretOnlyDraft = isWranglerSecretOnlyDraft(version);
+	if (proveSecretDraft && !isSecretOnlyDraft && record$1(version.annotations) && Object.keys(version.annotations).length === 1 && version.annotations["workers/triggered_by"] === "secret") {
+		const source = await read({
+			type: "versions.view",
+			versionId,
+			includeSource: true,
+			...target
+		});
+		if (source?.id === versionId) isSecretOnlyDraft = isVoidSecretOnlyDraft(source);
+	}
 	const after = options.versionId ? deployment : await read({
 		type: "deployments.status",
 		...target
@@ -163,7 +210,7 @@ async function readCloudflareWorker(options, allowMissing) {
 			runtime: resources.script_runtime,
 			script: resources.script
 		},
-		isSecretOnlyDraft: isWranglerSecretOnlyDraft(version)
+		isSecretOnlyDraft
 	};
 }
 /** Parse legacy version-detail shapes; this is not authoritative Worker migration state. */
@@ -231,7 +278,7 @@ async function readCloudflareApiAuthentication(runWrangler) {
 async function assertCloudflareDurableObjectLifecycleSupported(options) {
 	const migrations = parseDurableObjectMigrations(parseRootWranglerConfig(options.configPath).migrations);
 	if (!migrations.some((migration) => migration.changesClasses)) return;
-	const existing = await readCloudflareWorker(options, true);
+	const existing = await readCloudflareWorker(options, true, true);
 	if (!existing) return;
 	const readMigrationTag = options.readMigrationTag ?? readCloudflareWorkerMigrationTag;
 	const migrationOptions = {
@@ -241,7 +288,7 @@ async function assertCloudflareDurableObjectLifecycleSupported(options) {
 		workerName: options.workerName
 	};
 	const activeTag = await readMigrationTag(migrationOptions);
-	const after = await readCloudflareWorker(options, false);
+	const after = await readCloudflareWorker(options, false, true);
 	const afterTag = await readMigrationTag(migrationOptions);
 	if (!after || after.snapshot.versionId !== existing.snapshot.versionId || afterTag !== activeTag) throw new Error("Cloudflare production or Durable Object migration state changed during verification. Retry from the current deployment.");
 	if (activeTag === null && existing.isSecretOnlyDraft && after.isSecretOnlyDraft) return;
@@ -1188,6 +1235,7 @@ async function activateCloudflareVersionWithSecretsFile(options) {
 	let inheritanceBaseline;
 	let trustedCandidateChain = false;
 	let activeSecretsPinned = false;
+	let pinnedActiveSecrets;
 	if (options.expectedPreviousVersionId !== void 0 || options.verifyInheritedSecrets === true) {
 		const recent = await readRecentCloudflareVersionIds(options, configPath);
 		if (recent === null) return {
@@ -1222,6 +1270,7 @@ async function activateCloudflareVersionWithSecretsFile(options) {
 					rollback: "not-needed"
 				};
 				activeSecretsPinned = true;
+				pinnedActiveSecrets = activeSecrets;
 			}
 		}
 		inheritanceBaseline = recent;
@@ -1263,15 +1312,106 @@ async function activateCloudflareVersionWithSecretsFile(options) {
 	} : versionedPreviousTriggerConfig;
 	const previousTriggerConfig = triggerConfigWithQueueConsumerCleanup(versionedPreviousTriggerConfigWithTraffic, options.queueConsumerCleanup);
 	const alias = `void-ready-${Date.now().toString(36)}`;
-	if (options.atomic && previous.versionId !== null) {
-		if (!activeSecretsPinned && options.pinActiveSecrets) {
-			const activeSecrets = await readCloudflareVersionSecretBindings(options, configPath, previous.versionId);
-			if (activeSecrets?.length) await options.pinActiveSecrets(previous.versionId, activeSecrets);
+	const bootstrapVoidDraft = !options.preserveTriggers && !options.requirePreviewForReadiness && previousVersion?.isVoidSecretOnlyDraft === true;
+	if (previous.versionId !== null && (options.atomic || bootstrapVoidDraft)) {
+		if (bootstrapVoidDraft && !activeSecretsPinned && !options.pinActiveSecrets) return {
+			ok: false,
+			reason: "inheritance-source-unavailable"
+		};
+		if (bootstrapVoidDraft || !activeSecretsPinned && options.pinActiveSecrets) {
+			let activeSecrets;
+			try {
+				activeSecrets = await readCloudflareVersionSecretBindings(options, configPath, previous.versionId);
+			} catch {
+				return {
+					ok: false,
+					reason: "inheritance-source-unavailable"
+				};
+			}
+			if (activeSecrets === null) return {
+				ok: false,
+				reason: "inheritance-source-unavailable"
+			};
+			if (bootstrapVoidDraft && (activeSecrets.length === 0 || activeSecrets.some((secret) => secret.type !== "secret_text") || !arraysEqual(activeSecrets.map((secret) => secret.name).sort(), [...previousVersion.voidDraftSecretNames].sort()) || activeSecretsPinned && !isDeepStrictEqual([...activeSecrets].sort((a, b) => a.name.localeCompare(b.name)), [...pinnedActiveSecrets].sort((a, b) => a.name.localeCompare(b.name))))) return {
+				ok: false,
+				reason: "inheritance-source-changed"
+			};
+			if (!activeSecretsPinned && activeSecrets.length) {
+				let pinned;
+				try {
+					pinned = await options.pinActiveSecrets(previous.versionId, activeSecrets);
+				} catch {
+					return {
+						ok: false,
+						reason: "inheritance-source-unavailable"
+					};
+				}
+				if (!pinned) return {
+					ok: false,
+					reason: "inheritance-source-changed"
+				};
+			}
 		}
 		return bootstrapFirstDeployment({
 			...options,
 			message
-		}, configPath, previous.versionId, true, previousTriggerConfig);
+		}, configPath, previous.versionId, options.atomic === true, previousTriggerConfig);
+	}
+	if (previous.versionId !== null && !activeSecretsPinned && options.pinActiveSecrets && options.candidateSecretsFilePath === void 0) {
+		let activeSecrets;
+		try {
+			activeSecrets = await readCloudflareVersionSecretBindings(options, configPath, previous.versionId);
+		} catch {
+			return {
+				ok: false,
+				reason: "inheritance-source-unavailable"
+			};
+		}
+		if (activeSecrets === null) return {
+			ok: false,
+			reason: "inheritance-source-unavailable"
+		};
+		if (activeSecrets.some((secret) => !secret.name.trim() || secret.name.trim() !== secret.name) || new Set(activeSecrets.map((secret) => secret.name)).size !== activeSecrets.length) return {
+			ok: false,
+			reason: "inheritance-source-changed"
+		};
+		if (activeSecrets.length) {
+			let pinned;
+			try {
+				pinned = await options.pinActiveSecrets(previous.versionId, activeSecrets);
+			} catch {
+				return {
+					ok: false,
+					reason: "inheritance-source-unavailable"
+				};
+			}
+			if (!pinned) return {
+				ok: false,
+				reason: "inheritance-source-changed"
+			};
+			activeSecretsPinned = true;
+		}
+	}
+	if (activeSecretsPinned) {
+		if (!options.verifyUploader()) return {
+			ok: false,
+			reason: "uploader-changed"
+		};
+		const owner = await readCurrentProductionVersion(options, configPath);
+		if (owner.kind === "failed") return {
+			ok: false,
+			reason: "status-failed",
+			status: owner.status
+		};
+		if (owner.kind !== "ok" || owner.versionId !== previous.versionId || !productionVersionPercentagesEqual(owner.versions, [{
+			versionId: previous.versionId,
+			percentage: 100
+		}])) return {
+			ok: false,
+			reason: "deployment-changed",
+			activeVersionId: owner.kind === "ok" ? owner.versionId : null,
+			rollback: "not-needed"
+		};
 	}
 	options.onProgress?.("Uploading the Worker and assets...");
 	const upload = await Promise.resolve(options.runWrangler({
@@ -1647,21 +1787,25 @@ async function readCloudflareVersionInspection(options, configPath, versionId, k
 			const annotations = isRecord(entry.annotations) ? entry.annotations : void 0;
 			const message = annotations?.["workers/message"];
 			let draft = entry;
-			if (annotations?.["workers/triggered_by"] === "secret" && Object.keys(annotations).length === 1 && !isRecord(entry.resources)) {
+			if (annotations?.["workers/triggered_by"] === "secret" && Object.keys(annotations).length === 1 && !isWranglerSecretOnlyDraft(entry)) {
 				const inspection = await Promise.resolve(options.runWrangler({
 					type: "versions.view",
 					versionId,
 					configPath,
-					workerName: options.workerName
+					workerName: options.workerName,
+					includeSource: true
 				}, { capture: true }));
 				if (isCleanCommandExit(inspection)) {
 					const inspected = inspection.data;
 					if (isRecord(inspected) && inspected.id === versionId) draft = inspected;
 				}
 			}
+			const isVoidDraft = isVoidSecretOnlyDraft(draft);
 			return {
 				metadata: typeof message === "string" ? parseCloudflareVersionMessage(message) : null,
-				isSecretOnlyDraft: isWranglerSecretOnlyDraft(draft)
+				isSecretOnlyDraft: isWranglerSecretOnlyDraft(draft) || isVoidSecretOnlyDraft(draft),
+				isVoidSecretOnlyDraft: isVoidDraft,
+				voidDraftSecretNames: isVoidDraft ? draft.bindings.map((binding) => binding.name) : null
 			};
 		}
 	} catch {
@@ -1742,14 +1886,17 @@ async function bootstrapFirstDeployment(options, configPath, previousVersionId,
 		ok: false,
 		reason: "uploader-changed"
 	};
-	if (atomic) {
+	{
 		const current = await readCurrentProductionVersion(options, configPath);
 		if (current.kind === "failed") return {
 			ok: false,
 			reason: "status-failed",
 			status: current.status
 		};
-		if (current.kind !== "ok" || current.versionId !== previousVersionId) return {
+		if (current.kind !== "ok" || current.versionId !== previousVersionId || !productionVersionPercentagesEqual(current.versions, previousVersionId ? [{
+			versionId: previousVersionId,
+			percentage: 100
+		}] : [])) return {
 			ok: false,
 			reason: "deployment-changed",
 			activeVersionId: current.kind === "ok" ? current.versionId : null,
@@ -1794,7 +1941,6 @@ async function bootstrapFirstDeployment(options, configPath, previousVersionId,
 		previousVersionId,
 		rollback: "unsafe"
 	};
-	options.onProgress?.("Updating routes and triggers...");
 	const triggerOptions = {
 		runWrangler: options.runWrangler,
 		workerName: options.workerName,
@@ -1809,6 +1955,65 @@ async function bootstrapFirstDeployment(options, configPath, previousVersionId,
 		publishEmptyCustomDomains: options.publishEmptyCustomDomains,
 		publishEmptyCrons: options.publishEmptyCrons
 	};
+	const verifyPublishedOwner = async () => {
+		const owner = await readCurrentProductionVersion(options, configPath);
+		if (owner.kind === "failed") return {
+			ok: false,
+			reason: "status-failed",
+			status: owner.status,
+			versionId,
+			previousVersionId,
+			rollback: "unsafe"
+		};
+		if (owner.kind !== "ok" || owner.versionId !== versionId || !productionVersionPercentagesEqual(owner.versions, [{
+			versionId,
+			percentage: 100
+		}])) {
+			const repair = owner.kind === "ok" && owner.versionId && owner.versionId !== versionId && options.verifyUploader() ? await stabilizeCloudflareVersionTriggers({
+				...triggerOptions,
+				targetTriggerConfig: {
+					...desiredTriggerConfig,
+					preserve: true
+				}
+			}) : null;
+			return {
+				ok: false,
+				reason: "deployment-changed",
+				versionId,
+				previousVersionId,
+				activeVersionId: repair?.activeVersionId ?? (owner.kind === "ok" ? owner.versionId : null),
+				rollback: "not-needed",
+				...repair ? { triggerRepair: repair.ok && !repair.targetOwnsTraffic ? "succeeded" : !repair.ok && repair.reason !== "metadata-unavailable" ? "failed" : "unavailable" } : {}
+			};
+		}
+		return null;
+	};
+	const publishedOwnerFailure = await verifyPublishedOwner();
+	if (publishedOwnerFailure) return publishedOwnerFailure;
+	if (options.validateUploadedVersion || options.recordVerifiedCandidate) {
+		options.onProgress?.("Verifying the uploaded Worker...");
+		try {
+			await options.validateUploadedVersion?.(versionId);
+			const validatedOwnerFailure = await verifyPublishedOwner();
+			if (validatedOwnerFailure) return validatedOwnerFailure;
+			if (options.recordVerifiedCandidate) {
+				if (!options.validateUploadedVersion && !options.verifyInheritedSecrets && options.expectedPreviousVersionId === void 0) throw new Error("The bootstrap upload has no verified candidate checkpoint.");
+				await options.recordVerifiedCandidate(versionId, previousVersionId);
+			}
+		} catch {
+			return {
+				ok: false,
+				reason: atomic ? "atomic-failed" : "bootstrap-failed",
+				versionId,
+				previousVersionId,
+				rollback: "unavailable",
+				diagnostic: `Worker version ${versionId} was published, but its upload validation or candidate checkpoint failed. Inspect the current Worker deployment before retrying.`
+			};
+		}
+		const checkpointOwnerFailure = await verifyPublishedOwner();
+		if (checkpointOwnerFailure) return checkpointOwnerFailure;
+	}
+	options.onProgress?.("Updating routes and triggers...");
 	const triggers = await stabilizeCloudflareVersionTriggers(triggerOptions);
 	if (!triggers.ok || !triggers.targetOwnsTraffic) {
 		const superseded = triggers.activeVersionId !== void 0 && triggers.activeVersionId !== null && triggers.activeVersionId !== versionId;
@@ -2153,7 +2358,7 @@ function createCloudflareMetadataRunner(options) {
 		} else if (operation.type === "versions.list") {
 			kind = "versions";
 			resource = "/versions?deployable=true";
-		} else if (operation.type === "versions.view" && /^[0-9a-f-]{36}$/i.test(operation.versionId)) {
+		} else if (operation.type === "versions.view" && !operation.includeSource && /^[0-9a-f-]{36}$/i.test(operation.versionId)) {
 			kind = "version";
 			resource = "/versions/" + encodeURIComponent(operation.versionId);
 		}
@@ -2219,4 +2424,4 @@ function record(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 //#endregion
-export { CloudflareWorkerInspectionError, activateCloudflareVersion, assertCloudflareBindingsPreserved, assertCloudflareDurableObjectLifecycleSupported, assertExistingCloudflareConfig, createCloudflareMetadataRunner, deployCloudflareVersionTraffic, deployCloudflareVersionTriggers, encodeCloudflareVersionMessage, executeCloudflareDeploy, extractWorkersDevSubdomain, normalizeWorkersDevSubdomain, parseCloudflareVersionMessage, parseRootWranglerConfig, readBindingFieldPresence, readCloudflareTriggerConfig, readCloudflareVersionMigrationTag, readCloudflareWorkerMigrationTag, readConfigEntryString, readExistingCloudflareWorker, readStoredResourceName, readWranglerTopLevelString, renderCloudflareStaticEntry, resolveD1MigrateTarget, stabilizeCloudflareVersionTriggers, stageCloudflareStaticAssets, writeCloudflareFrameworkDeployConfig, writeCloudflareStaticDeployConfig };
+export { CloudflareWorkerInspectionError, VOID_SECRET_DRAFT_SOURCE, activateCloudflareVersion, assertCloudflareBindingsPreserved, assertCloudflareDurableObjectLifecycleSupported, assertExistingCloudflareConfig, createCloudflareMetadataRunner, deployCloudflareVersionTraffic, deployCloudflareVersionTriggers, encodeCloudflareVersionMessage, executeCloudflareDeploy, extractWorkersDevSubdomain, normalizeWorkersDevSubdomain, parseCloudflareVersionMessage, parseRootWranglerConfig, readBindingFieldPresence, readCloudflareTriggerConfig, readCloudflareVersionMigrationTag, readCloudflareWorkerMigrationTag, readConfigEntryString, readExistingCloudflareWorker, readStoredResourceName, readWranglerTopLevelString, renderCloudflareStaticEntry, resolveD1MigrateTarget, stabilizeCloudflareVersionTriggers, stageCloudflareStaticAssets, writeCloudflareFrameworkDeployConfig, writeCloudflareStaticDeployConfig };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@void/deploy-cloudflare",
-  "version": "0.23.0",
+  "version": "0.24.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/voidzero-dev/void.git",
@@ -20,7 +20,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@void/deploy-core": "0.23.0",
+    "@void/deploy-core": "0.24.0",
     "jsonc-parser": "3.3.1"
   },
   "devDependencies": {