@void/deploy-cloudflare 0.23.0 → 0.25.0

package/README.md

@@ -1,28 +1,5 @@
 # @void/deploy-cloudflare
 
-Public Cloudflare target adapter primitives for Void deployments.
+Cloudflare deployment primitives used by the Void CLI. Provides Worker configuration reads, uploads, activation, and deployment verification.
 
-This package owns Wrangler JSON/JSONC config reads and the final verified
-Cloudflare upload boundary. Source inference and app builds remain in `void`;
-provider-neutral contracts and plans remain in `@void/deploy-core`.
-
-Existing Worker handoffs read the active version, validate resource identities,
-and check the uploaded bindings before activation. Traffic-only activation uses
-an isolated config to retain Worker settings and triggers. Trigger snapshots
-record when configuration was preserved, so rollback can keep those settings
-for versions originally deployed outside Void.
-
-Handoff verifiers can accept an explicit list of new KV binding identities.
-Only those exact namespaces may be added; existing bindings, variables, secrets,
-and handlers must remain unchanged. New bindings cannot alias an existing KV
-namespace. The Void CLI uses this for the migration's explicit ISR cache choice.
-
-First-deployment readiness allows up to one minute for the new Worker's public
-route to propagate, with bounded requests and backoff. A successful check still
-requires the ready response, and Cloudflare Access denials fail immediately.
-Subsequent version previews retain the shorter retry window.
-
-Failed version uploads and first-deployment bootstraps return a bounded diagnostic
-alongside the exit status and Cloudflare error code. It retains validation messages
-and stack locations, strips terminal formatting, excludes stdout binding tables,
-and redacts common credential formats before callers display or log it.
+Applications normally deploy with `void deploy --platform cloudflare`. See the [Cloudflare guide](https://void.cloud/integrations/cloudflare) for configuration and credentials, or [Platform Development](https://void.cloud/guide/platform-development) for runtime and adapter work.

package/dist/index.d.mts

@@ -66,6 +66,7 @@ type CloudflareOperation = ({
 } & WorkerTarget) | ({
   type: "versions.view";
   versionId: string;
+  includeSource?: boolean;
 } & WorkerTarget) | ({
   type: "versions.deploy";
   versions: Array<{
@@ -429,7 +430,7 @@ type CloudflareVersionActivationOptions = {
   requirePreviewForReadiness?: boolean;
   /** Verify that omitted remote secrets come from the active Worker Version before uploading. */
   verifyInheritedSecrets?: boolean;
-  /** Pin opaque secret bindings to the live version when an unpublished upload is newer. */
+  /** Pin inherited opaque secret bindings to the inspected live version before uploading. */
   pinActiveSecrets?: (activeVersionId: string, bindings: ReadonlyArray<{
     name: string;
     type: "secret_text" | "secret_key";
@@ -477,4 +478,7 @@ export declare function createCloudflareMetadataRunner(options: {
   env?: Readonly<Record<string, string | undefined>>;
 }): CloudflareCommandRunner;
 //#endregion
+//#region src/secret-draft.d.ts
+export declare const VOID_SECRET_DRAFT_SOURCE = "export default { fetch() { return new Response(\"\"); } };\n";
+//#endregion
 export type { ApprovedCloudflareKvBinding, CloudflareCommandResult, CloudflareCommandRunner, CloudflareDeployExecution, CloudflareFrameworkDeployConfig, CloudflareOperation, CloudflareProviderError, CloudflareStaticDeployConfig, CloudflareTrafficConfig, CloudflareTriggerConfig, CloudflareTriggerStabilization, CloudflareUploadResult, CloudflareVersionActivation, CloudflareVersionActivationOptions, CloudflareVersionMetadata, CloudflareWorkerMigrationTagOptions, ExistingCloudflareWorker };

package/dist/index.mjs

@@ -1,6 +1,7 @@
 import { isDeepStrictEqual, stripVTControlCharacters } from "node:util";
 import { cpSync, existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { SyntaxKind, applyEdits, createScanner, modify, parse, parseTree } from "jsonc-parser";
+import { isRecord } from "@void/deploy-core";
 import nodePath from "node:path";
 import { createHash } from "node:crypto";
 import { tmpdir } from "node:os";
@@ -88,19 +89,53 @@ function resolveD1MigrateTarget(config, binding) {
 * application code configuration or non-secret resource that an ordinary deploy could own.
 */
 function isWranglerSecretOnlyDraft(entry) {
-	if (!isRecord$1(entry.annotations)) return false;
+	if (!isRecord(entry.annotations)) return false;
 	const annotationKeys = Object.keys(entry.annotations);
 	if (entry.annotations["workers/triggered_by"] !== "secret" || annotationKeys.some((key) => key !== "workers/triggered_by")) return false;
-	if (!isRecord$1(entry.resources)) return false;
+	if (!isRecord(entry.resources)) return false;
 	const { bindings, script, script_runtime: scriptRuntime } = entry.resources;
-	if (!Array.isArray(bindings) || bindings.length === 0 || !bindings.every((binding) => isRecord$1(binding) && typeof binding.name === "string" && binding.name.length > 0 && binding.type === "secret_text" && Object.keys(binding).every((key) => key === "name" || key === "type"))) return false;
-	if (!isRecord$1(script) || !Array.isArray(script.handlers) || script.handlers.length !== 1 || script.handlers[0] !== "fetch" || script.placement_mode !== void 0) return false;
-	if (!isRecord$1(scriptRuntime)) return false;
+	if (!Array.isArray(bindings) || bindings.length === 0 || !bindings.every((binding) => isRecord(binding) && typeof binding.name === "string" && binding.name.length > 0 && binding.type === "secret_text" && Object.keys(binding).every((key) => key === "name" || key === "type"))) return false;
+	if (!isRecord(script) || !Array.isArray(script.handlers) || script.handlers.length !== 1 || script.handlers[0] !== "fetch" || script.placement_mode !== void 0) return false;
+	if (!isRecord(scriptRuntime)) return false;
 	const runtimeKeys = Object.keys(scriptRuntime);
-	return scriptRuntime.usage_model === "standard" && (scriptRuntime.limits === void 0 || isRecord$1(scriptRuntime.limits) && Object.keys(scriptRuntime.limits).length === 0) && runtimeKeys.every((key) => key === "usage_model" || key === "limits");
-}
-function isRecord$1(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
+	return scriptRuntime.usage_model === "standard" && (scriptRuntime.limits === void 0 || isRecord(scriptRuntime.limits) && Object.keys(scriptRuntime.limits).length === 0) && runtimeKeys.every((key) => key === "usage_model" || key === "limits");
+}
+const VOID_SECRET_DRAFT_SOURCE = "export default { fetch() { return new Response(\"\"); } };\n";
+/** Prove a cf-created placeholder from the exact immutable version's source. */
+function isVoidSecretOnlyDraft(entry) {
+	const metadataFields = /* @__PURE__ */ new Set([
+		"id",
+		"number",
+		"startup_time_ms",
+		"created_on",
+		"source",
+		"author_id",
+		"author_email",
+		"urls",
+		"annotations",
+		"compatibility_date",
+		"usage_model",
+		"main_module",
+		"modules",
+		"bindings",
+		"env",
+		"resources"
+	]);
+	if (Object.keys(entry).some((key) => !metadataFields.has(key)) || entry.source !== "cf_cli" || !isRecord(entry.annotations) || Object.keys(entry.annotations).length !== 1 || entry.annotations["workers/triggered_by"] !== "secret" || entry.main_module !== "index.js" || !Array.isArray(entry.urls) || entry.urls.length !== 0 || !Array.isArray(entry.modules) || entry.modules.length !== 1 || !Array.isArray(entry.bindings) || entry.bindings.length === 0) return false;
+	const module = entry.modules[0];
+	if (!isRecord(module) || Object.keys(module).length !== 3 || module.name !== "index.js" || module.content_type !== "application/javascript+module" || module.content_base64 !== Buffer.from("export default { fetch() { return new Response(\"\"); } };\n").toString("base64")) return false;
+	const names = /* @__PURE__ */ new Set();
+	for (const binding of entry.bindings) {
+		if (!isRecord(binding) || Object.keys(binding).length !== 2 || typeof binding.name !== "string" || binding.name.length === 0 || names.has(binding.name) || binding.type !== "secret_text") return false;
+		names.add(binding.name);
+	}
+	if (entry.env !== void 0 && (!isRecord(entry.env) || Object.keys(entry.env).length !== names.size || Object.entries(entry.env).some(([name, binding]) => !names.has(name) || !isRecord(binding) || Object.keys(binding).length !== 1 || binding.type !== "secret_text"))) return false;
+	if (entry.resources !== void 0) {
+		if (!isRecord(entry.resources) || Object.keys(entry.resources).length !== 1) return false;
+		const bindings = entry.resources.bindings;
+		if (!Array.isArray(bindings) || !isDeepStrictEqual(bindings, entry.bindings)) return false;
+	}
+	return true;
 }
 //#endregion
 //#region src/existing.ts
@@ -114,7 +149,7 @@ async function readExistingCloudflareWorker(options) {
 	if (!worker) throw new Error(`Cloudflare Worker "${options.workerName}" does not have an active version.`);
 	return worker.snapshot;
 }
-async function readCloudflareWorker(options, allowMissing) {
+async function readCloudflareWorker(options, allowMissing, proveSecretDraft = false) {
 	const target = {
 		configPath: options.configPath,
 		workerName: options.workerName
@@ -151,6 +186,16 @@ async function readCloudflareWorker(options, allowMissing) {
 	if (version === null) throw new Error("Cloudflare did not return the existing Worker configuration.");
 	const resources = version.resources;
 	if (version.id !== versionId || !record$1(resources) || !Array.isArray(resources.bindings) || !resources.bindings.every(record$1) || !record$1(resources.script_runtime) || !record$1(resources.script)) throw new Error("Cloudflare did not return the existing Worker configuration.");
+	let isSecretOnlyDraft = isWranglerSecretOnlyDraft(version);
+	if (proveSecretDraft && !isSecretOnlyDraft && record$1(version.annotations) && Object.keys(version.annotations).length === 1 && version.annotations["workers/triggered_by"] === "secret") {
+		const source = await read({
+			type: "versions.view",
+			versionId,
+			includeSource: true,
+			...target
+		});
+		if (source?.id === versionId) isSecretOnlyDraft = isVoidSecretOnlyDraft(source);
+	}
 	const after = options.versionId ? deployment : await read({
 		type: "deployments.status",
 		...target
@@ -163,7 +208,7 @@ async function readCloudflareWorker(options, allowMissing) {
 			runtime: resources.script_runtime,
 			script: resources.script
 		},
-		isSecretOnlyDraft: isWranglerSecretOnlyDraft(version)
+		isSecretOnlyDraft
 	};
 }
 /** Parse legacy version-detail shapes; this is not authoritative Worker migration state. */
@@ -231,7 +276,7 @@ async function readCloudflareApiAuthentication(runWrangler) {
 async function assertCloudflareDurableObjectLifecycleSupported(options) {
 	const migrations = parseDurableObjectMigrations(parseRootWranglerConfig(options.configPath).migrations);
 	if (!migrations.some((migration) => migration.changesClasses)) return;
-	const existing = await readCloudflareWorker(options, true);
+	const existing = await readCloudflareWorker(options, true, true);
 	if (!existing) return;
 	const readMigrationTag = options.readMigrationTag ?? readCloudflareWorkerMigrationTag;
 	const migrationOptions = {
@@ -241,7 +286,7 @@ async function assertCloudflareDurableObjectLifecycleSupported(options) {
 		workerName: options.workerName
 	};
 	const activeTag = await readMigrationTag(migrationOptions);
-	const after = await readCloudflareWorker(options, false);
+	const after = await readCloudflareWorker(options, false, true);
 	const afterTag = await readMigrationTag(migrationOptions);
 	if (!after || after.snapshot.versionId !== existing.snapshot.versionId || afterTag !== activeTag) throw new Error("Cloudflare production or Durable Object migration state changed during verification. Retry from the current deployment.");
 	if (activeTag === null && existing.isSecretOnlyDraft && after.isSecretOnlyDraft) return;
@@ -1011,9 +1056,10 @@ function hasCustomDomains(routes) {
 /** Select a configured HTTPS route that is guaranteed to cover /__void/ready. */
 function customRouteReadinessUrl(routes) {
 	for (const route of routes) {
-		const pattern = typeof route === "string" ? route : isRecord(route) && typeof route.pattern === "string" ? route.pattern : void 0;
+		const record = isRecord(route) ? route : void 0;
+		const pattern = typeof route === "string" ? route : typeof record?.pattern === "string" ? record.pattern : void 0;
 		if (!pattern) continue;
-		const customDomain = isRecord(route) && route.custom_domain === true;
+		const customDomain = record?.custom_domain === true;
 		const withoutScheme = pattern.replace(/^https?:\/\//i, "");
 		const slash = withoutScheme.indexOf("/");
 		const hostname = (slash < 0 ? withoutScheme : withoutScheme.slice(0, slash)).trim();
@@ -1061,7 +1107,6 @@ function stableJson(value) {
 	return JSON.stringify(value);
 }
 function parseTriggerConfig(value) {
-	if (value === void 0) return null;
 	if (!isRecord(value)) return null;
 	if ([
 		"preserve",
@@ -1118,9 +1163,6 @@ function resolvePreservedTraffic(desired, previous, workerExists) {
 		...desired.addresses === void 0 ? {} : { addresses: desired.addresses }
 	};
 }
-function isRecord(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
 function isCandidatePreviewUrl(value, workerName, versionId, alias) {
 	try {
 		const url = new URL(value);
@@ -1188,6 +1230,7 @@ async function activateCloudflareVersionWithSecretsFile(options) {
 	let inheritanceBaseline;
 	let trustedCandidateChain = false;
 	let activeSecretsPinned = false;
+	let pinnedActiveSecrets;
 	if (options.expectedPreviousVersionId !== void 0 || options.verifyInheritedSecrets === true) {
 		const recent = await readRecentCloudflareVersionIds(options, configPath);
 		if (recent === null) return {
@@ -1222,6 +1265,7 @@ async function activateCloudflareVersionWithSecretsFile(options) {
 					rollback: "not-needed"
 				};
 				activeSecretsPinned = true;
+				pinnedActiveSecrets = activeSecrets;
 			}
 		}
 		inheritanceBaseline = recent;
@@ -1263,15 +1307,106 @@ async function activateCloudflareVersionWithSecretsFile(options) {
 	} : versionedPreviousTriggerConfig;
 	const previousTriggerConfig = triggerConfigWithQueueConsumerCleanup(versionedPreviousTriggerConfigWithTraffic, options.queueConsumerCleanup);
 	const alias = `void-ready-${Date.now().toString(36)}`;
-	if (options.atomic && previous.versionId !== null) {
-		if (!activeSecretsPinned && options.pinActiveSecrets) {
-			const activeSecrets = await readCloudflareVersionSecretBindings(options, configPath, previous.versionId);
-			if (activeSecrets?.length) await options.pinActiveSecrets(previous.versionId, activeSecrets);
+	const bootstrapVoidDraft = !options.preserveTriggers && !options.requirePreviewForReadiness && previousVersion?.isVoidSecretOnlyDraft === true;
+	if (previous.versionId !== null && (options.atomic || bootstrapVoidDraft)) {
+		if (bootstrapVoidDraft && !activeSecretsPinned && !options.pinActiveSecrets) return {
+			ok: false,
+			reason: "inheritance-source-unavailable"
+		};
+		if (bootstrapVoidDraft || !activeSecretsPinned && options.pinActiveSecrets) {
+			let activeSecrets;
+			try {
+				activeSecrets = await readCloudflareVersionSecretBindings(options, configPath, previous.versionId);
+			} catch {
+				return {
+					ok: false,
+					reason: "inheritance-source-unavailable"
+				};
+			}
+			if (activeSecrets === null) return {
+				ok: false,
+				reason: "inheritance-source-unavailable"
+			};
+			if (bootstrapVoidDraft && (activeSecrets.length === 0 || activeSecrets.some((secret) => secret.type !== "secret_text") || !arraysEqual(activeSecrets.map((secret) => secret.name).sort(), [...previousVersion.voidDraftSecretNames].sort()) || activeSecretsPinned && !isDeepStrictEqual([...activeSecrets].sort((a, b) => a.name.localeCompare(b.name)), [...pinnedActiveSecrets].sort((a, b) => a.name.localeCompare(b.name))))) return {
+				ok: false,
+				reason: "inheritance-source-changed"
+			};
+			if (!activeSecretsPinned && activeSecrets.length) {
+				let pinned;
+				try {
+					pinned = await options.pinActiveSecrets(previous.versionId, activeSecrets);
+				} catch {
+					return {
+						ok: false,
+						reason: "inheritance-source-unavailable"
+					};
+				}
+				if (!pinned) return {
+					ok: false,
+					reason: "inheritance-source-changed"
+				};
+			}
 		}
 		return bootstrapFirstDeployment({
 			...options,
 			message
-		}, configPath, previous.versionId, true, previousTriggerConfig);
+		}, configPath, previous.versionId, options.atomic === true, previousTriggerConfig);
+	}
+	if (previous.versionId !== null && !activeSecretsPinned && options.pinActiveSecrets && options.candidateSecretsFilePath === void 0) {
+		let activeSecrets;
+		try {
+			activeSecrets = await readCloudflareVersionSecretBindings(options, configPath, previous.versionId);
+		} catch {
+			return {
+				ok: false,
+				reason: "inheritance-source-unavailable"
+			};
+		}
+		if (activeSecrets === null) return {
+			ok: false,
+			reason: "inheritance-source-unavailable"
+		};
+		if (activeSecrets.some((secret) => !secret.name.trim() || secret.name.trim() !== secret.name) || new Set(activeSecrets.map((secret) => secret.name)).size !== activeSecrets.length) return {
+			ok: false,
+			reason: "inheritance-source-changed"
+		};
+		if (activeSecrets.length) {
+			let pinned;
+			try {
+				pinned = await options.pinActiveSecrets(previous.versionId, activeSecrets);
+			} catch {
+				return {
+					ok: false,
+					reason: "inheritance-source-unavailable"
+				};
+			}
+			if (!pinned) return {
+				ok: false,
+				reason: "inheritance-source-changed"
+			};
+			activeSecretsPinned = true;
+		}
+	}
+	if (activeSecretsPinned) {
+		if (!options.verifyUploader()) return {
+			ok: false,
+			reason: "uploader-changed"
+		};
+		const owner = await readCurrentProductionVersion(options, configPath);
+		if (owner.kind === "failed") return {
+			ok: false,
+			reason: "status-failed",
+			status: owner.status
+		};
+		if (owner.kind !== "ok" || owner.versionId !== previous.versionId || !productionVersionPercentagesEqual(owner.versions, [{
+			versionId: previous.versionId,
+			percentage: 100
+		}])) return {
+			ok: false,
+			reason: "deployment-changed",
+			activeVersionId: owner.kind === "ok" ? owner.versionId : null,
+			rollback: "not-needed"
+		};
 	}
 	options.onProgress?.("Uploading the Worker and assets...");
 	const upload = await Promise.resolve(options.runWrangler({
@@ -1647,21 +1782,25 @@ async function readCloudflareVersionInspection(options, configPath, versionId, k
 			const annotations = isRecord(entry.annotations) ? entry.annotations : void 0;
 			const message = annotations?.["workers/message"];
 			let draft = entry;
-			if (annotations?.["workers/triggered_by"] === "secret" && Object.keys(annotations).length === 1 && !isRecord(entry.resources)) {
+			if (annotations?.["workers/triggered_by"] === "secret" && Object.keys(annotations).length === 1 && !isWranglerSecretOnlyDraft(entry)) {
 				const inspection = await Promise.resolve(options.runWrangler({
 					type: "versions.view",
 					versionId,
 					configPath,
-					workerName: options.workerName
+					workerName: options.workerName,
+					includeSource: true
 				}, { capture: true }));
 				if (isCleanCommandExit(inspection)) {
 					const inspected = inspection.data;
 					if (isRecord(inspected) && inspected.id === versionId) draft = inspected;
 				}
 			}
+			const isVoidDraft = isVoidSecretOnlyDraft(draft);
 			return {
 				metadata: typeof message === "string" ? parseCloudflareVersionMessage(message) : null,
-				isSecretOnlyDraft: isWranglerSecretOnlyDraft(draft)
+				isSecretOnlyDraft: isWranglerSecretOnlyDraft(draft) || isVoidDraft,
+				isVoidSecretOnlyDraft: isVoidDraft,
+				voidDraftSecretNames: isVoidDraft ? draft.bindings.map((binding) => binding.name) : null
 			};
 		}
 	} catch {
@@ -1742,14 +1881,17 @@ async function bootstrapFirstDeployment(options, configPath, previousVersionId,
 		ok: false,
 		reason: "uploader-changed"
 	};
-	if (atomic) {
+	{
 		const current = await readCurrentProductionVersion(options, configPath);
 		if (current.kind === "failed") return {
 			ok: false,
 			reason: "status-failed",
 			status: current.status
 		};
-		if (current.kind !== "ok" || current.versionId !== previousVersionId) return {
+		if (current.kind !== "ok" || current.versionId !== previousVersionId || !productionVersionPercentagesEqual(current.versions, previousVersionId ? [{
+			versionId: previousVersionId,
+			percentage: 100
+		}] : [])) return {
 			ok: false,
 			reason: "deployment-changed",
 			activeVersionId: current.kind === "ok" ? current.versionId : null,
@@ -1794,7 +1936,6 @@ async function bootstrapFirstDeployment(options, configPath, previousVersionId,
 		previousVersionId,
 		rollback: "unsafe"
 	};
-	options.onProgress?.("Updating routes and triggers...");
 	const triggerOptions = {
 		runWrangler: options.runWrangler,
 		workerName: options.workerName,
@@ -1809,6 +1950,65 @@ async function bootstrapFirstDeployment(options, configPath, previousVersionId,
 		publishEmptyCustomDomains: options.publishEmptyCustomDomains,
 		publishEmptyCrons: options.publishEmptyCrons
 	};
+	const verifyPublishedOwner = async () => {
+		const owner = await readCurrentProductionVersion(options, configPath);
+		if (owner.kind === "failed") return {
+			ok: false,
+			reason: "status-failed",
+			status: owner.status,
+			versionId,
+			previousVersionId,
+			rollback: "unsafe"
+		};
+		if (owner.kind !== "ok" || owner.versionId !== versionId || !productionVersionPercentagesEqual(owner.versions, [{
+			versionId,
+			percentage: 100
+		}])) {
+			const repair = owner.kind === "ok" && owner.versionId && owner.versionId !== versionId && options.verifyUploader() ? await stabilizeCloudflareVersionTriggers({
+				...triggerOptions,
+				targetTriggerConfig: {
+					...desiredTriggerConfig,
+					preserve: true
+				}
+			}) : null;
+			return {
+				ok: false,
+				reason: "deployment-changed",
+				versionId,
+				previousVersionId,
+				activeVersionId: repair?.activeVersionId ?? (owner.kind === "ok" ? owner.versionId : null),
+				rollback: "not-needed",
+				...repair ? { triggerRepair: repair.ok && !repair.targetOwnsTraffic ? "succeeded" : !repair.ok && repair.reason !== "metadata-unavailable" ? "failed" : "unavailable" } : {}
+			};
+		}
+		return null;
+	};
+	const publishedOwnerFailure = await verifyPublishedOwner();
+	if (publishedOwnerFailure) return publishedOwnerFailure;
+	if (options.validateUploadedVersion || options.recordVerifiedCandidate) {
+		options.onProgress?.("Verifying the uploaded Worker...");
+		try {
+			await options.validateUploadedVersion?.(versionId);
+			const validatedOwnerFailure = await verifyPublishedOwner();
+			if (validatedOwnerFailure) return validatedOwnerFailure;
+			if (options.recordVerifiedCandidate) {
+				if (!options.validateUploadedVersion && !options.verifyInheritedSecrets && options.expectedPreviousVersionId === void 0) throw new Error("The bootstrap upload has no verified candidate checkpoint.");
+				await options.recordVerifiedCandidate(versionId, previousVersionId);
+			}
+		} catch {
+			return {
+				ok: false,
+				reason: atomic ? "atomic-failed" : "bootstrap-failed",
+				versionId,
+				previousVersionId,
+				rollback: "unavailable",
+				diagnostic: `Worker version ${versionId} was published, but its upload validation or candidate checkpoint failed. Inspect the current Worker deployment before retrying.`
+			};
+		}
+		const checkpointOwnerFailure = await verifyPublishedOwner();
+		if (checkpointOwnerFailure) return checkpointOwnerFailure;
+	}
+	options.onProgress?.("Updating routes and triggers...");
 	const triggers = await stabilizeCloudflareVersionTriggers(triggerOptions);
 	if (!triggers.ok || !triggers.targetOwnsTraffic) {
 		const superseded = triggers.activeVersionId !== void 0 && triggers.activeVersionId !== null && triggers.activeVersionId !== versionId;
@@ -2153,7 +2353,7 @@ function createCloudflareMetadataRunner(options) {
 		} else if (operation.type === "versions.list") {
 			kind = "versions";
 			resource = "/versions?deployable=true";
-		} else if (operation.type === "versions.view" && /^[0-9a-f-]{36}$/i.test(operation.versionId)) {
+		} else if (operation.type === "versions.view" && !operation.includeSource && /^[0-9a-f-]{36}$/i.test(operation.versionId)) {
 			kind = "version";
 			resource = "/versions/" + encodeURIComponent(operation.versionId);
 		}
@@ -2219,4 +2419,4 @@ function record(value) {
 	return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 //#endregion
-export { CloudflareWorkerInspectionError, activateCloudflareVersion, assertCloudflareBindingsPreserved, assertCloudflareDurableObjectLifecycleSupported, assertExistingCloudflareConfig, createCloudflareMetadataRunner, deployCloudflareVersionTraffic, deployCloudflareVersionTriggers, encodeCloudflareVersionMessage, executeCloudflareDeploy, extractWorkersDevSubdomain, normalizeWorkersDevSubdomain, parseCloudflareVersionMessage, parseRootWranglerConfig, readBindingFieldPresence, readCloudflareTriggerConfig, readCloudflareVersionMigrationTag, readCloudflareWorkerMigrationTag, readConfigEntryString, readExistingCloudflareWorker, readStoredResourceName, readWranglerTopLevelString, renderCloudflareStaticEntry, resolveD1MigrateTarget, stabilizeCloudflareVersionTriggers, stageCloudflareStaticAssets, writeCloudflareFrameworkDeployConfig, writeCloudflareStaticDeployConfig };
+export { CloudflareWorkerInspectionError, VOID_SECRET_DRAFT_SOURCE, activateCloudflareVersion, assertCloudflareBindingsPreserved, assertCloudflareDurableObjectLifecycleSupported, assertExistingCloudflareConfig, createCloudflareMetadataRunner, deployCloudflareVersionTraffic, deployCloudflareVersionTriggers, encodeCloudflareVersionMessage, executeCloudflareDeploy, extractWorkersDevSubdomain, normalizeWorkersDevSubdomain, parseCloudflareVersionMessage, parseRootWranglerConfig, readBindingFieldPresence, readCloudflareTriggerConfig, readCloudflareVersionMigrationTag, readCloudflareWorkerMigrationTag, readConfigEntryString, readExistingCloudflareWorker, readStoredResourceName, readWranglerTopLevelString, renderCloudflareStaticEntry, resolveD1MigrateTarget, stabilizeCloudflareVersionTriggers, stageCloudflareStaticAssets, writeCloudflareFrameworkDeployConfig, writeCloudflareStaticDeployConfig };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@void/deploy-cloudflare",
-  "version": "0.23.0",
+  "version": "0.25.0",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/voidzero-dev/void.git",
@@ -20,12 +20,12 @@
     "access": "public"
   },
   "dependencies": {
-    "@void/deploy-core": "0.23.0",
+    "@void/deploy-core": "0.25.0",
     "jsonc-parser": "3.3.1"
   },
   "devDependencies": {
     "@cloudflare/workers-types": "^4.20260702.1",
-    "@types/node": "^26.6.3",
+    "@types/node": "^26.6.4",
     "pathslash": "^0.1.0",
     "typescript": "7.0.2",
     "vite-plus": "1.0.0"