@void/deploy-cloudflare 1.2.1 → 1.4.0

package/dist/index.d.mts

@@ -10,7 +10,7 @@ type WorkerTarget = ConfigTarget & {
 type CloudflareOperation = ({
   type: "auth.whoami" | "auth.login" | "auth.logout" | "auth.token";
 } & ConfigTarget) | ({
-  type: "d1.list" | "kv.namespace.list" | "containers.list";
+  type: "d1.list" | "kv.namespace.list" | "containers.list" | "workers.subdomain.get";
 } & ConfigTarget) | ({
   type: "d1.info";
   name: string;
@@ -87,6 +87,7 @@ type CloudflareOperation = ({
     percentage: number;
   }>;
   message?: string;
+  bypassDeploymentChecks?: boolean;
 } & WorkerTarget) | ({
   type: "versions.upload" | "worker.deploy";
   message?: string;
@@ -267,6 +268,7 @@ type CloudflareStaticDeployConfig = Readonly<{
 /** Generate the deterministic thin Worker entry bundled by Wrangler. */
 export declare function renderCloudflareStaticEntry(options: {
   runtimeImport?: string;
+  alwaysUseHttps?: boolean;
   headerRules?: ReadonlyArray<HeaderRule>;
   redirectRules?: ReadonlyArray<RedirectRule>;
   fallbackRules?: ReadonlyArray<RedirectRule>;
@@ -310,6 +312,8 @@ type CloudflareTriggerConfig = Readonly<{
   settingsHash?: string;
   /** Explicit Worker-wide observability settings, published after version activation. */
   observability?: Readonly<Record<string, unknown>>;
+  /** Explicit Worker-wide Logpush setting, published after version activation. */
+  logpush?: boolean;
   workers_dev: boolean;
   preview_urls: boolean;
   routes: ReadonlyArray<unknown>;
@@ -317,7 +321,7 @@ type CloudflareTriggerConfig = Readonly<{
   queueConsumers: ReadonlyArray<unknown>;
   workflows: ReadonlyArray<unknown>;
   /**
-   * Email Routing addresses (`addresses` in Wrangler config). Wrangler 4.131 applies its
+   * Email Routing addresses (`addresses` in Wrangler config). The Cloudflare CLI applies its
    * Email Routing plan inside `triggers deploy` — `undefined` skips the plan entirely, while
    * `[]` is a destructive plan that deletes every rule this Worker owns — so the two must stay
    * distinct through the snapshot. Absent from annotations written before this field existed.
@@ -325,6 +329,17 @@ type CloudflareTriggerConfig = Readonly<{
   addresses?: ReadonlyArray<string>;
 }>;
 type CloudflareTrafficConfig = Pick<CloudflareTriggerConfig, "workers_dev" | "preview_urls" | "routes">;
+/**
+ * Result of an account workers.dev subdomain lookup. `uploader-changed` means the lookup refused
+ * to run a changed uploader with the session credentials.
+ */
+type CloudflareWorkersDevSubdomainLookup = {
+  ok: true;
+  subdomain: string;
+} | {
+  ok: false;
+  reason: "unavailable" | "uploader-changed";
+};
 type CloudflareVersionActivation = {
   ok: true;
   versionId: string;
@@ -345,10 +360,21 @@ type CloudflareVersionActivation = {
   versionId?: string;
   previousVersionId?: string | null;
   rollback?: "not-needed" | "succeeded" | "failed" | "unavailable" | "unsafe";
+  /**
+   * Cloudflare refused to restore the previous version because a secret
+   * changed with this deploy, so Void forced it. The previous version runs
+   * with its earlier secret values.
+   */
+  restoredOlderSecrets?: true;
   /** Version that owned production after a concurrent operation superseded this command. */
   activeVersionId?: string | null;
   /** Whether Void restored the active version's immutable trigger snapshot. */
   triggerRepair?: "succeeded" | "failed" | "unavailable";
+  /**
+   * Access denied a readiness probe to this custom-route origin. The probe carried no Access
+   * credentials because `readinessHeadersOrigin` did not name the origin.
+   */
+  customRouteReadinessOrigin?: string;
 };
 /** Encode migration state into Cloudflare's version annotation for safe rollback diagnostics. */
 export declare function encodeCloudflareVersionMessage(migrations: ReadonlyArray<string>, triggerConfig?: CloudflareTriggerConfig, contentHash?: string): string;
@@ -423,11 +449,23 @@ type CloudflareVersionActivationOptions = {
   readinessHeaders?: Readonly<Record<string, string>>;
   /** Account workers.dev subdomain used when this Worker cannot expose version preview URLs. */
   workersDevSubdomain?: string;
+  /**
+   * Look up the account workers.dev subdomain when a first publish reports no URL and
+   * `workersDevSubdomain` is not set. The subdomain includes the compliance-region label, for
+   * example `team.fed` for FedRAMP High. A thrown error counts as `unavailable`.
+   */
+  resolveWorkersDevSubdomain?: () => Promise<CloudflareWorkersDevSubdomainLookup>;
   /**
    * Operator-provided workers.dev subdomain that may receive readiness credentials even when
    * Wrangler cannot report a preview URL. Cached/project-controlled values must not be used here.
    */
   readinessHeadersWorkersDevSubdomain?: string;
+  /**
+   * Operator-provided HTTPS origin that may receive readiness credentials when the probe uses a
+   * configured custom route. A route hostname is not guaranteed to reach this Worker, so only an
+   * exact origin match receives them. Project-controlled values must not be used here.
+   */
+  readinessHeadersOrigin?: string;
   message: string;
   /** Direct empty-domain publisher for the Wrangler reconciliation gap. */
   publishEmptyCustomDomains?: () => Promise<CloudflareCommandResult>;
@@ -467,6 +505,12 @@ type CloudflareVersionActivationOptions = {
 };
 /** Upload, probe, and atomically activate a verified Worker Version. */
 export declare function activateCloudflareVersion(options: CloudflareVersionActivationOptions): Promise<CloudflareVersionActivation>;
+/**
+ * Normalize an operator-selected readiness origin. Returns `undefined` unless the value is one
+ * exact `https:` origin without a wildcard, credentials, a path, a query, or a fragment. A probe
+ * URL never has a wildcard host, so a wildcard value could never match.
+ */
+export declare function normalizeReadinessAccessOrigin(value: string | undefined): string | undefined;
 /** Change version traffic without synchronizing Worker settings from local config. */
 export declare function deployCloudflareVersionTraffic(options: {
   runWrangler: CloudflareCommandRunner;
@@ -474,6 +518,7 @@ export declare function deployCloudflareVersionTraffic(options: {
   workerName: string;
   percentages: Array<string>;
   message: string;
+  bypassDeploymentChecks?: boolean;
 }): Promise<CloudflareCommandResult>;
 /** Normalize an account workers.dev subdomain supplied by config or the environment. */
 export declare function normalizeWorkersDevSubdomain(value: string | undefined): string | undefined;
@@ -506,4 +551,4 @@ export declare function cloudflareCommandDiagnostic(result: CloudflareCommandRes
 //#region src/secret-draft.d.ts
 export declare const VOID_SECRET_DRAFT_SOURCE = "export default { fetch() { return new Response(\"\"); } };\n";
 //#endregion
-export type { ApprovedCloudflareKvBinding, CloudflareCommandResult, CloudflareCommandRunner, CloudflareDeployExecution, CloudflareFrameworkDeployConfig, CloudflareOperation, CloudflareProviderError, CloudflareStaticDeployConfig, CloudflareTrafficConfig, CloudflareTriggerConfig, CloudflareTriggerStabilization, CloudflareUploadResult, CloudflareVersionActivation, CloudflareVersionActivationOptions, CloudflareVersionMetadata, CloudflareWorkerMigrationTagOptions, ExistingCloudflareWorker };
+export type { ApprovedCloudflareKvBinding, CloudflareCommandResult, CloudflareCommandRunner, CloudflareDeployExecution, CloudflareFrameworkDeployConfig, CloudflareOperation, CloudflareProviderError, CloudflareStaticDeployConfig, CloudflareTrafficConfig, CloudflareTriggerConfig, CloudflareTriggerStabilization, CloudflareUploadResult, CloudflareVersionActivation, CloudflareVersionActivationOptions, CloudflareVersionMetadata, CloudflareWorkerMigrationTagOptions, CloudflareWorkersDevSubdomainLookup, ExistingCloudflareWorker };

package/dist/index.mjs

@@ -645,6 +645,7 @@ function writeCloudflareFrameworkDeployConfig(options) {
 /** Generate the deterministic thin Worker entry bundled by Wrangler. */
 function renderCloudflareStaticEntry(options) {
 	const config = JSON.stringify({
+		...options.alwaysUseHttps !== void 0 ? { alwaysUseHttps: options.alwaysUseHttps } : {},
 		...options.headerRules?.length ? { headerRules: options.headerRules } : {},
 		...options.redirectRules?.length ? { redirectRules: options.redirectRules } : {},
 		...options.fallbackRules?.length ? { fallbackRules: options.fallbackRules } : {},
@@ -799,6 +800,7 @@ function cloudflareCommandDiagnostic(result) {
 //#endregion
 //#region src/version.ts
 const DURABLE_MIGRATION_VERSION_ERROR = 10211;
+const CLOUDFLARE_SECRET_CHANGED_ERROR = 10220;
 /** Encode migration state into Cloudflare's version annotation for safe rollback diagnostics. */
 function encodeCloudflareVersionMessage(migrations, triggerConfig, contentHash) {
 	const metadata = triggerConfig ? {
@@ -843,7 +845,8 @@ function readCloudflareTriggerConfig(configPath, sourceConfigPath) {
 	const source = sourceConfigPath ? parseRootWranglerConfig(sourceConfigPath) : config;
 	const result = triggerConfigFromWrangler({
 		...config,
-		observability: source.observability
+		observability: source.observability,
+		logpush: source.logpush
 	});
 	if (!sourceConfigPath) return result;
 	return {
@@ -1084,6 +1087,7 @@ function triggerConfigFromWrangler(config) {
 		...config.preview_urls === void 0 ? { preservePreviewUrls: true } : {},
 		settingsHash: nonVersionedSettingsHash(config),
 		...isRecord(config.observability) ? { observability: config.observability } : {},
+		...typeof config.logpush === "boolean" ? { logpush: config.logpush } : {},
 		workers_dev: workersDev,
 		preview_urls: typeof config.preview_urls === "boolean" ? config.preview_urls : workersDev,
 		routes,
@@ -1117,7 +1121,8 @@ function parseTriggerConfig(value) {
 		"preserve",
 		"preserveRoutes",
 		"preserveWorkersDev",
-		"preservePreviewUrls"
+		"preservePreviewUrls",
+		"logpush"
 	].some((key) => value[key] !== void 0 && typeof value[key] !== "boolean") || value.settingsHash !== void 0 && typeof value.settingsHash !== "string" || value.observability !== void 0 && !isRecord(value.observability) || typeof value.workers_dev !== "boolean" || typeof value.preview_urls !== "boolean" || !Array.isArray(value.routes) || !Array.isArray(value.crons) || !Array.isArray(value.queueConsumers) || !Array.isArray(value.workflows) || value.addresses !== void 0 && readEmailAddresses(value.addresses) === void 0) return null;
 	return {
 		...value.preserve === true ? { preserve: true } : {},
@@ -1126,6 +1131,7 @@ function parseTriggerConfig(value) {
 		...value.preservePreviewUrls === true ? { preservePreviewUrls: true } : {},
 		...typeof value.settingsHash === "string" ? { settingsHash: value.settingsHash } : {},
 		...isRecord(value.observability) ? { observability: value.observability } : {},
+		...typeof value.logpush === "boolean" ? { logpush: value.logpush } : {},
 		workers_dev: value.workers_dev,
 		preview_urls: value.preview_urls,
 		routes: value.routes,
@@ -1143,6 +1149,7 @@ function triggerWranglerConfig(base, triggerConfig, manageRoutes = true) {
 	const config = {
 		...base,
 		...triggerConfig.observability === void 0 ? {} : { observability: triggerConfig.observability },
+		...triggerConfig.logpush === void 0 ? {} : { logpush: triggerConfig.logpush },
 		triggers,
 		queues,
 		workflows: [...triggerConfig.workflows],
@@ -1162,6 +1169,7 @@ function resolvePreservedTraffic(desired, previous, workerExists) {
 		...desired.preserve ? { preserve: true } : {},
 		...desired.settingsHash ? { settingsHash: desired.settingsHash } : {},
 		...desired.observability === void 0 ? {} : { observability: desired.observability },
+		...desired.logpush === void 0 ? {} : { logpush: desired.logpush },
 		workers_dev: desired.preserveWorkersDev ? previous?.workers_dev ?? desired.workers_dev : desired.workers_dev,
 		preview_urls: desired.preservePreviewUrls ? previous?.preview_urls ?? desired.preview_urls : desired.preview_urls,
 		routes: desired.preserveRoutes ? previous?.routes ?? desired.routes : desired.routes,
@@ -1506,7 +1514,9 @@ async function activateCloudflareVersionWithSecretsFile(options) {
 		if (stagingFailure) return stagingFailure;
 		stagedVersionOverride = true;
 	}
-	const probe = (url) => probeReadiness(`${url.replace(/\/$/, "")}/__void/ready`, options.workerName, readinessUsesCustomRoute ? void 0 : options.readinessHeaders, authenticatedWorkersDevSubdomain, stagedVersionOverride ? versionId : void 0, options.fetch ?? globalThis.fetch, options.sleep ?? setTimeout, options.readinessAttempts ?? 6, Number.POSITIVE_INFINITY, options.requireVersionMetadata ? versionId : void 0);
+	const trustedReadinessOrigin = normalizeReadinessAccessOrigin(options.readinessHeadersOrigin);
+	const withholdsCustomRouteHeaders = (url) => readinessUsesCustomRoute && !isTrustedReadinessOrigin(url, trustedReadinessOrigin);
+	const probe = (url) => probeReadiness(`${url.replace(/\/$/, "")}/__void/ready`, options.workerName, withholdsCustomRouteHeaders(url) ? void 0 : options.readinessHeaders, authenticatedWorkersDevSubdomain, readinessUsesCustomRoute ? trustedReadinessOrigin : void 0, stagedVersionOverride ? versionId : void 0, options.fetch ?? globalThis.fetch, options.sleep ?? setTimeout, options.readinessAttempts ?? 6, Number.POSITIVE_INFINITY, options.requireVersionMetadata ? versionId : void 0);
 	options.onProgress?.("Waiting for the Worker to become ready...");
 	let ready = await probe(readinessUrl);
 	if (ready === "access-denied" && !stagedVersionOverride && previous.versionId !== null && !options.requirePreviewForReadiness) {
@@ -1526,14 +1536,15 @@ async function activateCloudflareVersionWithSecretsFile(options) {
 		reason: ready === "access-denied" ? "readiness-access-denied" : "readiness-failed",
 		versionId,
 		previousVersionId: previous.versionId,
-		rollback: stagedVersionOverride ? await restorePreviousVersion(options, previous.versionId, "readiness failed", [stagedVersionPercentages(previous.versionId, versionId)]) : "not-needed"
+		...ready === "access-denied" && withholdsCustomRouteHeaders(readinessUrl) ? customRouteReadinessOriginField(readinessUrl) : {},
+		...stagedVersionOverride ? await restorePreviousVersion(options, previous.versionId, "readiness failed", [stagedVersionPercentages(previous.versionId, versionId)]) : { rollback: "not-needed" }
 	};
 	if (!options.verifyUploader()) return {
 		ok: false,
 		reason: "uploader-changed",
 		versionId,
 		previousVersionId: previous.versionId,
-		rollback: stagedVersionOverride ? await restorePreviousVersion(options, previous.versionId, "uploader verification failed", [stagedVersionPercentages(previous.versionId, versionId)]) : "not-needed"
+		...stagedVersionOverride ? await restorePreviousVersion(options, previous.versionId, "uploader verification failed", [stagedVersionPercentages(previous.versionId, versionId)]) : { rollback: "not-needed" }
 	};
 	const ownerBeforeActivation = await readCurrentProductionVersion(options);
 	if (ownerBeforeActivation.kind === "failed") return {
@@ -1570,10 +1581,10 @@ async function activateCloudflareVersionWithSecretsFile(options) {
 		status: activate.status,
 		versionId,
 		previousVersionId: previous.versionId,
-		rollback: stagedVersionOverride ? await restorePreviousVersion(options, previous.versionId, "version activation failed", [stagedVersionPercentages(previous.versionId, versionId), [{
+		...stagedVersionOverride ? await restorePreviousVersion(options, previous.versionId, "version activation failed", [stagedVersionPercentages(previous.versionId, versionId), [{
 			versionId,
 			percentage: 100
-		}]]) : "not-needed"
+		}]]) : { rollback: "not-needed" }
 	};
 	if (!options.verifyUploader()) return {
 		ok: false,
@@ -1666,14 +1677,14 @@ async function activateCloudflareVersionWithSecretsFile(options) {
 				triggerRepair: triggerRepairOutcome(repair)
 			};
 		}
-		const rollback = await restorePreviousVersionAndTriggers(options, previous.versionId, "trigger activation failed", desiredTriggerConfig, versionId, versionedPreviousTriggerConfigWithTraffic);
+		const restore = await restorePreviousVersionAndTriggers(options, previous.versionId, "trigger activation failed", desiredTriggerConfig, versionId, versionedPreviousTriggerConfigWithTraffic);
 		return {
 			ok: false,
 			reason: "triggers-failed",
 			status: triggers.status,
 			versionId,
 			previousVersionId: previous.versionId,
-			rollback
+			...restore
 		};
 	}
 	if (!triggers.targetOwnsTraffic) return {
@@ -1704,16 +1715,28 @@ async function restorePreviousVersionAndTriggers(options, previousVersionId, cau
 		versionId: failedVersionId,
 		percentage: 100
 	}]]);
-	if (traffic !== "succeeded" || !previousVersionId) return traffic;
-	if (!options.verifyUploader()) return "unsafe";
+	if (traffic.rollback !== "succeeded" || !previousVersionId) return traffic;
+	if (!options.verifyUploader()) return {
+		...traffic,
+		rollback: "unsafe"
+	};
 	let targetTriggerConfig = capturedTriggerConfig;
 	if (!targetTriggerConfig) {
 		const metadata = await readCloudflareVersionMetadata(options, previousVersionId);
-		if (metadata?.schema !== 2) return "unavailable";
+		if (metadata?.schema !== 2) return {
+			...traffic,
+			rollback: "unavailable"
+		};
 		targetTriggerConfig = metadata.triggerConfig;
 	}
-	if (targetTriggerConfig.preserve) return "unavailable";
-	if (!options.verifyUploader()) return "unsafe";
+	if (targetTriggerConfig.preserve) return {
+		...traffic,
+		rollback: "unavailable"
+	};
+	if (!options.verifyUploader()) return {
+		...traffic,
+		rollback: "unsafe"
+	};
 	const triggers = await stabilizeCloudflareVersionTriggers({
 		runWrangler: options.runWrangler,
 		workerName: options.workerName,
@@ -1725,7 +1748,10 @@ async function restorePreviousVersionAndTriggers(options, previousVersionId, cau
 		publishEmptyCustomDomains: options.publishEmptyCustomDomains,
 		publishEmptyCrons: options.publishEmptyCrons
 	});
-	return triggers.ok && triggers.targetOwnsTraffic ? "succeeded" : "failed";
+	return {
+		...traffic,
+		rollback: triggers.ok && triggers.targetOwnsTraffic ? "succeeded" : "failed"
+	};
 }
 async function readCloudflareVersionMetadata(options, versionId) {
 	return (await readCloudflareVersionInspection(options, versionId))?.metadata ?? null;
@@ -1879,7 +1905,33 @@ async function bootstrapFirstDeployment(options, previousVersionId, atomic = fal
 	const published = readUploadResult(bootstrap);
 	const versionId = published?.versionId;
 	const desiredTriggerConfig = desiredTriggerConfigFor(parseCloudflareVersionMessage(options.message), options.configPath);
-	const reportedOrConfiguredUrl = published?.previewUrl ?? published?.workersDevUrl ?? (desiredTriggerConfig.workers_dev ? workersDevReadinessUrl(options.workerName, options.workersDevSubdomain) : customRouteReadinessUrl(desiredTriggerConfig.routes));
+	let reportedOrConfiguredUrl = published?.previewUrl ?? published?.workersDevUrl ?? (desiredTriggerConfig.workers_dev ? workersDevReadinessUrl(options.workerName, options.workersDevSubdomain) : customRouteReadinessUrl(desiredTriggerConfig.routes));
+	if (versionId && !reportedOrConfiguredUrl && desiredTriggerConfig.workers_dev && !desiredTriggerConfig.preserve && !desiredTriggerConfig.preserveWorkersDev && !options.preserveTriggers && options.resolveWorkersDevSubdomain) {
+		if (!options.verifyUploader()) return {
+			ok: false,
+			reason: "uploader-changed",
+			versionId,
+			previousVersionId,
+			rollback: "unsafe"
+		};
+		let lookup;
+		try {
+			lookup = await options.resolveWorkersDevSubdomain();
+		} catch {
+			lookup = {
+				ok: false,
+				reason: "unavailable"
+			};
+		}
+		if (!lookup.ok && lookup.reason === "uploader-changed") return {
+			ok: false,
+			reason: "uploader-changed",
+			versionId,
+			previousVersionId,
+			rollback: "unsafe"
+		};
+		reportedOrConfiguredUrl = lookup.ok ? workersDevReadinessUrl(options.workerName, lookup.subdomain) : void 0;
+	}
 	if (!versionId || !reportedOrConfiguredUrl) return {
 		ok: false,
 		reason: atomic ? "atomic-output-invalid" : "bootstrap-output-invalid",
@@ -1984,14 +2036,18 @@ async function bootstrapFirstDeployment(options, previousVersionId, atomic = fal
 	const usesCustomDomain = !desiredTriggerConfig.workers_dev && desiredTriggerConfig.routes.some((route) => isRecord(route) && route.custom_domain === true);
 	const customDomainBootstrap = !atomic && usesCustomDomain;
 	const readinessTimeoutMs = customDomainBootstrap ? 3e5 : 6e4;
+	const previewSubdomain = extractWorkersDevSubdomain(previewUrl);
+	const trustedReadinessOrigin = previewSubdomain ? void 0 : normalizeReadinessAccessOrigin(options.readinessHeadersOrigin);
+	const withholdsCustomRouteHeaders = !previewSubdomain && !isTrustedReadinessOrigin(previewUrl, trustedReadinessOrigin);
 	options.onProgress?.("Waiting for the Worker to become ready...");
-	const ready = await probeReadiness(`${previewUrl.replace(/\/$/, "")}/__void/ready`, options.workerName, extractWorkersDevSubdomain(previewUrl) ? options.readinessHeaders : void 0, extractWorkersDevSubdomain(previewUrl), void 0, options.fetch ?? globalThis.fetch, options.sleep ?? setTimeout, options.readinessAttempts ?? (customDomainBootstrap ? 150 : 30), readinessTimeoutMs, options.requireVersionMetadata ? versionId : void 0);
+	const ready = await probeReadiness(`${previewUrl.replace(/\/$/, "")}/__void/ready`, options.workerName, withholdsCustomRouteHeaders ? void 0 : options.readinessHeaders, previewSubdomain, trustedReadinessOrigin, void 0, options.fetch ?? globalThis.fetch, options.sleep ?? setTimeout, options.readinessAttempts ?? (customDomainBootstrap ? 150 : 30), readinessTimeoutMs, options.requireVersionMetadata ? versionId : void 0);
 	if (ready !== "ready") return {
 		ok: false,
 		reason: ready === "access-denied" ? atomic ? "atomic-readiness-access-denied" : "bootstrap-readiness-access-denied" : atomic ? "atomic-readiness-failed" : "bootstrap-readiness-failed",
 		versionId,
 		previousVersionId,
 		rollback: "unavailable",
+		...ready === "access-denied" && withholdsCustomRouteHeaders ? customRouteReadinessOriginField(previewUrl) : {},
 		...ready === "failed" && usesCustomDomain ? { diagnostic: "The Custom Domain may still be propagating DNS or its TLS certificate. Check the configured domain in Cloudflare, then retry `void deploy --platform cloudflare` once its /__void/ready endpoint is reachable." } : {}
 	};
 	if (!options.verifyUploader()) return {
@@ -2167,8 +2223,8 @@ async function verifyReadinessStagingOwner(options, previousVersionId, versionId
 	};
 	return null;
 }
-async function probeReadiness(url, workerName, readinessHeaders, authenticatedWorkersDevSubdomain, versionOverride, fetcher, sleep, attempts, timeoutMs = Number.POSITIVE_INFINITY, expectedVersionId) {
-	const headers = guardedReadinessHeaders(url, workerName, readinessHeaders, authenticatedWorkersDevSubdomain);
+async function probeReadiness(url, workerName, readinessHeaders, authenticatedWorkersDevSubdomain, trustedReadinessOrigin, versionOverride, fetcher, sleep, attempts, timeoutMs = Number.POSITIVE_INFINITY, expectedVersionId) {
+	const headers = guardedReadinessHeaders(url, workerName, readinessHeaders, authenticatedWorkersDevSubdomain, trustedReadinessOrigin);
 	if (headers === null) return "failed";
 	const deadline = Date.now() + timeoutMs;
 	for (let attempt = 0; attempt < Math.max(1, attempts); attempt++) {
@@ -2199,9 +2255,13 @@ async function probeReadiness(url, workerName, readinessHeaders, authenticatedWo
 	}
 	return "failed";
 }
-/** Never forward Access headers to a hostname that cannot be this Worker. */
-function guardedReadinessHeaders(url, workerName, headers, authenticatedWorkersDevSubdomain) {
+/**
+* Never forward Access headers to a hostname that cannot be this Worker, unless the operator
+* named that exact origin.
+*/
+function guardedReadinessHeaders(url, workerName, headers, authenticatedWorkersDevSubdomain, trustedReadinessOrigin) {
 	if (!headers || Object.keys(headers).length === 0) return {};
+	if (isTrustedReadinessOrigin(url, trustedReadinessOrigin)) return headers;
 	try {
 		const parsed = new URL(url);
 		const firstLabel = parsed.hostname.toLowerCase().split(".")[0] ?? "";
@@ -2213,6 +2273,36 @@ function guardedReadinessHeaders(url, workerName, headers, authenticatedWorkersD
 		return null;
 	}
 }
+/**
+* Normalize an operator-selected readiness origin. Returns `undefined` unless the value is one
+* exact `https:` origin without a wildcard, credentials, a path, a query, or a fragment. A probe
+* URL never has a wildcard host, so a wildcard value could never match.
+*/
+function normalizeReadinessAccessOrigin(value) {
+	if (!value) return;
+	try {
+		const url = new URL(value);
+		return url.protocol === "https:" && !url.hostname.includes("*") && !url.username && !url.password && url.pathname === "/" && !url.search && !url.hash ? url.origin : void 0;
+	} catch {
+		return;
+	}
+}
+function isTrustedReadinessOrigin(url, trustedOrigin) {
+	if (trustedOrigin === void 0) return false;
+	try {
+		const parsed = new URL(url);
+		return parsed.protocol === "https:" && !parsed.username && !parsed.password && parsed.origin === trustedOrigin;
+	} catch {
+		return false;
+	}
+}
+function customRouteReadinessOriginField(url) {
+	try {
+		return { customRouteReadinessOrigin: new URL(url).origin };
+	} catch {
+		return {};
+	}
+}
 async function isCloudflareAccessDenial(response) {
 	if (response.status >= 300 && response.status < 400 && response.headers.get("location")?.includes("/cdn-cgi/access/")) return true;
 	if (response.status !== 403) return false;
@@ -2236,7 +2326,8 @@ async function deployVersionPercentages(options, percentages, message) {
 		versions: versionPercentages(percentages),
 		configPath: options.configPath,
 		workerName: options.workerName,
-		message
+		message,
+		...options.bypassDeploymentChecks ? { bypassDeploymentChecks: true } : {}
 	}, { capture: false });
 }
 /** Change version traffic without synchronizing Worker settings from local config. */
@@ -2251,7 +2342,8 @@ async function deployCloudflareVersionTraffic(options) {
 			versions: versionPercentages(options.percentages),
 			configPath: path,
 			workerName: options.workerName,
-			message: options.message
+			message: options.message,
+			...options.bypassDeploymentChecks ? { bypassDeploymentChecks: true } : {}
 		}, { capture: false });
 	} finally {
 		rmSync(directory, {
@@ -2261,11 +2353,26 @@ async function deployCloudflareVersionTraffic(options) {
 	}
 }
 async function restorePreviousVersion(options, previousVersionId, cause, expectedOwnedTraffic) {
-	if (!previousVersionId) return "unavailable";
-	if (!options.verifyUploader()) return "unsafe";
-	const owner = await readCurrentProductionVersion(options);
-	if (owner.kind !== "ok" || !expectedOwnedTraffic.some((expected) => productionVersionPercentagesEqual(owner.versions, expected))) return "unsafe";
-	return isCleanCommandExit(await deployVersionPercentages(options, [`${previousVersionId}@100`], `Void automatic rollback after ${cause}.`)) ? "succeeded" : "failed";
+	if (!previousVersionId) return { rollback: "unavailable" };
+	if (!options.verifyUploader()) return { rollback: "unsafe" };
+	const ownsExpectedTraffic = async () => {
+		const owner = await readCurrentProductionVersion(options);
+		return owner.kind === "ok" && expectedOwnedTraffic.some((expected) => productionVersionPercentagesEqual(owner.versions, expected));
+	};
+	if (!await ownsExpectedTraffic()) return { rollback: "unsafe" };
+	const restore = (bypassDeploymentChecks) => deployVersionPercentages({
+		...options,
+		bypassDeploymentChecks
+	}, [`${previousVersionId}@100`], `Void automatic rollback after ${cause}.`);
+	const result = await restore(false);
+	if (result.errorCode === CLOUDFLARE_SECRET_CHANGED_ERROR) {
+		if (!await ownsExpectedTraffic()) return { rollback: "unsafe" };
+		return isCleanCommandExit(await restore(true)) ? {
+			rollback: "succeeded",
+			restoredOlderSecrets: true
+		} : { rollback: "failed" };
+	}
+	return { rollback: isCleanCommandExit(result) ? "succeeded" : "failed" };
 }
 function workersDevReadinessUrl(workerName, value) {
 	const subdomain = normalizeWorkersDevSubdomain(value);
@@ -2391,4 +2498,4 @@ function createCloudflareMetadataRunner(options) {
 	};
 }
 //#endregion
-export { CloudflareWorkerInspectionError, VOID_SECRET_DRAFT_SOURCE, activateCloudflareVersion, assertCloudflareBindingsPreserved, assertCloudflareDurableObjectLifecycleSupported, assertExistingCloudflareConfig, cloudflareCommandDiagnostic, createCloudflareMetadataRunner, deployCloudflareVersionTraffic, deployCloudflareVersionTriggers, encodeCloudflareVersionMessage, executeCloudflareDeploy, extractWorkersDevSubdomain, normalizeWorkersDevSubdomain, parseCloudflareVersionMessage, parseRootWranglerConfig, readBindingFieldPresence, readCloudflareTriggerConfig, readCloudflareVersionMigrationTag, readCloudflareWorkerMigrationTag, readConfigEntryString, readExistingCloudflareWorker, readStoredResourceName, readWranglerTopLevelString, renderCloudflareStaticEntry, resolveD1MigrateTarget, stabilizeCloudflareVersionTriggers, stageCloudflareStaticAssets, writeCloudflareFrameworkDeployConfig, writeCloudflareStaticDeployConfig };
+export { CloudflareWorkerInspectionError, VOID_SECRET_DRAFT_SOURCE, activateCloudflareVersion, assertCloudflareBindingsPreserved, assertCloudflareDurableObjectLifecycleSupported, assertExistingCloudflareConfig, cloudflareCommandDiagnostic, createCloudflareMetadataRunner, deployCloudflareVersionTraffic, deployCloudflareVersionTriggers, encodeCloudflareVersionMessage, executeCloudflareDeploy, extractWorkersDevSubdomain, normalizeReadinessAccessOrigin, normalizeWorkersDevSubdomain, parseCloudflareVersionMessage, parseRootWranglerConfig, readBindingFieldPresence, readCloudflareTriggerConfig, readCloudflareVersionMigrationTag, readCloudflareWorkerMigrationTag, readConfigEntryString, readExistingCloudflareWorker, readStoredResourceName, readWranglerTopLevelString, renderCloudflareStaticEntry, resolveD1MigrateTarget, stabilizeCloudflareVersionTriggers, stageCloudflareStaticAssets, writeCloudflareFrameworkDeployConfig, writeCloudflareStaticDeployConfig };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@void/deploy-cloudflare",
-  "version": "1.2.1",
+  "version": "1.4.0",
   "description": "Cloudflare deployment primitives for Void runtimes and deployment adapters.",
   "homepage": "https://void.cloud",
   "bugs": {
@@ -26,7 +26,7 @@
     "access": "public"
   },
   "dependencies": {
-    "@void/deploy-core": "1.2.1",
+    "@void/deploy-core": "1.4.0",
     "jsonc-parser": "^3.3.1"
   },
   "devDependencies": {