@void/deploy-cloudflare 1.3.0 → 1.5.0

package/dist/index.d.mts

@@ -1,5 +1,4 @@
 import { AssetConfig, HeaderRule, RedirectRule } from "@void/deploy-core";
-//#region src/operations.d.ts
 /** Typed provider operations shared by app deployment and platform installation. */
 type ConfigTarget = {
   configPath?: string;
@@ -10,7 +9,7 @@ type WorkerTarget = ConfigTarget & {
 type CloudflareOperation = ({
   type: "auth.whoami" | "auth.login" | "auth.logout" | "auth.token";
 } & ConfigTarget) | ({
-  type: "d1.list" | "kv.namespace.list" | "containers.list";
+  type: "d1.list" | "kv.namespace.list" | "containers.list" | "workers.subdomain.get";
 } & ConfigTarget) | ({
   type: "d1.info";
   name: string;
@@ -120,8 +119,6 @@ type CloudflareProviderError = {
   code?: number;
   message: string;
 };
-//#endregion
-//#region src/execute.d.ts
 type CloudflareCommandResult = {
   /** Structured provider response. stdout is diagnostics only. */
   data?: unknown;
@@ -153,8 +150,6 @@ export declare function executeCloudflareDeploy(options: {
   verifyUploader: () => boolean;
   configPath?: string;
 }): Promise<CloudflareDeployExecution>;
-//#endregion
-//#region src/existing.d.ts
 type ExistingCloudflareWorker = {
   versionId: string;
   bindings: Array<Record<string, unknown>>;
@@ -208,8 +203,6 @@ export declare function assertCloudflareBindingsPreserved(before: ExistingCloudf
 }): void;
 /** Preserve the existing Worker, allowing only explicitly approved KV additions. */
 export declare function assertExistingCloudflareConfig(existing: ExistingCloudflareWorker, config: Record<string, unknown>, built?: boolean, approvedKv?: ReadonlyArray<ApprovedCloudflareKvBinding>): void;
-//#endregion
-//#region src/config.d.ts
 /** Parse a root Wrangler JSON/JSONC config without accepting a partial parse. */
 export declare function parseRootWranglerConfig(configPath: string): Record<string, unknown>;
 export declare function readWranglerTopLevelString(config: Record<string, unknown>, field: string): string | undefined;
@@ -226,8 +219,6 @@ export declare function resolveD1MigrateTarget(config: Record<string, unknown>,
   ok: false;
   reason: string;
 };
-//#endregion
-//#region src/framework.d.ts
 type CloudflareFrameworkDeployConfig = Readonly<{
   configPath: string;
   deployPointerPath: string;
@@ -254,8 +245,6 @@ type CloudflareFrameworkDeployConfig = Readonly<{
  * that file, so Wrangler uploads the exact config Void verifies.
  */
 export declare function writeCloudflareFrameworkDeployConfig(options: CloudflareFrameworkDeployConfig): boolean;
-//#endregion
-//#region src/static.d.ts
 type CloudflareStaticDeployConfig = Readonly<{
   configPath: string;
   name: string;
@@ -268,6 +257,7 @@ type CloudflareStaticDeployConfig = Readonly<{
 /** Generate the deterministic thin Worker entry bundled by Wrangler. */
 export declare function renderCloudflareStaticEntry(options: {
   runtimeImport?: string;
+  alwaysUseHttps?: boolean;
   headerRules?: ReadonlyArray<HeaderRule>;
   redirectRules?: ReadonlyArray<RedirectRule>;
   fallbackRules?: ReadonlyArray<RedirectRule>;
@@ -289,8 +279,6 @@ export declare function stageCloudflareStaticAssets(options: {
  * Durable Object migrations, resource ids, or unrelated user configuration.
  */
 export declare function writeCloudflareStaticDeployConfig(options: CloudflareStaticDeployConfig): boolean;
-//#endregion
-//#region src/version.d.ts
 type CloudflareVersionMetadata = Readonly<{
   schema: 1;
   migrations: ReadonlyArray<string>;
@@ -311,6 +299,8 @@ type CloudflareTriggerConfig = Readonly<{
   settingsHash?: string;
   /** Explicit Worker-wide observability settings, published after version activation. */
   observability?: Readonly<Record<string, unknown>>;
+  /** Explicit Worker-wide Logpush setting, published after version activation. */
+  logpush?: boolean;
   workers_dev: boolean;
   preview_urls: boolean;
   routes: ReadonlyArray<unknown>;
@@ -318,7 +308,7 @@ type CloudflareTriggerConfig = Readonly<{
   queueConsumers: ReadonlyArray<unknown>;
   workflows: ReadonlyArray<unknown>;
   /**
-   * Email Routing addresses (`addresses` in Wrangler config). Wrangler 4.131 applies its
+   * Email Routing addresses (`addresses` in Wrangler config). The Cloudflare CLI applies its
    * Email Routing plan inside `triggers deploy` — `undefined` skips the plan entirely, while
    * `[]` is a destructive plan that deletes every rule this Worker owns — so the two must stay
    * distinct through the snapshot. Absent from annotations written before this field existed.
@@ -326,6 +316,17 @@ type CloudflareTriggerConfig = Readonly<{
   addresses?: ReadonlyArray<string>;
 }>;
 type CloudflareTrafficConfig = Pick<CloudflareTriggerConfig, "workers_dev" | "preview_urls" | "routes">;
+/**
+ * Result of an account workers.dev subdomain lookup. `uploader-changed` means the lookup refused
+ * to run a changed uploader with the session credentials.
+ */
+type CloudflareWorkersDevSubdomainLookup = {
+  ok: true;
+  subdomain: string;
+} | {
+  ok: false;
+  reason: "unavailable" | "uploader-changed";
+};
 type CloudflareVersionActivation = {
   ok: true;
   versionId: string;
@@ -356,6 +357,11 @@ type CloudflareVersionActivation = {
   activeVersionId?: string | null;
   /** Whether Void restored the active version's immutable trigger snapshot. */
   triggerRepair?: "succeeded" | "failed" | "unavailable";
+  /**
+   * Access denied a readiness probe to this custom-route origin. The probe carried no Access
+   * credentials because `readinessHeadersOrigin` did not name the origin.
+   */
+  customRouteReadinessOrigin?: string;
 };
 /** Encode migration state into Cloudflare's version annotation for safe rollback diagnostics. */
 export declare function encodeCloudflareVersionMessage(migrations: ReadonlyArray<string>, triggerConfig?: CloudflareTriggerConfig, contentHash?: string): string;
@@ -430,11 +436,23 @@ type CloudflareVersionActivationOptions = {
   readinessHeaders?: Readonly<Record<string, string>>;
   /** Account workers.dev subdomain used when this Worker cannot expose version preview URLs. */
   workersDevSubdomain?: string;
+  /**
+   * Look up the account workers.dev subdomain when a first publish reports no URL and
+   * `workersDevSubdomain` is not set. The subdomain includes the compliance-region label, for
+   * example `team.fed` for FedRAMP High. A thrown error counts as `unavailable`.
+   */
+  resolveWorkersDevSubdomain?: () => Promise<CloudflareWorkersDevSubdomainLookup>;
   /**
    * Operator-provided workers.dev subdomain that may receive readiness credentials even when
    * Wrangler cannot report a preview URL. Cached/project-controlled values must not be used here.
    */
   readinessHeadersWorkersDevSubdomain?: string;
+  /**
+   * Operator-provided HTTPS origin that may receive readiness credentials when the probe uses a
+   * configured custom route. A route hostname is not guaranteed to reach this Worker, so only an
+   * exact origin match receives them. Project-controlled values must not be used here.
+   */
+  readinessHeadersOrigin?: string;
   message: string;
   /** Direct empty-domain publisher for the Wrangler reconciliation gap. */
   publishEmptyCustomDomains?: () => Promise<CloudflareCommandResult>;
@@ -474,6 +492,12 @@ type CloudflareVersionActivationOptions = {
 };
 /** Upload, probe, and atomically activate a verified Worker Version. */
 export declare function activateCloudflareVersion(options: CloudflareVersionActivationOptions): Promise<CloudflareVersionActivation>;
+/**
+ * Normalize an operator-selected readiness origin. Returns `undefined` unless the value is one
+ * exact `https:` origin without a wildcard, credentials, a path, a query, or a fragment. A probe
+ * URL never has a wildcard host, so a wildcard value could never match.
+ */
+export declare function normalizeReadinessAccessOrigin(value: string | undefined): string | undefined;
 /** Change version traffic without synchronizing Worker settings from local config. */
 export declare function deployCloudflareVersionTraffic(options: {
   runWrangler: CloudflareCommandRunner;
@@ -487,8 +511,6 @@ export declare function deployCloudflareVersionTraffic(options: {
 export declare function normalizeWorkersDevSubdomain(value: string | undefined): string | undefined;
 /** Extract the account subdomain from a Wrangler-reported workers.dev URL. */
 export declare function extractWorkersDevSubdomain(url: string): string | undefined;
-//#endregion
-//#region src/metadata.d.ts
 /**
  * Share one authenticated transport for the activator's read-only metadata calls.
  * Writes and unsupported commands use the pinned cf command adapter. Responses
@@ -506,12 +528,7 @@ export declare function createCloudflareMetadataRunner(options: {
   /** Environment used to decide whether the CLI's proxy-aware transport is required. */
   env?: Readonly<Record<string, string | undefined>>;
 }): CloudflareCommandRunner;
-//#endregion
-//#region src/diagnostics.d.ts
-/** Keep the uploader's error, excluding stdout binding tables and redacting common credential formats. */
+/** Keep the uploader's error, excluding cf's log lines and redacting common credential formats. */
 export declare function cloudflareCommandDiagnostic(result: CloudflareCommandResult): string | undefined;
-//#endregion
-//#region src/secret-draft.d.ts
 export declare const VOID_SECRET_DRAFT_SOURCE = "export default { fetch() { return new Response(\"\"); } };\n";
-//#endregion
-export type { ApprovedCloudflareKvBinding, CloudflareCommandResult, CloudflareCommandRunner, CloudflareDeployExecution, CloudflareFrameworkDeployConfig, CloudflareOperation, CloudflareProviderError, CloudflareStaticDeployConfig, CloudflareTrafficConfig, CloudflareTriggerConfig, CloudflareTriggerStabilization, CloudflareUploadResult, CloudflareVersionActivation, CloudflareVersionActivationOptions, CloudflareVersionMetadata, CloudflareWorkerMigrationTagOptions, ExistingCloudflareWorker };
+export type { ApprovedCloudflareKvBinding, CloudflareCommandResult, CloudflareCommandRunner, CloudflareDeployExecution, CloudflareFrameworkDeployConfig, CloudflareOperation, CloudflareProviderError, CloudflareStaticDeployConfig, CloudflareTrafficConfig, CloudflareTriggerConfig, CloudflareTriggerStabilization, CloudflareUploadResult, CloudflareVersionActivation, CloudflareVersionActivationOptions, CloudflareVersionMetadata, CloudflareWorkerMigrationTagOptions, CloudflareWorkersDevSubdomainLookup, ExistingCloudflareWorker };

package/dist/index.mjs

@@ -6,7 +6,7 @@ import nodePath from "node:path";
 import { createHash } from "node:crypto";
 import { tmpdir } from "node:os";
 import { setTimeout } from "node:timers/promises";
-//#region src/config.ts
+// src/config.ts
 /** Parse a root Wrangler JSON/JSONC config without accepting a partial parse. */
 function parseRootWranglerConfig(configPath) {
 	if (!existsSync(configPath)) return {};
@@ -82,8 +82,7 @@ function resolveD1MigrateTarget(config, binding) {
 		token
 	};
 }
-//#endregion
-//#region src/execute.ts
+// src/execute.ts
 /** Upload the already-verified Worker artifact without Wrangler autoconfiguration. */
 async function executeCloudflareDeploy(options) {
 	if (!options.verifyUploader()) return {
@@ -112,8 +111,7 @@ function isCleanCommandExit(result) {
 function isWorkerNotFound(result) {
 	return isCompletedCommand(result) && (result.failure === "not-found" || result.errorCode === 10007);
 }
-//#endregion
-//#region src/secret-draft.ts
+// src/secret-draft.ts
 /**
 * `wrangler secret put` creates a fetch-only draft before attaching a first secret to a Worker.
 * Accept that draft as first-deployment proof only when its complete deployable shape contains no
@@ -168,8 +166,7 @@ function isVoidSecretOnlyDraft(entry) {
 	}
 	return true;
 }
-//#endregion
-//#region src/existing.ts
+// src/existing.ts
 /** A failed remote read, distinct from an invalid or changing Worker configuration. */
 var CloudflareWorkerInspectionError = class extends Error {
 	name = "CloudflareWorkerInspectionError";
@@ -531,8 +528,7 @@ function hasContent(value) {
 	if (isRecord(value)) return Object.values(value).some(hasContent);
 	return true;
 }
-//#endregion
-//#region ../../node_modules/.pnpm/pathslash@0.1.0/node_modules/pathslash/dist/index.mjs
+// ../../node_modules/.pnpm/pathslash@0.1.0/node_modules/pathslash/dist/index.mjs
 const BACKSLASH_RE = /\\/g;
 const isWindows = process.platform === "win32";
 /**
@@ -570,8 +566,7 @@ const posix = { ...nodePath.posix };
 posix.posix = win32.posix = posix;
 posix.win32 = win32.win32 = win32;
 const { basename, delimiter, dirname, extname, format, isAbsolute, join, matchesGlob, normalize, parse: parse$1, relative, resolve, sep, toNamespacedPath } = isWindows ? win32 : posix;
-//#endregion
-//#region src/framework.ts
+// src/framework.ts
 /**
 * Point a standalone framework Worker at the canonical root Cloudflare state.
 *
@@ -640,11 +635,11 @@ function writeCloudflareFrameworkDeployConfig(options) {
 	}
 	return changed;
 }
-//#endregion
-//#region src/static.ts
+// src/static.ts
 /** Generate the deterministic thin Worker entry bundled by Wrangler. */
 function renderCloudflareStaticEntry(options) {
 	const config = JSON.stringify({
+		...options.alwaysUseHttps !== void 0 ? { alwaysUseHttps: options.alwaysUseHttps } : {},
 		...options.headerRules?.length ? { headerRules: options.headerRules } : {},
 		...options.redirectRules?.length ? { redirectRules: options.redirectRules } : {},
 		...options.fallbackRules?.length ? { fallbackRules: options.fallbackRules } : {},
@@ -762,11 +757,17 @@ function findDroppedComment(before, after) {
 		counts.set(token, remaining - 1);
 	}
 }
-//#endregion
-//#region src/diagnostics.ts
+// src/diagnostics.ts
 const MAX_DIAGNOSTIC_LENGTH = 4096;
 const MAX_DIAGNOSTIC_LINES = 24;
-/** Keep the uploader's error, excluding stdout binding tables and redacting common credential formats. */
+const ERROR_BOX = /(?:^|\n)[ \t]*┌[ \t]*(?:APIError|Error)\b[^\n]*\n(?:[ \t]*│[^\n]*\n)*[ \t]*└[^\n]*/i;
+const LOG_LINE = /^[├│◆◇●▲■└|*o•!x—](?: {2}|$)/;
+const UPLOAD_CONFLICT = /^[ \t]*(?:\S[ \t]+)?(Aborting the upload operation because of conflicts\..*)$/m;
+const SCRIPT_API_ORIGIN = /^[ \t]*(?:\S[ \t]+)?(You are about to upload a Worker that was last updated via the script API\.)/m;
+function withoutLogLines(output) {
+	return output.split("\n").filter((line) => !LOG_LINE.test(line)).join("\n");
+}
+/** Keep the uploader's error, excluding cf's log lines and redacting common credential formats. */
 function cloudflareCommandDiagnostic(result) {
 	const stderr = stripVTControlCharacters(result.stderr).replace(/\r\n?/g, "\n");
 	const stdout = stripVTControlCharacters(result.stdout).replace(/\r\n?/g, "\n");
@@ -779,15 +780,13 @@ function cloudflareCommandDiagnostic(result) {
 		}
 	}
 	if (message === stderr && !/(?:^|\n)[ \t]*(?:[✘×X][ \t]+)?\[ERROR\]/i.test(stderr)) {
-		const box = /(?:^|\n)[ \t]*┌[ \t]*(?:APIError|Error)\b[^\n]*\n(?:[ \t]*│[^\n]*\n)*[ \t]*└[^\n]*/i.exec(stdout);
+		const box = ERROR_BOX.exec(stdout);
+		const conflict = UPLOAD_CONFLICT.exec(`${stdout}\n${stderr}`);
 		if (box) message = box[0].trim();
+		else if (conflict) message = [SCRIPT_API_ORIGIN.exec(`${stdout}\n${stderr}`)?.[1], conflict[1]].filter(Boolean).join("\n");
 		else {
-			const lines = stdout.split("\n");
-			const abort = lines.find((line) => line.startsWith("■  Aborting the upload operation because of conflicts."));
-			if (abort) {
-				const reason = "You are about to upload a Worker that was last updated via the script API.";
-				message = [lines.includes(`▲  ${reason}`) ? reason : "", abort.slice(3)].filter(Boolean).join("\n");
-			}
+			const stderrBox = ERROR_BOX.exec(stderr);
+			message = stderrBox ? withoutLogLines(stderr.slice(0, stderrBox.index)) + stderrBox[0] + withoutLogLines(stderr.slice(stderrBox.index + stderrBox[0].length)) : withoutLogLines(stderr);
 		}
 	}
 	message = stripVTControlCharacters(message).split(/\n\s*(?:🪵|Logs (?:were )?written|If you think this is a bug)/)[0].trim();
@@ -796,8 +795,7 @@ function cloudflareCommandDiagnostic(result) {
 	const bounded = message.split("\n").slice(0, MAX_DIAGNOSTIC_LINES).join("\n").slice(0, MAX_DIAGNOSTIC_LENGTH);
 	return bounded.length < message.length ? `${bounded}\n[diagnostic truncated]` : bounded;
 }
-//#endregion
-//#region src/version.ts
+// src/version.ts
 const DURABLE_MIGRATION_VERSION_ERROR = 10211;
 const CLOUDFLARE_SECRET_CHANGED_ERROR = 10220;
 /** Encode migration state into Cloudflare's version annotation for safe rollback diagnostics. */
@@ -844,7 +842,8 @@ function readCloudflareTriggerConfig(configPath, sourceConfigPath) {
 	const source = sourceConfigPath ? parseRootWranglerConfig(sourceConfigPath) : config;
 	const result = triggerConfigFromWrangler({
 		...config,
-		observability: source.observability
+		observability: source.observability,
+		logpush: source.logpush
 	});
 	if (!sourceConfigPath) return result;
 	return {
@@ -1085,6 +1084,7 @@ function triggerConfigFromWrangler(config) {
 		...config.preview_urls === void 0 ? { preservePreviewUrls: true } : {},
 		settingsHash: nonVersionedSettingsHash(config),
 		...isRecord(config.observability) ? { observability: config.observability } : {},
+		...typeof config.logpush === "boolean" ? { logpush: config.logpush } : {},
 		workers_dev: workersDev,
 		preview_urls: typeof config.preview_urls === "boolean" ? config.preview_urls : workersDev,
 		routes,
@@ -1118,7 +1118,8 @@ function parseTriggerConfig(value) {
 		"preserve",
 		"preserveRoutes",
 		"preserveWorkersDev",
-		"preservePreviewUrls"
+		"preservePreviewUrls",
+		"logpush"
 	].some((key) => value[key] !== void 0 && typeof value[key] !== "boolean") || value.settingsHash !== void 0 && typeof value.settingsHash !== "string" || value.observability !== void 0 && !isRecord(value.observability) || typeof value.workers_dev !== "boolean" || typeof value.preview_urls !== "boolean" || !Array.isArray(value.routes) || !Array.isArray(value.crons) || !Array.isArray(value.queueConsumers) || !Array.isArray(value.workflows) || value.addresses !== void 0 && readEmailAddresses(value.addresses) === void 0) return null;
 	return {
 		...value.preserve === true ? { preserve: true } : {},
@@ -1127,6 +1128,7 @@ function parseTriggerConfig(value) {
 		...value.preservePreviewUrls === true ? { preservePreviewUrls: true } : {},
 		...typeof value.settingsHash === "string" ? { settingsHash: value.settingsHash } : {},
 		...isRecord(value.observability) ? { observability: value.observability } : {},
+		...typeof value.logpush === "boolean" ? { logpush: value.logpush } : {},
 		workers_dev: value.workers_dev,
 		preview_urls: value.preview_urls,
 		routes: value.routes,
@@ -1144,6 +1146,7 @@ function triggerWranglerConfig(base, triggerConfig, manageRoutes = true) {
 	const config = {
 		...base,
 		...triggerConfig.observability === void 0 ? {} : { observability: triggerConfig.observability },
+		...triggerConfig.logpush === void 0 ? {} : { logpush: triggerConfig.logpush },
 		triggers,
 		queues,
 		workflows: [...triggerConfig.workflows],
@@ -1163,6 +1166,7 @@ function resolvePreservedTraffic(desired, previous, workerExists) {
 		...desired.preserve ? { preserve: true } : {},
 		...desired.settingsHash ? { settingsHash: desired.settingsHash } : {},
 		...desired.observability === void 0 ? {} : { observability: desired.observability },
+		...desired.logpush === void 0 ? {} : { logpush: desired.logpush },
 		workers_dev: desired.preserveWorkersDev ? previous?.workers_dev ?? desired.workers_dev : desired.workers_dev,
 		preview_urls: desired.preservePreviewUrls ? previous?.preview_urls ?? desired.preview_urls : desired.preview_urls,
 		routes: desired.preserveRoutes ? previous?.routes ?? desired.routes : desired.routes,
@@ -1507,7 +1511,9 @@ async function activateCloudflareVersionWithSecretsFile(options) {
 		if (stagingFailure) return stagingFailure;
 		stagedVersionOverride = true;
 	}
-	const probe = (url) => probeReadiness(`${url.replace(/\/$/, "")}/__void/ready`, options.workerName, readinessUsesCustomRoute ? void 0 : options.readinessHeaders, authenticatedWorkersDevSubdomain, stagedVersionOverride ? versionId : void 0, options.fetch ?? globalThis.fetch, options.sleep ?? setTimeout, options.readinessAttempts ?? 6, Number.POSITIVE_INFINITY, options.requireVersionMetadata ? versionId : void 0);
+	const trustedReadinessOrigin = normalizeReadinessAccessOrigin(options.readinessHeadersOrigin);
+	const withholdsCustomRouteHeaders = (url) => readinessUsesCustomRoute && !isTrustedReadinessOrigin(url, trustedReadinessOrigin);
+	const probe = (url) => probeReadiness(`${url.replace(/\/$/, "")}/__void/ready`, options.workerName, withholdsCustomRouteHeaders(url) ? void 0 : options.readinessHeaders, authenticatedWorkersDevSubdomain, readinessUsesCustomRoute ? trustedReadinessOrigin : void 0, stagedVersionOverride ? versionId : void 0, options.fetch ?? globalThis.fetch, options.sleep ?? setTimeout, options.readinessAttempts ?? 6, Number.POSITIVE_INFINITY, options.requireVersionMetadata ? versionId : void 0);
 	options.onProgress?.("Waiting for the Worker to become ready...");
 	let ready = await probe(readinessUrl);
 	if (ready === "access-denied" && !stagedVersionOverride && previous.versionId !== null && !options.requirePreviewForReadiness) {
@@ -1527,6 +1533,7 @@ async function activateCloudflareVersionWithSecretsFile(options) {
 		reason: ready === "access-denied" ? "readiness-access-denied" : "readiness-failed",
 		versionId,
 		previousVersionId: previous.versionId,
+		...ready === "access-denied" && withholdsCustomRouteHeaders(readinessUrl) ? customRouteReadinessOriginField(readinessUrl) : {},
 		...stagedVersionOverride ? await restorePreviousVersion(options, previous.versionId, "readiness failed", [stagedVersionPercentages(previous.versionId, versionId)]) : { rollback: "not-needed" }
 	};
 	if (!options.verifyUploader()) return {
@@ -1895,7 +1902,33 @@ async function bootstrapFirstDeployment(options, previousVersionId, atomic = fal
 	const published = readUploadResult(bootstrap);
 	const versionId = published?.versionId;
 	const desiredTriggerConfig = desiredTriggerConfigFor(parseCloudflareVersionMessage(options.message), options.configPath);
-	const reportedOrConfiguredUrl = published?.previewUrl ?? published?.workersDevUrl ?? (desiredTriggerConfig.workers_dev ? workersDevReadinessUrl(options.workerName, options.workersDevSubdomain) : customRouteReadinessUrl(desiredTriggerConfig.routes));
+	let reportedOrConfiguredUrl = published?.previewUrl ?? published?.workersDevUrl ?? (desiredTriggerConfig.workers_dev ? workersDevReadinessUrl(options.workerName, options.workersDevSubdomain) : customRouteReadinessUrl(desiredTriggerConfig.routes));
+	if (versionId && !reportedOrConfiguredUrl && desiredTriggerConfig.workers_dev && !desiredTriggerConfig.preserve && !desiredTriggerConfig.preserveWorkersDev && !options.preserveTriggers && options.resolveWorkersDevSubdomain) {
+		if (!options.verifyUploader()) return {
+			ok: false,
+			reason: "uploader-changed",
+			versionId,
+			previousVersionId,
+			rollback: "unsafe"
+		};
+		let lookup;
+		try {
+			lookup = await options.resolveWorkersDevSubdomain();
+		} catch {
+			lookup = {
+				ok: false,
+				reason: "unavailable"
+			};
+		}
+		if (!lookup.ok && lookup.reason === "uploader-changed") return {
+			ok: false,
+			reason: "uploader-changed",
+			versionId,
+			previousVersionId,
+			rollback: "unsafe"
+		};
+		reportedOrConfiguredUrl = lookup.ok ? workersDevReadinessUrl(options.workerName, lookup.subdomain) : void 0;
+	}
 	if (!versionId || !reportedOrConfiguredUrl) return {
 		ok: false,
 		reason: atomic ? "atomic-output-invalid" : "bootstrap-output-invalid",
@@ -2000,14 +2033,18 @@ async function bootstrapFirstDeployment(options, previousVersionId, atomic = fal
 	const usesCustomDomain = !desiredTriggerConfig.workers_dev && desiredTriggerConfig.routes.some((route) => isRecord(route) && route.custom_domain === true);
 	const customDomainBootstrap = !atomic && usesCustomDomain;
 	const readinessTimeoutMs = customDomainBootstrap ? 3e5 : 6e4;
+	const previewSubdomain = extractWorkersDevSubdomain(previewUrl);
+	const trustedReadinessOrigin = previewSubdomain ? void 0 : normalizeReadinessAccessOrigin(options.readinessHeadersOrigin);
+	const withholdsCustomRouteHeaders = !previewSubdomain && !isTrustedReadinessOrigin(previewUrl, trustedReadinessOrigin);
 	options.onProgress?.("Waiting for the Worker to become ready...");
-	const ready = await probeReadiness(`${previewUrl.replace(/\/$/, "")}/__void/ready`, options.workerName, extractWorkersDevSubdomain(previewUrl) ? options.readinessHeaders : void 0, extractWorkersDevSubdomain(previewUrl), void 0, options.fetch ?? globalThis.fetch, options.sleep ?? setTimeout, options.readinessAttempts ?? (customDomainBootstrap ? 150 : 30), readinessTimeoutMs, options.requireVersionMetadata ? versionId : void 0);
+	const ready = await probeReadiness(`${previewUrl.replace(/\/$/, "")}/__void/ready`, options.workerName, withholdsCustomRouteHeaders ? void 0 : options.readinessHeaders, previewSubdomain, trustedReadinessOrigin, void 0, options.fetch ?? globalThis.fetch, options.sleep ?? setTimeout, options.readinessAttempts ?? (customDomainBootstrap ? 150 : 30), readinessTimeoutMs, options.requireVersionMetadata ? versionId : void 0);
 	if (ready !== "ready") return {
 		ok: false,
 		reason: ready === "access-denied" ? atomic ? "atomic-readiness-access-denied" : "bootstrap-readiness-access-denied" : atomic ? "atomic-readiness-failed" : "bootstrap-readiness-failed",
 		versionId,
 		previousVersionId,
 		rollback: "unavailable",
+		...ready === "access-denied" && withholdsCustomRouteHeaders ? customRouteReadinessOriginField(previewUrl) : {},
 		...ready === "failed" && usesCustomDomain ? { diagnostic: "The Custom Domain may still be propagating DNS or its TLS certificate. Check the configured domain in Cloudflare, then retry `void deploy --platform cloudflare` once its /__void/ready endpoint is reachable." } : {}
 	};
 	if (!options.verifyUploader()) return {
@@ -2183,8 +2220,8 @@ async function verifyReadinessStagingOwner(options, previousVersionId, versionId
 	};
 	return null;
 }
-async function probeReadiness(url, workerName, readinessHeaders, authenticatedWorkersDevSubdomain, versionOverride, fetcher, sleep, attempts, timeoutMs = Number.POSITIVE_INFINITY, expectedVersionId) {
-	const headers = guardedReadinessHeaders(url, workerName, readinessHeaders, authenticatedWorkersDevSubdomain);
+async function probeReadiness(url, workerName, readinessHeaders, authenticatedWorkersDevSubdomain, trustedReadinessOrigin, versionOverride, fetcher, sleep, attempts, timeoutMs = Number.POSITIVE_INFINITY, expectedVersionId) {
+	const headers = guardedReadinessHeaders(url, workerName, readinessHeaders, authenticatedWorkersDevSubdomain, trustedReadinessOrigin);
 	if (headers === null) return "failed";
 	const deadline = Date.now() + timeoutMs;
 	for (let attempt = 0; attempt < Math.max(1, attempts); attempt++) {
@@ -2215,9 +2252,13 @@ async function probeReadiness(url, workerName, readinessHeaders, authenticatedWo
 	}
 	return "failed";
 }
-/** Never forward Access headers to a hostname that cannot be this Worker. */
-function guardedReadinessHeaders(url, workerName, headers, authenticatedWorkersDevSubdomain) {
+/**
+* Never forward Access headers to a hostname that cannot be this Worker, unless the operator
+* named that exact origin.
+*/
+function guardedReadinessHeaders(url, workerName, headers, authenticatedWorkersDevSubdomain, trustedReadinessOrigin) {
 	if (!headers || Object.keys(headers).length === 0) return {};
+	if (isTrustedReadinessOrigin(url, trustedReadinessOrigin)) return headers;
 	try {
 		const parsed = new URL(url);
 		const firstLabel = parsed.hostname.toLowerCase().split(".")[0] ?? "";
@@ -2229,6 +2270,36 @@ function guardedReadinessHeaders(url, workerName, headers, authenticatedWorkersD
 		return null;
 	}
 }
+/**
+* Normalize an operator-selected readiness origin. Returns `undefined` unless the value is one
+* exact `https:` origin without a wildcard, credentials, a path, a query, or a fragment. A probe
+* URL never has a wildcard host, so a wildcard value could never match.
+*/
+function normalizeReadinessAccessOrigin(value) {
+	if (!value) return;
+	try {
+		const url = new URL(value);
+		return url.protocol === "https:" && !url.hostname.includes("*") && !url.username && !url.password && url.pathname === "/" && !url.search && !url.hash ? url.origin : void 0;
+	} catch {
+		return;
+	}
+}
+function isTrustedReadinessOrigin(url, trustedOrigin) {
+	if (trustedOrigin === void 0) return false;
+	try {
+		const parsed = new URL(url);
+		return parsed.protocol === "https:" && !parsed.username && !parsed.password && parsed.origin === trustedOrigin;
+	} catch {
+		return false;
+	}
+}
+function customRouteReadinessOriginField(url) {
+	try {
+		return { customRouteReadinessOrigin: new URL(url).origin };
+	} catch {
+		return {};
+	}
+}
 async function isCloudflareAccessDenial(response) {
 	if (response.status >= 300 && response.status < 400 && response.headers.get("location")?.includes("/cdn-cgi/access/")) return true;
 	if (response.status !== 403) return false;
@@ -2332,8 +2403,7 @@ function workersDevSubdomainResult(url) {
 	const workersDevSubdomain = extractWorkersDevSubdomain(url);
 	return workersDevSubdomain ? { workersDevSubdomain } : {};
 }
-//#endregion
-//#region src/metadata.ts
+// src/metadata.ts
 /**
 * Share one authenticated transport for the activator's read-only metadata calls.
 * Writes and unsupported commands use the pinned cf command adapter. Responses
@@ -2423,5 +2493,4 @@ function createCloudflareMetadataRunner(options) {
 		return fallback(operation, runOptions);
 	};
 }
-//#endregion
-export { CloudflareWorkerInspectionError, VOID_SECRET_DRAFT_SOURCE, activateCloudflareVersion, assertCloudflareBindingsPreserved, assertCloudflareDurableObjectLifecycleSupported, assertExistingCloudflareConfig, cloudflareCommandDiagnostic, createCloudflareMetadataRunner, deployCloudflareVersionTraffic, deployCloudflareVersionTriggers, encodeCloudflareVersionMessage, executeCloudflareDeploy, extractWorkersDevSubdomain, normalizeWorkersDevSubdomain, parseCloudflareVersionMessage, parseRootWranglerConfig, readBindingFieldPresence, readCloudflareTriggerConfig, readCloudflareVersionMigrationTag, readCloudflareWorkerMigrationTag, readConfigEntryString, readExistingCloudflareWorker, readStoredResourceName, readWranglerTopLevelString, renderCloudflareStaticEntry, resolveD1MigrateTarget, stabilizeCloudflareVersionTriggers, stageCloudflareStaticAssets, writeCloudflareFrameworkDeployConfig, writeCloudflareStaticDeployConfig };
+export { CloudflareWorkerInspectionError, VOID_SECRET_DRAFT_SOURCE, activateCloudflareVersion, assertCloudflareBindingsPreserved, assertCloudflareDurableObjectLifecycleSupported, assertExistingCloudflareConfig, cloudflareCommandDiagnostic, createCloudflareMetadataRunner, deployCloudflareVersionTraffic, deployCloudflareVersionTriggers, encodeCloudflareVersionMessage, executeCloudflareDeploy, extractWorkersDevSubdomain, normalizeReadinessAccessOrigin, normalizeWorkersDevSubdomain, parseCloudflareVersionMessage, parseRootWranglerConfig, readBindingFieldPresence, readCloudflareTriggerConfig, readCloudflareVersionMigrationTag, readCloudflareWorkerMigrationTag, readConfigEntryString, readExistingCloudflareWorker, readStoredResourceName, readWranglerTopLevelString, renderCloudflareStaticEntry, resolveD1MigrateTarget, stabilizeCloudflareVersionTriggers, stageCloudflareStaticAssets, writeCloudflareFrameworkDeployConfig, writeCloudflareStaticDeployConfig };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@void/deploy-cloudflare",
-  "version": "1.3.0",
+  "version": "1.5.0",
   "description": "Cloudflare deployment primitives for Void runtimes and deployment adapters.",
   "homepage": "https://void.cloud",
   "bugs": {
@@ -26,15 +26,15 @@
     "access": "public"
   },
   "dependencies": {
-    "@void/deploy-core": "1.3.0",
+    "@void/deploy-core": "1.5.0",
     "jsonc-parser": "^3.3.1"
   },
   "devDependencies": {
-    "@cloudflare/workers-types": "^5.20261019.1",
-    "@types/node": "^26.6.5",
+    "@cloudflare/workers-types": "^5.20261102.1",
+    "@types/node": "^26.6.6",
     "pathslash": "^0.1.0",
     "typescript": "7.0.2",
-    "vite-plus": "1.3.0"
+    "vite-plus": "1.4.0"
   },
   "scripts": {
     "build": "vp pack",