devflare 1.0.0-next.2 → 1.0.0-next.21

package/dist/deploy-xyfbhj3v.js

@@ -0,0 +1,1038 @@
+import {
+  applyDeploymentStrategy,
+  compareManifests,
+  createBuildManifest,
+  describeDeploymentStrategy,
+  formatDriftWarning,
+  prepareBuildArtifacts,
+  readBuildManifest
+} from "./index-txndxr4w.js";
+import"./index-aabgympv.js";
+import {
+  preparePreviewScopedResourcesForDeploy
+} from "./index-905svbb6.js";
+import {
+  asOptionalString
+} from "./index-1546yrn0.js";
+import {
+  formatWorkersDevUrl,
+  reconcilePreviewRegistry
+} from "./index-8evn52g1.js";
+import {
+  getDependencies
+} from "./index-z9gy8w6b.js";
+import"./index-khbmdrn2.js";
+import"./index-gn5wy09x.js";
+import {
+  getPackageVersion
+} from "./index-6h8xbs75.js";
+import {
+  createCliTheme,
+  dim,
+  green,
+  logLine,
+  yellow,
+  yellowBold
+} from "./index-stgn34cr.js";
+import"./index-3t6rypgc.js";
+import {
+  resolvePackageSpecifier
+} from "./index-t4fhcx1n.js";
+import"./index-yt0n4p46.js";
+import"./index-1p814k7s.js";
+import"./index-rbht7m9r.js";
+import"./index-vhqww6tt.js";
+import {
+  ServiceBindingValidationError,
+  compileBuildConfig,
+  compileConfig,
+  readWranglerConfig,
+  stringifyConfig,
+  validateServiceBindings,
+  writeWranglerConfig
+} from "./index-48rxsj95.js";
+import {
+  loadConfig,
+  prepareConfigResourcesForDeploy,
+  resolveConfigForEnvironment
+} from "./index-bc5pvbbd.js";
+import {
+  getEffectiveAccountId,
+  getPrimaryAccount,
+  getWorkerVersionDetail,
+  getWorkersSubdomain,
+  listWorkerDeployments,
+  listWorkerVersions,
+  listWorkers
+} from "./index-gba371j7.js";
+import"./index-abrqnq3e.js";
+import {
+  resolvePreviewIdentifier
+} from "./index-p296ban8.js";
+import"./index-ykfgpsmm.js";
+import {
+  __require
+} from "./index-37x76zdn.js";
+
+// src/cli/commands/deploy.ts
+import { mkdir, open, readFile, rm, writeFile } from "node:fs/promises";
+import { basename, dirname, isAbsolute, join, resolve } from "pathe";
+
+// src/cli/preview.ts
+function matchNamedValue(output, patterns) {
+  for (const pattern of patterns) {
+    const match = output.match(pattern);
+    if (match?.[1]) {
+      return match[1];
+    }
+  }
+  return;
+}
+function appendUniqueUrls(target, value) {
+  if (typeof value === "string") {
+    if (value.startsWith("http://") || value.startsWith("https://")) {
+      target.push(value);
+    }
+    return;
+  }
+  if (!Array.isArray(value)) {
+    return;
+  }
+  for (const item of value) {
+    appendUniqueUrls(target, item);
+  }
+}
+function parseWranglerStructuredOutput(output) {
+  const records = output.replace(/\r/g, "").split(`
+`).map((line) => line.trim()).filter(Boolean).map((line) => {
+    try {
+      return JSON.parse(line);
+    } catch {
+      return null;
+    }
+  }).filter((record) => record !== null);
+  const urls = [];
+  let versionId;
+  let previewUrl;
+  for (const record of records) {
+    if (!versionId && typeof record.version_id === "string" && record.version_id.trim()) {
+      versionId = record.version_id.trim();
+    }
+    appendUniqueUrls(urls, record.targets);
+    appendUniqueUrls(urls, record.preview_urls);
+    appendUniqueUrls(urls, record.urls);
+    appendUniqueUrls(urls, record.url);
+    if (!previewUrl && typeof record.preview_url === "string" && record.preview_url.trim()) {
+      previewUrl = record.preview_url.trim();
+    }
+  }
+  const uniqueUrls = [...new Set(urls)];
+  if (!previewUrl) {
+    previewUrl = uniqueUrls.find((url) => url.includes("workers.dev"));
+  }
+  return {
+    versionId,
+    previewUrl,
+    urls: uniqueUrls
+  };
+}
+function mergeParsedWranglerDeployOutputs(...outputs) {
+  const urls = [...new Set(outputs.flatMap((output) => output.urls))];
+  return {
+    versionId: outputs.map((output) => output.versionId).find((value) => Boolean(value)),
+    previewUrl: outputs.map((output) => output.previewUrl).find((value) => Boolean(value)) ?? urls.find((url) => url.includes("workers.dev")),
+    urls
+  };
+}
+function parseWranglerDeployOutput(output) {
+  const normalizedOutput = output.replace(/\r/g, "");
+  const urls = [...new Set(normalizedOutput.match(/https?:\/\/[^\s'"`]+/g) ?? [])];
+  const previewUrl = matchNamedValue(normalizedOutput, [
+    /Preview URL:\s*(https?:\/\/\S+)/i,
+    /Version Preview URL:\s*(https?:\/\/\S+)/i
+  ]) ?? urls.find((url) => url.includes("workers.dev"));
+  const versionId = matchNamedValue(normalizedOutput, [
+    /Worker Version ID:\s*([A-Za-z0-9_-]+)/i,
+    /Version ID:\s*([A-Za-z0-9_-]+)/i,
+    /version(?:_id| id)?\s*[:=]\s*([A-Za-z0-9_-]+)/i,
+    /"id"\s*:\s*"([A-Za-z0-9_-]+)"/i
+  ]);
+  return {
+    versionId,
+    previewUrl,
+    urls
+  };
+}
+
+// src/cli/deploy-target.ts
+function resolveDeployTarget(parsed, options = {}) {
+  const wantsProduction = parsed.options.prod === true || parsed.options.production === true;
+  const previewOption = parsed.options.preview;
+  const previewScopeRaw = asOptionalString(previewOption);
+  const wantsPreview = previewOption === true || Boolean(previewScopeRaw);
+  if (!wantsProduction && !wantsPreview) {
+    if (options.requireExplicitTarget === true) {
+      throw new Error("Deploy needs an explicit target. Use --prod / --production for live traffic, or --preview <name> (or bare --preview) for preview deploys.");
+    }
+    return {
+      mode: "implicit",
+      envOverrides: {}
+    };
+  }
+  if (wantsProduction && wantsPreview) {
+    throw new Error("Choose either --prod / --production or --preview <name>, not both.");
+  }
+  const explicitEnvironment = asOptionalString(parsed.options.env);
+  if (wantsProduction) {
+    if (explicitEnvironment && explicitEnvironment !== "production") {
+      throw new Error("Production deploys always target the production environment. Remove --env or use --env production.");
+    }
+    if (parsed.options["branch-name"] !== undefined) {
+      throw new Error("Production deploys do not accept --branch-name.");
+    }
+    return {
+      mode: "production",
+      environment: "production",
+      targetFlag: parsed.options.production === true ? "--production" : "--prod",
+      envOverrides: {
+        DEVFLARE_PREVIEW_BRANCH: undefined,
+        DEVFLARE_PREVIEW_IDENTIFIER: undefined,
+        DEVFLARE_PREVIEW_PR: undefined
+      }
+    };
+  }
+  if (explicitEnvironment && explicitEnvironment !== "preview") {
+    throw new Error("Preview deploys always target the preview environment. Remove --env or use --env preview.");
+  }
+  if (previewScopeRaw) {
+    const branchName = asOptionalString(parsed.options["branch-name"]);
+    if (branchName && branchName !== previewScopeRaw) {
+      throw new Error("Named preview deploys use the --preview value as the preview scope. Omit --branch-name or pass the same value to both flags.");
+    }
+    const previewScope = resolvePreviewIdentifier({
+      identifier: previewScopeRaw
+    }).identifier ?? "preview";
+    return {
+      mode: "preview-scope",
+      environment: "preview",
+      targetFlag: "--preview",
+      previewScope,
+      previewScopeRaw,
+      envOverrides: {
+        DEVFLARE_PREVIEW_BRANCH: previewScopeRaw,
+        DEVFLARE_PREVIEW_IDENTIFIER: previewScope,
+        DEVFLARE_PREVIEW_PR: undefined
+      }
+    };
+  }
+  return {
+    mode: "preview-upload",
+    environment: "preview",
+    targetFlag: "--preview",
+    envOverrides: {
+      DEVFLARE_PREVIEW_BRANCH: undefined,
+      DEVFLARE_PREVIEW_IDENTIFIER: undefined,
+      DEVFLARE_PREVIEW_PR: undefined
+    }
+  };
+}
+function applyResolvedDeployTarget(parsed, target) {
+  if (!target.environment) {
+    return parsed;
+  }
+  return {
+    ...parsed,
+    options: {
+      ...parsed.options,
+      env: target.environment
+    }
+  };
+}
+async function withTemporaryEnvironment(overrides, operation) {
+  const previousValues = new Map;
+  for (const [key, value] of Object.entries(overrides)) {
+    previousValues.set(key, process.env[key]);
+    if (typeof value === "string") {
+      process.env[key] = value;
+      continue;
+    }
+    delete process.env[key];
+  }
+  try {
+    return await operation();
+  } finally {
+    for (const [key, value] of previousValues) {
+      if (typeof value === "string") {
+        process.env[key] = value;
+        continue;
+      }
+      delete process.env[key];
+    }
+  }
+}
+
+// src/cli/commands/deploy.ts
+function summarizeDeployResourceNames(resources) {
+  const segments = [
+    resources.kv.length > 0 ? `KV ${resources.kv.length}` : null,
+    resources.d1.length > 0 ? `D1 ${resources.d1.length}` : null,
+    resources.r2.length > 0 ? `R2 ${resources.r2.length}` : null,
+    resources.queues.length > 0 ? `Queues ${resources.queues.length}` : null,
+    resources.vectorize.length > 0 ? `Vectorize ${resources.vectorize.length}` : null,
+    resources.hyperdrive.length > 0 ? `Hyperdrive ${resources.hyperdrive.length}` : null
+  ].filter((segment) => segment !== null);
+  return segments.length > 0 ? segments.join(" · ") : null;
+}
+async function readDeployRedirectPath(filePath) {
+  const fs = await import("node:fs/promises");
+  try {
+    const rawConfig = await fs.readFile(filePath, "utf-8");
+    const parsed = JSON.parse(rawConfig);
+    if (typeof parsed.configPath !== "string" || parsed.configPath.length === 0) {
+      return null;
+    }
+    return resolve(dirname(filePath), parsed.configPath);
+  } catch {
+    return null;
+  }
+}
+async function resolveBuildArtifactConfigPath(buildPath, cwd) {
+  const fs = await import("node:fs/promises");
+  const absoluteBuildPath = isAbsolute(buildPath) ? buildPath : resolve(cwd, buildPath);
+  let stat;
+  try {
+    stat = await fs.stat(absoluteBuildPath);
+  } catch {
+    throw new Error(`Could not find build artifact path: ${absoluteBuildPath}`);
+  }
+  if (stat.isFile()) {
+    if (basename(absoluteBuildPath) === "config.json") {
+      const redirectedConfigPath = await readDeployRedirectPath(absoluteBuildPath);
+      if (!redirectedConfigPath) {
+        throw new Error(`Build redirect ${absoluteBuildPath} did not contain a valid configPath.`);
+      }
+      return redirectedConfigPath;
+    }
+    return absoluteBuildPath;
+  }
+  const candidates = [
+    resolve(absoluteBuildPath, "wrangler.jsonc"),
+    resolve(absoluteBuildPath, ".wrangler", "deploy", "config.json"),
+    resolve(absoluteBuildPath, "config.json"),
+    resolve(absoluteBuildPath, ".devflare", "build", "wrangler.jsonc")
+  ];
+  for (const candidatePath of candidates) {
+    try {
+      const candidateStat = await fs.stat(candidatePath);
+      if (!candidateStat.isFile()) {
+        continue;
+      }
+      if (basename(candidatePath) === "config.json") {
+        const redirectedConfigPath = await readDeployRedirectPath(candidatePath);
+        if (redirectedConfigPath) {
+          return redirectedConfigPath;
+        }
+        continue;
+      }
+      return candidatePath;
+    } catch {}
+  }
+  throw new Error(`Could not resolve a Wrangler build config from ${absoluteBuildPath}. Pass a .devflare/build directory, a generated wrangler.jsonc, or a .wrangler/deploy/config.json redirect.`);
+}
+function withBuildArtifactPaths(compiledConfig, buildConfig) {
+  return {
+    ...compiledConfig,
+    ...buildConfig.main ? { main: buildConfig.main } : {},
+    ...buildConfig.assets ? { assets: buildConfig.assets } : {}
+  };
+}
+async function prepareDeployConfig(options) {
+  const rawConfig = await loadConfig({
+    cwd: options.cwd,
+    configFile: options.configPath
+  });
+  const manifestDir = dirname(options.buildConfigPath);
+  const manifest = await readBuildManifest(manifestDir);
+  if (manifest) {
+    const currentManifest = createBuildManifest(rawConfig, {
+      devflareVersion: await getPackageVersion(),
+      intendedTarget: {
+        environment: options.environment,
+        preview: options.preview,
+        branchName: options.branchName
+      }
+    });
+    const drift = compareManifests(manifest, currentManifest);
+    const warning = formatDriftWarning(drift);
+    if (warning && options.logger) {
+      if (options.force) {
+        logLine(options.logger, warning);
+        logLine(options.logger, "Continuing because --force was passed.");
+      } else {
+        logLine(options.logger, warning);
+      }
+    }
+  }
+  const previewScopedResources = options.environment === "preview" ? await preparePreviewScopedResourcesForDeploy(rawConfig, {
+    environment: options.environment
+  }) : null;
+  const deployResources = await prepareConfigResourcesForDeploy(previewScopedResources?.config ?? rawConfig, {
+    environment: options.environment,
+    accountId: previewScopedResources?.accountId,
+    cloudflare: previewScopedResources?.resourceResolutionCloudflare
+  });
+  const deploymentStrategy = applyDeploymentStrategy(deployResources.config, {
+    environment: options.environment,
+    preview: options.preview,
+    branchName: options.branchName,
+    previewBranch: process.env.DEVFLARE_PREVIEW_BRANCH
+  });
+  const validationAccountId = previewScopedResources?.accountId ?? deploymentStrategy.config.accountId ?? process.env.CLOUDFLARE_ACCOUNT_ID;
+  if (validationAccountId) {
+    try {
+      await validateServiceBindings(deploymentStrategy.config, validationAccountId, {
+        listWorkers: (accountId) => listWorkers(accountId),
+        selfWorkerName: deploymentStrategy.config.name
+      });
+    } catch (error) {
+      if (error instanceof ServiceBindingValidationError) {
+        throw error;
+      }
+    }
+  }
+  const buildWranglerConfig = await readWranglerConfig(options.buildConfigPath);
+  const wranglerConfig = withBuildArtifactPaths(compileConfig(deploymentStrategy.config), buildWranglerConfig);
+  const buildDir = dirname(options.buildConfigPath);
+  const deployArtefactDir = resolve(buildDir, "..", "deploy");
+  await mkdir(deployArtefactDir, { recursive: true });
+  const deployArtefactPath = resolve(deployArtefactDir, "wrangler.jsonc");
+  const lockPath = resolve(deployArtefactDir, ".lock");
+  const lockHandle = await acquireDeployArtefactLock(lockPath);
+  try {
+    await writeWranglerConfig(deployArtefactDir, wranglerConfig, "wrangler.jsonc");
+  } finally {
+    await releaseDeployArtefactLock(lockHandle, lockPath);
+  }
+  return {
+    config: deploymentStrategy.config,
+    deployConfigPath: deployArtefactPath,
+    previewScopedResources,
+    deployResources,
+    wranglerConfig
+  };
+}
+async function acquireDeployArtefactLock(lockPath, options = {}) {
+  const maxWaitMs = options.maxWaitMs ?? 30000;
+  const staleAfterMs = options.staleAfterMs ?? 60000;
+  const pollMs = 100;
+  const start = Date.now();
+  while (true) {
+    try {
+      const handle = await open(lockPath, "wx");
+      await handle.writeFile(`${process.pid}
+${Date.now()}`);
+      return handle;
+    } catch (err) {
+      if (err.code !== "EEXIST")
+        throw err;
+      try {
+        const existing = await readFile(lockPath, "utf-8");
+        const ts = Number.parseInt(existing.split(`
+`)[1] ?? "0", 10);
+        if (Number.isFinite(ts) && Date.now() - ts > staleAfterMs) {
+          await rm(lockPath, { force: true });
+          continue;
+        }
+      } catch {
+        continue;
+      }
+      if (Date.now() - start > maxWaitMs) {
+        throw new Error(`Timed out waiting for deploy artefact lock at ${lockPath}. Another \`devflare deploy\` may be running against the same artefact directory.`);
+      }
+      await new Promise((r) => setTimeout(r, pollMs));
+    }
+  }
+}
+async function releaseDeployArtefactLock(handle, lockPath) {
+  try {
+    await handle.close();
+  } catch {}
+  await rm(lockPath, { force: true });
+}
+async function resolveLocalWranglerExecutable(cwd, fs) {
+  const wranglerExecutablePath = resolvePackageSpecifier("wrangler/bin/wrangler.js", cwd);
+  try {
+    await fs.access(wranglerExecutablePath);
+    return wranglerExecutablePath;
+  } catch {
+    return null;
+  }
+}
+function inferRecordSource() {
+  return process.env.GITHUB_ACTIONS === "true" ? "github-action" : "cli";
+}
+function shouldVerifyDeployControlPlane() {
+  const configured = process.env.DEVFLARE_VERIFY_DEPLOYMENT?.trim().toLowerCase();
+  if (!configured) {
+    return false;
+  }
+  return !["0", "false", "no", "off"].includes(configured);
+}
+function shouldRequireFreshProductionDeployment() {
+  const configured = process.env.DEVFLARE_REQUIRE_FRESH_PRODUCTION_DEPLOYMENT?.trim().toLowerCase();
+  if (!configured) {
+    return false;
+  }
+  return !["0", "false", "no", "off"].includes(configured);
+}
+async function writeDeployResultMetadata(metadata) {
+  const metadataPath = process.env.DEVFLARE_DEPLOY_METADATA_PATH?.trim();
+  if (!metadataPath) {
+    return;
+  }
+  await mkdir(dirname(metadataPath), { recursive: true });
+  await writeFile(metadataPath, JSON.stringify(metadata, null, "\t"), "utf8");
+}
+function getDeployVerificationSettings() {
+  const attempts = Number.parseInt(process.env.DEVFLARE_VERIFY_DEPLOYMENT_ATTEMPTS ?? "", 10);
+  const delayMs = Number.parseInt(process.env.DEVFLARE_VERIFY_DEPLOYMENT_DELAY_MS ?? "", 10);
+  return {
+    attempts: Number.isFinite(attempts) && attempts > 0 ? attempts : 5,
+    delayMs: Number.isFinite(delayMs) && delayMs >= 0 ? delayMs : 1500
+  };
+}
+var DEPLOYMENT_LOOKBACK_TOLERANCE_MS = 120000;
+function normalizeCloudflareAccountId(value) {
+  const trimmed = value?.trim();
+  if (!trimmed) {
+    return;
+  }
+  return /^[a-f0-9]{32}$/i.test(trimmed) ? trimmed : undefined;
+}
+async function waitForDeployVerification(delayMs) {
+  if (delayMs <= 0) {
+    return;
+  }
+  await new Promise((resolve2) => setTimeout(resolve2, delayMs));
+}
+async function retryDeployVerification(description, operation) {
+  const { attempts, delayMs } = getDeployVerificationSettings();
+  let lastError;
+  for (let attempt = 1;attempt <= attempts; attempt++) {
+    try {
+      return await operation();
+    } catch (error) {
+      lastError = error;
+      if (attempt < attempts) {
+        await waitForDeployVerification(delayMs);
+      }
+    }
+  }
+  const message = lastError instanceof Error ? lastError.message : String(lastError);
+  throw new Error(`Cloudflare could not verify ${description} after ${attempts} attempt${attempts === 1 ? "" : "s"}: ${message}`);
+}
+async function resolveDeployAccountId(preferredAccountId) {
+  if (preferredAccountId !== undefined) {
+    return normalizeCloudflareAccountId(preferredAccountId);
+  }
+  const apiToken = process.env.CLOUDFLARE_API_TOKEN?.trim();
+  const apiKey = process.env.CLOUDFLARE_API_KEY?.trim();
+  const apiEmail = process.env.CLOUDFLARE_EMAIL?.trim();
+  if (!apiToken && !(apiKey && apiEmail)) {
+    return;
+  }
+  try {
+    const primaryAccount = await getPrimaryAccount();
+    if (!primaryAccount) {
+      return;
+    }
+    const effective = await getEffectiveAccountId(primaryAccount.id);
+    return normalizeCloudflareAccountId(effective.accountId);
+  } catch {
+    return;
+  }
+}
+function selectDeploymentVersionId(deployment) {
+  return deployment.versions.find((version) => version.percentage === 100)?.versionId ?? deployment.versions[0]?.versionId;
+}
+function getWorkerVersionTimestamp(version) {
+  return version.metadata.modifiedOn ?? version.metadata.createdOn;
+}
+async function resolveVersionIdFromLatestDeployment(options) {
+  return retryDeployVerification(options.verificationDescription, async () => {
+    const deployments = await listWorkerDeployments(options.accountId, options.workerName);
+    const latestDeployment = [...deployments].sort((a, b) => b.createdOn.getTime() - a.createdOn.getTime())[0];
+    if (!latestDeployment) {
+      throw new Error(`No deployments were found for Worker "${options.workerName}".`);
+    }
+    if (options.deployedAfter && latestDeployment.createdOn.getTime() < options.deployedAfter.getTime() - DEPLOYMENT_LOOKBACK_TOLERANCE_MS) {
+      throw new Error(`${options.deploymentLabel} ${latestDeployment.id} was created before this deploy started.`);
+    }
+    const versionId = selectDeploymentVersionId(latestDeployment);
+    if (!versionId) {
+      throw new Error(`${options.deploymentLabel} ${latestDeployment.id} does not reference any version ids.`);
+    }
+    return {
+      deploymentId: latestDeployment.id,
+      versionId
+    };
+  });
+}
+async function resolveVersionIdFromLatestWorkerVersion(options) {
+  return retryDeployVerification(`the latest ${options.preview ? "preview " : ""}version for Worker "${options.workerName}"`, async () => {
+    const versions = await listWorkerVersions(options.accountId, options.workerName);
+    const latestVersion = [...versions].filter((version) => version.id).filter((version) => version.metadata.hasPreview === options.preview).sort((a, b) => {
+      const left = getWorkerVersionTimestamp(a)?.getTime() ?? 0;
+      const right = getWorkerVersionTimestamp(b)?.getTime() ?? 0;
+      return right - left;
+    })[0];
+    if (!latestVersion) {
+      throw new Error(`No ${options.preview ? "preview " : ""}versions were found for Worker "${options.workerName}".`);
+    }
+    const latestVersionTimestamp = getWorkerVersionTimestamp(latestVersion);
+    if (!latestVersionTimestamp) {
+      throw new Error(`Latest version ${latestVersion.id} did not include a creation timestamp.`);
+    }
+    if (latestVersionTimestamp.getTime() < options.deployedAfter.getTime() - DEPLOYMENT_LOOKBACK_TOLERANCE_MS) {
+      throw new Error(`Latest version ${latestVersion.id} was created before this deploy started.`);
+    }
+    return latestVersion.id;
+  });
+}
+async function resolveVersionIdFromLatestProductionDeployment(options) {
+  return resolveVersionIdFromLatestDeployment({
+    accountId: options.accountId,
+    workerName: options.workerName,
+    verificationDescription: `the latest deployment for Worker "${options.workerName}"`,
+    deploymentLabel: "Latest deployment",
+    deployedAfter: options.deployedAfter
+  });
+}
+async function resolveVersionIdFromCurrentProductionDeployment(options) {
+  return resolveVersionIdFromLatestDeployment({
+    accountId: options.accountId,
+    workerName: options.workerName,
+    verificationDescription: `the current active deployment for Worker "${options.workerName}"`,
+    deploymentLabel: "Current deployment"
+  });
+}
+async function verifyDeployControlPlane(options) {
+  logLine(options.logger, dim("Verifying Cloudflare control-plane state…", options.theme));
+  await retryDeployVerification(`Worker version ${options.versionId}`, async () => {
+    const version = await getWorkerVersionDetail(options.accountId, options.workerName, options.versionId);
+    if (!version.id) {
+      throw new Error(`Cloudflare returned an empty version record for ${options.versionId}.`);
+    }
+    return version;
+  });
+  if (options.preview) {
+    options.logger.success(`Verified preview upload in Cloudflare control plane for version ${options.versionId}`);
+    return;
+  }
+  const deployment = await retryDeployVerification(`a deployment that references version ${options.versionId}`, async () => {
+    const deployments = await listWorkerDeployments(options.accountId, options.workerName);
+    const match = deployments.find((item) => item.versions.some((version) => version.versionId === options.versionId));
+    if (!match) {
+      throw new Error(`No deployment for Worker "${options.workerName}" references version ${options.versionId} yet.`);
+    }
+    return match;
+  });
+  options.logger.success(`Verified Cloudflare deployment ${deployment.id} for version ${options.versionId}`);
+}
+async function runDeployCommand(parsed, logger, options) {
+  let deployTarget = {
+    mode: "implicit",
+    envOverrides: {}
+  };
+  let resolvedParsed = parsed;
+  const cwd = options.cwd || process.cwd();
+  let configPath;
+  let environment;
+  let dryRun = false;
+  let preview = false;
+  let branchName;
+  let deployMessage;
+  let deployTag;
+  let previewScopeName;
+  let requireFreshProductionDeployment = false;
+  let resolvedPreviewScopeName = process.env.DEVFLARE_PREVIEW_BRANCH?.trim() || undefined;
+  const theme = createCliTheme(parsed.options);
+  logLine(logger);
+  logLine(logger, `${yellowBold("deploy", theme)} ${dim("Shipping to Cloudflare", theme)}`);
+  try {
+    deployTarget = resolveDeployTarget(parsed, {
+      requireExplicitTarget: options.requireExplicitDeployTarget === true
+    });
+    resolvedParsed = applyResolvedDeployTarget(parsed, deployTarget);
+    configPath = resolvedParsed.options.config;
+    environment = resolvedParsed.options.env;
+    dryRun = resolvedParsed.options["dry-run"] === true;
+    preview = deployTarget.mode === "preview-upload";
+    branchName = resolvedParsed.options["branch-name"];
+    deployMessage = resolvedParsed.options.message;
+    deployTag = resolvedParsed.options.tag;
+    previewScopeName = branchName?.trim() || deployTarget.previewScopeRaw || undefined;
+    resolvedPreviewScopeName = previewScopeName || process.env.DEVFLARE_PREVIEW_BRANCH?.trim() || undefined;
+    requireFreshProductionDeployment = !preview && shouldRequireFreshProductionDeployment();
+    return await withTemporaryEnvironment(deployTarget.envOverrides, async () => {
+      resolvedPreviewScopeName = previewScopeName || process.env.DEVFLARE_PREVIEW_BRANCH?.trim() || undefined;
+      if (dryRun) {
+        const config = await loadConfig({ cwd, configFile: configPath });
+        const deploymentStrategy = applyDeploymentStrategy(resolveConfigForEnvironment(config, environment), {
+          environment,
+          preview,
+          branchName,
+          previewBranch: process.env.DEVFLARE_PREVIEW_BRANCH
+        });
+        const wranglerConfig = compileBuildConfig(deploymentStrategy.config);
+        logLine(logger, `${yellow("dry run", theme)} ${dim("Skipping actual deployment", theme)}`);
+        const deploymentStrategyMessage = describeDeploymentStrategy(deploymentStrategy);
+        if (deploymentStrategyMessage) {
+          logLine(logger, dim(deploymentStrategyMessage, theme));
+        }
+        logLine(logger, dim("Would deploy with wrangler config:", theme));
+        logLine(logger, stringifyConfig(wranglerConfig));
+        try {
+          const describeResult = await prepareConfigResourcesForDeploy(deploymentStrategy.config, {
+            environment,
+            describeOnly: true
+          });
+          const resolvedWranglerConfig = compileConfig(describeResult.config);
+          logLine(logger, dim("Resolved view (would-create placeholders for missing resources):", theme));
+          logLine(logger, stringifyConfig(resolvedWranglerConfig));
+          const wouldCreate = [
+            ...describeResult.created.kv.map((n) => `KV: ${n}`),
+            ...describeResult.created.d1.map((n) => `D1: ${n}`),
+            ...describeResult.created.r2.map((n) => `R2: ${n}`),
+            ...describeResult.created.queues.map((n) => `Queue: ${n}`)
+          ];
+          if (wouldCreate.length > 0) {
+            logLine(logger, dim(`Would create:
+  - ${wouldCreate.join(`
+  - `)}`, theme));
+          }
+        } catch (describeErr) {
+          logLine(logger, dim(`(resolved view unavailable: ${describeErr.message})`, theme));
+        }
+        return { exitCode: 0 };
+      }
+      const deps = await getDependencies();
+      const requestedBuildPath = resolvedParsed.options.build;
+      const buildConfigPath = requestedBuildPath ? await resolveBuildArtifactConfigPath(requestedBuildPath, cwd) : (await prepareBuildArtifacts(resolvedParsed, logger, options)).deployConfigPath;
+      const prepared = await prepareDeployConfig({
+        cwd,
+        configPath,
+        environment,
+        buildConfigPath,
+        preview,
+        branchName,
+        logger,
+        force: resolvedParsed.options.force === true
+      });
+      const createdPreviewResourcesSummary = prepared.previewScopedResources ? summarizeDeployResourceNames(prepared.previewScopedResources.created) : null;
+      if (createdPreviewResourcesSummary) {
+        logLine(logger, `Provisioned preview-scoped resources: ${createdPreviewResourcesSummary}`);
+      }
+      const existingPreviewResourcesSummary = prepared.previewScopedResources ? summarizeDeployResourceNames(prepared.previewScopedResources.existing) : null;
+      if (existingPreviewResourcesSummary) {
+        logLine(logger, `Reused preview-scoped resources: ${existingPreviewResourcesSummary}`);
+      }
+      const createdDeployResourcesSummary = summarizeDeployResourceNames(prepared.deployResources.created);
+      if (createdDeployResourcesSummary) {
+        logLine(logger, `Provisioned deploy resources: ${createdDeployResourcesSummary}`);
+      }
+      const existingDeployResourcesSummary = summarizeDeployResourceNames(prepared.deployResources.existing);
+      if (existingDeployResourcesSummary) {
+        logLine(logger, `Reused deploy resources: ${existingDeployResourcesSummary}`);
+      }
+      for (const warning of prepared.previewScopedResources?.warnings ?? []) {
+        logger.warn(warning);
+      }
+      for (const warning of prepared.deployResources.warnings) {
+        logger.warn(warning);
+      }
+      if (requestedBuildPath) {
+        logLine(logger, `${dim("build", theme)} ${green(buildConfigPath, theme)}`);
+      }
+      logLine(logger, `${dim("worker", theme)} ${green(prepared.config.name, theme)}`);
+      const localWranglerExecutable = await resolveLocalWranglerExecutable(cwd, deps.fs);
+      const isBranchScopedPreviewDeployment = !preview && environment === "preview" && typeof resolvedPreviewScopeName === "string" && resolvedPreviewScopeName.length > 0;
+      if (preview) {
+        logger.warn("Cloudflare preview uploads cannot be the first upload for a brand-new Worker.");
+        if (prepared.config.bindings?.durableObjects && Object.keys(prepared.config.bindings.durableObjects).length > 0) {
+          logger.warn("Cloudflare does not currently generate preview URLs for Workers that implement Durable Objects.");
+        }
+        if (prepared.config.migrations && prepared.config.migrations.length > 0) {
+          logger.warn("Cloudflare versions upload does not currently support Durable Object migrations.");
+        }
+      }
+      logLine(logger, dim(preview ? "Uploading preview version with Wrangler…" : "Deploying with Wrangler…", theme));
+      const deployStartedAt = new Date;
+      const wranglerOutputDirectory = join(cwd, ".devflare");
+      const wranglerOutputFilePath = join(wranglerOutputDirectory, `wrangler-output-${Date.now()}-${process.pid}.ndjson`);
+      await deps.fs.mkdir(wranglerOutputDirectory, { recursive: true });
+      const wranglerCommand = localWranglerExecutable ? "node" : "bunx";
+      const wranglerArgs = preview ? localWranglerExecutable ? [localWranglerExecutable, "versions", "upload"] : ["wrangler", "versions", "upload"] : localWranglerExecutable ? [localWranglerExecutable, "deploy"] : ["wrangler", "deploy"];
+      wranglerArgs.push("--config", prepared.deployConfigPath);
+      if (deployMessage?.trim()) {
+        wranglerArgs.push("--message", deployMessage.trim());
+      }
+      if (deployTag?.trim()) {
+        wranglerArgs.push("--tag", deployTag.trim());
+      }
+      const deployProc = await deps.exec.exec(wranglerCommand, wranglerArgs, {
+        cwd,
+        stdio: "inherit",
+        env: {
+          ...process.env,
+          WRANGLER_OUTPUT_FILE_PATH: wranglerOutputFilePath,
+          FORCE_COLOR: process.env.FORCE_COLOR ?? "0"
+        }
+      });
+      let structuredOutput = "";
+      try {
+        structuredOutput = await deps.fs.readFile(wranglerOutputFilePath, "utf8");
+      } catch {
+        structuredOutput = "";
+      } finally {
+        try {
+          await deps.fs.unlink(wranglerOutputFilePath);
+        } catch {}
+      }
+      const parsedConsoleOutput = parseWranglerDeployOutput([deployProc.stdout, deployProc.stderr].filter((value) => typeof value === "string" && value.length > 0).join(`
+`));
+      const parsedStructuredOutput = structuredOutput ? parseWranglerStructuredOutput(structuredOutput) : { urls: [], versionId: undefined, previewUrl: undefined };
+      const parsedOutput = mergeParsedWranglerDeployOutputs(parsedConsoleOutput, parsedStructuredOutput);
+      const workersDevUrl = parsedOutput.urls.find((url) => url.includes("workers.dev"));
+      const configuredAccountId = normalizeCloudflareAccountId(prepared.config.accountId) ?? normalizeCloudflareAccountId(process.env.CLOUDFLARE_ACCOUNT_ID);
+      let resolvedAccountId = configuredAccountId;
+      let didAttemptAccountResolution = false;
+      const versionRecoveryDiagnostics = [];
+      const ensureResolvedAccountId = async () => {
+        if (resolvedAccountId || didAttemptAccountResolution) {
+          return resolvedAccountId;
+        }
+        didAttemptAccountResolution = true;
+        resolvedAccountId = await resolveDeployAccountId(undefined);
+        return resolvedAccountId;
+      };
+      let resolvedVersionId = parsedOutput.versionId;
+      let resolvedPreviewUrl = parsedOutput.previewUrl;
+      let loggedVersionId = false;
+      let verificationNote;
+      const persistDeployMetadata = async (input) => {
+        await writeDeployResultMetadata({
+          status: input.status,
+          exitCode: input.exitCode,
+          workerName: prepared.config.name,
+          preview,
+          branchScopedPreview: isBranchScopedPreviewDeployment,
+          previewScope: resolvedPreviewScopeName,
+          versionId: resolvedVersionId,
+          previewUrl: resolvedPreviewUrl,
+          workersDevUrl,
+          verificationNote,
+          outputUrls: parsedOutput.urls,
+          structuredOutput,
+          ...input.error ? { error: input.error } : {}
+        });
+      };
+      if (deployProc.exitCode !== 0) {
+        await persistDeployMetadata({
+          status: "failure",
+          exitCode: 1,
+          error: deployProc.stderr || deployProc.stdout || "Wrangler deploy failed"
+        });
+        logger.error("Deployment failed");
+        return { exitCode: 1, output: structuredOutput };
+      }
+      if (!preview && !resolvedVersionId && !isBranchScopedPreviewDeployment) {
+        resolvedAccountId = await ensureResolvedAccountId();
+      }
+      if (isBranchScopedPreviewDeployment && !resolvedPreviewUrl) {
+        resolvedAccountId = await ensureResolvedAccountId();
+      }
+      if (isBranchScopedPreviewDeployment && !resolvedPreviewUrl && resolvedAccountId) {
+        const workersSubdomain = await getWorkersSubdomain(resolvedAccountId);
+        if (workersSubdomain) {
+          resolvedPreviewUrl = formatWorkersDevUrl(prepared.config.name, workersSubdomain);
+        }
+      }
+      if (!resolvedVersionId && resolvedAccountId) {
+        try {
+          resolvedVersionId = await resolveVersionIdFromLatestWorkerVersion({
+            accountId: resolvedAccountId,
+            workerName: prepared.config.name,
+            preview: preview || isBranchScopedPreviewDeployment,
+            deployedAfter: deployStartedAt
+          });
+          logger.success(`Version ID: ${resolvedVersionId}`);
+          loggedVersionId = true;
+          logLine(logger, dim("Resolved version id from Cloudflare version metadata", theme));
+        } catch (error) {
+          const message = error instanceof Error ? error.message : String(error);
+          versionRecoveryDiagnostics.push(`version lookup: ${message}`);
+        }
+      }
+      if (isBranchScopedPreviewDeployment && !resolvedVersionId && resolvedAccountId) {
+        try {
+          const fallbackDeployment = await resolveVersionIdFromLatestProductionDeployment({
+            accountId: resolvedAccountId,
+            workerName: prepared.config.name,
+            deployedAfter: deployStartedAt
+          });
+          resolvedVersionId = fallbackDeployment.versionId;
+          logger.success(`Version ID: ${resolvedVersionId}`);
+          loggedVersionId = true;
+          logLine(logger, dim(`Resolved version id from Cloudflare deployment ${fallbackDeployment.deploymentId}`, theme));
+        } catch (error) {
+          const message = error instanceof Error ? error.message : String(error);
+          versionRecoveryDiagnostics.push(`deployment lookup: ${message}`);
+        }
+      }
+      if (!preview && !isBranchScopedPreviewDeployment && !resolvedVersionId && resolvedAccountId) {
+        try {
+          const fallbackDeployment = await resolveVersionIdFromLatestProductionDeployment({
+            accountId: resolvedAccountId,
+            workerName: prepared.config.name,
+            deployedAfter: deployStartedAt
+          });
+          resolvedVersionId = fallbackDeployment.versionId;
+          logger.success(`Version ID: ${resolvedVersionId}`);
+          loggedVersionId = true;
+          logLine(logger, dim(`Resolved version id from Cloudflare deployment ${fallbackDeployment.deploymentId}`, theme));
+        } catch (error) {
+          const message = error instanceof Error ? error.message : String(error);
+          versionRecoveryDiagnostics.push(`deployment lookup: ${message}`);
+        }
+      }
+      if (!preview && !isBranchScopedPreviewDeployment && !resolvedVersionId && resolvedAccountId) {
+        try {
+          const currentDeployment = await resolveVersionIdFromCurrentProductionDeployment({
+            accountId: resolvedAccountId,
+            workerName: prepared.config.name
+          });
+          resolvedVersionId = currentDeployment.versionId;
+          logger.success(`Version ID: ${resolvedVersionId}`);
+          loggedVersionId = true;
+          const reuseMessage = `Cloudflare did not expose a fresh deployment or version after verification retries, and the current active deployment ${currentDeployment.deploymentId} still points at version ${resolvedVersionId}. This usually means the built Worker code and configuration were unchanged, so Cloudflare kept the existing live version.`;
+          verificationNote = reuseMessage;
+          if (requireFreshProductionDeployment) {
+            await persistDeployMetadata({
+              status: "failure",
+              exitCode: 1,
+              error: reuseMessage
+            });
+            logger.error(`Deployment verification failed: ${reuseMessage} This run requires a fresh production deployment, so Devflare is treating the reused live version as a failure.`);
+            return { exitCode: 1, output: structuredOutput };
+          }
+          logger.warn(`Deployment verification note: ${reuseMessage}`);
+        } catch (error) {
+          const message = error instanceof Error ? error.message : String(error);
+          versionRecoveryDiagnostics.push(`current production deployment: ${message}`);
+        }
+      }
+      if (resolvedVersionId && !loggedVersionId) {
+        logger.success(`Version ID: ${resolvedVersionId}`);
+      }
+      if (isBranchScopedPreviewDeployment && !resolvedPreviewUrl && resolvedAccountId) {
+        const workersSubdomain = await getWorkersSubdomain(resolvedAccountId);
+        if (workersSubdomain) {
+          resolvedPreviewUrl = formatWorkersDevUrl(prepared.config.name, workersSubdomain);
+        }
+      }
+      if ((preview || isBranchScopedPreviewDeployment) && resolvedPreviewUrl) {
+        logLine(logger, `Preview URL: ${resolvedPreviewUrl}`);
+      }
+      if (shouldVerifyDeployControlPlane()) {
+        if (!resolvedVersionId) {
+          const recoveryDetails = versionRecoveryDiagnostics.length > 0 ? ` Cloudflare fallback checks also failed: ${versionRecoveryDiagnostics.join(" | ")}` : "";
+          await persistDeployMetadata({
+            status: "failure",
+            exitCode: 1,
+            error: `Wrangler did not return a Worker version id, so Devflare could not prove which version Cloudflare accepted.${recoveryDetails}`
+          });
+          logger.error(`Deployment verification failed: Wrangler did not return a Worker version id, so Devflare could not prove which version Cloudflare accepted.${recoveryDetails}`);
+          return { exitCode: 1, output: structuredOutput };
+        } else {
+          resolvedAccountId = await ensureResolvedAccountId();
+          if (!resolvedAccountId) {
+            await persistDeployMetadata({
+              status: "failure",
+              exitCode: 1,
+              error: "Devflare could not resolve a Cloudflare account id."
+            });
+            logger.error("Deployment verification failed: Devflare could not resolve a Cloudflare account id. Pass cloudflare-account-id to the action or set accountId in devflare.config.ts.");
+            return { exitCode: 1, output: structuredOutput };
+          }
+          try {
+            await verifyDeployControlPlane({
+              accountId: resolvedAccountId,
+              workerName: prepared.config.name,
+              versionId: resolvedVersionId,
+              preview,
+              logger,
+              theme
+            });
+          } catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            await persistDeployMetadata({
+              status: "failure",
+              exitCode: 1,
+              error: message
+            });
+            logger.error(`Deployment verification failed: ${message}`);
+            return { exitCode: 1, output: structuredOutput };
+          }
+        }
+      }
+      if (resolvedAccountId) {
+        const previewRegistryScope = isBranchScopedPreviewDeployment ? deployTarget.previewScope : undefined;
+        const previewRegistryUrl = preview || isBranchScopedPreviewDeployment ? resolvedPreviewUrl : undefined;
+        try {
+          await reconcilePreviewRegistry({
+            accountId: resolvedAccountId,
+            workerName: prepared.config.name,
+            versionId: resolvedVersionId,
+            previewScope: previewRegistryScope,
+            previewUrl: previewRegistryUrl,
+            branchName: resolvedPreviewScopeName,
+            commitSha: process.env.GITHUB_SHA,
+            source: inferRecordSource(),
+            deploymentMessage: process.env.GITHUB_EVENT_NAME,
+            logger
+          });
+        } catch (error) {
+          const message = error instanceof Error ? error.message : String(error);
+          logger.warn(`Devflare preview registry sync failed: ${message}`);
+        }
+      }
+      await persistDeployMetadata({
+        status: "success",
+        exitCode: 0
+      });
+      logger.success("Deployed successfully!");
+      return { exitCode: 0, output: structuredOutput };
+    });
+  } catch (error) {
+    await writeDeployResultMetadata({
+      status: "failure",
+      exitCode: 1,
+      preview,
+      branchScopedPreview: !preview && environment === "preview" && Boolean(resolvedPreviewScopeName),
+      previewScope: resolvedPreviewScopeName,
+      outputUrls: [],
+      ...error instanceof Error ? { error: error.message } : { error: String(error) }
+    });
+    if (error instanceof Error) {
+      logger.error("Deployment failed:", error.message);
+      if (resolvedParsed.options.debug) {
+        logger.error(error.stack);
+      }
+    }
+    return { exitCode: 1 };
+  }
+}
+export {
+  runDeployCommand
+};