devflare 1.0.0-next.4 → 1.0.0-next.40

package/dist/_chunks/deploy-DMTr6JeR.js

@@ -0,0 +1,915 @@
+import { a as resolvePreviewIdentifier, d as resolveConfigEnvVars } from "./preview-BhqDmq8I.js";
+import { c as prepareConfigResourcesForDeploy, r as loadConfig, u as resolveConfigForEnvironment } from "./loader-DLXO60RO.js";
+import { a as readWranglerConfig, c as writeWranglerConfig, n as compileConfig, o as rebaseWranglerConfigPaths, s as stringifyConfig, t as compileBuildConfig } from "./compiler-uoyAQ8zW.js";
+import { d as getPrimaryAccount, n as getEffectiveAccountId } from "./preferences-BKp_7XJx.js";
+import { D as listWorkerVersions, E as listWorkerDeployments, O as listWorkers, T as getWorkersSubdomain, c as reconcilePreviewRegistry, w as getWorkerVersionDetail, x as formatWorkersDevUrl } from "./preview-registry-ClAbLTHH.js";
+import { _ as yellowBold, d as green, f as logLine, g as yellow, o as dim, r as createCliTheme } from "./ui-BUoZApvE.js";
+import { n as getPackageVersion } from "./package-metadata-DAuCkyvK.js";
+import { t as resolvePackageSpecifier } from "./resolve-package-Y84HB3Nt.js";
+import { t as asOptionalString } from "./command-utils-BsfkmTqh.js";
+import { a as createBuildManifest, i as compareManifests, n as applyDeploymentStrategy, o as formatDriftWarning, r as describeDeploymentStrategy, s as readBuildManifest, t as prepareBuildArtifacts } from "./build-artifacts-8TqBSQkG.js";
+import { t as getDependencies } from "./dependencies-C2oxFjU_.js";
+import { n as preparePreviewScopedResourcesForDeploy } from "./preview-resources-DdXj8LMM.js";
+import { mkdir, open, readFile, rm, writeFile } from "node:fs/promises";
+import { basename, dirname, isAbsolute, join, resolve } from "pathe";
+//#region src/config/service-bindings-validation.ts
+var ServiceBindingValidationError = class extends Error {
+	code = "SERVICE_BINDING_VALIDATION_ERROR";
+	missing;
+	constructor(missing, accountId) {
+		super(`Service binding(s) reference worker(s) that do not exist in Cloudflare account ${accountId}: ` + missing.join(", ") + `. Check the 'services' map in devflare.config.ts for typos or deploy the target worker(s) first.`);
+		this.name = "ServiceBindingValidationError";
+		this.missing = missing;
+	}
+};
+/**
+* Collect every `service` target referenced by the config's `bindings.services`
+* map, deduplicated. Returns `[]` when no service bindings are configured.
+*/
+function collectReferencedServiceNames(config) {
+	const services = config.bindings?.services;
+	if (!services) return [];
+	const names = /* @__PURE__ */ new Set();
+	for (const binding of Object.values(services)) if (binding && typeof binding === "object" && typeof binding.service === "string") {
+		const name = binding.service.trim();
+		if (name.length > 0) names.add(name);
+	}
+	return [...names];
+}
+/**
+* Validate that every service binding target exists in the Cloudflare account.
+*
+* Throws `ServiceBindingValidationError` with the full list of missing
+* targets if any are unreachable. A missing self-reference is tolerated
+* when `selfWorkerName` matches, so first deploys don't fail against
+* themselves.
+*/
+async function validateServiceBindings(config, accountId, options) {
+	const referenced = collectReferencedServiceNames(config);
+	if (referenced.length === 0) return;
+	const selfName = options.selfWorkerName?.trim();
+	const toValidate = selfName ? referenced.filter((name) => name !== selfName) : referenced;
+	if (toValidate.length === 0) return;
+	const workers = await options.listWorkers(accountId);
+	const workerNames = new Set(workers.map((worker) => worker.name));
+	const missing = toValidate.filter((name) => !workerNames.has(name));
+	if (missing.length > 0) throw new ServiceBindingValidationError(missing, accountId);
+}
+//#endregion
+//#region src/cli/deploy-target.ts
+function resolveDeployTarget(parsed, options = {}) {
+	const wantsProduction = parsed.options.prod === true || parsed.options.production === true;
+	const previewOption = parsed.options.preview;
+	const previewScopeRaw = asOptionalString(previewOption);
+	const wantsPreview = previewOption === true || Boolean(previewScopeRaw);
+	if (!wantsProduction && !wantsPreview) {
+		if (options.requireExplicitTarget === true) throw new Error("Deploy needs an explicit target. Use --prod / --production for live traffic, or --preview <name> (or bare --preview) for preview deploys.");
+		return {
+			mode: "implicit",
+			envOverrides: {}
+		};
+	}
+	if (wantsProduction && wantsPreview) throw new Error("Choose either --prod / --production or --preview <name>, not both.");
+	const explicitEnvironment = asOptionalString(parsed.options.env);
+	if (wantsProduction) {
+		if (explicitEnvironment && explicitEnvironment !== "production") throw new Error("Production deploys always target the production environment. Remove --env or use --env production.");
+		if (parsed.options["branch-name"] !== void 0) throw new Error("Production deploys do not accept --branch-name.");
+		return {
+			mode: "production",
+			environment: "production",
+			targetFlag: parsed.options.production === true ? "--production" : "--prod",
+			envOverrides: {
+				DEVFLARE_PREVIEW_BRANCH: void 0,
+				DEVFLARE_PREVIEW_IDENTIFIER: void 0,
+				DEVFLARE_PREVIEW_PR: void 0
+			}
+		};
+	}
+	if (explicitEnvironment && explicitEnvironment !== "preview") throw new Error("Preview deploys always target the preview environment. Remove --env or use --env preview.");
+	if (previewScopeRaw) {
+		const branchName = asOptionalString(parsed.options["branch-name"]);
+		if (branchName && branchName !== previewScopeRaw) throw new Error("Named preview deploys use the --preview value as the preview scope. Omit --branch-name or pass the same value to both flags.");
+		const previewScope = resolvePreviewIdentifier({ identifier: previewScopeRaw }).identifier ?? "preview";
+		return {
+			mode: "preview-scope",
+			environment: "preview",
+			targetFlag: "--preview",
+			previewScope,
+			previewScopeRaw,
+			envOverrides: {
+				DEVFLARE_PREVIEW_BRANCH: previewScopeRaw,
+				DEVFLARE_PREVIEW_IDENTIFIER: previewScope,
+				DEVFLARE_PREVIEW_PR: void 0
+			}
+		};
+	}
+	return {
+		mode: "preview-upload",
+		environment: "preview",
+		targetFlag: "--preview",
+		envOverrides: {
+			DEVFLARE_PREVIEW_BRANCH: void 0,
+			DEVFLARE_PREVIEW_IDENTIFIER: void 0,
+			DEVFLARE_PREVIEW_PR: void 0
+		}
+	};
+}
+function applyResolvedDeployTarget(parsed, target) {
+	if (!target.environment) return parsed;
+	return {
+		...parsed,
+		options: {
+			...parsed.options,
+			env: target.environment
+		}
+	};
+}
+async function withTemporaryEnvironment(overrides, operation) {
+	const previousValues = /* @__PURE__ */ new Map();
+	for (const [key, value] of Object.entries(overrides)) {
+		previousValues.set(key, process.env[key]);
+		if (typeof value === "string") {
+			process.env[key] = value;
+			continue;
+		}
+		delete process.env[key];
+	}
+	try {
+		return await operation();
+	} finally {
+		for (const [key, value] of previousValues) {
+			if (typeof value === "string") {
+				process.env[key] = value;
+				continue;
+			}
+			delete process.env[key];
+		}
+	}
+}
+//#endregion
+//#region src/cli/preview.ts
+function matchNamedValue(output, patterns) {
+	for (const pattern of patterns) {
+		const match = output.match(pattern);
+		if (match?.[1]) return match[1];
+	}
+}
+function appendUniqueUrls(target, value) {
+	if (typeof value === "string") {
+		if (value.startsWith("http://") || value.startsWith("https://")) target.push(value);
+		return;
+	}
+	if (!Array.isArray(value)) return;
+	for (const item of value) appendUniqueUrls(target, item);
+}
+function parseWranglerStructuredOutput(output) {
+	const records = output.replace(/\r/g, "").split("\n").map((line) => line.trim()).filter(Boolean).map((line) => {
+		try {
+			return JSON.parse(line);
+		} catch {
+			return null;
+		}
+	}).filter((record) => record !== null);
+	const urls = [];
+	let versionId;
+	let previewUrl;
+	for (const record of records) {
+		if (!versionId && typeof record.version_id === "string" && record.version_id.trim()) versionId = record.version_id.trim();
+		appendUniqueUrls(urls, record.targets);
+		appendUniqueUrls(urls, record.preview_urls);
+		appendUniqueUrls(urls, record.urls);
+		appendUniqueUrls(urls, record.url);
+		if (!previewUrl && typeof record.preview_url === "string" && record.preview_url.trim()) previewUrl = record.preview_url.trim();
+	}
+	const uniqueUrls = [...new Set(urls)];
+	if (!previewUrl) previewUrl = uniqueUrls.find((url) => url.includes("workers.dev"));
+	return {
+		versionId,
+		previewUrl,
+		urls: uniqueUrls
+	};
+}
+function mergeParsedWranglerDeployOutputs(...outputs) {
+	const urls = [...new Set(outputs.flatMap((output) => output.urls))];
+	return {
+		versionId: outputs.map((output) => output.versionId).find((value) => Boolean(value)),
+		previewUrl: outputs.map((output) => output.previewUrl).find((value) => Boolean(value)) ?? urls.find((url) => url.includes("workers.dev")),
+		urls
+	};
+}
+function parseWranglerDeployOutput(output) {
+	const normalizedOutput = output.replace(/\r/g, "");
+	const urls = [...new Set(normalizedOutput.match(/https?:\/\/[^\s'"`]+/g) ?? [])];
+	const previewUrl = matchNamedValue(normalizedOutput, [/Preview URL:\s*(https?:\/\/\S+)/i, /Version Preview URL:\s*(https?:\/\/\S+)/i]) ?? urls.find((url) => url.includes("workers.dev"));
+	return {
+		versionId: matchNamedValue(normalizedOutput, [
+			/Worker Version ID:\s*([A-Za-z0-9_-]+)/i,
+			/Version ID:\s*([A-Za-z0-9_-]+)/i,
+			/version(?:_id| id)?\s*[:=]\s*([A-Za-z0-9_-]+)/i,
+			/"id"\s*:\s*"([A-Za-z0-9_-]+)"/i
+		]),
+		previewUrl,
+		urls
+	};
+}
+//#endregion
+//#region src/cli/commands/deploy/metadata.ts
+function inferRecordSource() {
+	return process.env.GITHUB_ACTIONS === "true" ? "github-action" : "cli";
+}
+async function writeDeployResultMetadata(metadata) {
+	const metadataPath = process.env.DEVFLARE_DEPLOY_METADATA_PATH?.trim();
+	if (!metadataPath) return;
+	await mkdir(dirname(metadataPath), { recursive: true });
+	await writeFile(metadataPath, JSON.stringify(metadata, null, "	"), "utf8");
+}
+//#endregion
+//#region src/cli/commands/deploy/prepare.ts
+function summarizeDeployResourceNames(resources) {
+	const segments = [
+		resources.kv.length > 0 ? `KV ${resources.kv.length}` : null,
+		resources.d1.length > 0 ? `D1 ${resources.d1.length}` : null,
+		resources.r2.length > 0 ? `R2 ${resources.r2.length}` : null,
+		resources.queues.length > 0 ? `Queues ${resources.queues.length}` : null,
+		resources.vectorize.length > 0 ? `Vectorize ${resources.vectorize.length}` : null,
+		resources.hyperdrive.length > 0 ? `Hyperdrive ${resources.hyperdrive.length}` : null
+	].filter((segment) => segment !== null);
+	return segments.length > 0 ? segments.join(" · ") : null;
+}
+async function readDeployRedirectPath(filePath) {
+	const fs = await import("node:fs/promises");
+	try {
+		const rawConfig = await fs.readFile(filePath, "utf-8");
+		const parsed = JSON.parse(rawConfig);
+		if (typeof parsed.configPath !== "string" || parsed.configPath.length === 0) return null;
+		return resolve(dirname(filePath), parsed.configPath);
+	} catch {
+		return null;
+	}
+}
+async function resolveBuildArtifactConfigPath(buildPath, cwd) {
+	const fs = await import("node:fs/promises");
+	const absoluteBuildPath = isAbsolute(buildPath) ? buildPath : resolve(cwd, buildPath);
+	let stat;
+	try {
+		stat = await fs.stat(absoluteBuildPath);
+	} catch {
+		throw new Error(`Could not find build artifact path: ${absoluteBuildPath}`);
+	}
+	if (stat.isFile()) {
+		if (basename(absoluteBuildPath) === "config.json") {
+			const redirectedConfigPath = await readDeployRedirectPath(absoluteBuildPath);
+			if (!redirectedConfigPath) throw new Error(`Build redirect ${absoluteBuildPath} did not contain a valid configPath.`);
+			return redirectedConfigPath;
+		}
+		return absoluteBuildPath;
+	}
+	const candidates = [
+		resolve(absoluteBuildPath, "wrangler.jsonc"),
+		resolve(absoluteBuildPath, ".wrangler", "deploy", "config.json"),
+		resolve(absoluteBuildPath, "config.json"),
+		resolve(absoluteBuildPath, ".devflare", "build", "wrangler.jsonc")
+	];
+	for (const candidatePath of candidates) try {
+		if (!(await fs.stat(candidatePath)).isFile()) continue;
+		if (basename(candidatePath) === "config.json") {
+			const redirectedConfigPath = await readDeployRedirectPath(candidatePath);
+			if (redirectedConfigPath) return redirectedConfigPath;
+			continue;
+		}
+		return candidatePath;
+	} catch {}
+	throw new Error(`Could not resolve a Wrangler build config from ${absoluteBuildPath}. Pass a .devflare/build directory, a generated wrangler.jsonc, or a .wrangler/deploy/config.json redirect.`);
+}
+function withBuildArtifactPaths(compiledConfig, buildConfig) {
+	return {
+		...compiledConfig,
+		...buildConfig.main ? { main: buildConfig.main } : {},
+		...buildConfig.assets ? { assets: buildConfig.assets } : {}
+	};
+}
+async function prepareDeployConfig(options) {
+	const rawConfig = await resolveConfigEnvVars(await loadConfig({
+		cwd: options.cwd,
+		configFile: options.configPath
+	}), {
+		cwd: options.cwd,
+		configPath: options.configPath,
+		mode: "build"
+	});
+	const manifest = await readBuildManifest(dirname(options.buildConfigPath));
+	if (manifest) {
+		const warning = formatDriftWarning(compareManifests(manifest, createBuildManifest(rawConfig, {
+			devflareVersion: await getPackageVersion(),
+			intendedTarget: {
+				environment: options.environment,
+				preview: options.preview,
+				branchName: options.branchName
+			}
+		})));
+		if (warning && options.logger) if (options.force) {
+			logLine(options.logger, warning);
+			logLine(options.logger, "Continuing because --force was passed.");
+		} else logLine(options.logger, warning);
+	}
+	const previewScopedResources = options.environment === "preview" ? await preparePreviewScopedResourcesForDeploy(rawConfig, { environment: options.environment }) : null;
+	const deployResources = await prepareConfigResourcesForDeploy(previewScopedResources?.config ?? rawConfig, {
+		environment: options.environment,
+		accountId: previewScopedResources?.accountId,
+		cloudflare: previewScopedResources?.resourceResolutionCloudflare
+	});
+	const deploymentStrategy = applyDeploymentStrategy(deployResources.config, {
+		environment: options.environment,
+		preview: options.preview,
+		branchName: options.branchName,
+		previewBranch: process.env.DEVFLARE_PREVIEW_BRANCH
+	});
+	const validationAccountId = previewScopedResources?.accountId ?? deploymentStrategy.config.accountId ?? process.env.CLOUDFLARE_ACCOUNT_ID;
+	if (validationAccountId) try {
+		await validateServiceBindings(deploymentStrategy.config, validationAccountId, {
+			listWorkers: (accountId) => listWorkers(accountId),
+			selfWorkerName: deploymentStrategy.config.name
+		});
+	} catch (error) {
+		if (error instanceof ServiceBindingValidationError) throw error;
+	}
+	const buildWranglerConfig = await readWranglerConfig(options.buildConfigPath);
+	const compiledWranglerConfig = compileConfig(deploymentStrategy.config);
+	const buildDir = dirname(options.buildConfigPath);
+	const deployArtefactDir = resolve(buildDir, "..", "deploy");
+	await mkdir(deployArtefactDir, { recursive: true });
+	const deployArtefactPath = resolve(deployArtefactDir, "wrangler.jsonc");
+	const wranglerConfig = withBuildArtifactPaths(rebaseWranglerConfigPaths(options.cwd, deployArtefactDir, compiledWranglerConfig), rebaseWranglerConfigPaths(buildDir, deployArtefactDir, buildWranglerConfig));
+	const lockPath = resolve(deployArtefactDir, ".lock");
+	const lockHandle = await acquireDeployArtefactLock(lockPath);
+	try {
+		await writeWranglerConfig(deployArtefactDir, wranglerConfig, "wrangler.jsonc");
+	} finally {
+		await releaseDeployArtefactLock(lockHandle, lockPath);
+	}
+	return {
+		config: deploymentStrategy.config,
+		deployConfigPath: deployArtefactPath,
+		previewScopedResources,
+		deployResources,
+		wranglerConfig
+	};
+}
+/**
+* C10 — bounded-wait exclusive lock around the deploy artefact directory.
+*
+* Uses `open(path, 'wx')` (O_EXCL) which atomically fails when the file
+* already exists, so the only way to acquire the lock is to be the process
+* that successfully created it. Stale locks (older than 60s) are forcibly
+* cleared so a crashed deploy cannot wedge subsequent runs.
+*/
+async function acquireDeployArtefactLock(lockPath, options = {}) {
+	const maxWaitMs = options.maxWaitMs ?? 3e4;
+	const staleAfterMs = options.staleAfterMs ?? 6e4;
+	const pollMs = 100;
+	const start = Date.now();
+	while (true) try {
+		const handle = await open(lockPath, "wx");
+		await handle.writeFile(`${process.pid}\n${Date.now()}`);
+		return handle;
+	} catch (err) {
+		if (err.code !== "EEXIST") throw err;
+		try {
+			const existing = await readFile(lockPath, "utf-8");
+			const ts = Number.parseInt(existing.split("\n")[1] ?? "0", 10);
+			if (Number.isFinite(ts) && Date.now() - ts > staleAfterMs) {
+				await rm(lockPath, { force: true });
+				continue;
+			}
+		} catch {
+			continue;
+		}
+		if (Date.now() - start > maxWaitMs) throw new Error(`Timed out waiting for deploy artefact lock at ${lockPath}. Another \`devflare deploy\` may be running against the same artefact directory.`);
+		await new Promise((r) => setTimeout(r, pollMs));
+	}
+}
+async function releaseDeployArtefactLock(handle, lockPath) {
+	try {
+		await handle.close();
+	} catch {}
+	await rm(lockPath, { force: true });
+}
+//#endregion
+//#region src/cli/commands/deploy/runtime.ts
+async function resolveLocalWranglerExecutable(cwd, fs) {
+	const wranglerExecutablePath = resolvePackageSpecifier("wrangler/bin/wrangler.js", cwd);
+	try {
+		await fs.access(wranglerExecutablePath);
+		return wranglerExecutablePath;
+	} catch {
+		return null;
+	}
+}
+//#endregion
+//#region src/cli/commands/deploy/verification.ts
+function shouldVerifyDeployControlPlane() {
+	const configured = process.env.DEVFLARE_VERIFY_DEPLOYMENT?.trim().toLowerCase();
+	if (!configured) return false;
+	return ![
+		"0",
+		"false",
+		"no",
+		"off"
+	].includes(configured);
+}
+function shouldRequireFreshProductionDeployment() {
+	const configured = process.env.DEVFLARE_REQUIRE_FRESH_PRODUCTION_DEPLOYMENT?.trim().toLowerCase();
+	if (!configured) return false;
+	return ![
+		"0",
+		"false",
+		"no",
+		"off"
+	].includes(configured);
+}
+function getDeployVerificationSettings() {
+	const attempts = Number.parseInt(process.env.DEVFLARE_VERIFY_DEPLOYMENT_ATTEMPTS ?? "", 10);
+	const delayMs = Number.parseInt(process.env.DEVFLARE_VERIFY_DEPLOYMENT_DELAY_MS ?? "", 10);
+	return {
+		attempts: Number.isFinite(attempts) && attempts > 0 ? attempts : 5,
+		delayMs: Number.isFinite(delayMs) && delayMs >= 0 ? delayMs : 1500
+	};
+}
+const DEPLOYMENT_LOOKBACK_TOLERANCE_MS = 120 * 1e3;
+function normalizeCloudflareAccountId(value) {
+	const trimmed = value?.trim();
+	if (!trimmed) return;
+	return /^[a-f0-9]{32}$/i.test(trimmed) ? trimmed : void 0;
+}
+async function waitForDeployVerification(delayMs) {
+	if (delayMs <= 0) return;
+	await new Promise((resolve) => setTimeout(resolve, delayMs));
+}
+async function retryDeployVerification(description, operation) {
+	const { attempts, delayMs } = getDeployVerificationSettings();
+	let lastError;
+	for (let attempt = 1; attempt <= attempts; attempt++) try {
+		return await operation();
+	} catch (error) {
+		lastError = error;
+		if (attempt < attempts) await waitForDeployVerification(delayMs);
+	}
+	const message = lastError instanceof Error ? lastError.message : String(lastError);
+	throw new Error(`Cloudflare could not verify ${description} after ${attempts} attempt${attempts === 1 ? "" : "s"}: ${message}`);
+}
+async function resolveDeployAccountId(preferredAccountId) {
+	if (preferredAccountId !== void 0) return normalizeCloudflareAccountId(preferredAccountId);
+	const apiToken = process.env.CLOUDFLARE_API_TOKEN?.trim();
+	const apiKey = process.env.CLOUDFLARE_API_KEY?.trim();
+	const apiEmail = process.env.CLOUDFLARE_EMAIL?.trim();
+	if (!apiToken && !(apiKey && apiEmail)) return;
+	try {
+		const primaryAccount = await getPrimaryAccount();
+		if (!primaryAccount) return;
+		return normalizeCloudflareAccountId((await getEffectiveAccountId(primaryAccount.id)).accountId);
+	} catch {
+		return;
+	}
+}
+function selectDeploymentVersionId(deployment) {
+	return deployment.versions.find((version) => version.percentage === 100)?.versionId ?? deployment.versions[0]?.versionId;
+}
+function getWorkerVersionTimestamp(version) {
+	return version.metadata.modifiedOn ?? version.metadata.createdOn;
+}
+async function resolveVersionIdFromLatestDeployment(options) {
+	return retryDeployVerification(options.verificationDescription, async () => {
+		const latestDeployment = [...await listWorkerDeployments(options.accountId, options.workerName)].sort((a, b) => b.createdOn.getTime() - a.createdOn.getTime())[0];
+		if (!latestDeployment) throw new Error(`No deployments were found for Worker "${options.workerName}".`);
+		if (options.deployedAfter && latestDeployment.createdOn.getTime() < options.deployedAfter.getTime() - DEPLOYMENT_LOOKBACK_TOLERANCE_MS) throw new Error(`${options.deploymentLabel} ${latestDeployment.id} was created before this deploy started.`);
+		const versionId = selectDeploymentVersionId(latestDeployment);
+		if (!versionId) throw new Error(`${options.deploymentLabel} ${latestDeployment.id} does not reference any version ids.`);
+		return {
+			deploymentId: latestDeployment.id,
+			versionId
+		};
+	});
+}
+async function resolveVersionIdFromLatestWorkerVersion(options) {
+	return retryDeployVerification(`the latest ${options.preview ? "preview " : ""}version for Worker "${options.workerName}"`, async () => {
+		const latestVersion = [...await listWorkerVersions(options.accountId, options.workerName)].filter((version) => version.id).filter((version) => version.metadata.hasPreview === options.preview).sort((a, b) => {
+			const left = getWorkerVersionTimestamp(a)?.getTime() ?? 0;
+			return (getWorkerVersionTimestamp(b)?.getTime() ?? 0) - left;
+		})[0];
+		if (!latestVersion) throw new Error(`No ${options.preview ? "preview " : ""}versions were found for Worker "${options.workerName}".`);
+		const latestVersionTimestamp = getWorkerVersionTimestamp(latestVersion);
+		if (!latestVersionTimestamp) throw new Error(`Latest version ${latestVersion.id} did not include a creation timestamp.`);
+		if (latestVersionTimestamp.getTime() < options.deployedAfter.getTime() - DEPLOYMENT_LOOKBACK_TOLERANCE_MS) throw new Error(`Latest version ${latestVersion.id} was created before this deploy started.`);
+		return latestVersion.id;
+	});
+}
+async function resolveVersionIdFromLatestProductionDeployment(options) {
+	return resolveVersionIdFromLatestDeployment({
+		accountId: options.accountId,
+		workerName: options.workerName,
+		verificationDescription: `the latest deployment for Worker "${options.workerName}"`,
+		deploymentLabel: "Latest deployment",
+		deployedAfter: options.deployedAfter
+	});
+}
+async function resolveVersionIdFromCurrentProductionDeployment(options) {
+	return resolveVersionIdFromLatestDeployment({
+		accountId: options.accountId,
+		workerName: options.workerName,
+		verificationDescription: `the current active deployment for Worker "${options.workerName}"`,
+		deploymentLabel: "Current deployment"
+	});
+}
+async function verifyDeployControlPlane(options) {
+	logLine(options.logger, dim("Verifying Cloudflare control-plane state…", options.theme));
+	await retryDeployVerification(`Worker version ${options.versionId}`, async () => {
+		const version = await getWorkerVersionDetail(options.accountId, options.workerName, options.versionId);
+		if (!version.id) throw new Error(`Cloudflare returned an empty version record for ${options.versionId}.`);
+		return version;
+	});
+	if (options.preview) {
+		options.logger.success(`Verified preview upload in Cloudflare control plane for version ${options.versionId}`);
+		return;
+	}
+	const deployment = await retryDeployVerification(`a deployment that references version ${options.versionId}`, async () => {
+		const match = (await listWorkerDeployments(options.accountId, options.workerName)).find((item) => item.versions.some((version) => version.versionId === options.versionId));
+		if (!match) throw new Error(`No deployment for Worker "${options.workerName}" references version ${options.versionId} yet.`);
+		return match;
+	});
+	options.logger.success(`Verified Cloudflare deployment ${deployment.id} for version ${options.versionId}`);
+}
+//#endregion
+//#region src/cli/commands/deploy.ts
+async function runDeployCommand(parsed, logger, options) {
+	let deployTarget = {
+		mode: "implicit",
+		envOverrides: {}
+	};
+	let resolvedParsed = parsed;
+	const cwd = options.cwd || process.cwd();
+	let configPath;
+	let environment;
+	let dryRun = false;
+	let preview = false;
+	let branchName;
+	let deployMessage;
+	let deployTag;
+	let previewScopeName;
+	let requireFreshProductionDeployment = false;
+	let resolvedPreviewScopeName = process.env.DEVFLARE_PREVIEW_BRANCH?.trim() || void 0;
+	const theme = createCliTheme(parsed.options);
+	logLine(logger);
+	logLine(logger, `${yellowBold("deploy", theme)} ${dim("Shipping to Cloudflare", theme)}`);
+	try {
+		deployTarget = resolveDeployTarget(parsed, { requireExplicitTarget: options.requireExplicitDeployTarget === true });
+		resolvedParsed = applyResolvedDeployTarget(parsed, deployTarget);
+		configPath = resolvedParsed.options.config;
+		environment = resolvedParsed.options.env;
+		dryRun = resolvedParsed.options["dry-run"] === true;
+		preview = deployTarget.mode === "preview-upload";
+		branchName = resolvedParsed.options["branch-name"];
+		deployMessage = resolvedParsed.options.message;
+		deployTag = resolvedParsed.options.tag;
+		previewScopeName = branchName?.trim() || deployTarget.previewScopeRaw || void 0;
+		resolvedPreviewScopeName = previewScopeName || process.env.DEVFLARE_PREVIEW_BRANCH?.trim() || void 0;
+		requireFreshProductionDeployment = !preview && shouldRequireFreshProductionDeployment();
+		return await withTemporaryEnvironment(deployTarget.envOverrides, async () => {
+			resolvedPreviewScopeName = previewScopeName || process.env.DEVFLARE_PREVIEW_BRANCH?.trim() || void 0;
+			if (dryRun) {
+				const deploymentStrategy = applyDeploymentStrategy(await resolveConfigEnvVars(resolveConfigForEnvironment(await loadConfig({
+					cwd,
+					configFile: configPath
+				}), environment), {
+					cwd,
+					configPath,
+					mode: "build"
+				}), {
+					environment,
+					preview,
+					branchName,
+					previewBranch: process.env.DEVFLARE_PREVIEW_BRANCH
+				});
+				const wranglerConfig = compileBuildConfig(deploymentStrategy.config, void 0, { alreadyResolved: true });
+				logLine(logger, `${yellow("dry run", theme)} ${dim("Skipping actual deployment", theme)}`);
+				const deploymentStrategyMessage = describeDeploymentStrategy(deploymentStrategy);
+				if (deploymentStrategyMessage) logLine(logger, dim(deploymentStrategyMessage, theme));
+				logLine(logger, dim("Would deploy with wrangler config:", theme));
+				logLine(logger, stringifyConfig(wranglerConfig));
+				try {
+					const describeResult = await prepareConfigResourcesForDeploy(deploymentStrategy.config, {
+						environment,
+						describeOnly: true
+					});
+					const resolvedWranglerConfig = compileConfig(describeResult.config);
+					logLine(logger, dim("Resolved view (would-create placeholders for missing resources):", theme));
+					logLine(logger, stringifyConfig(resolvedWranglerConfig));
+					const wouldCreate = [
+						...describeResult.created.kv.map((n) => `KV: ${n}`),
+						...describeResult.created.d1.map((n) => `D1: ${n}`),
+						...describeResult.created.r2.map((n) => `R2: ${n}`),
+						...describeResult.created.queues.map((n) => `Queue: ${n}`)
+					];
+					if (wouldCreate.length > 0) logLine(logger, dim(`Would create:\n  - ${wouldCreate.join("\n  - ")}`, theme));
+				} catch (describeErr) {
+					logLine(logger, dim(`(resolved view unavailable: ${describeErr.message})`, theme));
+				}
+				return { exitCode: 0 };
+			}
+			const deps = await getDependencies();
+			const requestedBuildPath = resolvedParsed.options.build;
+			const buildConfigPath = requestedBuildPath ? await resolveBuildArtifactConfigPath(requestedBuildPath, cwd) : (await prepareBuildArtifacts(resolvedParsed, logger, options)).deployConfigPath;
+			const prepared = await prepareDeployConfig({
+				cwd,
+				configPath,
+				environment,
+				buildConfigPath,
+				preview,
+				branchName,
+				logger,
+				force: resolvedParsed.options.force === true
+			});
+			const createdPreviewResourcesSummary = prepared.previewScopedResources ? summarizeDeployResourceNames(prepared.previewScopedResources.created) : null;
+			if (createdPreviewResourcesSummary) logLine(logger, `Provisioned preview-scoped resources: ${createdPreviewResourcesSummary}`);
+			const existingPreviewResourcesSummary = prepared.previewScopedResources ? summarizeDeployResourceNames(prepared.previewScopedResources.existing) : null;
+			if (existingPreviewResourcesSummary) logLine(logger, `Reused preview-scoped resources: ${existingPreviewResourcesSummary}`);
+			const createdDeployResourcesSummary = summarizeDeployResourceNames(prepared.deployResources.created);
+			if (createdDeployResourcesSummary) logLine(logger, `Provisioned deploy resources: ${createdDeployResourcesSummary}`);
+			const existingDeployResourcesSummary = summarizeDeployResourceNames(prepared.deployResources.existing);
+			if (existingDeployResourcesSummary) logLine(logger, `Reused deploy resources: ${existingDeployResourcesSummary}`);
+			for (const warning of prepared.previewScopedResources?.warnings ?? []) logger.warn(warning);
+			for (const warning of prepared.deployResources.warnings) logger.warn(warning);
+			if (requestedBuildPath) logLine(logger, `${dim("build", theme)} ${green(buildConfigPath, theme)}`);
+			logLine(logger, `${dim("worker", theme)} ${green(prepared.config.name, theme)}`);
+			const localWranglerExecutable = await resolveLocalWranglerExecutable(cwd, deps.fs);
+			const isBranchScopedPreviewDeployment = !preview && environment === "preview" && typeof resolvedPreviewScopeName === "string" && resolvedPreviewScopeName.length > 0;
+			if (preview) {
+				logger.warn("Cloudflare preview uploads cannot be the first upload for a brand-new Worker.");
+				if (prepared.config.bindings?.durableObjects && Object.keys(prepared.config.bindings.durableObjects).length > 0) logger.warn("Cloudflare does not currently generate preview URLs for Workers that implement Durable Objects.");
+				if (prepared.config.migrations && prepared.config.migrations.length > 0) logger.warn("Cloudflare versions upload does not currently support Durable Object migrations.");
+			}
+			logLine(logger, dim(preview ? "Uploading preview version with Wrangler…" : "Deploying with Wrangler…", theme));
+			const deployStartedAt = /* @__PURE__ */ new Date();
+			const wranglerOutputDirectory = join(cwd, ".devflare");
+			const wranglerOutputFilePath = join(wranglerOutputDirectory, `wrangler-output-${Date.now()}-${process.pid}.ndjson`);
+			await deps.fs.mkdir(wranglerOutputDirectory, { recursive: true });
+			const wranglerCommand = localWranglerExecutable ? "node" : "bunx";
+			const wranglerArgs = preview ? localWranglerExecutable ? [
+				localWranglerExecutable,
+				"versions",
+				"upload"
+			] : [
+				"wrangler",
+				"versions",
+				"upload"
+			] : localWranglerExecutable ? [localWranglerExecutable, "deploy"] : ["wrangler", "deploy"];
+			wranglerArgs.push("--config", prepared.deployConfigPath);
+			if (deployMessage?.trim()) wranglerArgs.push("--message", deployMessage.trim());
+			if (deployTag?.trim()) wranglerArgs.push("--tag", deployTag.trim());
+			const deployProc = await deps.exec.exec(wranglerCommand, wranglerArgs, {
+				cwd,
+				stdio: "inherit",
+				env: {
+					...process.env,
+					WRANGLER_OUTPUT_FILE_PATH: wranglerOutputFilePath,
+					FORCE_COLOR: process.env.FORCE_COLOR ?? "0"
+				}
+			});
+			let structuredOutput = "";
+			try {
+				structuredOutput = await deps.fs.readFile(wranglerOutputFilePath, "utf8");
+			} catch {
+				structuredOutput = "";
+			} finally {
+				try {
+					await deps.fs.unlink(wranglerOutputFilePath);
+				} catch {}
+			}
+			const parsedOutput = mergeParsedWranglerDeployOutputs(parseWranglerDeployOutput([deployProc.stdout, deployProc.stderr].filter((value) => typeof value === "string" && value.length > 0).join("\n")), structuredOutput ? parseWranglerStructuredOutput(structuredOutput) : {
+				urls: [],
+				versionId: void 0,
+				previewUrl: void 0
+			});
+			const workersDevUrl = parsedOutput.urls.find((url) => url.includes("workers.dev"));
+			let resolvedAccountId = normalizeCloudflareAccountId(prepared.config.accountId) ?? normalizeCloudflareAccountId(process.env.CLOUDFLARE_ACCOUNT_ID);
+			let didAttemptAccountResolution = false;
+			const versionRecoveryDiagnostics = [];
+			const ensureResolvedAccountId = async () => {
+				if (resolvedAccountId || didAttemptAccountResolution) return resolvedAccountId;
+				didAttemptAccountResolution = true;
+				resolvedAccountId = await resolveDeployAccountId(void 0);
+				return resolvedAccountId;
+			};
+			let resolvedVersionId = parsedOutput.versionId;
+			let resolvedPreviewUrl = parsedOutput.previewUrl;
+			let loggedVersionId = false;
+			let verificationNote;
+			const persistDeployMetadata = async (input) => {
+				await writeDeployResultMetadata({
+					status: input.status,
+					exitCode: input.exitCode,
+					workerName: prepared.config.name,
+					preview,
+					branchScopedPreview: isBranchScopedPreviewDeployment,
+					previewScope: resolvedPreviewScopeName,
+					versionId: resolvedVersionId,
+					previewUrl: resolvedPreviewUrl,
+					workersDevUrl,
+					verificationNote,
+					outputUrls: parsedOutput.urls,
+					structuredOutput,
+					...input.error ? { error: input.error } : {}
+				});
+			};
+			if (deployProc.exitCode !== 0) {
+				await persistDeployMetadata({
+					status: "failure",
+					exitCode: 1,
+					error: deployProc.stderr || deployProc.stdout || "Wrangler deploy failed"
+				});
+				logger.error("Deployment failed");
+				return {
+					exitCode: 1,
+					output: structuredOutput
+				};
+			}
+			if (!preview && !resolvedVersionId && !isBranchScopedPreviewDeployment) resolvedAccountId = await ensureResolvedAccountId();
+			if (isBranchScopedPreviewDeployment && !resolvedPreviewUrl) resolvedAccountId = await ensureResolvedAccountId();
+			if (isBranchScopedPreviewDeployment && !resolvedPreviewUrl && resolvedAccountId) {
+				const workersSubdomain = await getWorkersSubdomain(resolvedAccountId);
+				if (workersSubdomain) resolvedPreviewUrl = formatWorkersDevUrl(prepared.config.name, workersSubdomain);
+			}
+			if (!resolvedVersionId && resolvedAccountId) try {
+				resolvedVersionId = await resolveVersionIdFromLatestWorkerVersion({
+					accountId: resolvedAccountId,
+					workerName: prepared.config.name,
+					preview: preview || isBranchScopedPreviewDeployment,
+					deployedAfter: deployStartedAt
+				});
+				logger.success(`Version ID: ${resolvedVersionId}`);
+				loggedVersionId = true;
+				logLine(logger, dim("Resolved version id from Cloudflare version metadata", theme));
+			} catch (error) {
+				const message = error instanceof Error ? error.message : String(error);
+				versionRecoveryDiagnostics.push(`version lookup: ${message}`);
+			}
+			if (isBranchScopedPreviewDeployment && !resolvedVersionId && resolvedAccountId) try {
+				const fallbackDeployment = await resolveVersionIdFromLatestProductionDeployment({
+					accountId: resolvedAccountId,
+					workerName: prepared.config.name,
+					deployedAfter: deployStartedAt
+				});
+				resolvedVersionId = fallbackDeployment.versionId;
+				logger.success(`Version ID: ${resolvedVersionId}`);
+				loggedVersionId = true;
+				logLine(logger, dim(`Resolved version id from Cloudflare deployment ${fallbackDeployment.deploymentId}`, theme));
+			} catch (error) {
+				const message = error instanceof Error ? error.message : String(error);
+				versionRecoveryDiagnostics.push(`deployment lookup: ${message}`);
+			}
+			if (!preview && !isBranchScopedPreviewDeployment && !resolvedVersionId && resolvedAccountId) try {
+				const fallbackDeployment = await resolveVersionIdFromLatestProductionDeployment({
+					accountId: resolvedAccountId,
+					workerName: prepared.config.name,
+					deployedAfter: deployStartedAt
+				});
+				resolvedVersionId = fallbackDeployment.versionId;
+				logger.success(`Version ID: ${resolvedVersionId}`);
+				loggedVersionId = true;
+				logLine(logger, dim(`Resolved version id from Cloudflare deployment ${fallbackDeployment.deploymentId}`, theme));
+			} catch (error) {
+				const message = error instanceof Error ? error.message : String(error);
+				versionRecoveryDiagnostics.push(`deployment lookup: ${message}`);
+			}
+			if (!preview && !isBranchScopedPreviewDeployment && !resolvedVersionId && resolvedAccountId) try {
+				const currentDeployment = await resolveVersionIdFromCurrentProductionDeployment({
+					accountId: resolvedAccountId,
+					workerName: prepared.config.name
+				});
+				resolvedVersionId = currentDeployment.versionId;
+				logger.success(`Version ID: ${resolvedVersionId}`);
+				loggedVersionId = true;
+				const reuseMessage = `Cloudflare did not expose a fresh deployment or version after verification retries, and the current active deployment ${currentDeployment.deploymentId} still points at version ${resolvedVersionId}. This usually means the built Worker code and configuration were unchanged, so Cloudflare kept the existing live version.`;
+				verificationNote = reuseMessage;
+				if (requireFreshProductionDeployment) {
+					await persistDeployMetadata({
+						status: "failure",
+						exitCode: 1,
+						error: reuseMessage
+					});
+					logger.error(`Deployment verification failed: ${reuseMessage} This run requires a fresh production deployment, so Devflare is treating the reused live version as a failure.`);
+					return {
+						exitCode: 1,
+						output: structuredOutput
+					};
+				}
+				logger.warn(`Deployment verification note: ${reuseMessage}`);
+			} catch (error) {
+				const message = error instanceof Error ? error.message : String(error);
+				versionRecoveryDiagnostics.push(`current production deployment: ${message}`);
+			}
+			if (resolvedVersionId && !loggedVersionId) logger.success(`Version ID: ${resolvedVersionId}`);
+			if (isBranchScopedPreviewDeployment && !resolvedPreviewUrl && resolvedAccountId) {
+				const workersSubdomain = await getWorkersSubdomain(resolvedAccountId);
+				if (workersSubdomain) resolvedPreviewUrl = formatWorkersDevUrl(prepared.config.name, workersSubdomain);
+			}
+			if ((preview || isBranchScopedPreviewDeployment) && resolvedPreviewUrl) logLine(logger, `Preview URL: ${resolvedPreviewUrl}`);
+			if (shouldVerifyDeployControlPlane()) {
+				if (!resolvedVersionId) {
+					const recoveryDetails = versionRecoveryDiagnostics.length > 0 ? ` Cloudflare fallback checks also failed: ${versionRecoveryDiagnostics.join(" | ")}` : "";
+					await persistDeployMetadata({
+						status: "failure",
+						exitCode: 1,
+						error: `Wrangler did not return a Worker version id, so Devflare could not prove which version Cloudflare accepted.${recoveryDetails}`
+					});
+					logger.error(`Deployment verification failed: Wrangler did not return a Worker version id, so Devflare could not prove which version Cloudflare accepted.${recoveryDetails}`);
+					return {
+						exitCode: 1,
+						output: structuredOutput
+					};
+				}
+				resolvedAccountId = await ensureResolvedAccountId();
+				if (!resolvedAccountId) {
+					await persistDeployMetadata({
+						status: "failure",
+						exitCode: 1,
+						error: "Devflare could not resolve a Cloudflare account id."
+					});
+					logger.error("Deployment verification failed: Devflare could not resolve a Cloudflare account id. Pass cloudflare-account-id to the action or set accountId in devflare.config.ts.");
+					return {
+						exitCode: 1,
+						output: structuredOutput
+					};
+				}
+				try {
+					await verifyDeployControlPlane({
+						accountId: resolvedAccountId,
+						workerName: prepared.config.name,
+						versionId: resolvedVersionId,
+						preview,
+						logger,
+						theme
+					});
+				} catch (error) {
+					const message = error instanceof Error ? error.message : String(error);
+					await persistDeployMetadata({
+						status: "failure",
+						exitCode: 1,
+						error: message
+					});
+					logger.error(`Deployment verification failed: ${message}`);
+					return {
+						exitCode: 1,
+						output: structuredOutput
+					};
+				}
+			}
+			if (resolvedAccountId) {
+				const previewRegistryScope = isBranchScopedPreviewDeployment ? deployTarget.previewScope : void 0;
+				const previewRegistryUrl = preview || isBranchScopedPreviewDeployment ? resolvedPreviewUrl : void 0;
+				try {
+					await reconcilePreviewRegistry({
+						accountId: resolvedAccountId,
+						workerName: prepared.config.name,
+						versionId: resolvedVersionId,
+						previewScope: previewRegistryScope,
+						previewUrl: previewRegistryUrl,
+						branchName: resolvedPreviewScopeName,
+						commitSha: process.env.GITHUB_SHA,
+						source: inferRecordSource(),
+						deploymentMessage: process.env.GITHUB_EVENT_NAME,
+						logger
+					});
+				} catch (error) {
+					const message = error instanceof Error ? error.message : String(error);
+					logger.warn(`Devflare preview registry sync failed: ${message}`);
+				}
+			}
+			await persistDeployMetadata({
+				status: "success",
+				exitCode: 0
+			});
+			logger.success("Deployed successfully!");
+			return {
+				exitCode: 0,
+				output: structuredOutput
+			};
+		});
+	} catch (error) {
+		await writeDeployResultMetadata({
+			status: "failure",
+			exitCode: 1,
+			preview,
+			branchScopedPreview: !preview && environment === "preview" && Boolean(resolvedPreviewScopeName),
+			previewScope: resolvedPreviewScopeName,
+			outputUrls: [],
+			...error instanceof Error ? { error: error.message } : { error: String(error) }
+		});
+		if (error instanceof Error) {
+			logger.error("Deployment failed:", error.message);
+			if (resolvedParsed.options.debug) logger.error(error.stack);
+		}
+		return { exitCode: 1 };
+	}
+}
+//#endregion
+export { runDeployCommand };