devflare 1.0.0-next.47 → 1.0.0-next.49

package/README.md

@@ -188,6 +188,7 @@ for examples with file paths.
 | `devflare productions` | inspect or manage production Worker versions |
 | `devflare remote` | manage remote test mode |
 | `devflare secrets` | manage local Secrets Store values |
+| `devflare tail` | stream live logs from a deployed Worker |
 | `devflare tokens` | create and manage Devflare-scoped API tokens |
 | `devflare types` | generate `env.d.ts` |
 | `devflare version` | print the installed version |

package/dist/_chunks/{account-Cdo_cRNv.js → account-BI3WZMDy.js}

@@ -3,7 +3,7 @@ import { a as setGlobalDefaultAccountId, i as getWorkspaceAccountId, o as setWor
 import { t as account } from "./cloudflare-BaloqI3H.js";
 import { a as DIM, c as RESET, i as CYAN_BOLD, r as CYAN } from "./colors-DiK6wPJ5.js";
 import { c as formatCommand, d as green, f as logLine, g as yellow, h as whiteDim, l as formatLabelValue, n as bold, o as dim, p as logTable, r as createCliTheme } from "./ui-BUoZApvE.js";
-import { n as getConfiguredAccountId } from "./command-utils-C48hJMln.js";
+import { n as getConfiguredAccountId } from "./command-utils-DA0Qx9_K.js";
 //#region src/cli/commands/account.ts
 const ACCOUNT_SUBCOMMANDS = [
 	"info",

package/dist/_chunks/{build-artifacts-CaSTDXLE.js → build-artifacts-DU5V0J0Z.js}

@@ -1,10 +1,10 @@
 import { d as resolveConfigEnvVars } from "./preview-C3Cdr8an.js";
-import { r as loadConfig, u as resolveConfigForEnvironment } from "./loader-RZhqzsRJ.js";
-import { c as writeWranglerConfig, i as isolateViteBuildOutputPaths$1, o as rebaseWranglerConfigPaths, t as compileBuildConfig } from "./compiler-Dc97FkBg.js";
+import { r as loadConfig, u as resolveConfigForEnvironment } from "./loader-Cr0_OWPy.js";
+import { c as writeWranglerConfig, i as isolateViteBuildOutputPaths$1, o as rebaseWranglerConfigPaths, t as compileBuildConfig } from "./compiler-Zw16C9Pi.js";
 import { f as logLine } from "./ui-BUoZApvE.js";
 import { n as getPackageVersion } from "./package-metadata-DjHBLB-z.js";
 import { t as resolvePackageSpecifier } from "./resolve-package-qizBfCIm.js";
-import { i as writeGeneratedViteConfig, l as prepareComposedWorkerEntrypoint, n as resolveEffectiveViteProject } from "./vite-D5dfVb6G.js";
+import { i as writeGeneratedViteConfig, l as prepareComposedWorkerEntrypoint, n as resolveEffectiveViteProject } from "./vite-CGtVNf5E.js";
 import { t as bundleWorkerEntry } from "./worker-bundler-dTTnYU3n.js";
 import { t as detectViteProject } from "./vite-utils-OVLMV605.js";
 import { t as getDependencies } from "./dependencies-C2oxFjU_.js";

package/dist/_chunks/{build-B6vCBDdQ.js → build-e0KR38-4.js}

@@ -1,5 +1,5 @@
 import { a as cyanBold, f as logLine, o as dim, r as createCliTheme } from "./ui-BUoZApvE.js";
-import { t as prepareBuildArtifacts } from "./build-artifacts-CaSTDXLE.js";
+import { t as prepareBuildArtifacts } from "./build-artifacts-DU5V0J0Z.js";
 //#region src/cli/commands/build.ts
 async function runBuildCommand(parsed, logger, options) {
 	const theme = createCliTheme(parsed.options);

package/dist/_chunks/{cli-Ba6JBLOz.js → cli-DuUz10Mn.js}

@@ -20,6 +20,7 @@ const COMMANDS = [
 	"worker",
 	"tokens",
 	"secrets",
+	"tail",
 	"ai",
 	"remote",
 	"help",
@@ -260,6 +261,7 @@ const CORE_HELP_PAGES = [
 			entry("worker", "Rename and manage Worker control-plane operations"),
 			entry("tokens", "Manage Devflare-managed Cloudflare API tokens"),
 			entry("secrets", "Manage local Secrets Store values"),
+			entry("tail", "Stream live logs from a deployed Worker"),
 			entry("ai", "View Workers AI pricing information"),
 			entry("remote", "Manage remote test mode for paid Cloudflare features"),
 			entry("help", "Show command overview or a command-specific help page"),
@@ -346,6 +348,7 @@ const CORE_HELP_PAGES = [
 			"devflare deploy --production [--config <path>] [--build <path>] [--message <text>] [--tag <text>] [--debug]",
 			"devflare deploy --preview <name> [--config <path>] [--build <path>] [--message <text>] [--tag <text>]",
 			"devflare deploy --preview [--config <path>] [--build <path>] [--branch-name <branch>] [--message <text>] [--tag <text>]",
+			"devflare deploy --prod --percentage <n> [--version <current-version-id>] [--config <path>] [--message <text>]",
 			"devflare deploy --prod --dry-run [--config <path>]",
 			"devflare deploy --preview <name> --dry-run [--config <path>]",
 			"devflare deploy --preview --dry-run [--config <path>]"
@@ -367,6 +370,8 @@ const CORE_HELP_PAGES = [
 			entry("--branch-name <branch>", "Provide explicit branch metadata for preview-aware naming when your workflow needs it"),
 			entry("--message <text>", "Attach an explicit Wrangler deployment/version message"),
 			entry("--tag <text>", "Attach an explicit Wrangler version tag"),
+			entry("--percentage <n>", "Production gradual rollout: upload a new version and route n% (0-100) of traffic to it via `wrangler versions deploy`"),
+			entry("--version <id>", "With --percentage, the currently-live version id that keeps the remaining traffic (otherwise Wrangler distributes it)"),
 			entry("--debug", "Print stack traces when deployment orchestration fails")
 		],
 		examples: [
@@ -376,10 +381,12 @@ const CORE_HELP_PAGES = [
 			entry("devflare deploy --preview next", "Deploy the named `next` preview scope and provision preview-scoped resources automatically"),
 			entry("devflare deploy --preview pr-1", "Deploy the named `pr-1` preview scope directly"),
 			entry("devflare deploy --preview --branch-name feature-branch", "Upload a same-worker preview version with explicit branch metadata"),
-			entry("devflare deploy --preview next --dry-run", "Inspect the generated named-preview Wrangler config without deploying")
+			entry("devflare deploy --preview next --dry-run", "Inspect the generated named-preview Wrangler config without deploying"),
+			entry("devflare deploy --prod --percentage 10", "Upload a new version and route 10% of production traffic to it (canary)")
 		],
 		notes: [
 			"`devflare deploy` without an explicit target is rejected from the CLI so production and preview destinations stay unmistakable.",
+			"`--percentage <n>` performs a Cloudflare gradual deployment: Devflare runs `wrangler versions upload` (no traffic shift) and then `wrangler versions deploy <new-version-id>@<n> --yes`, routing n% of production traffic to the new version. Pass `--version <id>` to keep the remaining traffic on a specific currently-live version; otherwise Wrangler distributes the rest. To advance an existing rollout (e.g. 10% → 50% → 100%) without re-uploading, drive `wrangler versions deploy` directly. `--percentage` is production-only and rejected with `--preview`.",
 			"`--prod` / `--production` clear preview-scope environment overrides such as `DEVFLARE_PREVIEW_BRANCH` so production deploys stay pointed at stable Worker names.",
 			"Named preview deploys automatically provision preview-scoped resources before building and deploying.",
 			"When a build artifact still contains name-based bindings, deploy resolves or provisions the concrete Cloudflare resources and rewrites the generated Wrangler config with the IDs Wrangler requires.",
@@ -408,7 +415,11 @@ const CORE_HELP_PAGES = [
 			entry("devflare secrets --local --store store-123 --list", "List names in one local store"),
 			entry("devflare secrets --local --store store-123 --name api-token --delete", "Delete one local secret value")
 		],
-		notes: ["Local values are stored in `.devflare/secrets.local.json`, which is ignored by the repository template.", "Command output prints store/name references only; it does not echo secret values."]
+		notes: [
+			"Local values are stored in `.devflare/secrets.local.json`, which is ignored by the repository template.",
+			"Command output prints store/name references only; it does not echo secret values.",
+			"Runtime secrets are local-only here: set production secret values with `wrangler secret put` or the Cloudflare dashboard. Devflare never sends secret values to Cloudflare — deploy emits Secrets Store references only."
+		]
 	},
 	{
 		path: ["types"],
@@ -563,6 +574,25 @@ const MISC_HELP_PAGES = [
 		],
 		notes: ["Created tokens include the selected account resource and all zones in that account so deploys can manage Worker routes and custom-domain route state.", "Cloudflare only returns token secrets once for create and roll operations, so store them immediately."]
 	},
+	{
+		path: ["tail"],
+		summary: "Stream live logs from a deployed Worker",
+		usage: ["devflare tail [worker] [--worker <name>] [--format <pretty|json>] [--account <id>] [--config <path>]"],
+		description: ["Streams live request logs and exceptions from a Worker that is already deployed to Cloudflare, using Cloudflare’s Workers Trace (tail) API.", "This command is inherently remote: it opens a real tail session against your live Worker. There is no local emulation of deployed traffic — use `devflare dev` and `cf.tail.trigger()` for local/offline tail-handler testing."],
+		arguments: [entry("[worker]", "Worker name to tail (defaults to --worker, then the config `name`)")],
+		options: [
+			entry("--worker <name>", "Worker name to tail instead of the configured `name`"),
+			entry("--format <pretty|json>", "Output format: human-readable lines (default) or raw JSON events"),
+			entry("--account <id>", "Use a specific Cloudflare account instead of the resolved default"),
+			entry("--config <path>", "Use a specific devflare config file to resolve the Worker name/account")
+		],
+		examples: [
+			entry("devflare tail", "Stream logs from the Worker named in the current config"),
+			entry("devflare tail my-worker", "Stream logs from an explicitly named Worker"),
+			entry("devflare tail --format json", "Stream raw JSON tail events for piping into other tools")
+		],
+		notes: ["Requires Cloudflare authentication (`devflare login` or CLOUDFLARE_API_TOKEN) and a resolvable account id.", "Press Ctrl-C to stop; Devflare deletes the tail session and closes the WebSocket on exit. Cloudflare also expires idle tail sessions on its own."]
+	},
 	{
 		path: ["ai"],
 		summary: "Show Workers AI pricing information",
@@ -1050,6 +1080,7 @@ async function runCli(argv, options = {}) {
 		case "worker": return runWorker(parsed, logger, options);
 		case "tokens": return runToken(parsed, logger, options);
 		case "secrets": return runSecrets(parsed, logger, options);
+		case "tail": return runTail(parsed, logger, options);
 		case "ai": return runAI();
 		case "remote": return runRemote(parsed, logger, options);
 		default:
@@ -1062,60 +1093,64 @@ async function runInit(parsed, logger, options) {
 	return runInitCommand(parsed, logger, options);
 }
 async function runDev(parsed, logger, options) {
-	const { runDevCommand } = await import("./dev-DaREvpZf.js");
+	const { runDevCommand } = await import("./dev-D4e_RRZn.js");
 	return runDevCommand(parsed, logger, options);
 }
 async function runBuild(parsed, logger, options) {
-	const { runBuildCommand } = await import("./build-B6vCBDdQ.js");
+	const { runBuildCommand } = await import("./build-e0KR38-4.js");
 	return runBuildCommand(parsed, logger, options);
 }
 async function runDeploy(parsed, logger, options) {
-	const { runDeployCommand } = await import("./deploy-0w_38g8h.js");
+	const { runDeployCommand } = await import("./deploy-B-Kku1Vk.js");
 	return runDeployCommand(parsed, logger, {
 		...options,
 		requireExplicitDeployTarget: true
 	});
 }
 async function runTypes(parsed, logger, options) {
-	const { runTypesCommand } = await import("./types-Zn9vyUGA.js");
+	const { runTypesCommand } = await import("./types-DoKsMYfm.js");
 	return runTypesCommand(parsed, logger, options);
 }
 async function runDoctor(parsed, logger, options) {
-	const { runDoctorCommand } = await import("./doctor-lFlh-olK.js");
+	const { runDoctorCommand } = await import("./doctor-jm_K4dxL.js");
 	return runDoctorCommand(parsed, logger, options);
 }
 async function runConfig(parsed, logger, options) {
-	const { runConfigCommand } = await import("./config-DQ_uWv37.js");
+	const { runConfigCommand } = await import("./config-Brju62xy.js");
 	return runConfigCommand(parsed, logger, options);
 }
 async function runAccount(parsed, logger, options) {
-	const { runAccountCommand } = await import("./account-Cdo_cRNv.js");
+	const { runAccountCommand } = await import("./account-BI3WZMDy.js");
 	return runAccountCommand(parsed, logger, options);
 }
 async function runLogin(parsed, logger, options) {
-	const { runLoginCommand } = await import("./login-DnyfffOC.js");
+	const { runLoginCommand } = await import("./login-FjTAAQbi.js");
 	return runLoginCommand(parsed, logger, options);
 }
 async function runPreviews(parsed, logger, options) {
-	const { runPreviewsCommand } = await import("./previews-wI-pW6HM.js");
+	const { runPreviewsCommand } = await import("./previews-C7hs9-BT.js");
 	return runPreviewsCommand(parsed, logger, options);
 }
 async function runProductions(parsed, logger, options) {
-	const { runProductionsCommand } = await import("./productions-BpROdhLN.js");
+	const { runProductionsCommand } = await import("./productions-T9Als4fE.js");
 	return runProductionsCommand(parsed, logger, options);
 }
 async function runWorker(parsed, logger, options) {
-	const { runWorkerCommand } = await import("./worker-rL5udcl9.js");
+	const { runWorkerCommand } = await import("./worker-BEZI4od1.js");
 	return runWorkerCommand(parsed, logger, options);
 }
 async function runToken(parsed, logger, options) {
-	const { runTokenCommand } = await import("./token-kguIDmej.js");
+	const { runTokenCommand } = await import("./token-Dmi0KXyX.js");
 	return runTokenCommand(parsed, logger, options);
 }
 async function runSecrets(parsed, logger, options) {
 	const { runSecretsCommand } = await import("./secrets-DIpJGe6C.js");
 	return runSecretsCommand(parsed, logger, options);
 }
+async function runTail(parsed, logger, options) {
+	const { runTailCommand } = await import("./tail-IY-ijYmv.js");
+	return runTailCommand(parsed, logger, options);
+}
 async function runAI() {
 	const { runAICommand } = await import("./ai-CBEuLdoP.js");
 	return runAICommand();

package/dist/_chunks/{command-utils-C48hJMln.js → command-utils-DA0Qx9_K.js}

@@ -1,4 +1,4 @@
-import { i as resolveConfigPath, r as loadConfig } from "./loader-RZhqzsRJ.js";
+import { i as resolveConfigPath, r as loadConfig } from "./loader-Cr0_OWPy.js";
 import { d as getPrimaryAccount, i as getWorkspaceAccountId, n as getEffectiveAccountId } from "./preferences-BKp_7XJx.js";
 //#region src/cli/command-utils.ts
 function asOptionalString(value) {

package/dist/_chunks/{compiler-Dc97FkBg.js → compiler-Zw16C9Pi.js}

@@ -1,4 +1,4 @@
-import { f as normalizeCompatibilityFlags, u as resolveConfigForEnvironment } from "./loader-RZhqzsRJ.js";
+import { p as normalizeCompatibilityFlags, u as resolveConfigForEnvironment } from "./loader-Cr0_OWPy.js";
 import { C as browserBindingSchema, _ as normalizeSecretsStoreBinding, a as normalizeD1Binding, b as normalizeVpcServiceBinding, c as normalizeFlagshipBinding, d as normalizeKVBinding, f as normalizeMediaBinding, g as normalizeR2Binding, h as normalizeQueueProducer, i as normalizeArtifactsBinding, l as normalizeHyperdriveBinding, m as normalizePipelineBinding, o as normalizeDOBinding, p as normalizeMtlsCertificateBinding, r as getSingleBrowserBindingName, s as normalizeDispatchNamespaceBinding, u as normalizeImagesBinding, v as normalizeStreamBinding, x as normalizeWorkflowBinding, y as normalizeVpcNetworkBinding } from "./schema-normalization-BCwTLTGp.js";
 import { n as toWranglerSecretsConfig } from "./local-dev-vars-CTSa-wvF.js";
 import { basename, isAbsolute, relative, resolve } from "pathe";

package/dist/_chunks/{config-DQ_uWv37.js → config-Brju62xy.js}

@@ -1,6 +1,6 @@
 import { d as resolveConfigEnvVars } from "./preview-C3Cdr8an.js";
-import { a as ConfigResourceResolutionError, o as loadResolvedConfig, r as loadConfig, s as resolveResources } from "./loader-RZhqzsRJ.js";
-import { n as compileConfig, t as compileBuildConfig } from "./compiler-Dc97FkBg.js";
+import { a as ConfigResourceResolutionError, o as loadResolvedConfig, r as loadConfig, s as resolveResources } from "./loader-Cr0_OWPy.js";
+import { n as compileConfig, t as compileBuildConfig } from "./compiler-Zw16C9Pi.js";
 //#region src/cli/commands/config.ts
 function isSupportedFormat(value) {
 	return value === "devflare" || value === "wrangler";

package/dist/_chunks/{config-path-ePwIvHNX.js → config-path-DaL1ylZ_.js}

@@ -1,4 +1,4 @@
-import { i as resolveConfigPath } from "./loader-RZhqzsRJ.js";
+import { i as resolveConfigPath } from "./loader-Cr0_OWPy.js";
 import { i as findFiles } from "./glob-CmQOvunB.js";
 import { stat } from "node:fs/promises";
 //#region src/cli/config-path.ts

package/dist/_chunks/{deploy-0w_38g8h.js → deploy-B-Kku1Vk.js}

@@ -1,15 +1,15 @@
 import { a as resolvePreviewIdentifier, d as resolveConfigEnvVars } from "./preview-C3Cdr8an.js";
-import { c as prepareConfigResourcesForDeploy, r as loadConfig, u as resolveConfigForEnvironment } from "./loader-RZhqzsRJ.js";
-import { a as readWranglerConfig, c as writeWranglerConfig, n as compileConfig, o as rebaseWranglerConfigPaths, s as stringifyConfig, t as compileBuildConfig } from "./compiler-Dc97FkBg.js";
+import { c as prepareConfigResourcesForDeploy, r as loadConfig, u as resolveConfigForEnvironment } from "./loader-Cr0_OWPy.js";
+import { a as readWranglerConfig, c as writeWranglerConfig, n as compileConfig, o as rebaseWranglerConfigPaths, s as stringifyConfig, t as compileBuildConfig } from "./compiler-Zw16C9Pi.js";
 import { d as getPrimaryAccount, n as getEffectiveAccountId } from "./preferences-BKp_7XJx.js";
 import { D as listWorkerVersions, E as listWorkerDeployments, O as listWorkers, T as getWorkersSubdomain, c as reconcilePreviewRegistry, w as getWorkerVersionDetail, x as formatWorkersDevUrl } from "./preview-registry-ClAbLTHH.js";
 import { _ as yellowBold, d as green, f as logLine, g as yellow, o as dim, r as createCliTheme } from "./ui-BUoZApvE.js";
 import { n as getPackageVersion } from "./package-metadata-DjHBLB-z.js";
 import { t as resolvePackageSpecifier } from "./resolve-package-qizBfCIm.js";
-import { t as asOptionalString } from "./command-utils-C48hJMln.js";
-import { a as createBuildManifest, i as compareManifests, n as applyDeploymentStrategy, o as formatDriftWarning, r as describeDeploymentStrategy, s as readBuildManifest, t as prepareBuildArtifacts } from "./build-artifacts-CaSTDXLE.js";
+import { t as asOptionalString } from "./command-utils-DA0Qx9_K.js";
+import { a as createBuildManifest, i as compareManifests, n as applyDeploymentStrategy, o as formatDriftWarning, r as describeDeploymentStrategy, s as readBuildManifest, t as prepareBuildArtifacts } from "./build-artifacts-DU5V0J0Z.js";
 import { t as getDependencies } from "./dependencies-C2oxFjU_.js";
-import { n as preparePreviewScopedResourcesForDeploy } from "./preview-resources-xziKCynb.js";
+import { n as preparePreviewScopedResourcesForDeploy } from "./preview-resources-CGMBjsYB.js";
 import { mkdir, open, readFile, rm, writeFile } from "node:fs/promises";
 import { basename, dirname, isAbsolute, join, resolve } from "pathe";
 //#region src/config/service-bindings-validation.ts
@@ -147,6 +147,68 @@ async function withTemporaryEnvironment(overrides, operation) {
 	}
 }
 //#endregion
+//#region src/cli/gradual-deploy.ts
+/**
+* Parse and validate the `--percentage` CLI option.
+*
+* Returns `undefined` when the flag is absent (a normal full deploy). Throws a
+* clear error when the value is present but not an integer in `[0, 100]` — the
+* same bounds Wrangler enforces — so a typo never silently becomes a full
+* deploy.
+*/
+function parseDeployPercentage(value) {
+	if (value === void 0) return;
+	if (value === true || value === false) throw new Error("--percentage requires a value between 0 and 100, e.g. `--percentage 10`.");
+	const trimmed = value.trim();
+	if (!/^\d+$/.test(trimmed)) throw new Error(`--percentage must be a whole number between 0 and 100, received "${value}".`);
+	const parsed = Number.parseInt(trimmed, 10);
+	if (!Number.isInteger(parsed) || parsed < 0 || parsed > 100) throw new Error(`--percentage must be a whole number between 0 and 100, received "${value}".`);
+	return parsed;
+}
+/**
+* Build the positional `<version-id>@<percentage>` version specs for a rollout.
+*
+* Wrangler's `versions deploy` consumes traffic splits as positional specs (see
+* `wrangler versions deploy --help`: "Shorthand notation to deploy Worker
+* Version(s) [<version-id>@<percentage>..]"). When a distinct previous version
+* id is provided, the remaining percentage is routed to it so the split is
+* fully specified and Wrangler never has to prompt; otherwise only the new
+* version is named and Wrangler distributes the rest.
+*/
+function buildVersionSpecs(spec) {
+	const specs = [`${spec.versionId}@${spec.percentage}`];
+	const remaining = 100 - spec.percentage;
+	if (spec.previousVersionId && spec.previousVersionId !== spec.versionId && remaining > 0) specs.push(`${spec.previousVersionId}@${remaining}`);
+	return specs;
+}
+/**
+* Build the full `wrangler versions deploy` invocation for a gradual rollout.
+*
+* `localWranglerExecutable` mirrors the deploy command's resolution: when a
+* local `wrangler/bin/wrangler.js` exists it is run under `node`; otherwise the
+* invocation falls back to `bunx wrangler …`.
+*/
+function buildGradualDeployInvocation(spec, localWranglerExecutable) {
+	const command = localWranglerExecutable ? "node" : "bunx";
+	const args = localWranglerExecutable ? [
+		localWranglerExecutable,
+		"versions",
+		"deploy"
+	] : [
+		"wrangler",
+		"versions",
+		"deploy"
+	];
+	args.push(...buildVersionSpecs(spec));
+	args.push("--name", spec.workerName);
+	if (spec.message?.trim()) args.push("--message", spec.message.trim());
+	args.push("--yes");
+	return {
+		command,
+		args
+	};
+}
+//#endregion
 //#region src/cli/preview.ts
 function matchNamedValue(output, patterns) {
 	for (const pattern of patterns) {
@@ -555,6 +617,8 @@ async function runDeployCommand(parsed, logger, options) {
 	let deployMessage;
 	let deployTag;
 	let previewScopeName;
+	let rolloutPercentage;
+	let rolloutPreviousVersionId;
 	let requireFreshProductionDeployment = false;
 	let resolvedPreviewScopeName = process.env.DEVFLARE_PREVIEW_BRANCH?.trim() || void 0;
 	const theme = createCliTheme(parsed.options);
@@ -570,6 +634,9 @@ async function runDeployCommand(parsed, logger, options) {
 		branchName = resolvedParsed.options["branch-name"];
 		deployMessage = resolvedParsed.options.message;
 		deployTag = resolvedParsed.options.tag;
+		rolloutPercentage = parseDeployPercentage(resolvedParsed.options.percentage);
+		rolloutPreviousVersionId = typeof resolvedParsed.options.version === "string" ? resolvedParsed.options.version.trim() || void 0 : void 0;
+		if (rolloutPercentage !== void 0 && deployTarget.mode !== "production") throw new Error("--percentage is a production gradual rollout and is only valid with an explicit production target. Run `devflare deploy --prod --percentage <n>` (it cannot be combined with --preview or a named/branch preview deploy).");
 		previewScopeName = branchName?.trim() || deployTarget.previewScopeRaw || void 0;
 		resolvedPreviewScopeName = previewScopeName || process.env.DEVFLARE_PREVIEW_BRANCH?.trim() || void 0;
 		requireFreshProductionDeployment = !preview && shouldRequireFreshProductionDeployment();
@@ -591,6 +658,7 @@ async function runDeployCommand(parsed, logger, options) {
 				});
 				const wranglerConfig = compileBuildConfig(deploymentStrategy.config, void 0, { alreadyResolved: true });
 				logLine(logger, `${yellow("dry run", theme)} ${dim("Skipping actual deployment", theme)}`);
+				if (rolloutPercentage !== void 0) logLine(logger, dim(`Would upload a new Worker version and route ${rolloutPercentage}% of production traffic to it via \`wrangler versions deploy\`${rolloutPreviousVersionId ? `, keeping ${100 - rolloutPercentage}% on version ${rolloutPreviousVersionId}` : ""}.`, theme));
 				const deploymentStrategyMessage = describeDeploymentStrategy(deploymentStrategy);
 				if (deploymentStrategyMessage) logLine(logger, dim(deploymentStrategyMessage, theme));
 				logLine(logger, dim("Would deploy with wrangler config:", theme));
@@ -647,13 +715,15 @@ async function runDeployCommand(parsed, logger, options) {
 				if (prepared.config.bindings?.durableObjects && Object.keys(prepared.config.bindings.durableObjects).length > 0) logger.warn("Cloudflare does not currently generate preview URLs for Workers that implement Durable Objects.");
 				if (prepared.config.migrations && prepared.config.migrations.length > 0) logger.warn("Cloudflare versions upload does not currently support Durable Object migrations.");
 			}
-			logLine(logger, dim(preview ? "Uploading preview version with Wrangler…" : "Deploying with Wrangler…", theme));
+			const usePercentageRollout = !preview && !isBranchScopedPreviewDeployment && rolloutPercentage !== void 0;
+			const uploadVersionOnly = preview || usePercentageRollout;
+			logLine(logger, dim(preview ? "Uploading preview version with Wrangler…" : usePercentageRollout ? "Uploading new Worker version with Wrangler…" : "Deploying with Wrangler…", theme));
 			const deployStartedAt = /* @__PURE__ */ new Date();
 			const wranglerOutputDirectory = join(cwd, ".devflare");
 			const wranglerOutputFilePath = join(wranglerOutputDirectory, `wrangler-output-${Date.now()}-${process.pid}.ndjson`);
 			await deps.fs.mkdir(wranglerOutputDirectory, { recursive: true });
 			const wranglerCommand = localWranglerExecutable ? "node" : "bunx";
-			const wranglerArgs = preview ? localWranglerExecutable ? [
+			const wranglerArgs = uploadVersionOnly ? localWranglerExecutable ? [
 				localWranglerExecutable,
 				"versions",
 				"upload"
@@ -766,7 +836,7 @@ async function runDeployCommand(parsed, logger, options) {
 				const message = error instanceof Error ? error.message : String(error);
 				versionRecoveryDiagnostics.push(`deployment lookup: ${message}`);
 			}
-			if (!preview && !isBranchScopedPreviewDeployment && !resolvedVersionId && resolvedAccountId) try {
+			if (!preview && !isBranchScopedPreviewDeployment && !usePercentageRollout && !resolvedVersionId && resolvedAccountId) try {
 				const fallbackDeployment = await resolveVersionIdFromLatestProductionDeployment({
 					accountId: resolvedAccountId,
 					workerName: prepared.config.name,
@@ -780,7 +850,7 @@ async function runDeployCommand(parsed, logger, options) {
 				const message = error instanceof Error ? error.message : String(error);
 				versionRecoveryDiagnostics.push(`deployment lookup: ${message}`);
 			}
-			if (!preview && !isBranchScopedPreviewDeployment && !resolvedVersionId && resolvedAccountId) try {
+			if (!preview && !isBranchScopedPreviewDeployment && !usePercentageRollout && !resolvedVersionId && resolvedAccountId) try {
 				const currentDeployment = await resolveVersionIdFromCurrentProductionDeployment({
 					accountId: resolvedAccountId,
 					workerName: prepared.config.name
@@ -845,7 +915,7 @@ async function runDeployCommand(parsed, logger, options) {
 						accountId: resolvedAccountId,
 						workerName: prepared.config.name,
 						versionId: resolvedVersionId,
-						preview,
+						preview: preview || usePercentageRollout,
 						logger,
 						theme
 					});
@@ -863,6 +933,52 @@ async function runDeployCommand(parsed, logger, options) {
 					};
 				}
 			}
+			if (usePercentageRollout) {
+				if (!resolvedVersionId) {
+					const recoveryDetails = versionRecoveryDiagnostics.length > 0 ? ` Cloudflare fallback checks also failed: ${versionRecoveryDiagnostics.join(" | ")}` : "";
+					const rolloutError = `A new Worker version was uploaded, but Devflare could not resolve its version id, so it could not start the ${rolloutPercentage}% gradual rollout. Re-run \`devflare deploy --prod --percentage ${rolloutPercentage}\`, or split traffic manually with \`wrangler versions deploy\`.${recoveryDetails}`;
+					await persistDeployMetadata({
+						status: "failure",
+						exitCode: 1,
+						error: rolloutError
+					});
+					logger.error(rolloutError);
+					return {
+						exitCode: 1,
+						output: structuredOutput
+					};
+				}
+				const rolloutInvocation = buildGradualDeployInvocation({
+					versionId: resolvedVersionId,
+					percentage: rolloutPercentage,
+					previousVersionId: rolloutPreviousVersionId,
+					workerName: prepared.config.name,
+					message: deployMessage?.trim() || void 0
+				}, localWranglerExecutable);
+				logLine(logger, dim(`Routing ${rolloutPercentage}% of production traffic to the new version with Wrangler…`, theme));
+				const rolloutProc = await deps.exec.exec(rolloutInvocation.command, rolloutInvocation.args, {
+					cwd,
+					stdio: "inherit",
+					env: {
+						...process.env,
+						FORCE_COLOR: process.env.FORCE_COLOR ?? "0"
+					}
+				});
+				if (rolloutProc.exitCode !== 0) {
+					const rolloutError = `The new Worker version ${resolvedVersionId} was uploaded, but \`wrangler versions deploy\` failed to route ${rolloutPercentage}% of production traffic to it. Re-run the rollout, or split traffic manually with \`wrangler versions deploy\`.`;
+					await persistDeployMetadata({
+						status: "failure",
+						exitCode: 1,
+						error: rolloutProc.stderr || rolloutProc.stdout || rolloutError
+					});
+					logger.error(rolloutError);
+					return {
+						exitCode: 1,
+						output: structuredOutput
+					};
+				}
+				logger.success(`Routed ${rolloutPercentage}% of production traffic to version ${resolvedVersionId}`);
+			}
 			if (resolvedAccountId) {
 				const previewRegistryScope = isBranchScopedPreviewDeployment ? deployTarget.previewScope : void 0;
 				const previewRegistryUrl = preview || isBranchScopedPreviewDeployment ? resolvedPreviewUrl : void 0;
@@ -889,6 +1005,7 @@ async function runDeployCommand(parsed, logger, options) {
 				exitCode: 0
 			});
 			logger.success("Deployed successfully!");
+			if (!preview && !isBranchScopedPreviewDeployment) logLine(logger, dim("Runtime secrets: set production secret values with `wrangler secret put` or the Cloudflare dashboard. Devflare manages local secret values (`devflare secrets --local`) and emits Secrets Store references only — it never sends secret values to Cloudflare.", theme));
 			return {
 				exitCode: 0,
 				output: structuredOutput

package/dist/_chunks/{dev-DaREvpZf.js → dev-D4e_RRZn.js}

@@ -1,13 +1,13 @@
 import { c as getDevflareDotenvPaths, d as resolveConfigEnvVars, o as EnvVarResolutionError } from "./preview-C3Cdr8an.js";
-import { i as resolveConfigPath, r as loadConfig } from "./loader-RZhqzsRJ.js";
+import { i as resolveConfigPath, r as loadConfig } from "./loader-Cr0_OWPy.js";
 import { g as normalizeR2Binding, n as getLocalKVNamespaceIdentifier, r as getSingleBrowserBindingName, t as getLocalD1DatabaseIdentifier } from "./schema-normalization-BCwTLTGp.js";
 import { t as applyLocalDevVarsToConfig } from "./local-dev-vars-CTSa-wvF.js";
 import { a as cyanBold, f as logLine, g as yellow, o as dim, r as createCliTheme } from "./ui-BUoZApvE.js";
 import { clearLocalSendEmailBindings, setLocalSendEmailBindings } from "../utils/send-email.js";
-import { C as buildSendEmailConfig, D as buildWorkerLoadersConfig, E as buildVersionMetadataConfig, O as buildWorkflowsConfig, S as buildSecretsStoreConfig, T as buildTailConsumersConfig, _ as buildMtlsCertificatesConfig, b as buildQueueProducers, c as buildAiSearchInstancesConfig, d as buildArtifactsConfig, f as buildDispatchNamespacesConfig, g as buildMediaConfig, h as buildImagesConfig, l as buildAiSearchNamespacesConfig, m as buildHyperdrivesConfig, n as getRouteDirectoryCandidate, p as buildFlagshipConfig, s as resolveServiceBindings, t as discoverRoutes, u as buildAnalyticsEngineConfig, v as buildPipelinesConfig, w as buildStreamConfig, x as buildRateLimitsConfig, y as buildQueueConsumers } from "./routes-C4S8x2HU.js";
+import { C as buildSendEmailConfig, D as buildWorkerLoadersConfig, E as buildVersionMetadataConfig, O as buildWorkflowsConfig, S as buildSecretsStoreConfig, T as buildTailConsumersConfig, _ as buildMtlsCertificatesConfig, b as buildQueueProducers, c as buildAiSearchInstancesConfig, d as buildArtifactsConfig, f as buildDispatchNamespacesConfig, g as buildMediaConfig, h as buildImagesConfig, l as buildAiSearchNamespacesConfig, m as buildHyperdrivesConfig, n as getRouteDirectoryCandidate, p as buildFlagshipConfig, s as resolveServiceBindings, t as discoverRoutes, u as buildAnalyticsEngineConfig, v as buildPipelinesConfig, w as buildStreamConfig, x as buildRateLimitsConfig, y as buildQueueConsumers } from "./routes-BFYCqHb-.js";
 import { r as transformDurableObject } from "./durable-object-DMtH0XYX.js";
 import { i as findFiles } from "./glob-CmQOvunB.js";
-import { d as DEFAULT_FETCH_ENTRY_FILES, f as DEFAULT_QUEUE_ENTRY_FILES, g as discoverDurableObjectFiles, h as resolveWorkerSurfacePaths, i as writeGeneratedViteConfig, l as prepareComposedWorkerEntrypoint, m as hasWorkerSurfacePaths, n as resolveEffectiveViteProject, p as DEFAULT_SCHEDULED_ENTRY_FILES, u as DEFAULT_EMAIL_ENTRY_FILES } from "./vite-D5dfVb6G.js";
+import { d as DEFAULT_FETCH_ENTRY_FILES, f as DEFAULT_QUEUE_ENTRY_FILES, g as discoverDurableObjectFiles, h as resolveWorkerSurfacePaths, i as writeGeneratedViteConfig, l as prepareComposedWorkerEntrypoint, m as hasWorkerSurfacePaths, n as resolveEffectiveViteProject, p as DEFAULT_SCHEDULED_ENTRY_FILES, u as DEFAULT_EMAIL_ENTRY_FILES } from "./vite-CGtVNf5E.js";
 import { a as createWorkerdBundlerDefaults, i as writeWorkerCompatibleBundle, n as ensureDebugShim, r as resolveWorkerCompatibleRolldownConfig, t as bundleWorkerEntry } from "./worker-bundler-dTTnYU3n.js";
 import { t as bundleWorkflowEntrypointScript } from "./local-workflow-entrypoints-Cq_WJajd.js";
 import { n as buildLocalSecretWrappedBindingConfig } from "./local-secrets-DMPkmOn3.js";

package/dist/_chunks/{doctor-lFlh-olK.js → doctor-jm_K4dxL.js}

@@ -1,10 +1,10 @@
-import { r as loadConfig } from "./loader-RZhqzsRJ.js";
+import { r as loadConfig } from "./loader-Cr0_OWPy.js";
 import { d as green, f as logLine, g as yellow, m as red, n as bold, o as dim, r as createCliTheme } from "./ui-BUoZApvE.js";
 import { n as getPackageVersion } from "./package-metadata-DjHBLB-z.js";
 import { t as detectViteProject } from "./vite-utils-OVLMV605.js";
 import { t as getDependencies } from "./dependencies-C2oxFjU_.js";
 import { n as getGeneratedArtifactPaths } from "./generated-artifacts-dMJY4KAt.js";
-import { n as formatSupportedConfigFilenames, r as resolveConfigCandidatePath } from "./config-path-ePwIvHNX.js";
+import { n as formatSupportedConfigFilenames, r as resolveConfigCandidatePath } from "./config-path-DaL1ylZ_.js";
 import { basename, dirname, relative, resolve } from "pathe";
 //#region src/cli/commands/doctor.ts
 async function runDoctorCommand(parsed, logger, options) {

package/dist/_chunks/{family-Dfb9VR9g.js → family-_9-mGSfO.js}

@@ -1,4 +1,4 @@
-import { u as resolveConfigForEnvironment } from "./loader-RZhqzsRJ.js";
+import { u as resolveConfigForEnvironment } from "./loader-Cr0_OWPy.js";
 //#region src/cli/commands/previews-support/family.ts
 function compareConfiguredWorkerFamilies(left, right) {
 	if (left.role === "primary" && right.role !== "primary") return -1;