void 0.21.4 → 0.21.6

package/dist/cli/cli.mjs

@@ -2020,7 +2020,7 @@ if (helpPath) {
 		log.error(formatCloudflareUserMessage(err instanceof Error ? err.message : String(err)));
 		process.exit(1);
 	}
-	import("../deploy-BVwow28d.mjs").then(({ runDeploy }) => {
+	import("../deploy-f1j5MyEP.mjs").then(({ runDeploy }) => {
 		runDeploy(root, {
 			projectSlug: deployArgs.projectSlug,
 			dir: deployArgs.dir,
@@ -2052,8 +2052,8 @@ else if (command === "cloudflare") runSubcommandGroup("cloudflare", cloudflareSu
 else if (command === "project") runSubcommandGroup("project", projectSubcommands, parseProjectArgs, (root, parsed) => import("../project-cmd-B44I8J_W.mjs").then(({ runProjectCommand }) => runProjectCommand(root, parsed)));
 else if (command === "secret") runSubcommandGroup("secret", secretSubcommands, parseSecretArgs, (root, parsed) => import("../secret-DN9sSNiV.mjs").then(({ runSecretCommand }) => runSecretCommand(root, parsed)));
 else if (command === "domain") runSubcommandGroup("domain", domainSubcommands, parseDomainArgs, (root, parsed) => import("../domain-Dmhvb2oU.mjs").then(({ runDomainCommand }) => runDomainCommand(root, parsed)));
-else if (command === "email") runSubcommandGroup("email", emailSubcommands, parseEmailArgs, (root, parsed) => import("../email-BxHabktK.mjs").then(({ runEmailCommand }) => runEmailCommand(root, parsed)));
-else if (command === "db") runSubcommandGroup("db", dbSubcommands, parseDbArgs, (root, parsed) => import("../db-CTXIWD42.mjs").then(({ runDbCommand }) => runDbCommand(root, parsed)));
+else if (command === "email") runSubcommandGroup("email", emailSubcommands, parseEmailArgs, (root, parsed) => import("../email-BXBtqadx.mjs").then(({ runEmailCommand }) => runEmailCommand(root, parsed)));
+else if (command === "db") runSubcommandGroup("db", dbSubcommands, parseDbArgs, (root, parsed) => import("../db-CyHAAGkK.mjs").then(({ runDbCommand }) => runDbCommand(root, parsed)));
 else if (command === "env") runSubcommandGroup("env", envSubcommands, parseEnvArgs, (root, parsed) => import("../env-Csi-tMbT.mjs").then(({ runEnvCommand }) => runEnvCommand(root, parsed)));
 else if (command === "gen") runSubcommandGroup("gen", genSubcommands, parseGenArgs, (root, parsed) => import("../gen-Vnv2f65C.mjs").then(({ runGenCommand }) => runGenCommand(root, parsed)));
 else if (command === "github") runSubcommandGroup("github", githubSubcommands, parseGithubArgs, (root, parsed) => import("../github-cmd-BED3_9JD.mjs").then(({ runGithubCommand }) => runGithubCommand(root, parsed)));
@@ -2222,7 +2222,7 @@ else if (command === "prepare") {
 				return;
 			}
 			case "deploy": {
-				const { runDeploy } = await import("../deploy-BVwow28d.mjs");
+				const { runDeploy } = await import("../deploy-f1j5MyEP.mjs");
 				await runDeploy(root);
 				return;
 			}
@@ -2235,8 +2235,8 @@ else if (command === "prepare") {
 			case "domain": return runSubcommandGroup("domain", domainSubcommands, parseDomainArgs, (r, p) => import("../domain-Dmhvb2oU.mjs").then(({ runDomainCommand }) => runDomainCommand(r, p)));
 			case "github": return runSubcommandGroup("github", githubSubcommands, parseGithubArgs, (r, p) => import("../github-cmd-BED3_9JD.mjs").then(({ runGithubCommand }) => runGithubCommand(r, p)));
 			case "build": return runSubcommandGroup("build", buildSubcommands, parseBuildArgs, (r, p) => import("../build-cmd-Dpt0jd-x.mjs").then(({ runBuildCommand }) => runBuildCommand(r, p)));
-			case "email": return runSubcommandGroup("email", emailSubcommands, parseEmailArgs, (r, p) => import("../email-BxHabktK.mjs").then(({ runEmailCommand }) => runEmailCommand(r, p)));
-			case "db": return runSubcommandGroup("db", dbSubcommands, parseDbArgs, (r, p) => import("../db-CTXIWD42.mjs").then(({ runDbCommand }) => runDbCommand(r, p)));
+			case "email": return runSubcommandGroup("email", emailSubcommands, parseEmailArgs, (r, p) => import("../email-BXBtqadx.mjs").then(({ runEmailCommand }) => runEmailCommand(r, p)));
+			case "db": return runSubcommandGroup("db", dbSubcommands, parseDbArgs, (r, p) => import("../db-CyHAAGkK.mjs").then(({ runDbCommand }) => runDbCommand(r, p)));
 			case "env": return runSubcommandGroup("env", envSubcommands, parseEnvArgs, (r, p) => import("../env-Csi-tMbT.mjs").then(({ runEnvCommand }) => runEnvCommand(r, p)));
 			case "gen": return runSubcommandGroup("gen", genSubcommands, parseGenArgs, (r, p) => import("../gen-Vnv2f65C.mjs").then(({ runGenCommand }) => runGenCommand(r, p)));
 			case "prepare": {

package/dist/{db-CTXIWD42.mjs → db-CyHAAGkK.mjs}

@@ -862,7 +862,7 @@ async function runMigrate(root, dialect, remote) {
 				log.error(getErrorMessage(error));
 				process.exit(1);
 			}
-			const { checkWranglerMigrationApplySet, parseRootWranglerConfig } = await import("./deploy-BVwow28d.mjs");
+			const { checkWranglerMigrationApplySet, parseRootWranglerConfig } = await import("./deploy-f1j5MyEP.mjs");
 			const applySet = await checkWranglerMigrationApplySet(context.operation.configPath, parseRootWranglerConfig(context.operation.configPath), binding, context.migrationsDir, rawMigrations);
 			if (!applySet.ok) {
 				log.error(applySet.reason);

package/dist/{deploy-F1exK5F4.mjs → deploy-CAOwIvwP.mjs}

@@ -57,7 +57,7 @@ import { applyEdits, modify, parse } from "jsonc-parser";
 import { isDeepStrictEqual } from "node:util";
 import { Minimatch } from "minimatch";
 import { activateCloudflareVersion, assertCloudflareBindingsPreserved, assertCloudflareDurableObjectLifecycleSupported, assertExistingCloudflareConfig, encodeCloudflareVersionMessage, extractWorkersDevSubdomain, normalizeWorkersDevSubdomain, parseRootWranglerConfig, parseRootWranglerConfig as parseRootWranglerConfig$1, readBindingFieldPresence, readCloudflareTriggerConfig, readConfigEntryString, readExistingCloudflareWorker, readStoredResourceName, readWranglerTopLevelString, renderCloudflareStaticEntry, resolveD1MigrateTarget, stageCloudflareStaticAssets, writeCloudflareFrameworkDeployConfig, writeCloudflareStaticDeployConfig } from "@void/deploy-cloudflare";
-import { getWorkerConfigPath, readBuildOutput } from "@cloudflare/build-output-utils";
+import { getWorkerAssetsDir, getWorkerBundleDir, getWorkerConfigPath, readBuildOutput } from "@cloudflare/build-output-utils";
 import ignore from "ignore";
 import { hash } from "blake3-jit";
 //#region src/asset-routing.ts
@@ -1857,6 +1857,321 @@ async function prerenderPagesNode(options) {
 	return result;
 }
 //#endregion
+//#region src/cli/cf-version-api.ts
+function object(value) {
+	return value && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+function requiredString(value, label) {
+	if (typeof value !== "string" || !value) throw new Error(`The Cloudflare ${label} is missing from the verified Worker output.`);
+	return value;
+}
+function textValue(value, label) {
+	if (typeof value !== "string") throw new Error(`The Cloudflare ${label} is missing from the verified Worker output.`);
+	return value;
+}
+const moduleContentTypes = {
+	esm: "application/javascript+module",
+	cjs: "application/javascript",
+	wasm: "application/wasm",
+	text: "text/plain",
+	data: "application/octet-stream",
+	json: "text/plain",
+	sourcemap: "application/source-map"
+};
+function bindingsFromOutput(env, workerName, activeSecrets, explicitSecrets) {
+	const inherited = new Map(activeSecrets.bindings.map((binding) => [binding.name, binding.type]));
+	const names = /* @__PURE__ */ new Set([
+		...Object.keys(env),
+		...inherited.keys(),
+		...Object.keys(explicitSecrets)
+	]);
+	const bindings = [];
+	for (const name of names) {
+		const value = object(env[name]);
+		const explicit = explicitSecrets[name];
+		if (explicit !== void 0) {
+			if (typeof explicit !== "string" || inherited.get(name) === "secret_key" || value && value.type !== "secret") throw new Error(`Cloudflare secret ${name} has an invalid explicit value or binding.`);
+			bindings.push({
+				name,
+				type: "secret_text",
+				text: explicit
+			});
+			continue;
+		}
+		if (inherited.has(name)) {
+			if (value && ![
+				"secret",
+				"inherit",
+				"unsafe:inherit"
+			].includes(String(value.type))) throw new Error(`Cloudflare secret ${name} conflicts with a Worker binding.`);
+			bindings.push({
+				name,
+				type: "inherit",
+				version_id: activeSecrets.versionId
+			});
+			continue;
+		}
+		if (!value) throw new Error(`Cloudflare binding ${name} is missing from the Worker output.`);
+		switch (value.type) {
+			case "text":
+				bindings.push({
+					name,
+					type: "plain_text",
+					text: textValue(value.value, name)
+				});
+				break;
+			case "json":
+				bindings.push({
+					name,
+					type: "json",
+					json: value.value
+				});
+				break;
+			case "kv":
+				bindings.push({
+					name,
+					type: "kv_namespace",
+					namespace_id: requiredString(value.id, name)
+				});
+				break;
+			case "d1":
+				bindings.push({
+					name,
+					type: "d1",
+					database_id: requiredString(value.id, name)
+				});
+				break;
+			case "r2":
+				bindings.push({
+					name,
+					type: "r2_bucket",
+					bucket_name: requiredString(value.name, name),
+					...value.jurisdiction ? { jurisdiction: value.jurisdiction } : {}
+				});
+				break;
+			case "durable-object":
+				bindings.push({
+					name,
+					type: "durable_object_namespace",
+					class_name: requiredString(value.exportName, name),
+					...value.worker !== workerName ? { script_name: requiredString(value.worker, name) } : {}
+				});
+				break;
+			case "assets":
+				bindings.push({
+					name,
+					type: "assets"
+				});
+				break;
+			default: throw new Error(`Cloudflare binding ${name} cannot be uploaded with pinned secrets.`);
+		}
+	}
+	return bindings;
+}
+function exportsFromOutput(exports) {
+	if (exports === void 0) return;
+	const entries = object(exports);
+	if (!entries) throw new Error("Cloudflare Durable Object exports were not readable.");
+	const result = {};
+	for (const [name, raw] of Object.entries(entries)) {
+		const value = object(raw);
+		if (!value || value.type !== "durable-object") throw new Error(`Cloudflare export ${name} cannot be uploaded with pinned secrets.`);
+		if (value.state === "deleted") result[name] = {
+			type: "durable-object",
+			state: "deleted"
+		};
+		else if (value.storage === "sqlite" || value.storage === "legacy-kv") result[name] = {
+			type: "durable-object",
+			storage: value.storage,
+			state: "created"
+		};
+		else throw new Error(`Cloudflare Durable Object export ${name} has no storage type.`);
+	}
+	return result;
+}
+function assetConfigFromOutput(value) {
+	if (value === void 0) return;
+	const config = object(value);
+	if (!config) throw new Error("Cloudflare asset configuration was not readable.");
+	const supported = /* @__PURE__ */ new Set([
+		"basePath",
+		"htmlHandling",
+		"notFoundHandling",
+		"runWorkerFirst"
+	]);
+	if (Object.keys(config).some((key) => !supported.has(key))) throw new Error("Cloudflare asset configuration has an unsupported setting.");
+	return {
+		...config.basePath === void 0 ? {} : { base_path: config.basePath },
+		...config.htmlHandling === void 0 ? {} : { html_handling: config.htmlHandling },
+		...config.notFoundHandling === void 0 ? {} : { not_found_handling: config.notFoundHandling },
+		...config.runWorkerFirst === void 0 ? {} : { run_worker_first: config.runWorkerFirst }
+	};
+}
+async function apiResult(url, token, method, body, verifyUploader, timeout = 12e4) {
+	if (!verifyUploader()) throw new Error("The Cloudflare uploader changed during deployment.");
+	const form = body instanceof FormData;
+	const response = await fetch(url, {
+		method,
+		headers: {
+			Authorization: `Bearer ${token}`,
+			...body && !form ? { "Content-Type": "application/json" } : {}
+		},
+		...body ? { body: form ? body : JSON.stringify(body) } : {},
+		redirect: "manual",
+		signal: AbortSignal.timeout(timeout)
+	});
+	const parsed = object(await response.json());
+	const result = object(parsed?.result);
+	if (!response.ok || parsed?.success !== true || !result) {
+		const error = Array.isArray(parsed?.errors) ? object(parsed.errors[0]) : null;
+		const code = Number.isSafeInteger(error?.code) ? ` [code: ${error.code}]` : "";
+		const message = typeof error?.message === "string" ? ` ${error.message}` : "";
+		throw new Error(`Cloudflare version upload failed (${response.status})${code}.${message}`);
+	}
+	return result;
+}
+async function uploadAssets(options) {
+	if (!options.output.assetsDirectory) return;
+	const directory = getWorkerAssetsDir(options.output.directory);
+	const manifest = {};
+	const byHash = /* @__PURE__ */ new Map();
+	const ignored = ignore().add([
+		"/.assetsignore",
+		"/_headers",
+		"/_redirects",
+		".DS_Store",
+		".env",
+		".env.*",
+		".dev.vars",
+		".dev.vars.*"
+	]);
+	const ignorePath = join(directory, ".assetsignore");
+	try {
+		ignored.add(readFileSync(ignorePath, "utf8"));
+	} catch (cause) {
+		if (!(cause instanceof Error && "code" in cause && cause.code === "ENOENT")) throw cause;
+	}
+	for (const entry of readdirSync(directory, {
+		recursive: true,
+		withFileTypes: true
+	})) {
+		if (entry.isDirectory()) continue;
+		if (!entry.isFile()) throw new Error("The Cloudflare asset output contains an unsupported entry.");
+		const path = join(entry.parentPath, entry.name);
+		const relativeName = relative(directory, path).replaceAll("\\", "/");
+		if (ignored.ignores(relativeName)) continue;
+		const name = `/${relativeName}`;
+		const content = readFileSync(path);
+		const extension = extname(entry.name).slice(1);
+		const hash = createHash("sha256").update(content.toString("base64") + extension).digest("hex").slice(0, 32);
+		manifest[name] = {
+			hash,
+			size: content.length
+		};
+		byHash.set(hash, path);
+	}
+	const session = await apiResult(`${options.accountUrl}/workers/scripts/${encodeURIComponent(options.workerName)}/assets-upload-session`, options.token, "POST", { manifest }, options.verifyUploader);
+	let jwt = requiredString(session.jwt, "asset upload token");
+	if (!Array.isArray(session.buckets)) throw new Error("Cloudflare did not provide asset upload batches.");
+	for (const bucket of session.buckets) {
+		if (!Array.isArray(bucket) || !bucket.every((hash) => typeof hash === "string")) throw new Error("Cloudflare returned an invalid asset upload batch.");
+		const form = new FormData();
+		for (const hash of bucket) {
+			const path = byHash.get(hash);
+			if (!path) throw new Error("Cloudflare requested an asset outside the verified Worker output.");
+			form.append(hash, readFileSync(path).toString("base64"));
+		}
+		jwt = requiredString((await apiResult(`${options.accountUrl}/workers/assets/upload?base64=true`, jwt, "POST", form, options.verifyUploader)).jwt, "asset completion token");
+	}
+	return jwt;
+}
+/** The Workers beta API is the only upload endpoint that accepts a version UUID as an inheritance source. */
+async function uploadPinnedCloudflareVersion(options) {
+	const activeSecrets = options.output.activeSecrets;
+	if (!activeSecrets) throw new Error("The active Worker secret source was not verified.");
+	const config = (await readBuildOutput(options.output.directory)).workers.default.config;
+	if (config.name !== options.workerName || !config.manifest || config.manifest.type !== "complete") throw new Error("The verified Cloudflare Worker output changed before upload.");
+	const unsupported = Object.keys(config).filter((key) => !(/* @__PURE__ */ new Set([
+		"name",
+		"compatibilityDate",
+		"compatibilityFlags",
+		"assets",
+		"domains",
+		"observability",
+		"workersDev",
+		"previewUrls",
+		"unsafe",
+		"env",
+		"exports",
+		"manifest",
+		"triggers"
+	])).has(key));
+	if (unsupported.length) throw new Error(`Cloudflare Worker setting ${unsupported[0]} cannot be uploaded with pinned secrets.`);
+	const unsafe = object(config.unsafe);
+	const metadata = object(unsafe?.metadata);
+	if (unsafe && Object.keys(unsafe).some((key) => key !== "metadata") || metadata && Object.keys(metadata).some((key) => key !== "keep_bindings") || metadata?.keep_bindings !== void 0 && (!Array.isArray(metadata.keep_bindings) || !metadata.keep_bindings.every((type) => typeof type === "string"))) throw new Error("Cloudflare Worker upload metadata has an unsupported setting.");
+	const explicitSecrets = options.secretsFilePath ? object(JSON.parse(readFileSync(options.secretsFilePath, "utf8"))) : {};
+	if (!explicitSecrets) throw new Error("The explicit Cloudflare secrets file was not readable.");
+	const bindings = bindingsFromOutput(config.env ?? {}, options.workerName, activeSecrets, explicitSecrets);
+	const active = await apiResult(`${options.apiBaseUrl.replace(/\/$/, "")}/accounts/${encodeURIComponent(options.accountId)}/workers/workers/${encodeURIComponent(options.workerName)}/versions/${encodeURIComponent(activeSecrets.versionId)}`, options.token, "GET", void 0, options.verifyUploader);
+	if (active.id !== activeSecrets.versionId || !Array.isArray(active.bindings)) throw new Error("The active Cloudflare Worker bindings could not be verified.");
+	const activeBindingNames = /* @__PURE__ */ new Set();
+	const candidateNames = new Set(bindings.map((binding) => String(binding.name)));
+	const keptTypes = new Set(metadata?.keep_bindings ?? []);
+	for (const entry of active.bindings) {
+		const binding = object(entry);
+		if (!binding || typeof binding.name !== "string" || typeof binding.type !== "string") throw new Error("The active Cloudflare Worker bindings could not be verified.");
+		activeBindingNames.add(binding.name);
+		if (!candidateNames.has(binding.name) && keptTypes.has(binding.type) && ["plain_text", "json"].includes(binding.type)) {
+			bindings.push({
+				name: binding.name,
+				type: "inherit",
+				version_id: activeSecrets.versionId
+			});
+			candidateNames.add(binding.name);
+		}
+	}
+	if (activeSecrets.bindings.some(({ name }) => !activeBindingNames.has(name))) throw new Error("The active Cloudflare Worker secrets changed before upload.");
+	const exports = exportsFromOutput(config.exports);
+	const assetConfig = assetConfigFromOutput(config.assets);
+	if (bindings.some((binding) => binding.type === "assets") && !options.output.assetsDirectory) throw new Error("The Cloudflare Worker has an assets binding without verified assets.");
+	const modules = [];
+	for (const [name, entry] of Object.entries(config.manifest.modules)) {
+		const type = moduleContentTypes[entry.type];
+		if (!type || name.startsWith("/") || name.split("/").includes("..")) throw new Error(`Cloudflare Worker module ${name} cannot be uploaded with pinned secrets.`);
+		modules.push({
+			name,
+			content_type: type,
+			content_base64: readFileSync(join(getWorkerBundleDir(options.output.directory), name)).toString("base64")
+		});
+	}
+	const accountUrl = `${options.apiBaseUrl.replace(/\/$/, "")}/accounts/${encodeURIComponent(options.accountId)}`;
+	const jwt = await uploadAssets({
+		output: options.output,
+		accountUrl,
+		workerName: options.workerName,
+		token: options.token,
+		verifyUploader: options.verifyUploader
+	});
+	const uploaded = await apiResult(`${accountUrl}/workers/workers/${encodeURIComponent(options.workerName)}/versions${options.atomic ? "?deploy=true" : ""}`, options.token, "POST", {
+		main_module: config.manifest.mainModule,
+		modules,
+		compatibility_date: config.compatibilityDate,
+		compatibility_flags: config.compatibilityFlags,
+		bindings,
+		...exports ? { exports } : {},
+		...jwt ? { assets: {
+			jwt,
+			...assetConfig ? { config: assetConfig } : {}
+		} } : {},
+		annotations: { "workers/message": options.message ?? "" }
+	}, options.verifyUploader);
+	return {
+		id: requiredString(uploaded.id, "Worker Version ID"),
+		urls: Array.isArray(uploaded.urls) ? uploaded.urls.filter((url) => typeof url === "string") : []
+	};
+}
+//#endregion
 //#region src/cli/cf-version-runner.ts
 function failed(message) {
 	return {
@@ -1885,7 +2200,19 @@ function safePositional(value) {
 		return code < 32 || code === 127;
 	});
 }
-/** Pin opaque secrets to the live version in the private, disposable Build Output. */
+/** Existing-Worker handoffs retain their separate link and binding checks. */
+function createActiveSecretPinner(options) {
+	const { output } = options;
+	if (!output || options.handoffPending) return;
+	return (activeVersionId, bindings) => pinActiveWorkerSecrets({
+		output,
+		activeVersionId,
+		bindings,
+		requiredNames: options.requiredNames,
+		explicitNames: options.explicitNames
+	});
+}
+/** Record the live secret source for the version-aware API uploader. */
 async function pinActiveWorkerSecrets(options) {
 	const { activeVersionId, bindings, requiredNames, explicitNames = [] } = options;
 	if (!/^[0-9a-f]{8}-(?:[0-9a-f]{4}-){3}[0-9a-f]{12}$/i.test(activeVersionId)) return false;
@@ -1896,31 +2223,17 @@ async function pinActiveWorkerSecrets(options) {
 	const path = getWorkerConfigPath(options.output.directory);
 	const worker = parseJson(readFileSync(path, "utf8"));
 	if (!record(worker) || worker.env !== void 0 && !record(worker.env)) return false;
-	const env = { ...worker.env ?? {} };
-	for (const name of explicit) delete env[name];
+	const env = worker.env ?? {};
 	for (const [name, value] of Object.entries(env)) if (record(value) && (value.type === "secret" || value.type === "inherit" || value.type === "unsafe:inherit") && !secretNames.has(name) && !explicit.has(name)) return false;
 	for (const { name } of bindings) {
 		if (explicit.has(name)) continue;
 		const current = env[name];
 		if (current !== void 0 && (!record(current) || current.type !== "secret" && current.type !== "inherit" && current.type !== "unsafe:inherit")) return false;
-		env[name] = {
-			type: "unsafe:inherit",
-			version_id: activeVersionId
-		};
 	}
-	const unsafe = record(worker.unsafe) ? { ...worker.unsafe } : {};
-	const metadata = record(unsafe.metadata) ? { ...unsafe.metadata } : {};
-	if (metadata.bindings !== void 0) return false;
-	if (metadata.keep_bindings !== void 0 && (!Array.isArray(metadata.keep_bindings) || !metadata.keep_bindings.every((type) => typeof type === "string"))) return false;
-	metadata.keep_bindings = (metadata.keep_bindings ?? []).filter((type) => type !== "secret_text" && type !== "secret_key");
-	unsafe.metadata = metadata;
-	const next = {
-		...worker,
-		env,
-		unsafe
+	options.output.activeSecrets = {
+		versionId: activeVersionId,
+		bindings: [...bindings]
 	};
-	writeFileSync(path, JSON.stringify(next), { mode: 384 });
-	await readBuildOutput(options.output.directory);
 	return true;
 }
 /** Prevent cf's prebuilt uploader from creating a resource as a side effect. */
@@ -2077,6 +2390,32 @@ function createCfVersionRunner(options) {
 			return failed("Cloudflare resources could not be verified before upload.");
 		}
 	};
+	const uploadPinnedVersion = async (args, atomic) => {
+		if (!options.pinnedUpload || !options.pinnedUpload.verifyUploader()) return failed("The version-aware Cloudflare uploader is unavailable.");
+		const token = await options.pinnedUpload.getToken();
+		if (!token) return failed("Cloudflare session has no bearer for version-aware upload.");
+		try {
+			const version = await uploadPinnedCloudflareVersion({
+				output,
+				accountId: options.pinnedUpload.accountId,
+				apiBaseUrl: options.pinnedUpload.apiBaseUrl,
+				workerName,
+				token,
+				...flag(args, "--message") ? { message: flag(args, "--message") } : {},
+				...flag(args, "--secrets-file") ? { secretsFilePath: flag(args, "--secrets-file") } : {},
+				atomic,
+				verifyUploader: options.pinnedUpload.verifyUploader
+			});
+			const preview = version.urls.find((url) => /^https:\/\//.test(url));
+			return {
+				status: 0,
+				stdout: `Worker Version ID: ${version.id}\n${preview ? `Version Preview URL: ${preview}\n` : ""}`,
+				stderr: ""
+			};
+		} catch (cause) {
+			return failed(cause instanceof Error ? cause.message : "Cloudflare version upload failed.");
+		}
+	};
 	return async (args, command) => {
 		if (args[0] === "deployments" && args[1] === "status") {
 			const result = await run([
@@ -2172,6 +2511,7 @@ function createCfVersionRunner(options) {
 			if (flag(args, "--name") !== workerName || args.includes("--assets") && flag(args, "--assets") !== output.assetsDirectory) return failed("The Cloudflare version upload target changed.");
 			const verified = await verifyResources(output.directory);
 			if (verified.status !== 0 || verified.signal || verified.error) return verified;
+			if (output.activeSecrets) return uploadPinnedVersion(args, false);
 			return run([
 				"workers",
 				"versions",
@@ -2216,6 +2556,7 @@ function createCfVersionRunner(options) {
 			if (flag(args, "--name") !== workerName || args.includes("--assets") && flag(args, "--assets") !== output.assetsDirectory) return failed("The Cloudflare bootstrap target changed.");
 			const verified = await verifyResources(output.directory);
 			if (verified.status !== 0 || verified.signal || verified.error) return verified;
+			if (output.activeSecrets) return uploadPinnedVersion(args, true);
 			return run([
 				"deploy",
 				"--prebuilt",
@@ -7492,6 +7833,12 @@ async function runCloudflareDeploy(root, options, cliLog, deps = {}) {
 		output: cfOutput,
 		workerName,
 		runCf: cfCommand,
+		pinnedUpload: {
+			accountId,
+			apiBaseUrl,
+			getToken: () => runWranglerAuthToken(runWrangler, generatedConfigPath),
+			verifyUploader: cfUploaderIsPinned
+		},
 		verifyResources: createCfResourceVerifier({
 			configPath: generatedConfigPath,
 			runCf: cfCommand,
@@ -7499,6 +7846,12 @@ async function runCloudflareDeploy(root, options, cliLog, deps = {}) {
 			verifyCompatibilityRunner: assertUploaderStillPinned
 		})
 	}) : runWrangler;
+	const pinActiveSecrets = createActiveSecretPinner({
+		output: cfOutput,
+		handoffPending: pinnedHandoffLink !== null,
+		requiredNames: schemaFacts.requiredKeys,
+		...initialAuthSecret ? { explicitNames: [BETTER_AUTH_SECRET_NAME] } : {}
+	});
 	const execution = await activateCloudflareVersionWithProgress(deps.activateVersion ?? activateCloudflareVersion, {
 		runWrangler: activationRunner,
 		verifyUploader: cfOutput ? cfUploaderIsPinned : assertUploaderStillPinned,
@@ -7545,13 +7898,7 @@ async function runCloudflareDeploy(root, options, cliLog, deps = {}) {
 		previousTrafficConfig: readWranglerPublishedTrafficSnapshot(configPath),
 		queueConsumerCleanup,
 		verifyInheritedSecrets: true,
-		...cfOutput && existingWorker && !pinnedHandoffLink ? { pinActiveSecrets: (activeVersionId, bindings) => pinActiveWorkerSecrets({
-			output: cfOutput,
-			activeVersionId,
-			bindings,
-			requiredNames: schemaFacts.requiredKeys,
-			...initialAuthSecret ? { explicitNames: [BETTER_AUTH_SECRET_NAME] } : {}
-		}) } : {},
+		...pinActiveSecrets ? { pinActiveSecrets } : {},
 		atomic,
 		...initialAuthSecret ? { candidateSecrets: { [BETTER_AUTH_SECRET_NAME]: initialAuthSecret } } : {}
 	}).finally(() => cfOutput?.dispose());
@@ -7971,6 +8318,12 @@ async function runCloudflareStaticDeploy(root, options, voidConfig, preset, cliL
 		output: cfOutput,
 		workerName,
 		runCf: cfCommand,
+		pinnedUpload: {
+			accountId,
+			apiBaseUrl,
+			getToken: () => runWranglerAuthToken(runWrangler, staticConfigPath),
+			verifyUploader: cfUploaderIsPinned
+		},
 		verifyResources: createCfResourceVerifier({
 			configPath: staticConfigPath,
 			runCf: cfCommand,

package/dist/{deploy-BVwow28d.mjs → deploy-f1j5MyEP.mjs}

@@ -1,2 +1,2 @@
-import { A as parseRootWranglerConfig, J as runDeploy, f as checkWranglerMigrationApplySet } from "./deploy-F1exK5F4.mjs";
+import { A as parseRootWranglerConfig, J as runDeploy, f as checkWranglerMigrationApplySet } from "./deploy-CAOwIvwP.mjs";
 export { checkWranglerMigrationApplySet, parseRootWranglerConfig, runDeploy };

package/dist/{email-BxHabktK.mjs → email-BXBtqadx.mjs}

@@ -1,6 +1,6 @@
 import { a as join } from "./dist-BVqXeR_h.mjs";
 import { c as import_picocolors, i as createSpinner } from "./output-CCH48AMM.mjs";
-import { L as resolveDeployTransport, O as isWranglerNonInteractiveOrCI, X as runWranglerAuthToken, _ as deriveWorkerName, _t as findEmailConfigConflicts, bt as renderEmailChecklist, gt as createNodeEmailDns, h as createDeployWranglerRunner, ht as applyEmailSetup, k as loadProvisionModule, v as discoverRootWranglerConfig, vt as preflightEmail, yt as renderAddressMap } from "./deploy-F1exK5F4.mjs";
+import { L as resolveDeployTransport, O as isWranglerNonInteractiveOrCI, X as runWranglerAuthToken, _ as deriveWorkerName, _t as findEmailConfigConflicts, bt as renderEmailChecklist, gt as createNodeEmailDns, h as createDeployWranglerRunner, ht as applyEmailSetup, k as loadProvisionModule, v as discoverRootWranglerConfig, vt as preflightEmail, yt as renderAddressMap } from "./deploy-CAOwIvwP.mjs";
 import { n as readProjectPaths } from "./project-paths-GgcMozYz.mjs";
 import { c as getToken, d as openBrowser } from "./auth-DLNN0D3Z.mjs";
 import { o as readProjectConfig } from "./project-C0Fqu05O.mjs";

package/dist/index.mjs

@@ -1,7 +1,7 @@
 import { n as __toESM } from "./rolldown-runtime-DXIUcv95.mjs";
 import { a as join, l as relative, n as dirname, u as resolve } from "./dist-BVqXeR_h.mjs";
 import { d as require_picocolors } from "./output-CCH48AMM.mjs";
-import { G as resolveWorkerDirName, St as hasDocumentRoutes, V as resolveDistDir, ct as prerenderPagesNode, dt as collectRevalidate, ft as hasRevalidate, mt as SEND_EMAIL_BINDING, ot as generateQueueResolverSource, pt as scanDurableObjectModules, st as prerenderPages, ut as collectPages, wt as resolveAssetRoutingPolicy, xt as hasApiRoutes } from "./deploy-F1exK5F4.mjs";
+import { G as resolveWorkerDirName, St as hasDocumentRoutes, V as resolveDistDir, ct as prerenderPagesNode, dt as collectRevalidate, ft as hasRevalidate, mt as SEND_EMAIL_BINDING, ot as generateQueueResolverSource, pt as scanDurableObjectModules, st as prerenderPages, ut as collectPages, wt as resolveAssetRoutingPolicy, xt as hasApiRoutes } from "./deploy-CAOwIvwP.mjs";
 import { i as resolveProjectPaths, n as readProjectPaths, t as assertNoRootSourceConventionConflicts } from "./project-paths-GgcMozYz.mjs";
 import { n as loadVoidAuthConfig, t as findVoidAuthConfig } from "./config-DPByhVck.mjs";
 import { r as scopedAccessCredentials } from "./cf-access-DRsQRe6k.mjs";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "void",
-  "version": "0.21.4",
+  "version": "0.21.6",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/voidzero-dev/void.git",
@@ -325,11 +325,11 @@
     "@cloudflare/vite-plugin": "1.54.7",
     "@cloudflare/workers-types": "^4.20260702.1",
     "@napi-rs/keyring": "2.0.0",
-    "@void/deploy-cloudflare": "0.21.4",
-    "@void/deploy-core": "0.21.4",
-    "@void/edge": "0.21.4",
-    "@void/isr": "0.21.4",
-    "@void/platform": "0.21.4",
+    "@void/deploy-cloudflare": "0.21.6",
+    "@void/deploy-core": "0.21.6",
+    "@void/edge": "0.21.6",
+    "@void/isr": "0.21.6",
+    "@void/platform": "0.21.6",
     "acorn": "^8.15.0",
     "better-auth": "^1.7.3",
     "better-sqlite3": "^13.0.3",
@@ -379,7 +379,7 @@
     "zod": "^4.6.1"
   },
   "peerDependencies": {
-    "@void/md": "0.21.4",
+    "@void/md": "0.21.6",
     "arktype": ">=2.0.0",
     "valibot": ">=1.0.0-beta.7",
     "vite": "^8.0.0",