release: version packages

[github-actions]

This PR was opened by the Changesets release GitHub action. When you're ready to do a release, you can merge this and publish to npm yourself or setup this action to publish automatically. If you're not ready to do a release yet, that's fine, whenever you add more changesets to dev, this PR will be updated.

Releases

@proofoftech/fleet-control@0.5.0

Minor Changes

• 36a4b7c: Add token-driven bounded normal decommissioning for at-least-once control-plane Worker workflows. Fleet D1 owns scan progress. Each call performs at most one bounded scan chunk; only an exact matching verify may immediately consume that result through its single same-lease resource action. Other calls perform at most one lifecycle or resource action group.

  Persist an immutable database-export receipt authority before the first D1 scan or export. Retries after artifact commit or Fleet state-write loss converge on the same filesystem or R2 receipt; authority changes and byte collisions preserve the committed winner and fail closed. Custom bounded backends must expose the paired receipt authority and export capability. Queue-driven bounded decommissioning requires Workers Paid because its bounded multi-R2 read groups can exceed the Free plan external-subrequest limit.

  Add a root-only bounded backend-switch advance API that uses the same durable token and receipt guarantees. It binds teardown to one immutable switch snapshot and captured entry subphase, advances at most one release, R2 resource, scan chunk, or D1 action group per call, and preserves legacy recovery after a shell-less deployment reaches export authorization. A pending ordinary Worker requires lossless exact-version inspection, authoritative secret-name inventory, and its persisted Durable Object namespace identities. Custom switch providers must expose the bounded scan, receipt, database, residual, delete, and conditional pending-artifact inspection capabilities required by the durable state they resume.

• bb9291c: Add CloudflareApiPlainWorkerBackend, a direct Cloudflare API backend for platform-authored ordinary Workers. Its adapter classifies each mutation's dispatch under the operation's own execution context, so a queued mutation's pre-dispatch failure rejects instead of resolving { status: 'failed' }. Construct it with a plain-only CloudflareProvisioningClient. Configure that client with a shared rate coordinator and a durable export store. The existing Wrangler and Workers for Platforms backends keep their public provisioning contracts.

  Expose the configured provider request timeout through the public CloudflareProvisioningClient.requestTimeoutMs getter.

  Harden provider behavior across the built-in backends:

  • BEHAVIOR CHANGE: Disable Cloudflare SDK logging even when CLOUDFLARE_LOG requests verbose output.
  • BEHAVIOR CHANGE: Bound every paginated Cloudflare inventory and fail instead of truncating an over-bound result.
  • BEHAVIOR CHANGE: Disable SDK retries for Worker upload and deployment, D1 creation and query, and each D1 export poll. This includes the D1 query path shared by both provider backends.
  • BEHAVIOR CHANGE: Redact signed URLs, provider response details, headers, and original causes from database export failures.
  • BEHAVIOR CHANGE: Replace uploaded secret plaintext in ordinary-Worker provider error messages, and in the cause chain of transport failures behind them, before returning a failed mutation outcome.
  • BEHAVIOR CHANGE: Surface a lost lease before database or R2 reconciliation in all three affected create paths.
  • BEHAVIOR CHANGE: Reject PlainWorkerBackend.identityCaller values that are not printable, single-line ASCII tokens from 1 through 128 characters.
  • BEHAVIOR CHANGE: Refuse a reconciled Worker upload whose workers.dev or preview-URL state does not match the intent instead of accepting it by tag rediscovery.
  • BEHAVIOR CHANGE: Queued provider mutations assert their own lease. Under concurrency pressure a queued mutation previously ran under the preceding operation's execution context.

  When upgrading, construct direct ordinary-Worker clients with plane: 'plain-worker' and no dispatchNamespace. Keep dispatchNamespace on Workers for Platforms clients, provide one quota coordinator across every replica sharing a provider token, and ensure the token can complete the documented attachment scans before destructive teardown.

• 224421b: PlainWorkerProvisioningApi.listDatabases accepts an optional name filter. The direct Cloudflare API adapter forwards it as the D1 list query and the Wrangler adapter filters its parsed inventory locally; PlainWorkerBackend.findDatabase passes the deployment's database name and keeps its exact-name comparison and its duplicate-name and missing-UUID refusals.

• cfcd24c: Export the shared PlainWorkerBackend, its PlainWorkerProvisioningApi port, and the port's ordinary-Worker record types. Port adapters must verify database exports independently against the durable store's committed size and digest. WranglerLoopBackend now extends this core while retaining the same constructor options and provisioning members.

  Harden ordinary-Worker provisioning and teardown:

  • BEHAVIOR CHANGE: Surface a lost external mutation lease as a failure instead of masking it behind a post-dispatch readback.
  • Preserve both operation and scratch-cleanup failures without masking either.
  • BEHAVIOR CHANGE: Refuse D1 bindings and database inventory entries with an empty primary identifier instead of accepting a fallback field or malformed inventory.
  • BEHAVIOR CHANGE: Reject malformed Worker version inventory that omits an identifier instead of treating the entry as provider absence.
  • BEHAVIOR CHANGE: Keep lease denials distinct from provider absence during Worker deletion.
  • Allocate adapter-owned upload scratch only when an upload is required.
  • BEHAVIOR CHANGE: Classify post-install scratch-cleanup failures so callers remove only Workers created by the failed attempt.

  Provider-neutral error messages now describe plain-Worker and provider operations instead of Wrangler. Error-message text compatibility is not claimed by this release.

  When upgrading, consumers that matched deployWorker rejections by identity or message text should catch WorkerDeploymentError and read createdByAttempt and resourceState.

Patch Changes

• f100ab3: Harden account-wide D1 and R2 attachment scans with a request-bounded, page-independent resumable engine. Rechecked inventory drift, malformed provider metadata, non-string or repeated dispatch cursors, and page or item overflows now fail closed instead of allowing an incomplete absence proof.
• 6543c6f: FileSystemDatabaseExportStore.write no longer awaits the reader's cancel in its failure cleanup. When the body is a tee() branch, that cancel settles when the tee source is exhausted or errors, or the other branch is cancelled, so a write refused by the store's own checks held its rejection and its temporary file until then, and held both indefinitely when nothing drove the source. It now rejects with the store's error and removes the file without awaiting the cancel.
• Updated dependencies [a086f24]
  • @proofoftech/flowsafe@0.20.1

@proofoftech/flowsafe@0.20.1

Patch Changes

• a086f24: flowsafe-provision sets a 64 MiB maxBuffer on the wrangler d1 execute --json child process whose output it parses. Node's default is 1 MiB counted across the captured stdout and stderr together, so a response past that was truncated and the run surfaced as failed to execute Wrangler 4 with an ENOBUFS cause instead of the parsed rows.

anchorage-agent-starter@0.0.17

Patch Changes

• Updated dependencies [a086f24]
  • @proofoftech/flowsafe@0.20.1

showcase@0.0.23

Patch Changes

• Updated dependencies [a086f24]
  • @proofoftech/flowsafe@0.20.1

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	anchorage-showcase-single-tenant	69dbd54	Aug 31 2026, 10:17 AM