CHANGELOG.md

Changelog

Unreleased

1.7.1

Changed

• Bump the bundled Wrangler to 4.120.0, which includes undici 7.29.0 without the package-level override.

Fixed

• Reject unsupported Wrangler triggers.events subscriptions before bundling instead of silently dropping them from the WDL deploy manifest.

1.7.0

Added

• [wdl] session_policy = "restart" opts a Worker into session restarts, matching Cloudflare's default deploy behavior. The default remains preserve. wdl deploy refuses to promote when control does not confirm the policy.

Fixed

• Reject a bare TOML datetime where a config table is expected, instead of reading it as an empty table and silently dropping the section.
• Report an unknown promotion outcome when a timeout, transport failure, 3xx/5xx or unconfirmed response answers the promote, instead of claiming the version was not promoted.

Security

• Override undici to ^7.29.0 and refresh brace-expansion to 5.0.9, clearing five undici advisories and GHSA-rgw5-rvv9-x895. Both reach this repository's install tree only, through the miniflare dev server the CLI never runs and through ESLint.

1.6.1

Changed

• Pin Prettier and enforce repository formatting in CI and release validation.

1.6.0

Added

• Routed Workers with at least one custom route can set workers_dev = false to disable their platform-domain URL. Deploy summaries print the active platform URL and route-pattern URL hints, omitting the disabled URL.

1.5.1

Security

• Bump the bundled wrangler to 4.114.0, which vendors a patched sharp (0.35.2) and clears a high-severity libvips advisory (GHSA-f88m-g3jw-g9cj) reachable only through the miniflare dev server, which the CLI never runs.

1.5.0

Changed

• wdl workers and wdl workflows list now expose workflow-definition state, including retired definitions. Delete dry-runs report worker-secret and workflow-definition presence without claiming blocked data will be deleted.
• Local deploy URLs now preserve the scheme and port from CONTROL_URL.
• wdl deploy now pins Wrangler 4.112.0, rejects unmapped addresses and dependencies_instrumentation, and suppresses Wrangler's banner, routine update check, and telemetry during dry-run. Unknown-field diagnostics may still query the npm registry.

Fixed

• wdl deploy now explains compatibility_flag_unsupported errors.
• Workflow human output now escapes control-plane fields without changing --json output.

1.4.1

Fixed

• wdl deploy no longer passes WDL-only [[exports]], [[platform_bindings]], [[triggers.schedules]], or [[services]].ns to Wrangler's temporary bundle config. This avoids the exports schema collision in Wrangler 4.107+ while preserving the fields in the WDL deploy manifest.

1.4.0

Changed

• wdl deploy now selects wrangler.json, then wrangler.jsonc, then wrangler.toml, parses both JSON filenames as JSONC, and resolves Wrangler from explicit/project/package/PATH sources (npx remains opt-in). It rejects Python modules, unmapped runtime fields, and binding collisions before upload; runtime/workerd bundle policy remains canonical in control.
• New projects use compatibility_date = "2026-06-17" unless a feature requires newer behavior.
• Control requests now identify the CLI version, cap buffered JSON responses at 16 MiB, and consistently honor validated CONTROL_CONNECT_HOST host, port, URL, and IPv6 overrides.
• wdl doctor --strict provides a failing CI gate while default doctor remains report-only. Successful help writes to stdout, and wdl help <command> shows command-specific help.
• Deploy, D1 migrations, and doctor report lower-priority Wrangler configs that were ignored; tail reconnects cleanly when control recycles an idle or expired session.
• R2 object keys preserve empty segments while rejecting . and ..; list validates --limit, and get requires --out before writing bytes to a TTY. Workflow status requires --include-steps whenever --step-limit is used.

Fixed

• Control connection failures, invalid 2xx JSON, unreadable project .env or D1 input files, and unexpected arguments now use escaped CLI diagnostics instead of raw Node errors or silently ignored input.
• Deploy failures now retain control warnings and actionable secret, environment-budget, and caller-secret guidance.
• D1 migrations reject symlinked SQL files, invalid .assetsignore patterns identify the offending rule, and project .env parsing tolerates unrelated dotenv extensions.
• Secret mutation failures explain environment-budget, contention, and envelope errors, including when no mutation was written; token list safely renders stored labels and endpoints.

Security

• Token-store writes are atomic and symlink-safe, serialized by a recoverable lock, use unguessable temporary names, and escape filesystem diagnostics.
• Tail bounds malformed SSE lines, and deploy cleans temporary Wrangler config files on normal exit and signals.

1.3.1

Fixed

• Assets docs now show await env.ASSETS.url(...), matching the runtime API and the example workers.

1.3.0

Changed

• wdl d1 execute now requires exactly one SQL source (--sql or --file) and rejects empty SQL locally before contacting control. Even --sql "" conflicts with --file.
• wdl deploy now rejects more malformed Wrangler config locally instead of silently dropping invalid input: non-array kv_namespaces, malformed KV entries, present-but-non-table [assets], and several validated fields that previously reached the manifest with loose types. Wrangler local-dev KV fields preview_id and remote remain allowed but are ignored by deploy.

1.2.2

Security

• wdl token set and any other credential write now refuse a group- or world-writable store directory: a 0600 file there can still be deleted, replaced, or symlink-swapped by another user, so the write fails with a chmod 700 hint instead. POSIX only.
• wdl r2 object head --json parses custom metadata without prototype pollution — an x-amz-meta-__proto__ header stays an own key, and an empty x-amz-meta- header is dropped.

Changed

• Docs and the npm description point at the now-public platform repo (wdl-dev/wdl), frame the CLI as its companion, and add a self-host note.

1.2.1

Changed

• wdl d1 execute --mode exec rejects --params locally before the control plane round-trip (any value, including [] and an empty string); an invalid non-exec --params now fails the JSON-array check instead of being silently dropped.
• A local deploy prints a direct http://<ns>.<domain>:8080/<worker>/ URL instead of a curl -H 'Host: ...' hint, and a control plane reached via a .test / .local host is recognized as local (previously only localhost / 127.0.0.1).
• KV docs (GUIDE and docs/kv.md) describe the 512-byte key / list-prefix cap the platform now enforces; they previously said it was not checked. Documented that wdl d1 execute --mode exec takes no --params.

1.2.0

Added

• --no-token-store (and WDL_TOKEN_STORE=off) resolves credentials from flags / env / .env only, never reading the global token store — for deploying less-trusted projects, or for deterministic credential resolution in CI.
• wdl doctor reports the global token store: how many namespaces it holds and that project build code can read it during a deploy.

Changed

• Documentation now recommends the local token store (wdl token set) as the default way to supply a control URL and admin token, ahead of a per-shell export or a project .env.
• CONTROL_CONNECT_HOST is documented (GUIDE, the wdl-deploy skill) as a local-dev / debug-only override for the TCP connection target — the HTTP Host header and TLS SNI still track CONTROL_URL, and it must not be set persistently in a CI or production shell.

Removed

• Breaking: top-level allowed_callers in wrangler.toml / .jsonc is no longer accepted. Cross-namespace service-binding access is declared on the target Worker via [[exports]] (entrypoint = "default" for the default handler, or the class name for a named entrypoint, with allowed_callers). wdl deploy now fails fast before bundling with the migration path, matching the control plane, which rejects a deploy carrying a worker-level allowedCallers. [[exports]]-based ACLs are unchanged.

Security

• Control-plane error context keys are now escaped before printing, as the values already were. A malicious or compromised control plane could put terminal control bytes (ESC / OSC / C1) in a JSON error property name and have them written unescaped to stderr (OSC 52 clipboard writes, display spoofing).
• Control-plane responses now abort the connection when the body exceeds the 10 MiB cap, instead of rejecting the result while continuing to read the stream — the cap bounds resource use, not just the returned value.
• The trusted-publishing release job pins the npm CLI to an exact reviewed version instead of installing npm@latest, so a compromised npm release can't run in the job that holds the npm OIDC token and publish a tampered, provenance-signed artifact.
• Documented that wdl deploy runs project-local build code as your OS user, which can read the on-disk token store (the environment scrub closes only the env path, not the file). Deploy only projects you trust; --no-token-store resolves credentials without reading the store. See docs/token.md.
• Bump the bundled wrangler to ^4.102.0, which vendors a patched undici (7.28.0) and clears a high-severity advisory (TLS validation bypass / shared cache disclosure) reachable only through the miniflare dev server, which the CLI never runs.

1.1.0

Added

• wdl token set/list/use/rm manages a local credential store at ~/.config/wdl/credentials ($XDG_CONFIG_HOME/%APPDATA% honored), so commands resolve a control URL and token without a per-shell ADMIN_TOKEN export or a token in every project's .env. set reads the token from stdin (hidden on a TTY) and validates it against /whoami before storing it under the namespace; rm deletes the local copy without revoking it. The store is the same dotenv/INI dialect as a project .env, written 0600, and is the lowest-precedence credential layer: flag > shell env > project .env > token store. It is trusted (home directory, same-source token + endpoint) and is not subject to the cross-origin .env guard, while a project .env endpoint is still dropped when the token comes from the store. wdl config explain shows token store [<ns>].… as a value's source.
• The store carries a default namespace (a base WDL_NS, the analogue of a project .env's base WDL_NS): the first stored namespace becomes the default, wdl token set --default and wdl token use <ns> change it, and wdl token list marks it with *. With a default set, commands resolve a namespace without --ns; the selection chain is --ns > shell WDL_NS > project .env WDL_NS > store default, and wdl config explain shows token store default as the namespace source.

Changed

• wdl init's --ns is now optional. With --ns, the scaffolded npm run deploy keeps wdl deploy . --ns <ns>; without it the script is wdl deploy . and the namespace is resolved at deploy time (--ns / WDL_NS / project .env / a wdl token default). init also no longer autoloads control credentials, so a corrupt token store cannot block scaffolding.

Removed

• BREAKING: the --admin flag and the ADMIN_URL environment variable — legacy compatibility aliases for the control endpoint — are removed. Use --control-url <url> and the CONTROL_URL environment variable instead. --admin is now an unknown option and ADMIN_URL is no longer read from the shell or .env.

Fixed

• wdl secret put no longer echoes the typed secret on a TTY: input is read in raw mode (hidden), and fails closed — it errors rather than echo if the terminal cannot hide input.
• .env values containing literal backslash escape sequences (e.g. a token with a backslash followed by n) now round-trip correctly instead of being decoded as control characters.

Security

• Pinned ws to ^8.21.0 via npm overrides to clear GHSA-96hv-2xvq-fx4p in the wrangler → miniflare → ws dependency chain, keeping wrangler on v4. The DoS is reachable only through miniflare's dev server, which the CLI never starts (it only runs wrangler deploy --dry-run), but the pin keeps the dependency tree clean.

1.0.0

Initial open-source release.

• wdl init scaffolding for new WDL Worker projects, with bundled examples covering assets, KV, D1, R2, cron triggers, queues, Durable Objects, Workflows, and environment overrides.
• wdl deploy for Wrangler v4 projects: local bundling, manifest validation, upload, and promote against the WDL control plane.
• Resource management commands: wdl d1, wdl r2, wdl secret, wdl workers, wdl workflows, wdl delete.
• Diagnostics: wdl config explain, wdl doctor, wdl whoami, and live log streaming via wdl tail.