v0.27.1

Patch Changes

• App-token failures during dev/deploy now carry their HTTP status and server code, and an app id the platform cannot resolve refuses loudly with app_not_found instead of silently writing .dev.vars without APP_IDENTITY_TOKEN — which made every platform call fail verification at runtime with nothing printed. Deploy's --json envelope distinguishes these failures too: a token/.dev.vars failure that is not an ApiError and not a refreshed-cache failure now reports its own dev_vars_failed code instead of riding secrets_refresh_failed.
• Deploy no longer uploads secret values: the deploy form names the secrets config (secretsConfig, wranglerEnv ?? 'prd') and the platform reads its own store at commit — one authority, no plaintext values on the deploy wire. Store-side, the config-missing refusal is now enforced server-side (409 secrets_config_missing, with the same executable secrets configs create fix) where it cannot be bypassed, an uninitialized store deploys as authoritative-empty exactly as before, and a store read failure fails closed (503, nothing deployed). The CLI still refuses early — before build and uploads — and still rewrites .dev.vars for dev parity; it now also hard-requires the secretsSource: 'store-read-v1' capability from the deploy service so it can never deploy against an older server that would misread the new shape as an upload with no secret bindings and strip every live user secret from an owner deploy. One check moved later: a stored secret whose name is reserved or collides with a declared wrangler binding is now refused by the platform at commit (after asset upload) rather than by the CLI before build — the price of retiring the client-side copy of that check. For one release the server also accepts the legacy userSecrets field from pre-0.24 CLIs (mutually exclusive with secretsConfig; sending both is refused), so existing installs keep deploying through the transition; the legacy arm is removed in 0.25 — update to keep deploying after that.
• Feature installer: drop the never-used css integration area and per-file overwrite flag (no feature has ever declared either), and remove the internal presence-test feature.
• Remove dead client-era wire riders: retagged is gone from POST /api/apps/:appId/transfer/accept responses, GET /api/deploy/:appId (deployment-status read, no live consumer) is gone, and the GitHub-source stale_base guard plus the baseReleaseId deploy field (always null from every shipped CLI) are gone.
• Deploy/rollback contract fixes from review: a same-key deploy retry that straddles a concurrent secrets set now supersedes the still-prepared reservation and proceeds (instead of dying idempotency_key_reused; after activation the mismatch stays a hard refusal). Rollback's not-active refusal is now coded app_undeployed (was app_suspended — the suspended status was retired, and stale registry rows are normalized to undeployed on schema init). Rollback's do_guard_unavailable refusal now carries the Cloudflare-side cause as detail, which the CLI renders as its Cause: line. The CLI's dead bindings_read_unavailable passthrough (no server ever emits it) is removed.
• /api/secrets/* error contract: internal faults (registry down, binding missing) keep answering a generic 500 with no internal error text echoed to the client — unchanged — but the fault's own message is now logged server-side as a string, so those 500s stop being undiagnosable from Workers Logs. Also: deploy's secrets_config_missing refusal now carries actionRequired: true with its executable secrets configs create action, matching the sibling refusals.