Naresh

Recover stable backup restores (#781) * Classify stable container unavailability The Cloudflare runtime can start, replace, or briefly drop a sandbox's container while the SDK is connecting to it — most often during a deployment rollout. Today these moments surface as raw transport failures (e.g. RPC session disposed), and a default-session create RPC that lands after a container stop fails the caller outright. Introduce the lifecycle error vocabulary shared by this hotfix series: a retryable CONTAINER_UNAVAILABLE (503) for a container that is not yet ready or was replaced during connection, and an OPERATION_INTERRUPTED (409) contract consumed by the backup-restore and tunnel recovery changes stacked on top of this change. Failed /rpc upgrades now discard the poisoned connection and preserve locally-raised SDK errors, and the default session retries once against the new container generation. No public method signatures change; the new errors are additive exports. * Surface interrupted RPC operations When an in-flight capnweb call loses its RPC session, users currently see a transport-internal message about the main stub being disposed. That describes the wire failure but not the sandbox lifecycle event or whether retrying is safe. Map session-disposed RPC failures with known method context to OPERATION_INTERRUPTED. The error carries the public operation name, marks admission as unknown, and tells callers to retry only idempotent work or verify sandbox state first. The original transport error stays available as the cause for debugging. * Retry safe E2E sandbox initialization The E2E helper initializes each sandbox with a side-effect-free ready command. When that probe is interrupted by runtime replacement, the SDK now exposes a structured lifecycle error that the helper can handle safely. Retry only the default initialization probe on CONTAINER_UNAVAILABLE or OPERATION_INTERRUPTED. Tests that supply a mutating init command keep full responsibility for their own retry semantics. * Classify platform update interruptions Workers can reset a Sandbox Durable Object while an operation is in flight during a deployment. Surfacing the platform string directly gives users no stable way to decide whether retry is safe. Add platform-transient classifiers modeled after the Agents SDK and map code-update resets observed through getSandbox() enhanced methods to OPERATION_INTERRUPTED with unknown admission. The E2E initialization helper uses the same classifier to retry only its side-effect-free ready probe. * Refine stable lifecycle changeset Broaden the release note for the base hotfix to cover structured runtime and platform update interruptions, not only container admission failures. * Surface in-flight transport interruptions Peer-closed and WebSocket error events during an RPC method have unknown side effects just like explicit session disposal. Surface them through the operation interruption contract so callers can branch on a stable SDK error code. * Update .changeset/stable-container-unavailable.md Co-authored-by: Aron <263346377+aron-cf@users.noreply.github.com> * Classify DO storage startup resets Durable Object storage startup can reset an object before an idempotent E2E initialization request is admitted. Treat that platform reset as an operation interruption so safe initialization can retry. * Recover stable backup restores When the Cloudflare runtime replaces a sandbox's container while a backup restore is in progress, restoreBackup() fails with a generic 500 and leaves the caller unsure whether the restore committed. Run restore through a lifecycle that fences each attempt by sandbox lifetime and runtime identity, retries boundedly when the runtime is replaced mid-restore, and records terminal restore state. Restores are not retried across destroy() or a sandbox lifetime change. When bounded recovery is exhausted the caller receives OPERATION_INTERRUPTED (409) with retry guidance rather than an opaque failure. Builds on the lifecycle error contract from the previous change. * Update .changeset/stable-backup-restore-recovery.md Co-authored-by: Aron <263346377+aron-cf@users.noreply.github.com> --------- Co-authored-by: Aron <263346377+aron-cf@users.noreply.github.com>

Recover stable quick tunnels (#782) * Recover stable quick tunnels After the Cloudflare runtime replaces a sandbox's container, a quick tunnel created against the old runtime is dead, yet tunnels.get(port) could return its stale URL and tunnels.list() could still advertise it. Provision quick tunnels through a runtime-run boundary: the Sandbox DO issues a logical tunnel id and the container owns a runtime-local runId, so ensureTunnelRun() is idempotent across retries and a replacement during provisioning is retried boundedly to return a currently usable URL. Runtime-local process callbacks are fenced by runId, and list() hides quick URLs known to be stale after restart reconciliation. Builds on the lifecycle error contract and recovery primitives from the previous changes. * Shorten tunnel run ids to base32 The runtime-run boundary minted quick tunnel and run ids from crypto.randomUUID(), producing 36-character values that are unwieldy in logs, storage keys, and error messages. Generate ids from a 20-character Crockford base32 alphabet (~100 bits of entropy) via crypto.getRandomValues. Collisions stay negligible at any realistic volume without a uniqueness retry loop, and the lowercase alphabet is safe to use as a DNS label or URL segment. * Fence quick tunnel legacy runs Runtime-run admission must not overlap with legacy cloudflared processes that are still active in the same container. Stop stale legacy quick records before refreshing them and reject mixed registry conflicts inside the container.

Classify stable container unavailability (#780) * Classify stable container unavailability The Cloudflare runtime can start, replace, or briefly drop a sandbox's container while the SDK is connecting to it — most often during a deployment rollout. Today these moments surface as raw transport failures (e.g. RPC session disposed), and a default-session create RPC that lands after a container stop fails the caller outright. Introduce the lifecycle error vocabulary shared by this hotfix series: a retryable CONTAINER_UNAVAILABLE (503) for a container that is not yet ready or was replaced during connection, and an OPERATION_INTERRUPTED (409) contract consumed by the backup-restore and tunnel recovery changes stacked on top of this change. Failed /rpc upgrades now discard the poisoned connection and preserve locally-raised SDK errors, and the default session retries once against the new container generation. No public method signatures change; the new errors are additive exports. * Surface interrupted RPC operations When an in-flight capnweb call loses its RPC session, users currently see a transport-internal message about the main stub being disposed. That describes the wire failure but not the sandbox lifecycle event or whether retrying is safe. Map session-disposed RPC failures with known method context to OPERATION_INTERRUPTED. The error carries the public operation name, marks admission as unknown, and tells callers to retry only idempotent work or verify sandbox state first. The original transport error stays available as the cause for debugging. * Retry safe E2E sandbox initialization The E2E helper initializes each sandbox with a side-effect-free ready command. When that probe is interrupted by runtime replacement, the SDK now exposes a structured lifecycle error that the helper can handle safely. Retry only the default initialization probe on CONTAINER_UNAVAILABLE or OPERATION_INTERRUPTED. Tests that supply a mutating init command keep full responsibility for their own retry semantics. * Classify platform update interruptions Workers can reset a Sandbox Durable Object while an operation is in flight during a deployment. Surfacing the platform string directly gives users no stable way to decide whether retry is safe. Add platform-transient classifiers modeled after the Agents SDK and map code-update resets observed through getSandbox() enhanced methods to OPERATION_INTERRUPTED with unknown admission. The E2E initialization helper uses the same classifier to retry only its side-effect-free ready probe. * Refine stable lifecycle changeset Broaden the release note for the base hotfix to cover structured runtime and platform update interruptions, not only container admission failures. * Surface in-flight transport interruptions Peer-closed and WebSocket error events during an RPC method have unknown side effects just like explicit session disposal. Surface them through the operation interruption contract so callers can branch on a stable SDK error code. * Update .changeset/stable-container-unavailable.md Co-authored-by: Aron <263346377+aron-cf@users.noreply.github.com> --------- Co-authored-by: Aron <263346377+aron-cf@users.noreply.github.com>

Add release artifact orchestration (#800) Move stable, prerelease, and backfill artifact publishing through a single desired-state orchestrator. Reruns now converge npm, registry, GitHub Release, tag, and binary artifacts instead of depending on whether npm was newly published in the current workflow attempt.

Add prerelease channel releases Introduce reusable prerelease release automation so breaking changes can ship on an opt-in channel before they are promoted to the stable release path. Keep shared image publishing mechanics in scripts that both stable and prerelease workflows use.

Fix stable release promotion flow (#869) Publish current npm releases directly to latest only after the other artifacts are complete. This keeps stable publishing tokenless because npm trusted publishing cannot authenticate a separate dist-tag update. Let current-version reconciliation create the promotion PR so recovery runs finish repository reference updates as well.

Retry stable release reinspection

Gate E2E on deployment readiness Cancelled and overlapping deployments can leave test environments on old container versions. Fence PR ownership, wait for rollouts to drain, and probe each runtime before starting the broad suites.

Grant release E2E permissions (#843) Release workflows could not start after reusable E2E began reading pull request state. Pass that permission through both release call chains and guard the nested workflow configuration against regression.

Skip already released stable versions (#805) The release workflow runs on every main push, not only Version Packages merges. Skip publish when the current package version already has a tag on another commit so non-version changes do not attempt to republish the last release.