sync cloudflare
Preview a synchronization:
12345mellon sync cloudflare \ --project <project> \ --env <environment> \ --surface <surface> \ --worker <worker-name>
The default command compares secret names. It reports additions, updates, managed removals, and unrelated Worker secrets. It does not send secret values or change the Worker.
Apply the synchronization after you review the plan:
123456mellon sync cloudflare \ --project <project> \ --env <environment> \ --surface <surface> \ --worker <worker-name> \ --apply
Mellon downloads values into process memory. It sends one JSON payload to
wrangler secret bulk through standard input. Mellon does not print the values or write them to a plaintext file.Use
--cf-env <environment> for a named Wrangler environment.Production protection
Production synchronization requires an additional option:
123456mellon sync cloudflare \ --project <project> \ --env prod \ --worker <worker-name> \ --apply \ --confirm-production
Managed pruning
Mellon stores a name-only synchronization record under
~/.mellon/sync/. A later run can remove names that Mellon managed before but no longer provides.123456mellon sync cloudflare \ --project <project> \ --env <environment> \ --worker <worker-name> \ --apply \ --prune
Pruning does not remove unrelated Worker secrets. The first synchronization cannot prune existing bindings because Mellon did not manage them.