Step 2.5 in deploy.js was env-blind, so 'npm run deploy:dev' falsely
reported reusing the production KV while wrangler silently fell back to
the env binding. Combined with [env.development] inheriting top-level
routes, dev deploys could also hijack the production custom domain.
Make extractWorkerName / injectKvNamespaceId / findExistingKvId accept
an envName parameter, and preserve [env.development].routes across
Sync Upstream merges so 'routes = []' overrides survive upgrades.
Bump package manifests, logger/monitoring defaults, and README badges
to 1.4.0 covering the backup/export refactor and offline fallback.
Single-file release bundles now inject a timestamped
serviceWorkerVersion via esbuild define (previously fell back to
SW_VERSION='v1' and left PWA clients on stale caches), and the
generated DEPLOY.md lists the cache version plus the cloud-drive
OAuth secrets (ONEDRIVE_*, GOOGLE_DRIVE_*, OAUTH_REDIRECT_BASE_URL).
Centralize backup serialization in utils/backup-format.js with a
single createBackupEntry() path shared by scheduled backups, manual
backups and exports. Introduce utils/backup-index.js for KV key
listing/pruning and utils/data-hash.js for change detection,
replacing ad-hoc helpers scattered across api/secrets/backup.js,
restore.js and worker.js. UI backup/export modules consume the shared
format so HTML/JSON/CSV exports round-trip through the same schema.
Comment out all [[kv_namespaces]] in wrangler.toml (both production and
development) so deploy.workers.cloudflare.com no longer creates an empty
"2fa" KV. Updated deploy.js to handle fully commented KV config: search
for existing "SECRETS_KV" namespace first (exact match only), create one
if not found, then inject the binding block into wrangler.toml before
deploying.
