WC-5233 use patch apis for wrangler preview secret commands

.changeset/preview-secret-per-preview.md

@@ -0,0 +1,7 @@
+---
+"wrangler": minor
+---
+
+Use Preview deployment PATCH APIs for Preview secret commands
+
+Wrangler now updates Worker Preview secrets by patching the named Preview's latest deployment instead of patching the Worker's Previews settings. This keeps secret changes scoped to one Preview, avoids affecting production or other Previews, and creates a new Preview deployment that goes live at 100% immediately. `wrangler preview secret list` now reads from the named Preview's latest deployment and prints secret names with values masked. `wrangler preview secret bulk` now deletes a secret when its value is `null`, matching `wrangler secret bulk`.

packages/deploy-helpers/src/preview/api.ts

@@ -230,7 +230,7 @@ export async function getPreviewDeployment(
 	accountId: string,
 	workerName: string,
 	previewIdentifier: string,
-	deploymentIdentifier: string
+	deploymentIdentifier = "latest"
 ): Promise<DeploymentResource> {
 	return fetchResult<DeploymentResource>(
 		config,
@@ -266,6 +266,31 @@ export async function createPreviewDeployment(
 	);
 }
 
+export async function patchPreviewDeployment(
+	config: Config,
+	accountId: string,
+	workerName: string,
+	previewIdentifier: string,
+	env: Record<string, Binding | null>,
+	annotations?: {
+		"workers/message"?: string;
+		"workers/tag"?: string;
+	},
+	deploymentIdentifier = "latest"
+): Promise<DeploymentResource> {
+	return fetchResult<DeploymentResource>(
+		config,
+		`/accounts/${accountId}/workers/workers/${workerName}/previews/${encodeURIComponent(
+			previewIdentifier
+		)}/deployments/${encodeURIComponent(deploymentIdentifier)}`,
+		{
+			method: "PATCH",
+			headers: { "Content-Type": "application/merge-patch+json" },
+			body: JSON.stringify({ env, annotations }),
+		}
+	);
+}
+
 export async function getWorkerPreviewDefaults(
 	config: Config,
 	accountId: string,