workers secrets bulk: --file and unwrapped bodies silently create an empty version + 100% deployment with no error #201

What happened

cf workers secrets bulk can silently no-op: it reports success, creates a new Worker version, and even creates a 100% deployment — but with zero binding changes, and no error anywhere. Two distinct paths produce this:

1. --file sends the request body as application/octet-stream (visible via --dry-run: "bodyKind": "octet-stream"). The secrets-bulk PATCH endpoint apparently cannot parse that body, so the change set is empty.
2. A bare top-level map body via --body/--body @file, e.g. {"MY_SECRET": {"name": "MY_SECRET", "type": "secret_text", "text": "..."}}. The API contract requires the map to be wrapped in a secrets field — {"secrets": {"MY_SECRET": {...}}} (per the generated CLI help text and the cloudflare TS/Go SDKs, where the params object is {secrets: Record<string, ScriptSecretBulkUpdateParamsSecrets>}). An unwrapped map is silently treated as an empty merge patch.

Both paths return success: true with the current bindings manifest as the result, and both create a new version annotated workers/triggered_by: secret plus a 100% deployment. Operators who trust the exit code (0) or the success response will believe the secret landed when it did not.

Repro

# 1. --file path (octet-stream, silent no-op)
echo '{"MY_SECRET": {"name": "MY_SECRET", "type": "secret_text", "text": "value"}}' > body.json
cf workers secrets bulk --worker my-worker --file body.json
# -> success, new version created, MY_SECRET absent from the version's bindings

# 2. unwrapped --body (silent no-op)
cf workers secrets bulk --worker my-worker --body @body.json
# -> same result

# 3. wrapped --body (works)
echo '{"secrets": {"MY_SECRET": {"name": "MY_SECRET", "type": "secret_text", "text": "value"}}}' > body2.json
cf workers secrets bulk --worker my-worker --body @body2.json
# -> MY_SECRET present in the new version's bindings

Verify with cf workers versions list --worker-id my-worker (inspect the new version's bindings) or cf workers secrets get MY_SECRET --worker my-worker.

Expected behaviour

• --file should deliver the file contents as a JSON request body (the same body --body @file produces), or the flag should be rejected for commands whose body is JSON.
• A body that does not match the documented shape (missing secrets wrapper) should fail loudly — a client-side validation error or a surfaced API error — rather than being treated as an empty merge patch.
• At minimum, the command should print a warning when the resulting change set is empty, since it creates a version + deployment as a side effect.

Versions

• cf CLI: v1.0.0-beta.6 (delegated)
• macOS arm64, observed 2026-10-04 against the workers secrets bulk command (PATCH /accounts/{account_id}/workers/scripts/{script_name}/secrets-bulk).