@smoothbricks/cli 0.11.15 → 0.11.17

package/dist/wrangler/deploy-stage.d.ts

@@ -1,4 +1,5 @@
 import { type CloudflareClient } from './cloudflare.js';
+import { type VersionEndpointWaitOptions } from './live-version.js';
 import { type DeploymentStage } from './stage.js';
 export interface ProcessResult {
     exitCode: number;
@@ -24,6 +25,10 @@ export interface WranglerCommandDependencies {
     runner?: ProcessRunner;
     cloudflare?: CloudflareClient;
     processEnv?: NodeJS.ProcessEnv;
+    /** Bounds and clock for the post-deploy wait; tests drive it without sleeping. */
+    wait?: VersionEndpointWaitOptions;
+    /** Where a successful deploy records the tag it made live, for `smoo wrangler deployed-version`. */
+    liveVersionCacheDirectory?: string;
 }
 export interface DeployStageResult {
     stage: DeploymentStage;
@@ -36,6 +41,12 @@ export interface DeployStageOptions {
     stage: string;
     /** A build-generated flat wrangler.json to deploy instead of `./wrangler.toml` (see `prepareFlatConfig`). */
     config?: string;
+    /**
+     * A URL, served by this worker, whose trimmed body is the running version tag. When given, the
+     * deploy is not done until that URL answers with the tag it just made live — the control plane
+     * accepting a traffic shift is not the edge serving it.
+     */
+    versionEndpoint?: string;
 }
 export declare function deployStage(cwd: string, options: DeployStageOptions, dependencies?: WranglerCommandDependencies): Promise<DeployStageResult>;
 /**
@@ -60,7 +71,7 @@ export interface CleanupResult {
 }
 export declare function cleanupPullRequest(cwd: string, prNumber: number, dependencies?: WranglerCommandDependencies): Promise<CleanupResult>;
 export declare function nxTaskVersionTag(environment: NodeJS.ProcessEnv): string | undefined;
-export declare function findVersionIdByTag(value: unknown, tag: string): string | null;
-export declare function isFullCurrentDeployment(value: unknown, versionId: string): boolean;
+/** One wrangler invocation whose stdout must be JSON; shared by the deploy and the read-only query. */
+export declare function wranglerJson(runner: ProcessRunner, args: string[], run: ProcessRunOptions): Promise<unknown>;
 export {};
 //# sourceMappingURL=deploy-stage.d.ts.map

package/dist/wrangler/deploy-stage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy-stage.d.ts","sourceRoot":"","sources":["../../src/wrangler/deploy-stage.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,KAAK,gBAAgB,EAA+C,MAAM,iBAAiB,CAAC;AAGrG,OAAO,EAEL,KAAK,eAAe,EAYrB,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,6GAA6G;IAC7G,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,kHAAkH;IAClH,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;CAC1F;AAED,+GAA+G;AAC/G,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,CAAC,UAAU,CAE9E;AAED,qBAAa,gBAAiB,YAAW,aAAa;IAC9C,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,aAAa,CAAC,CAc7F;CACF;AAED,MAAM,WAAW,2BAA2B;IAC1C,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CAChC;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,eAAe,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,UAAU,GAAG,WAAW,GAAG,kBAAkB,CAAC;IACtD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAID,MAAM,WAAW,kBAAkB;IACjC,yCAAyC;IACzC,KAAK,EAAE,MAAM,CAAC;IACd,6GAA6G;IAC7G,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wBAAsB,WAAW,CAC/B,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,kBAAkB,EAC3B,YAAY,GAAE,2BAAgC,GAC7C,OAAO,CAAC,iBAAiB,CAAC,CA4F5B;AAyFD;;;;GAIG;AACH,iBAAe,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAOhF;AACD,eAAO,MAAM,2BAA2B,6BAAuB,CAAC;AAqFhE,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,KAAK,MAAM,EAAE,CAAC;IACrB,OAAO,EAAE;QACP,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,MAAM,CAAC;QAChB,YAAY,EAAE,MAAM,CAAC;QACrB,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,EAAE,MAAM,CAAC;QACnB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;CACH;AAED,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,EAChB,YAAY,GAAE,2BAAgC,GAC7C,OAAO,CAAC,aAAa,CAAC,CAoFxB;AAwFD,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,GAAG,SAAS,CAgBnF;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAuB7E;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAelF"}
+{"version":3,"file":"deploy-stage.d.ts","sourceRoot":"","sources":["../../src/wrangler/deploy-stage.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,KAAK,gBAAgB,EAA+C,MAAM,iBAAiB,CAAC;AAErG,OAAO,EAOL,KAAK,0BAA0B,EAEhC,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAEL,KAAK,eAAe,EAYrB,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,6GAA6G;IAC7G,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,kHAAkH;IAClH,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;CAC1F;AAED,+GAA+G;AAC/G,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,CAAC,UAAU,CAE9E;AAED,qBAAa,gBAAiB,YAAW,aAAa;IAC9C,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,aAAa,CAAC,CAc7F;CACF;AAED,MAAM,WAAW,2BAA2B;IAC1C,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IAC/B,kFAAkF;IAClF,IAAI,CAAC,EAAE,0BAA0B,CAAC;IAClC,oGAAoG;IACpG,yBAAyB,CAAC,EAAE,MAAM,CAAC;CACpC;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,eAAe,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,UAAU,GAAG,WAAW,GAAG,kBAAkB,CAAC;IACtD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,kBAAkB;IACjC,yCAAyC;IACzC,KAAK,EAAE,MAAM,CAAC;IACd,6GAA6G;IAC7G,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,wBAAsB,WAAW,CAC/B,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,kBAAkB,EAC3B,YAAY,GAAE,2BAAgC,GAC7C,OAAO,CAAC,iBAAiB,CAAC,CAwG5B;AAyFD;;;;GAIG;AACH,iBAAe,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAOhF;AACD,eAAO,MAAM,2BAA2B,6BAAuB,CAAC;AAqFhE,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,KAAK,MAAM,EAAE,CAAC;IACrB,OAAO,EAAE;QACP,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,MAAM,CAAC;QAChB,YAAY,EAAE,MAAM,CAAC;QACrB,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,EAAE,MAAM,CAAC;QACnB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;CACH;AAED,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,EAChB,YAAY,GAAE,2BAAgC,GAC7C,OAAO,CAAC,aAAa,CAAC,CAoFxB;AAwFD,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,GAAG,SAAS,CAgBnF;AAyCD,uGAAuG;AACvG,wBAAsB,YAAY,CAAC,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC,OAAO,CAAC,CAOlH"}

package/dist/wrangler/deploy-stage.js

@@ -2,11 +2,11 @@ import { randomUUID } from 'node:crypto';
 import { existsSync, readFileSync } from 'node:fs';
 import { readFile, rm, writeFile } from 'node:fs/promises';
 import { dirname, join } from 'node:path';
-import typia from 'typia';
 import { parseJsonFileText } from '../lib/json.js';
 import { mergeEnv, printCommandOutput } from '../lib/run.js';
 import { CloudflareRestClient } from './cloudflare.js';
 import { parseFlatWranglerConfig, planFlatStageResources } from './flat-config.js';
+import { awaitLiveVersion, awaitVersionEndpoint, currentDeploymentVersionId, findVersionIdByTag, liveVersionCacheDirectory, writeCachedLiveVersion, } from './live-version.js';
 import { parseDevVarsExample } from './prepare-env.js';
 import { derivePullRequestStageConfig, derivePullRequestWranglerConfig, hasExactStageSegment, isPullRequestStage, parseDeploymentStage, planConfiguredStageResources, planPullRequestBindings, planPullRequestResources, pullRequestStage, } from './stage.js';
 /** The child environment `options` describe; every runner, test doubles included, spawns with exactly this. */
@@ -30,15 +30,6 @@ export class BunProcessRunner {
         return { exitCode, stdout, stderr };
     }
 }
-const isUnknownRecord = (() => {
-    const _io0 = input => Object.keys(input).every(key => {
-        const value = input[key];
-        if (undefined === value)
-            return true;
-        return true;
-    });
-    return input => "object" === typeof input && null !== input && false === Array.isArray(input) && _io0(input);
-})();
 export async function deployStage(cwd, options, dependencies = {}) {
     const stage = parseDeploymentStage(options.stage);
     const processEnv = dependencies.processEnv ?? process.env;
@@ -73,15 +64,23 @@ export async function deployStage(cwd, options, dependencies = {}) {
         // `reconcileStageResources` nor `versions list` looks at.
         const run = prepared.envFlag ? { cwd } : { cwd, unsetEnv: ['CLOUDFLARE_ENV'] };
         const workerName = prepared.plan.workerName;
+        const probe = {
+            deployments: () => wranglerJson(runner, ['deployments', 'status', '--name', workerName, '--json'], run),
+            versions: () => wranglerJson(runner, ['versions', 'list', '--name', workerName, '--json'], run),
+        };
         // The tagged-version lookup runs before the migrations: a cache hit means this exact build is
         // already live, so its migrations ran with it and re-applying them would touch the remote
         // database for nothing. The activation and upload paths below still migrate first.
+        //
+        // This reads Cloudflare every time and never the local cache. A cache hit here would mean
+        // "we believe this hash is live" — exactly the belief a rollback falsifies — and believing it
+        // would skip the deploy that repairs the rollback. Reading live state is what makes a
+        // redundant deploy a proven no-op instead of an assumed one, which is in turn what makes a
+        // cross-project `dependsOn: ["<other>:deploy"]` edge cheap enough to be the ordering mechanism.
         let taggedVersionId = null;
         if (versionTag && workerExists) {
-            const versions = await wranglerJson(runner, ['versions', 'list', '--name', workerName, '--json'], run);
-            const deployments = await wranglerJson(runner, ['deployments', 'status', '--name', workerName, '--json'], run);
-            taggedVersionId = findVersionIdByTag(versions, versionTag);
-            if (taggedVersionId && isFullCurrentDeployment(deployments, taggedVersionId)) {
+            taggedVersionId = findVersionIdByTag(await probe.versions(), versionTag);
+            if (taggedVersionId && currentDeploymentVersionId(await probe.deployments()) === taggedVersionId) {
                 return { stage, workerName, action: 'remote-cache-hit', versionTag };
             }
         }
@@ -101,6 +100,7 @@ export async function deployStage(cwd, options, dependencies = {}) {
                 ...envArgs,
                 '--yes',
             ], run);
+            await confirmVersionIsLive(probe, versionTag, { stage, workerName, accountId }, options, dependencies, cwd);
             return { stage, workerName, action: 'activated', versionTag };
         }
         const deployArgs = ['deploy', '--config', prepared.deployConfigPath, ...envArgs];
@@ -112,6 +112,9 @@ export async function deployStage(cwd, options, dependencies = {}) {
             deployArgs.push('--secrets-file', temporarySecretsPath);
         }
         await wrangler(runner, deployArgs, run);
+        if (versionTag) {
+            await confirmVersionIsLive(probe, versionTag, { stage, workerName, accountId }, options, dependencies, cwd);
+        }
         return { stage, workerName, action: 'deployed', ...(versionTag ? { versionTag } : {}) };
     }
     finally {
@@ -447,48 +450,30 @@ export function nxTaskVersionTag(environment) {
     }
     throw new Error('NX_TASK_HASH must be canonical decimal digits or at least 32 hexadecimal characters.');
 }
-export function findVersionIdByTag(value, tag) {
-    if (Array.isArray(value)) {
-        for (const entry of value) {
-            const found = findVersionIdByTag(entry, tag);
-            if (found)
-                return found;
-        }
-        return null;
-    }
-    if (!isUnknownRecord(value))
-        return null;
-    const annotations = isUnknownRecord(value.annotations) ? value.annotations : undefined;
-    const metadata = isUnknownRecord(value.metadata) ? value.metadata : undefined;
-    const annotationTag = annotations?.['workers/tag'];
-    const candidateTag = typeof annotationTag === 'string' ? annotationTag : typeof value.tag === 'string' ? value.tag : metadata?.tag;
-    if (candidateTag === tag) {
-        if (typeof value.id === 'string')
-            return value.id;
-        if (typeof value.version_id === 'string')
-            return value.version_id;
-    }
-    for (const nested of Object.values(value)) {
-        const found = findVersionIdByTag(nested, tag);
-        if (found)
-            return found;
-    }
-    return null;
-}
-export function isFullCurrentDeployment(value, versionId) {
-    if (Array.isArray(value))
-        return value.some((entry) => isFullCurrentDeployment(entry, versionId));
-    if (!isUnknownRecord(value))
-        return false;
-    if (Array.isArray(value.versions)) {
-        return (value.versions.length === 1 &&
-            value.versions.some((version) => isUnknownRecord(version) &&
-                (version.version_id === versionId || version.id === versionId) &&
-                Number(version.percentage) === 100));
+/**
+ * Turns "Cloudflare accepted the traffic shift" into "the new version answers".
+ *
+ * Without this the deploy step goes green while the edge still serves the previous version — the
+ * measured gap was about 20 s — so anything ordered after this deploy could call into code that
+ * has not shipped yet. The wait is what a `dependsOn: ["<other>:deploy"]` edge actually buys; an
+ * edge onto a step that returns early orders nothing.
+ */
+async function confirmVersionIsLive(probe, versionTag, identity, options, dependencies, cwd) {
+    const wait = dependencies.wait ?? {};
+    const live = await awaitLiveVersion(probe, versionTag, wait);
+    if (!live.ok)
+        throw new Error(`${identity.workerName}: ${live.error.message}`);
+    if (options.versionEndpoint) {
+        const answered = await awaitVersionEndpoint(options.versionEndpoint, versionTag, wait);
+        if (!answered.ok)
+            throw new Error(`${identity.workerName}: ${answered.error.message}`);
     }
-    return Object.values(value).some((entry) => isFullCurrentDeployment(entry, versionId));
+    const processEnv = dependencies.processEnv ?? process.env;
+    const directory = dependencies.liveVersionCacheDirectory ?? liveVersionCacheDirectory(cwd, processEnv);
+    await writeCachedLiveVersion(directory, { accountId: identity.accountId, workerName: identity.workerName, stage: identity.stage }, { versionTag, versionId: live.value.versionId, fetchedAt: Date.now() });
 }
-async function wranglerJson(runner, args, run) {
+/** One wrangler invocation whose stdout must be JSON; shared by the deploy and the read-only query. */
+export async function wranglerJson(runner, args, run) {
     const result = await wrangler(runner, args, run);
     try {
         return JSON.parse(result.stdout);

package/dist/wrangler/deployed-version.d.ts

@@ -0,0 +1,44 @@
+import { type ProcessRunner } from './deploy-stage.js';
+import { type DeploymentStage } from './stage.js';
+export interface DeployedVersionOptions {
+    /** `staging`, `production`, or `prN`. */
+    stage: string;
+    /** The build-generated flat wrangler.json the deploy would use, when the project deploys one. */
+    config?: string;
+    /** Ask Cloudflare even when a fresh cache entry exists. */
+    refresh?: boolean;
+}
+export interface DeployedVersionDependencies {
+    runner?: ProcessRunner;
+    processEnv?: NodeJS.ProcessEnv;
+    cacheDirectory?: string;
+    ttlMs?: number;
+    now?: () => number;
+}
+export interface DeployedVersionReport {
+    workerName: string;
+    stage: DeploymentStage;
+    versionTag: string | null;
+    versionId: string;
+    source: 'cloudflare' | 'cache';
+}
+/**
+ * The worker `stage` deploys to, from committed configuration alone.
+ *
+ * A pull-request stage's worker name is derived from the staging name the same way the deploy
+ * derives it, but WITHOUT the account listing the deploy needs for its KV/D1/R2 isolation: a
+ * question about what is live must not be able to create anything.
+ */
+export declare function stageWorkerName(cwd: string, stage: DeploymentStage, configPath?: string): Promise<string>;
+/**
+ * Answers with the tag serving 100% of this worker's traffic, or refuses.
+ *
+ * Refusing is the whole contract. A missing credential, an API error, or a traffic split has no
+ * honest answer, and returning a placeholder such as `unknown` would be worse than the error: a
+ * later run comparing against that placeholder would read it as a match and conclude the desired
+ * version is already live. For the same reason nothing here is ever written to the cache except a
+ * real observation, and the answer never contains a timestamp or anything else that varies per
+ * invocation.
+ */
+export declare function deployedVersion(cwd: string, options: DeployedVersionOptions, dependencies?: DeployedVersionDependencies): Promise<DeployedVersionReport>;
+//# sourceMappingURL=deployed-version.d.ts.map

package/dist/wrangler/deployed-version.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deployed-version.d.ts","sourceRoot":"","sources":["../../src/wrangler/deployed-version.ts"],"names":[],"mappings":"AAUA,OAAO,EAAoB,KAAK,aAAa,EAAwC,MAAM,mBAAmB,CAAC;AAU/G,OAAO,EACL,KAAK,eAAe,EAMrB,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,sBAAsB;IACrC,yCAAyC;IACzC,KAAK,EAAE,MAAM,CAAC;IACd,iGAAiG;IACjG,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2DAA2D;IAC3D,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,2BAA2B;IAC1C,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IAC/B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,eAAe,CAAC;IACvB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC;CAChC;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAe/G;AAED;;;;;;;;;GASG;AACH,wBAAsB,eAAe,CACnC,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,sBAAsB,EAC/B,YAAY,GAAE,2BAAgC,GAC7C,OAAO,CAAC,qBAAqB,CAAC,CAqChC"}

package/dist/wrangler/deployed-version.js

@@ -0,0 +1,87 @@
+// `smoo wrangler deployed-version --stage <stage>` — what is serving this project's worker right now.
+//
+// Read-only by construction: it resolves the worker name from the committed config and asks
+// Cloudflare. It never provisions, never derives a pull-request stage's resources, and never
+// writes anything except its own cache entry.
+import { existsSync } from 'node:fs';
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { parseJsonFileText } from '../lib/json.js';
+import { BunProcessRunner, wranglerJson } from './deploy-stage.js';
+import { parseFlatWranglerConfig, planFlatStageResources } from './flat-config.js';
+import { LIVE_VERSION_CACHE_TTL_MS, liveVersionCacheDirectory, readCachedLiveVersion, readLiveVersion, writeCachedLiveVersion, } from './live-version.js';
+import { isPullRequestStage, parseDeploymentStage, planConfiguredStageResources, stageResourceName, stagingWorkerBaseName, } from './stage.js';
+/**
+ * The worker `stage` deploys to, from committed configuration alone.
+ *
+ * A pull-request stage's worker name is derived from the staging name the same way the deploy
+ * derives it, but WITHOUT the account listing the deploy needs for its KV/D1/R2 isolation: a
+ * question about what is live must not be able to create anything.
+ */
+export async function stageWorkerName(cwd, stage, configPath) {
+    if (configPath) {
+        const flat = parseJsonFileText(configPath, await readFile(configPath, 'utf8'), parseFlatWranglerConfig);
+        return isPullRequestStage(stage)
+            ? stageResourceName(stagingWorkerBaseName(flat.name), stage)
+            : planFlatStageResources(flat, stage).workerName;
+    }
+    const tomlPath = join(cwd, 'wrangler.toml');
+    if (!existsSync(tomlPath)) {
+        throw new Error(`${tomlPath} does not exist; pass --config for a build-generated flat configuration.`);
+    }
+    const toml = await readFile(tomlPath, 'utf8');
+    return isPullRequestStage(stage)
+        ? stageResourceName(stagingWorkerBaseName(planConfiguredStageResources(toml, 'staging').workerName), stage)
+        : planConfiguredStageResources(toml, stage).workerName;
+}
+/**
+ * Answers with the tag serving 100% of this worker's traffic, or refuses.
+ *
+ * Refusing is the whole contract. A missing credential, an API error, or a traffic split has no
+ * honest answer, and returning a placeholder such as `unknown` would be worse than the error: a
+ * later run comparing against that placeholder would read it as a match and conclude the desired
+ * version is already live. For the same reason nothing here is ever written to the cache except a
+ * real observation, and the answer never contains a timestamp or anything else that varies per
+ * invocation.
+ */
+export async function deployedVersion(cwd, options, dependencies = {}) {
+    const stage = parseDeploymentStage(options.stage);
+    const processEnv = dependencies.processEnv ?? process.env;
+    const accountId = processEnv.CLOUDFLARE_ACCOUNT_ID;
+    if (!accountId)
+        throw new Error('CLOUDFLARE_ACCOUNT_ID is required.');
+    if (!processEnv.CLOUDFLARE_API_TOKEN)
+        throw new Error('CLOUDFLARE_API_TOKEN is required.');
+    const workerName = await stageWorkerName(cwd, stage, options.config);
+    const cacheDirectory = dependencies.cacheDirectory ?? liveVersionCacheDirectory(cwd, processEnv);
+    const key = { accountId, workerName, stage };
+    const ttlMs = dependencies.ttlMs ?? LIVE_VERSION_CACHE_TTL_MS;
+    const now = dependencies.now ?? Date.now;
+    if (options.refresh !== true) {
+        const cached = await readCachedLiveVersion(cacheDirectory, key, ttlMs, now);
+        if (cached) {
+            return { workerName, stage, versionTag: cached.versionTag, versionId: cached.versionId, source: 'cache' };
+        }
+    }
+    const runner = dependencies.runner ?? new BunProcessRunner();
+    const run = { cwd, unsetEnv: ['CLOUDFLARE_ENV'] };
+    const probe = {
+        deployments: () => wranglerJson(runner, ['deployments', 'status', '--name', workerName, '--json'], run),
+        versions: () => wranglerJson(runner, ['versions', 'list', '--name', workerName, '--json'], run),
+    };
+    const live = await readLiveVersion(probe);
+    if (!live.ok)
+        throw new Error(`${workerName} (${stage}): ${live.error.message}`);
+    await writeCachedLiveVersion(cacheDirectory, key, {
+        versionTag: live.value.tag,
+        versionId: live.value.versionId,
+        fetchedAt: now(),
+    });
+    return {
+        workerName,
+        stage,
+        versionTag: live.value.tag,
+        versionId: live.value.versionId,
+        source: 'cloudflare',
+    };
+}

package/dist/wrangler/live-version.d.ts

@@ -0,0 +1,146 @@
+/** Same shape as the release tooling's Result: a known operational failure is a value, not a throw. */
+export type Result<T, E> = {
+    ok: true;
+    value: T;
+} | {
+    ok: false;
+    error: E;
+};
+/** The version Cloudflare is serving to 100% of traffic for one worker. */
+export interface LiveVersion {
+    versionId: string;
+    /** `wrangler versions deploy --version-tag` matches on this; a version deployed outside Nx has none. */
+    tag: string | null;
+}
+export type LiveVersionFailure = {
+    kind: 'never-deployed';
+    message: string;
+} | {
+    kind: 'split-traffic';
+    message: string;
+};
+/** Reads the two `wrangler` JSON payloads the live version is derived from. */
+export interface LiveVersionProbe {
+    /** `wrangler deployments status --name <worker> --json` */
+    deployments(): Promise<unknown>;
+    /** `wrangler versions list --name <worker> --json` */
+    versions(): Promise<unknown>;
+}
+/**
+ * Every `{ id -> tag }` pair the payload carries, in document order.
+ *
+ * Wrangler nests versions differently per subcommand and per version of itself, spells the tag
+ * three ways (`annotations['workers/tag']`, a bare `tag`, `metadata.tag`) and the id two (`id`,
+ * `version_id`). One walk collects the relation once; both directions of the lookup are then a Map
+ * read rather than a second recursive scan that could disagree with the first.
+ */
+export declare function collectVersionTags(value: unknown): Map<string, string>;
+/** The version id whose tag is `tag`, or null. */
+export declare function findVersionIdByTag(value: unknown, tag: string): string | null;
+/** One version's share of the current deployment's traffic. */
+export interface DeployedVersionShare {
+    versionId: string | null;
+    percentage: number;
+}
+/**
+ * The current deployment's traffic split, or null when the payload names no deployment at all.
+ *
+ * "Nothing is deployed" and "two versions share the traffic" are different facts with different
+ * remedies, and a caller that collapses them cannot tell an operator which one it hit — so the
+ * split is returned whole and both questions are answered from it.
+ */
+export declare function currentDeploymentVersions(value: unknown): DeployedVersionShare[] | null;
+/**
+ * The one version serving 100% of traffic, or null when there is none or the deployment is split.
+ *
+ * A split is not "close enough": with two versions live, "is our version live" has no single
+ * answer, and answering it optimistically is how a deploy reports success while part of the
+ * traffic still reaches the old code.
+ */
+export declare function currentDeploymentVersionId(value: unknown): string | null;
+/** The version serving all traffic for this worker, with the tag it was uploaded under. */
+export declare function readLiveVersion(probe: LiveVersionProbe): Promise<Result<LiveVersion, LiveVersionFailure>>;
+/**
+ * How long a deploy waits for the version it just activated to become the one being served.
+ *
+ * The bound is the point: an unbounded loop turns a stuck propagation into a hung CI job nobody
+ * reads, and a fixed sleep turns it into a green job that lied. Both are worse than a red job
+ * naming what it expected and what it saw.
+ */
+export declare const LIVE_VERSION_WAIT_BUDGET_MS = 120000;
+/** Cloudflare's control plane converges in seconds; polling faster than this only burns API quota. */
+export declare const LIVE_VERSION_POLL_INTERVAL_MS = 2000;
+export interface LiveVersionWaitOptions {
+    budgetMs?: number;
+    intervalMs?: number;
+    now?: () => number;
+    sleep?: (ms: number) => Promise<void>;
+}
+export interface LiveVersionNotObserved {
+    kind: 'not-observed';
+    message: string;
+    expected: string;
+    observed: string;
+}
+/**
+ * Polls until the worker's live version carries `expectedTag`, or the budget runs out.
+ *
+ * The tag is the match, not the version id: the tag IS the desired-state identity (`nx-<task
+ * hash>`), it is what both `wrangler deploy --tag` and `wrangler versions deploy --version-tag`
+ * were told to make live, and it is the one name the caller knows before the upload has produced
+ * a version id.
+ *
+ * Returns the failure rather than throwing it: a deploy that cannot be observed is an operational
+ * outcome the caller has to report, not a broken invariant.
+ */
+export declare function awaitLiveVersion(probe: LiveVersionProbe, expectedTag: string, options?: LiveVersionWaitOptions): Promise<Result<LiveVersion, LiveVersionNotObserved>>;
+/**
+ * Exactly the call the wait makes. Demanding all of `typeof fetch` would force every caller — the
+ * tests included — to also supply `preconnect`, which nothing here uses.
+ */
+export type FetchLike = (input: string, init?: RequestInit) => Promise<Response>;
+export interface VersionEndpointWaitOptions extends LiveVersionWaitOptions {
+    fetch?: FetchLike;
+}
+/**
+ * Polls a worker-served endpoint until it answers with `expectedTag`.
+ *
+ * The control plane agreeing is necessary and not sufficient — that gap is exactly what this
+ * change's predecessor measured — so a project that can prove the edge serves the new code says so
+ * with an endpoint echoing its own version tag (Workers read it from the version-metadata
+ * binding). The contract is deliberately one shape: the trimmed response body IS the tag.
+ */
+export declare function awaitVersionEndpoint(url: string, expectedTag: string, options?: VersionEndpointWaitOptions): Promise<Result<void, LiveVersionNotObserved>>;
+/**
+ * How long `smoo wrangler deployed-version` trusts its own last answer.
+ *
+ * This TTL is a convenience for operators and repeated local queries, NOT a correctness mechanism:
+ * nothing that decides whether to deploy may read it. The deploy's own liveness check always calls
+ * Cloudflare, because a cached "live already equals the desired tag" is precisely the belief a
+ * rollback falsifies, and acting on it would skip the deploy that repairs the rollback.
+ */
+export declare const LIVE_VERSION_CACHE_TTL_MS = 45000;
+export interface LiveVersionCacheKey {
+    accountId: string;
+    workerName: string;
+    stage: string;
+}
+export interface CachedLiveVersion {
+    versionTag: string | null;
+    versionId: string;
+    fetchedAt: number;
+}
+/**
+ * One file per key, so two deploys running in parallel cannot clobber each other's answer; a
+ * shared map would need a lock to say the same thing.
+ */
+export declare function liveVersionCachePath(cacheDirectory: string, key: LiveVersionCacheKey): string;
+export declare function readCachedLiveVersion(cacheDirectory: string, key: LiveVersionCacheKey, ttlMs: number, now?: () => number): Promise<CachedLiveVersion | null>;
+export declare function writeCachedLiveVersion(cacheDirectory: string, key: LiveVersionCacheKey, entry: CachedLiveVersion): Promise<void>;
+/**
+ * Where the cache lives. Nx's workspace data directory already exists, is already gitignored, and
+ * is already wiped when the workspace is reset — three properties a hand-rolled directory would
+ * each have to re-earn, and one ($HOME) that would leak one checkout's answers into another's.
+ */
+export declare function liveVersionCacheDirectory(workspaceRoot: string, environment: NodeJS.ProcessEnv): string;
+//# sourceMappingURL=live-version.d.ts.map

package/dist/wrangler/live-version.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"live-version.d.ts","sourceRoot":"","sources":["../../src/wrangler/live-version.ts"],"names":[],"mappings":"AAYA,uGAAuG;AACvG,MAAM,MAAM,MAAM,CAAC,CAAC,EAAE,CAAC,IAAI;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAE,CAAC;AAE5E,2EAA2E;AAC3E,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,wGAAwG;IACxG,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;CACpB;AAED,MAAM,MAAM,kBAAkB,GAC1B;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC3C;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/C,+EAA+E;AAC/E,MAAM,WAAW,gBAAgB;IAC/B,2DAA2D;IAC3D,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAChC,sDAAsD;IACtD,QAAQ,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;CAC9B;AAID;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAItE;AAqBD,kDAAkD;AAClD,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAK7E;AAED,+DAA+D;AAC/D,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,OAAO,GAAG,oBAAoB,EAAE,GAAG,IAAI,CAqBvF;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAKxE;AAED,2FAA2F;AAC3F,wBAAsB,eAAe,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC,CAiB/G;AAED;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,SAAU,CAAC;AACnD,sGAAsG;AACtG,eAAO,MAAM,6BAA6B,OAAQ,CAAC;AAEnD,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,cAAc,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAkCD;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,gBAAgB,EACvB,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,sBAAsB,CAAC,CAAC,CAoBtD;AAED;;;GAGG;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAEjF,MAAM,WAAW,0BAA2B,SAAQ,sBAAsB;IACxE,KAAK,CAAC,EAAE,SAAS,CAAC;CACnB;AAED;;;;;;;GAOG;AACH,wBAAsB,oBAAoB,CACxC,GAAG,EAAE,MAAM,EACX,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,0BAA+B,GACvC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC,CAkB/C;AAcD;;;;;;;GAOG;AACH,eAAO,MAAM,yBAAyB,QAAS,CAAC;AAEhD,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAID;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,cAAc,EAAE,MAAM,EAAE,GAAG,EAAE,mBAAmB,GAAG,MAAM,CAG7F;AAED,wBAAsB,qBAAqB,CACzC,cAAc,EAAE,MAAM,EACtB,GAAG,EAAE,mBAAmB,EACxB,KAAK,EAAE,MAAM,EACb,GAAG,GAAE,MAAM,MAAiB,GAC3B,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAUnC;AAED,wBAAsB,sBAAsB,CAC1C,cAAc,EAAE,MAAM,EACtB,GAAG,EAAE,mBAAmB,EACxB,KAAK,EAAE,iBAAiB,GACvB,OAAO,CAAC,IAAI,CAAC,CAIf;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,aAAa,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAEvG"}