@smoothbricks/cli 0.11.15 → 0.11.17

package/dist/wrangler/live-version.js

@@ -0,0 +1,326 @@
+import * as _validateReport_1 from "typia/lib/internal/_validateReport";
+// What is live right now, as opposed to what we last uploaded.
+//
+// `wrangler versions deploy` returns when Cloudflare ACCEPTS the traffic shift, not when the edge
+// serves it. A deploy that returns is therefore not yet a deploy that answers: the site that signs
+// in to its stage's backend measured the previous backend version's response about 20 s after the
+// backend's deploy step had already gone green. Everything here exists to turn "we asked" into
+// "we observed".
+import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+import typia from 'typia';
+const isUnknownRecord = (() => {
+    const _io0 = input => Object.keys(input).every(key => {
+        const value = input[key];
+        if (undefined === value)
+            return true;
+        return true;
+    });
+    return input => "object" === typeof input && null !== input && false === Array.isArray(input) && _io0(input);
+})();
+/**
+ * Every `{ id -> tag }` pair the payload carries, in document order.
+ *
+ * Wrangler nests versions differently per subcommand and per version of itself, spells the tag
+ * three ways (`annotations['workers/tag']`, a bare `tag`, `metadata.tag`) and the id two (`id`,
+ * `version_id`). One walk collects the relation once; both directions of the lookup are then a Map
+ * read rather than a second recursive scan that could disagree with the first.
+ */
+export function collectVersionTags(value) {
+    const pairs = new Map();
+    collectInto(value, pairs);
+    return pairs;
+}
+function collectInto(value, pairs) {
+    if (Array.isArray(value)) {
+        for (const entry of value)
+            collectInto(entry, pairs);
+        return;
+    }
+    if (!isUnknownRecord(value))
+        return;
+    const annotations = isUnknownRecord(value.annotations) ? value.annotations : undefined;
+    const metadata = isUnknownRecord(value.metadata) ? value.metadata : undefined;
+    const annotationTag = annotations?.['workers/tag'];
+    const candidateTag = typeof annotationTag === 'string' ? annotationTag : typeof value.tag === 'string' ? value.tag : metadata?.tag;
+    const candidateId = typeof value.id === 'string' ? value.id : typeof value.version_id === 'string' ? value.version_id : undefined;
+    if (typeof candidateTag === 'string' && candidateId !== undefined && !pairs.has(candidateId)) {
+        pairs.set(candidateId, candidateTag);
+    }
+    for (const nested of Object.values(value))
+        collectInto(nested, pairs);
+}
+/** The version id whose tag is `tag`, or null. */
+export function findVersionIdByTag(value, tag) {
+    for (const [id, candidate] of collectVersionTags(value)) {
+        if (candidate === tag)
+            return id;
+    }
+    return null;
+}
+/**
+ * The current deployment's traffic split, or null when the payload names no deployment at all.
+ *
+ * "Nothing is deployed" and "two versions share the traffic" are different facts with different
+ * remedies, and a caller that collapses them cannot tell an operator which one it hit — so the
+ * split is returned whole and both questions are answered from it.
+ */
+export function currentDeploymentVersions(value) {
+    if (Array.isArray(value)) {
+        for (const entry of value) {
+            const found = currentDeploymentVersions(entry);
+            if (found)
+                return found;
+        }
+        return null;
+    }
+    if (!isUnknownRecord(value))
+        return null;
+    if (Array.isArray(value.versions)) {
+        return value.versions.map((version) => {
+            if (!isUnknownRecord(version))
+                return { versionId: null, percentage: 0 };
+            const id = version.version_id ?? version.id;
+            return { versionId: typeof id === 'string' ? id : null, percentage: Number(version.percentage) };
+        });
+    }
+    for (const nested of Object.values(value)) {
+        const found = currentDeploymentVersions(nested);
+        if (found)
+            return found;
+    }
+    return null;
+}
+/**
+ * The one version serving 100% of traffic, or null when there is none or the deployment is split.
+ *
+ * A split is not "close enough": with two versions live, "is our version live" has no single
+ * answer, and answering it optimistically is how a deploy reports success while part of the
+ * traffic still reaches the old code.
+ */
+export function currentDeploymentVersionId(value) {
+    const shares = currentDeploymentVersions(value);
+    if (shares?.length !== 1)
+        return null;
+    const [only] = shares;
+    return only.percentage === 100 ? only.versionId : null;
+}
+/** The version serving all traffic for this worker, with the tag it was uploaded under. */
+export async function readLiveVersion(probe) {
+    const deployments = await probe.deployments();
+    const shares = currentDeploymentVersions(deployments);
+    const versionId = currentDeploymentVersionId(deployments);
+    if (!versionId) {
+        return shares && shares.length > 0
+            ? {
+                ok: false,
+                error: {
+                    kind: 'split-traffic',
+                    message: 'no single worker version is serving 100% of traffic; refusing to name one as live',
+                },
+            }
+            : { ok: false, error: { kind: 'never-deployed', message: 'this worker has no active deployment' } };
+    }
+    const tag = collectVersionTags(await probe.versions()).get(versionId) ?? null;
+    return { ok: true, value: { versionId, tag } };
+}
+/**
+ * How long a deploy waits for the version it just activated to become the one being served.
+ *
+ * The bound is the point: an unbounded loop turns a stuck propagation into a hung CI job nobody
+ * reads, and a fixed sleep turns it into a green job that lied. Both are worse than a red job
+ * naming what it expected and what it saw.
+ */
+export const LIVE_VERSION_WAIT_BUDGET_MS = 120_000;
+/** Cloudflare's control plane converges in seconds; polling faster than this only burns API quota. */
+export const LIVE_VERSION_POLL_INTERVAL_MS = 2_000;
+/**
+ * Runs `attempt` until it succeeds or the budget expires, and reports the LAST thing it saw.
+ *
+ * Both waits below need the same deadline arithmetic and the same "what did you see instead"
+ * record; sharing it keeps the two from drifting into disagreeing about when a wait is over.
+ */
+async function pollWithinBudget(attempt, options) {
+    const budgetMs = options.budgetMs ?? LIVE_VERSION_WAIT_BUDGET_MS;
+    const intervalMs = options.intervalMs ?? LIVE_VERSION_POLL_INTERVAL_MS;
+    const now = options.now ?? Date.now;
+    const sleep = options.sleep ?? sleepFor;
+    const deadline = now() + budgetMs;
+    for (;;) {
+        const result = await attempt();
+        if (result.done)
+            return { ok: true, value: result.value };
+        if (now() >= deadline)
+            return { ok: false, error: { observed: result.observed, waitedMs: budgetMs } };
+        await sleep(intervalMs);
+    }
+}
+function sleepFor(ms) {
+    const { promise, resolve } = Promise.withResolvers();
+    setTimeout(resolve, ms);
+    return promise;
+}
+/**
+ * Polls until the worker's live version carries `expectedTag`, or the budget runs out.
+ *
+ * The tag is the match, not the version id: the tag IS the desired-state identity (`nx-<task
+ * hash>`), it is what both `wrangler deploy --tag` and `wrangler versions deploy --version-tag`
+ * were told to make live, and it is the one name the caller knows before the upload has produced
+ * a version id.
+ *
+ * Returns the failure rather than throwing it: a deploy that cannot be observed is an operational
+ * outcome the caller has to report, not a broken invariant.
+ */
+export async function awaitLiveVersion(probe, expectedTag, options = {}) {
+    const polled = await pollWithinBudget(async () => {
+        const live = await readLiveVersion(probe);
+        if (!live.ok)
+            return { done: false, observed: live.error.message };
+        const { tag, versionId } = live.value;
+        if (tag === expectedTag)
+            return { done: true, value: live.value };
+        return { done: false, observed: tag ? `${tag} (${versionId})` : `an untagged version (${versionId})` };
+    }, options);
+    if (polled.ok)
+        return polled;
+    return {
+        ok: false,
+        error: {
+            kind: 'not-observed',
+            expected: expectedTag,
+            observed: polled.error.observed,
+            message: `deployed version ${expectedTag} was not serving traffic after ` +
+                `${Math.round(polled.error.waitedMs / 1000)}s; live is ${polled.error.observed}`,
+        },
+    };
+}
+/**
+ * Polls a worker-served endpoint until it answers with `expectedTag`.
+ *
+ * The control plane agreeing is necessary and not sufficient — that gap is exactly what this
+ * change's predecessor measured — so a project that can prove the edge serves the new code says so
+ * with an endpoint echoing its own version tag (Workers read it from the version-metadata
+ * binding). The contract is deliberately one shape: the trimmed response body IS the tag.
+ */
+export async function awaitVersionEndpoint(url, expectedTag, options = {}) {
+    const request = options.fetch ?? fetch;
+    const polled = await pollWithinBudget(async () => {
+        const observed = await probeVersionEndpoint(request, url);
+        return observed === expectedTag ? { done: true, value: undefined } : { done: false, observed };
+    }, options);
+    if (polled.ok)
+        return polled;
+    return {
+        ok: false,
+        error: {
+            kind: 'not-observed',
+            expected: expectedTag,
+            observed: polled.error.observed,
+            message: `${url} did not report version ${expectedTag} after ` +
+                `${Math.round(polled.error.waitedMs / 1000)}s; it reported ${polled.error.observed}`,
+        },
+    };
+}
+async function probeVersionEndpoint(request, url) {
+    try {
+        const response = await request(url, { headers: { accept: 'text/plain' } });
+        const body = (await response.text()).trim();
+        return response.ok ? body : `HTTP ${response.status} ${body}`.trim();
+    }
+    catch (error) {
+        // A worker mid-rollout refuses connections; that is a poll result, not a reason to abandon the
+        // wait. It only becomes the failure when it is still the answer at the deadline.
+        return error instanceof Error ? error.message : String(error);
+    }
+}
+/**
+ * How long `smoo wrangler deployed-version` trusts its own last answer.
+ *
+ * This TTL is a convenience for operators and repeated local queries, NOT a correctness mechanism:
+ * nothing that decides whether to deploy may read it. The deploy's own liveness check always calls
+ * Cloudflare, because a cached "live already equals the desired tag" is precisely the belief a
+ * rollback falsifies, and acting on it would skip the deploy that repairs the rollback.
+ */
+export const LIVE_VERSION_CACHE_TTL_MS = 45_000;
+const parseCachedLiveVersion = (() => {
+    const _io0 = input => (null === input.versionTag || "string" === typeof input.versionTag) && "string" === typeof input.versionId && "number" === typeof input.fetchedAt;
+    const _vo0 = (input, _path, _exceptionable = true) => [null === input.versionTag || "string" === typeof input.versionTag || _report(_exceptionable, {
+            path: _path + ".versionTag",
+            expected: "(null | string)",
+            value: input.versionTag
+        }), "string" === typeof input.versionId || _report(_exceptionable, {
+            path: _path + ".versionId",
+            expected: "string",
+            value: input.versionId
+        }), "number" === typeof input.fetchedAt || _report(_exceptionable, {
+            path: _path + ".fetchedAt",
+            expected: "number",
+            value: input.fetchedAt
+        })].every(flag => flag);
+    const __is = input => "object" === typeof input && null !== input && _io0(input);
+    let errors;
+    let _report;
+    const __validate = input => {
+        if (false === __is(input)) {
+            errors = [];
+            _report = _validateReport_1._validateReport(errors);
+            ((input, _path, _exceptionable = true) => ("object" === typeof input && null !== input || _report(true, {
+                path: _path + "",
+                expected: "CachedLiveVersion",
+                value: input
+            })) && _vo0(input, _path + "", true) || _report(true, {
+                path: _path + "",
+                expected: "CachedLiveVersion",
+                value: input
+            }))(input, "$input", true);
+            const success = 0 === errors.length;
+            return success ? {
+                success,
+                data: input
+            } : {
+                success,
+                errors,
+                data: input
+            };
+        }
+        return {
+            success: true,
+            data: input
+        };
+    };
+    return input => __validate(JSON.parse(input));
+})();
+/**
+ * One file per key, so two deploys running in parallel cannot clobber each other's answer; a
+ * shared map would need a lock to say the same thing.
+ */
+export function liveVersionCachePath(cacheDirectory, key) {
+    const name = [key.accountId, key.workerName, key.stage].map(encodeURIComponent).join('_');
+    return join(cacheDirectory, 'smoo-live-version', `${name}.json`);
+}
+export async function readCachedLiveVersion(cacheDirectory, key, ttlMs, now = Date.now) {
+    let text;
+    try {
+        text = await readFile(liveVersionCachePath(cacheDirectory, key), 'utf8');
+    }
+    catch {
+        return null;
+    }
+    const parsed = parseCachedLiveVersion(text);
+    if (!parsed.success)
+        return null;
+    return now() - parsed.data.fetchedAt < ttlMs ? parsed.data : null;
+}
+export async function writeCachedLiveVersion(cacheDirectory, key, entry) {
+    const path = liveVersionCachePath(cacheDirectory, key);
+    await mkdir(dirname(path), { recursive: true });
+    await writeFile(path, `${JSON.stringify(entry)}\n`);
+}
+/**
+ * Where the cache lives. Nx's workspace data directory already exists, is already gitignored, and
+ * is already wiped when the workspace is reset — three properties a hand-rolled directory would
+ * each have to re-earn, and one ($HOME) that would leak one checkout's answers into another's.
+ */
+export function liveVersionCacheDirectory(workspaceRoot, environment) {
+    return environment.NX_WORKSPACE_DATA_DIRECTORY ?? join(workspaceRoot, '.nx', 'workspace-data');
+}

package/managed/raw/tooling/direnv/devenv.smoo.nix

@@ -372,9 +372,11 @@
         esac
       ''}
     '')
-    # Epilogue: the wrapper runs devenv from tooling/direnv, so return the shell
-    # to wherever the caller invoked it. Last, after every project step.
+    # Epilogue, after every project step (a project's own enterShell may resolve
+    # SDKROOT/compilers; the toolchain identity must see the final values). The
+    # stamp logic lives in toolchain-stamp.ts; see its header for why.
     (lib.mkAfter ''
+      bun "$DEVENV_ROOT/toolchain-stamp.ts" || exit $?
       if [ -n "$DEVENV_SHELL_PWD" ]; then
         cd "$DEVENV_SHELL_PWD"
       fi

package/managed/raw/tooling/direnv/github-actions-bootstrap.sh

@@ -145,7 +145,10 @@ build_devenv_shell() {
   # One evaluation: the shell that captures the environment is the shell
   # build. A separate `devenv shell -- date` evaluated everything twice.
   persist_devenv_environment
-  if [ "${SMOO_HOST_RUNNER:-false}" != true ]; then
+  # Only the ephemeral-runner path of setup-devenv opts in: the scan walks the
+  # whole store, which on a developer host or a host runner is large and not
+  # ours to root.
+  if [ "${SMOO_ROOT_BUILD_INPUTS:-false}" = true ]; then
     root_build_inputs "$since"
   fi
   # Add repo-local tools only after the shell exists; cleanup steps use an

package/managed/raw/tooling/direnv/toolchain-stamp.ts

@@ -0,0 +1,88 @@
+#!/usr/bin/env bun
+/**
+ * Invalidate cmake build-script caches when the toolchain changes.
+ *
+ * cmake-rs keeps CMAKE_OSX_SYSROOT and the compilers in CMakeCache.txt from
+ * the FIRST configure and only clears a build directory when the source path
+ * moves. Every C/C++ build script's cache under target/ therefore encodes
+ * whichever toolchain the shell had when it was first configured, and it
+ * outlives every later fix to that shell: a nix-store sysroot cached on one
+ * day kept failing `ld: library 'c++' not found` after the shell stopped
+ * exporting it. Nx does not see this state either — it hashes inputs, not
+ * what a cache under target/ remembers.
+ *
+ * Runs at the end of shell entry, after the project's own enterShell resolved
+ * SDKROOT and the compilers. It records the toolchain identity the shell
+ * settled on and, when that identity differs from the recorded one, removes
+ * exactly the cargo build-script directories that hold a CMakeCache.txt, so
+ * cargo re-runs those scripts against the current toolchain. Nothing else
+ * under target/ is touched; a checkout without target/ has nothing to do.
+ */
+import { existsSync, readdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { join, resolve } from 'node:path';
+import { $ } from 'bun';
+
+const root = resolve(`${process.env.DEVENV_ROOT ?? process.cwd()}/../..`);
+const target = join(root, 'target');
+if (existsSync(target)) {
+  const stamp = join(target, '.toolchain-stamp');
+  const identity = await toolchainIdentity();
+  const recorded = existsSync(stamp) ? readFileSync(stamp, 'utf8') : null;
+  if (recorded !== identity) {
+    const removed = removeCmakeBuildScriptDirs(target);
+    if (removed > 0) {
+      console.error(`devenv: toolchain identity changed; removed ${removed} cmake build-script cache(s) under target/`);
+    }
+    writeFileSync(stamp, identity);
+  }
+}
+
+async function toolchainIdentity(): Promise<string> {
+  const rustc = await $`rustc -Vv`.quiet().nothrow().text();
+  const cc = (await $`cc --version`.quiet().nothrow().text()).split('\n')[0] ?? '';
+  return [
+    rustc.trim(),
+    `SDKROOT=${process.env.SDKROOT ?? ''}`,
+    `DEVELOPER_DIR=${process.env.DEVELOPER_DIR ?? ''}`,
+    cc,
+  ].join('\n');
+}
+
+/**
+ * Removes every cargo build-script directory (`…/build/<crate>-<hash>`) whose
+ * `out/build/CMakeCache.txt` exists; returns the count. Only the `build/`
+ * directories cargo creates under a profile are scanned - never the compiled
+ * artifacts beside them - and the scan completes before anything is removed.
+ */
+function removeCmakeBuildScriptDirs(target: string): number {
+  const stale: string[] = [];
+  for (const buildDir of cargoBuildDirs(target, 0)) {
+    for (const entry of readdirSync(buildDir, { withFileTypes: true })) {
+      if (entry.isDirectory() && existsSync(join(buildDir, entry.name, 'out', 'build', 'CMakeCache.txt'))) {
+        stale.push(join(buildDir, entry.name));
+      }
+    }
+  }
+  for (const dir of stale) {
+    rmSync(dir, { recursive: true, force: true });
+  }
+  return stale.length;
+}
+
+/** `target/[<lane>/][<triple>/]<profile>/build` - at most four levels below target/. */
+function* cargoBuildDirs(dir: string, depth: number): Generator<string> {
+  if (depth > 4) {
+    return;
+  }
+  for (const entry of readdirSync(dir, { withFileTypes: true })) {
+    if (!entry.isDirectory()) {
+      continue;
+    }
+    const path = join(dir, entry.name);
+    if (entry.name === 'build' && depth > 0) {
+      yield path;
+    } else if (entry.name !== 'deps' && entry.name !== 'incremental' && entry.name !== '.fingerprint') {
+      yield* cargoBuildDirs(path, depth + 1);
+    }
+  }
+}

package/managed/templates/github/actions/setup-devenv/action.yml

@@ -237,5 +237,5 @@ runs:
       shell: bash
       working-directory: ${{ env.DEVENV_WORKDIR }}/tooling/direnv
       env:
-        SMOO_HOST_RUNNER: ${{ steps.runner-kind.outputs.host }}
+        SMOO_ROOT_BUILD_INPUTS: ${{ steps.runner-kind.outputs.host != 'true' }}
       run: ./github-actions-bootstrap.sh build-shell

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@smoothbricks/cli",
-  "version": "0.11.15",
+  "version": "0.11.17",
   "type": "module",
   "description": "SmoothBricks monorepo automation CLI",
   "bin": {
@@ -64,7 +64,7 @@
   ],
   "dependencies": {
     "@arethetypeswrong/core": "^0.18.2",
-    "@smoothbricks/nx-plugin": "0.4.9",
+    "@smoothbricks/nx-plugin": "0.4.11",
     "@smoothbricks/validation": "0.1.8",
     "commander": "^14.0.3",
     "make-synchronized": "^0.8.0",

package/src/cli.ts

@@ -6,7 +6,9 @@ import { cliPackageVersion } from './lib/cli-package.js';
 import { decode, findRepoRoot, printCommandOutput } from './lib/run.js';
 import { ensureChromium } from './playwright/index.js';
 import { resolvePrConflicts } from './pr/index.js';
+import { secretsSet, secretsStatus, secretsSync } from './secrets/commands.js';
 import { cleanupPullRequest, deployStage } from './wrangler/deploy-stage.js';
+import { deployedVersion } from './wrangler/deployed-version.js';
 import { scaffold } from './wrangler/scaffold.js';
 
 export async function runCli(argv = process.argv.slice(2)): Promise<void> {
@@ -525,6 +527,31 @@ function buildProgram(): Command {
       await ensureChromium();
     });
 
+  const secrets = program
+    .command('secrets')
+    .description('Reconcile declared secrets: what Workers need, what workflows pass, what the repository holds');
+  secrets
+    .command('status')
+    .description('Show every declared secret and refuse when a workflow passes one the repository lacks')
+    .option('--repo <owner/name>', 'repository to read secrets from; defaults to the current checkout')
+    .action(async (options: { repo?: string }) => {
+      process.exitCode = secretsStatus(await findRepoRoot(), options);
+    });
+  secrets
+    .command('set <name>')
+    .description('Set one repository secret from a pasted value; the value is read without echo and never logged')
+    .option('--repo <owner/name>', 'repository to set the secret on')
+    .action(async (name: string, options: { repo?: string }) => {
+      process.exitCode = await secretsSet(name, options);
+    });
+  secrets
+    .command('sync')
+    .description('Push every secret smoo.secrets can fetch locally to the repository')
+    .option('--repo <owner/name>', 'repository to set the secrets on')
+    .action(async (options: { repo?: string }) => {
+      process.exitCode = await secretsSync(await findRepoRoot(), options);
+    });
+
   const wrangler = program.command('wrangler').description('Cloudflare wrangler project helpers');
   wrangler
     .command('scaffold <project>')
@@ -537,11 +564,29 @@ function buildProgram(): Command {
     .command('deploy-stage')
     .requiredOption('--stage <stage>', 'staging, production, or prN')
     .option('--config <path>', 'deploy a build-generated flat wrangler.json instead of ./wrangler.toml')
-    .action(async (options: { stage: string; config?: string }) => {
+    .option('--version-endpoint <url>', 'URL served by this worker whose trimmed body is the running version tag')
+    .action(async (options: { stage: string; config?: string; versionEndpoint?: string }) => {
       await deployStage(process.cwd(), {
         stage: options.stage,
         ...(options.config ? { config: resolve(options.config) } : {}),
+        ...(options.versionEndpoint ? { versionEndpoint: options.versionEndpoint } : {}),
+      });
+    });
+  wrangler
+    .command('deployed-version')
+    .description('Print the version tag serving all traffic for this project\u2019s worker on a stage')
+    .requiredOption('--stage <stage>', 'staging, production, or prN')
+    .option('--config <path>', 'resolve the worker name from a build-generated flat wrangler.json')
+    .option('--refresh', 'ask Cloudflare even when a fresh cached answer exists')
+    .action(async (options: { stage: string; config?: string; refresh?: boolean }) => {
+      const report = await deployedVersion(process.cwd(), {
+        stage: options.stage,
+        ...(options.config ? { config: resolve(options.config) } : {}),
+        ...(options.refresh ? { refresh: true } : {}),
       });
+      // The tag alone on stdout: this is read by humans and by `$(...)`, and a version deployed
+      // outside Nx genuinely has no tag, which `untagged` says without pretending to be one.
+      console.log(report.versionTag ?? 'untagged');
     });
   wrangler
     .command('cleanup-pr')