@smoothbricks/cli 0.11.16 → 0.11.17

package/dist/secrets/commands.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"commands.d.ts","sourceRoot":"","sources":["../../src/secrets/commands.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAgBH,uFAAuF;AACvF,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,MAAM,GAAG,SAAS,GACvB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAuB/D;AAED,mEAAmE;AACnE,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,GAAG,SAAS,GACvB,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAWvD;AA8BD;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAgC9E;AA8BD,0CAA0C;AAC1C,wBAAsB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAa1F;AAED;;;;GAIG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAuB3F"}

package/dist/secrets/commands.js

@@ -0,0 +1,189 @@
+/**
+ * `smoo secrets` — the operator side of the reconciliation in ./index.ts.
+ *
+ * Values are handed to `gh` over stdin, never through argv (a process list is
+ * world-readable) and never printed. Reading one from the terminal disables
+ * echo, so a pasted key does not end up in a scrollback buffer or a screen
+ * share.
+ */
+import { spawn, spawnSync } from 'node:child_process';
+import { getWorkspacePackages } from '../lib/workspace.js';
+import { fetchLocalSecret, localSecretCommandNames, reconcileSecrets, secretNameMapping, unsatisfiedSecrets, unwiredSecrets, workerSecretNames, workflowSecretNames, } from './index.js';
+/** Repository secret names GitHub currently holds, or a refusal naming what failed. */
+export function readRepositorySecrets(repo) {
+    const args = ['secret', 'list', '--json', 'name'];
+    if (repo)
+        args.push('--repo', repo);
+    const result = spawnSync('gh', args, { encoding: 'utf8' });
+    if (result.status !== 0) {
+        return {
+            ok: false,
+            reason: `gh ${args.join(' ')} exited ${result.status ?? 'without status'}: ${result.stderr.trim()}`,
+        };
+    }
+    const parsed = JSON.parse(result.stdout);
+    if (!Array.isArray(parsed)) {
+        return { ok: false, reason: 'gh secret list did not return a list' };
+    }
+    const names = [];
+    for (const row of parsed) {
+        if (typeof row !== 'object' || row === null || !('name' in row))
+            continue;
+        // `in` narrows the property to unknown, so the typeof check below is the
+        // only thing that admits it — no assertion about gh's output shape.
+        const name = row.name;
+        if (typeof name === 'string')
+            names.push(name);
+    }
+    return { ok: true, names: names.sort((left, right) => left.localeCompare(right)) };
+}
+/** Write one secret, value over stdin so it never reaches argv. */
+export async function writeRepositorySecret(name, value, repo) {
+    const args = ['secret', 'set', name];
+    if (repo)
+        args.push('--repo', repo);
+    const child = spawn('gh', args, { stdio: ['pipe', 'inherit', 'inherit'] });
+    child.stdin.end(value);
+    const status = await new Promise((resolvePromise) => {
+        child.on('close', (code) => resolvePromise(code));
+    });
+    return status === 0
+        ? { ok: true }
+        : { ok: false, reason: `gh ${args.join(' ')} exited ${status ?? 'without status'}` };
+}
+function collectSources(root, repositorySecrets) {
+    const workspaceDirs = getWorkspacePackages(root).map((pkg) => pkg.path);
+    const workerSecrets = workerSecretNames(root, workspaceDirs);
+    const workflowSecrets = workflowSecretNames(root);
+    const localCommands = localSecretCommandNames(root);
+    const envNames = [
+        ...new Set([...Object.values(workerSecrets).flatMap((names) => [...names]), ...workflowSecrets, ...localCommands]),
+    ];
+    return {
+        workerSecrets,
+        workflowSecrets,
+        secretNames: secretNameMapping(root, envNames),
+        localCommands,
+        repositorySecrets,
+    };
+}
+function describe(row) {
+    const where = row.declaredByWorkers.length > 0 ? row.declaredByWorkers.join(', ') : '—';
+    return [
+        row.onRepository ? 'set ' : 'ABSENT',
+        row.name.padEnd(32),
+        row.suppliedByWorkflow ? 'workflow' : '        ',
+        row.fetchableLocally ? 'local' : '     ',
+        where,
+    ].join('  ');
+}
+/**
+ * Print every known secret with its sources. Exit code 1 when a workflow
+ * promises a value the repository does not hold — that combination is the one
+ * that fails a deploy, and it fails talking about the value rather than the
+ * missing secret.
+ */
+export function secretsStatus(root, options) {
+    const repositorySecrets = readRepositorySecrets(options.repo);
+    if (!repositorySecrets.ok) {
+        console.error(repositorySecrets.reason);
+        return 1;
+    }
+    const rows = reconcileSecrets(collectSources(root, repositorySecrets.names));
+    console.log('state   name                              workflow  local  declared by');
+    for (const row of rows)
+        console.log(describe(row));
+    const unsatisfied = unsatisfiedSecrets(rows);
+    const unwired = unwiredSecrets(rows);
+    if (unwired.length > 0) {
+        console.log('');
+        for (const row of unwired) {
+            console.log(`note: ${row.name} is declared by ${row.declaredByWorkers.join(', ')} but no managed workflow passes it; ` +
+                'declare it in smoo.github.deploySecrets to have CI supply it.');
+        }
+    }
+    if (unsatisfied.length > 0) {
+        console.log('');
+        for (const row of unsatisfied) {
+            console.error(`missing: ${row.name} — a workflow passes secrets.${row.name} and the repository has no value.`);
+            console.error(`         set it with: smoo secrets set ${row.name}${options.repo ? ` --repo ${options.repo}` : ''}`);
+        }
+        return 1;
+    }
+    return 0;
+}
+/** Read a value with echo disabled when stdin is a terminal; otherwise read piped input. */
+async function readSecretValue(prompt) {
+    if (!process.stdin.isTTY) {
+        const chunks = [];
+        for await (const chunk of process.stdin)
+            chunks.push(Buffer.from(chunk));
+        return Buffer.concat(chunks).toString('utf8').replace(/\n$/, '');
+    }
+    process.stderr.write(prompt);
+    process.stdin.setRawMode(true);
+    let value = '';
+    try {
+        for await (const chunk of process.stdin) {
+            const text = Buffer.from(chunk).toString('utf8');
+            if (text === '\r' || text === '\n' || text === '\u0004')
+                break;
+            if (text === '\u0003')
+                throw new Error('cancelled');
+            if (text === '\u007f') {
+                value = value.slice(0, -1);
+                continue;
+            }
+            value += text;
+        }
+    }
+    finally {
+        process.stdin.setRawMode(false);
+        process.stderr.write('\n');
+    }
+    return value;
+}
+/** Set one secret from a pasted value. */
+export async function secretsSet(name, options) {
+    const value = await readSecretValue(`Value for ${name} (not echoed): `);
+    if (value.length === 0) {
+        console.error(`${name}: refusing to set an empty value.`);
+        return 1;
+    }
+    const written = await writeRepositorySecret(name, value, options.repo);
+    if (!written.ok) {
+        console.error(written.reason);
+        return 1;
+    }
+    console.log(`set     ${name}`);
+    return 0;
+}
+/**
+ * Push every locally fetchable secret to the repository. Only names
+ * `smoo.secrets` declares a command for: everything else has no source here
+ * and must be pasted with `smoo secrets set`.
+ */
+export async function secretsSync(root, options) {
+    const names = localSecretCommandNames(root);
+    if (names.length === 0) {
+        console.error('smoo.secrets declares no fetch commands; nothing to sync.');
+        return 1;
+    }
+    let failed = 0;
+    for (const name of names) {
+        const fetched = fetchLocalSecret(root, name);
+        if (!fetched.ok) {
+            console.error(`skip    ${name}: ${fetched.reason}`);
+            failed += 1;
+            continue;
+        }
+        const written = await writeRepositorySecret(name, fetched.value, options.repo);
+        if (!written.ok) {
+            console.error(`fail    ${name}: ${written.reason}`);
+            failed += 1;
+            continue;
+        }
+        console.log(`set     ${name}`);
+    }
+    return failed === 0 ? 0 : 1;
+}

package/dist/secrets/index.d.ts

@@ -0,0 +1,83 @@
+/**
+ * Reconciles the three places a repository's secrets are described, all of
+ * which smoo already owns:
+ *
+ * 1. **Workers declare names.** `.dev.vars.example` per wrangler project — the
+ *    file `wrangler types --env-file` reads and `prepare-env` prompts from.
+ * 2. **Workflows declare where values come from.** `smoo.github.deploySecrets`
+ *    and `e2eSecrets` map an env name to a repository secret, and the managed
+ *    workflows render exactly those into the job environment.
+ * 3. **A developer shell declares how to fetch one locally.** `smoo.secrets`
+ *    names a command whose stdout is the value.
+ *
+ * Nothing joined them, so a Worker could declare a secret no workflow supplies
+ * and no repository holds. That fails at deploy time, on a stage, with a
+ * fail-closed message about the value rather than about the missing
+ * declaration — the shape that costs an afternoon: a Worker declares
+ * `STRIPE_PUBLISHABLE_KEY`, `ci.yml` passes `secrets.STRIPE_PUBLISHABLE_KEY`,
+ * the repository holds no such secret, and the empty value surfaces as the
+ * payment library's own `publishable_key_mismatch` refusal.
+ */
+/** Where an env name is described, which repository secret carries it, and whether that exists. */
+export interface SecretRow {
+    name: string;
+    /** The repository secret this env name reads from, by convention or declaration. */
+    repositorySecret: string;
+    /** Wrangler projects whose `.dev.vars.example` declares it. */
+    declaredByWorkers: string[];
+    /** True when a managed workflow renders `secrets.<name>` into a job. */
+    suppliedByWorkflow: boolean;
+    /** True when `smoo.secrets` can fetch it for a developer shell. */
+    fetchableLocally: boolean;
+    /** True when the repository holds a secret of this name. */
+    onRepository: boolean;
+}
+export interface SecretSources {
+    /** Worker label -> env names it declares. */
+    workerSecrets: Record<string, readonly string[]>;
+    /** Env names a managed workflow passes into a job. */
+    workflowSecrets: readonly string[];
+    /** Env name -> repository secret, by convention with declared exceptions. */
+    secretNames: Readonly<Record<string, string>>;
+    /** Env names `smoo.secrets` can fetch locally. */
+    localCommands: readonly string[];
+    /** Repository secret names GitHub currently holds. */
+    repositorySecrets: readonly string[];
+}
+/**
+ * One row per name known to any source, sorted, so a reader sees the whole
+ * picture rather than one source's view of it.
+ */
+export declare function reconcileSecrets(sources: SecretSources): SecretRow[];
+/**
+ * The rows a CI deploy cannot satisfy: a Worker declares the name, a workflow
+ * promises to pass it, and the repository has no value to pass. Reported
+ * separately from "declared but not wired into any workflow", because the
+ * remedies differ — set a secret, versus declare it in `smoo.github`.
+ */
+export declare function unsatisfiedSecrets(rows: readonly SecretRow[]): SecretRow[];
+/** Worker-declared names no managed workflow passes: a CI deploy will run without them. */
+export declare function unwiredSecrets(rows: readonly SecretRow[]): SecretRow[];
+/** Env names the managed workflows pass into a job, from the declarations that render them. */
+export declare function workflowSecretNames(root: string): string[];
+/**
+ * Env name -> repository secret for every name in play, following the naming
+ * convention and honouring the declared exceptions a repository still needs.
+ */
+export declare function secretNameMapping(root: string, envNames: readonly string[]): Record<string, string>;
+/** Every wrangler project's declared secret names, keyed by the project directory. */
+export declare function workerSecretNames(root: string, workspaceDirs: readonly string[]): Record<string, string[]>;
+/** Names `smoo.secrets` declares a fetch command for. */
+export declare function localSecretCommandNames(root: string): string[];
+/**
+ * Resolve one declared secret through its command. The value is returned, never
+ * logged: callers hand it to `gh secret set` over stdin.
+ */
+export declare function fetchLocalSecret(root: string, name: string): {
+    ok: true;
+    value: string;
+} | {
+    ok: false;
+    reason: string;
+};
+//# sourceMappingURL=index.d.ts.map

package/dist/secrets/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/secrets/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AASH,mGAAmG;AACnG,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,oFAAoF;IACpF,gBAAgB,EAAE,MAAM,CAAC;IACzB,+DAA+D;IAC/D,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,wEAAwE;IACxE,kBAAkB,EAAE,OAAO,CAAC;IAC5B,mEAAmE;IACnE,gBAAgB,EAAE,OAAO,CAAC;IAC1B,4DAA4D;IAC5D,YAAY,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,aAAa;IAC5B,6CAA6C;IAC7C,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC;IACjD,sDAAsD;IACtD,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,6EAA6E;IAC7E,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IAC9C,kDAAkD;IAClD,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,sDAAsD;IACtD,iBAAiB,EAAE,SAAS,MAAM,EAAE,CAAC;CACtC;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,aAAa,GAAG,SAAS,EAAE,CA0BpE;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,SAAS,SAAS,EAAE,GAAG,SAAS,EAAE,CAE1E;AAED,2FAA2F;AAC3F,wBAAgB,cAAc,CAAC,IAAI,EAAE,SAAS,SAAS,EAAE,GAAG,SAAS,EAAE,CAEtE;AAED,+FAA+F;AAC/F,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAkB1D;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAMnG;AAED,sFAAsF;AACtF,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAS1G;AAED,yDAAyD;AACzD,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAG9D;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,GACX;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAqB7D"}

package/dist/secrets/index.js

@@ -0,0 +1,149 @@
+/**
+ * Reconciles the three places a repository's secrets are described, all of
+ * which smoo already owns:
+ *
+ * 1. **Workers declare names.** `.dev.vars.example` per wrangler project — the
+ *    file `wrangler types --env-file` reads and `prepare-env` prompts from.
+ * 2. **Workflows declare where values come from.** `smoo.github.deploySecrets`
+ *    and `e2eSecrets` map an env name to a repository secret, and the managed
+ *    workflows render exactly those into the job environment.
+ * 3. **A developer shell declares how to fetch one locally.** `smoo.secrets`
+ *    names a command whose stdout is the value.
+ *
+ * Nothing joined them, so a Worker could declare a secret no workflow supplies
+ * and no repository holds. That fails at deploy time, on a stage, with a
+ * fail-closed message about the value rather than about the missing
+ * declaration — the shape that costs an afternoon: a Worker declares
+ * `STRIPE_PUBLISHABLE_KEY`, `ci.yml` passes `secrets.STRIPE_PUBLISHABLE_KEY`,
+ * the repository holds no such secret, and the empty value surfaces as the
+ * payment library's own `publishable_key_mismatch` refusal.
+ */
+import { spawnSync } from 'node:child_process';
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { repositoryOwnerFromUrl, repositorySecretMapping } from '../lib/secret-names.js';
+import { readPackageJsonObject, repositoryInfo } from '../lib/workspace.js';
+import { parseDevVarsExample } from '../wrangler/prepare-env.js';
+/**
+ * One row per name known to any source, sorted, so a reader sees the whole
+ * picture rather than one source's view of it.
+ */
+export function reconcileSecrets(sources) {
+    const declaredByAnyWorker = Object.values(sources.workerSecrets).flatMap((names) => [...names]);
+    const names = new Set([...declaredByAnyWorker, ...sources.workflowSecrets, ...sources.localCommands]);
+    // A repository secret that already carries a known env name is that name's
+    // row, not a row of its own: listing ACME_GITHUB_CLIENT_SECRET beside
+    // GITHUB_CLIENT_SECRET would report one value as two secrets, one of them
+    // permanently "declared by nothing".
+    const carriesKnownEnvName = new Set(names.size > 0 ? [...names].map((name) => sources.secretNames[name] ?? name) : []);
+    for (const secret of sources.repositorySecrets) {
+        if (!carriesKnownEnvName.has(secret))
+            names.add(secret);
+    }
+    return [...names]
+        .sort((left, right) => left.localeCompare(right))
+        .map((name) => ({
+        name,
+        repositorySecret: sources.secretNames[name] ?? name,
+        declaredByWorkers: Object.entries(sources.workerSecrets)
+            .filter(([, declared]) => declared.includes(name))
+            .map(([label]) => label)
+            .sort((left, right) => left.localeCompare(right)),
+        suppliedByWorkflow: sources.workflowSecrets.includes(name),
+        fetchableLocally: sources.localCommands.includes(name),
+        onRepository: sources.repositorySecrets.includes(sources.secretNames[name] ?? name),
+    }));
+}
+/**
+ * The rows a CI deploy cannot satisfy: a Worker declares the name, a workflow
+ * promises to pass it, and the repository has no value to pass. Reported
+ * separately from "declared but not wired into any workflow", because the
+ * remedies differ — set a secret, versus declare it in `smoo.github`.
+ */
+export function unsatisfiedSecrets(rows) {
+    return rows.filter((row) => row.suppliedByWorkflow && !row.onRepository);
+}
+/** Worker-declared names no managed workflow passes: a CI deploy will run without them. */
+export function unwiredSecrets(rows) {
+    return rows.filter((row) => row.declaredByWorkers.length > 0 && !row.suppliedByWorkflow);
+}
+/** Env names the managed workflows pass into a job, from the declarations that render them. */
+export function workflowSecretNames(root) {
+    const manifest = readPackageJsonObject(join(root, 'package.json'));
+    const smoo = manifest?.smoo;
+    const github = smoo?.github;
+    const names = new Set([
+        ...Object.keys(github?.deploySecrets ?? {}),
+        ...Object.keys(github?.e2eSecrets ?? {}),
+    ]);
+    if (smoo?.remoteCache?.tokenSecret)
+        names.add(smoo.remoteCache.tokenSecret);
+    for (const origin of github?.cargoCredentials?.gitOrigins ?? []) {
+        if (origin.tokenEnv)
+            names.add(origin.tokenEnv);
+    }
+    for (const source of github?.sourceCheckouts ?? []) {
+        if (source.tokenEnv)
+            names.add(source.tokenEnv);
+    }
+    if (smoo?.privateNpm?.readTokenEnv)
+        names.add(smoo.privateNpm.readTokenEnv);
+    if (smoo?.privateNpm?.publishTokenEnv)
+        names.add(smoo.privateNpm.publishTokenEnv);
+    return [...names].sort((left, right) => left.localeCompare(right));
+}
+/**
+ * Env name -> repository secret for every name in play, following the naming
+ * convention and honouring the declared exceptions a repository still needs.
+ */
+export function secretNameMapping(root, envNames) {
+    const manifest = readPackageJsonObject(join(root, 'package.json'));
+    const declared = { ...(manifest?.smoo?.github?.deploySecrets ?? {}), ...(manifest?.smoo?.github?.e2eSecrets ?? {}) };
+    const repository = manifest ? repositoryInfo(manifest) : null;
+    const owner = repository ? (repositoryOwnerFromUrl(repository.url) ?? '') : '';
+    return repositorySecretMapping(envNames, owner, declared);
+}
+/** Every wrangler project's declared secret names, keyed by the project directory. */
+export function workerSecretNames(root, workspaceDirs) {
+    const byWorker = {};
+    for (const dir of workspaceDirs) {
+        const examplePath = join(root, dir, '.dev.vars.example');
+        if (!existsSync(examplePath))
+            continue;
+        const names = parseDevVarsExample(readFileSync(examplePath, 'utf8'));
+        if (names.length > 0)
+            byWorker[dir] = names;
+    }
+    return byWorker;
+}
+/** Names `smoo.secrets` declares a fetch command for. */
+export function localSecretCommandNames(root) {
+    const manifest = readPackageJsonObject(join(root, 'package.json'));
+    return Object.keys(manifest?.smoo?.secrets ?? {}).sort((left, right) => left.localeCompare(right));
+}
+/**
+ * Resolve one declared secret through its command. The value is returned, never
+ * logged: callers hand it to `gh secret set` over stdin.
+ */
+export function fetchLocalSecret(root, name) {
+    const manifest = readPackageJsonObject(join(root, 'package.json'));
+    const declared = manifest?.smoo?.secrets?.[name];
+    if (!declared) {
+        return { ok: false, reason: `smoo.secrets declares no command for ${name}` };
+    }
+    const [command, ...args] = declared.command;
+    const result = spawnSync(command, args, { encoding: 'utf8' });
+    if (result.status !== 0) {
+        // Name the command, never its output: a failing secret fetch prints
+        // credentials often enough that it is worth refusing to.
+        return {
+            ok: false,
+            reason: `${name}: \`${declared.command.join(' ')}\` exited ${result.status ?? 'without status'}`,
+        };
+    }
+    const value = result.stdout.replace(/\n$/, '');
+    if (value.length === 0) {
+        return { ok: false, reason: `${name}: \`${declared.command.join(' ')}\` produced no value` };
+    }
+    return { ok: true, value };
+}

package/dist/wrangler/deploy-stage.d.ts

@@ -1,4 +1,5 @@
 import { type CloudflareClient } from './cloudflare.js';
+import { type VersionEndpointWaitOptions } from './live-version.js';
 import { type DeploymentStage } from './stage.js';
 export interface ProcessResult {
     exitCode: number;
@@ -24,6 +25,10 @@ export interface WranglerCommandDependencies {
     runner?: ProcessRunner;
     cloudflare?: CloudflareClient;
     processEnv?: NodeJS.ProcessEnv;
+    /** Bounds and clock for the post-deploy wait; tests drive it without sleeping. */
+    wait?: VersionEndpointWaitOptions;
+    /** Where a successful deploy records the tag it made live, for `smoo wrangler deployed-version`. */
+    liveVersionCacheDirectory?: string;
 }
 export interface DeployStageResult {
     stage: DeploymentStage;
@@ -36,6 +41,12 @@ export interface DeployStageOptions {
     stage: string;
     /** A build-generated flat wrangler.json to deploy instead of `./wrangler.toml` (see `prepareFlatConfig`). */
     config?: string;
+    /**
+     * A URL, served by this worker, whose trimmed body is the running version tag. When given, the
+     * deploy is not done until that URL answers with the tag it just made live — the control plane
+     * accepting a traffic shift is not the edge serving it.
+     */
+    versionEndpoint?: string;
 }
 export declare function deployStage(cwd: string, options: DeployStageOptions, dependencies?: WranglerCommandDependencies): Promise<DeployStageResult>;
 /**
@@ -60,7 +71,7 @@ export interface CleanupResult {
 }
 export declare function cleanupPullRequest(cwd: string, prNumber: number, dependencies?: WranglerCommandDependencies): Promise<CleanupResult>;
 export declare function nxTaskVersionTag(environment: NodeJS.ProcessEnv): string | undefined;
-export declare function findVersionIdByTag(value: unknown, tag: string): string | null;
-export declare function isFullCurrentDeployment(value: unknown, versionId: string): boolean;
+/** One wrangler invocation whose stdout must be JSON; shared by the deploy and the read-only query. */
+export declare function wranglerJson(runner: ProcessRunner, args: string[], run: ProcessRunOptions): Promise<unknown>;
 export {};
 //# sourceMappingURL=deploy-stage.d.ts.map

package/dist/wrangler/deploy-stage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy-stage.d.ts","sourceRoot":"","sources":["../../src/wrangler/deploy-stage.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,KAAK,gBAAgB,EAA+C,MAAM,iBAAiB,CAAC;AAGrG,OAAO,EAEL,KAAK,eAAe,EAYrB,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,6GAA6G;IAC7G,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,kHAAkH;IAClH,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;CAC1F;AAED,+GAA+G;AAC/G,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,CAAC,UAAU,CAE9E;AAED,qBAAa,gBAAiB,YAAW,aAAa;IAC9C,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,aAAa,CAAC,CAc7F;CACF;AAED,MAAM,WAAW,2BAA2B;IAC1C,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CAChC;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,eAAe,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,UAAU,GAAG,WAAW,GAAG,kBAAkB,CAAC;IACtD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAID,MAAM,WAAW,kBAAkB;IACjC,yCAAyC;IACzC,KAAK,EAAE,MAAM,CAAC;IACd,6GAA6G;IAC7G,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wBAAsB,WAAW,CAC/B,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,kBAAkB,EAC3B,YAAY,GAAE,2BAAgC,GAC7C,OAAO,CAAC,iBAAiB,CAAC,CA4F5B;AAyFD;;;;GAIG;AACH,iBAAe,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAOhF;AACD,eAAO,MAAM,2BAA2B,6BAAuB,CAAC;AAqFhE,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,KAAK,MAAM,EAAE,CAAC;IACrB,OAAO,EAAE;QACP,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,MAAM,CAAC;QAChB,YAAY,EAAE,MAAM,CAAC;QACrB,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,EAAE,MAAM,CAAC;QACnB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;CACH;AAED,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,EAChB,YAAY,GAAE,2BAAgC,GAC7C,OAAO,CAAC,aAAa,CAAC,CAoFxB;AAwFD,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,GAAG,SAAS,CAgBnF;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAuB7E;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAelF"}
+{"version":3,"file":"deploy-stage.d.ts","sourceRoot":"","sources":["../../src/wrangler/deploy-stage.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,KAAK,gBAAgB,EAA+C,MAAM,iBAAiB,CAAC;AAErG,OAAO,EAOL,KAAK,0BAA0B,EAEhC,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAEL,KAAK,eAAe,EAYrB,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,6GAA6G;IAC7G,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,kHAAkH;IAClH,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;CAC1F;AAED,+GAA+G;AAC/G,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,CAAC,UAAU,CAE9E;AAED,qBAAa,gBAAiB,YAAW,aAAa;IAC9C,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,aAAa,CAAC,CAc7F;CACF;AAED,MAAM,WAAW,2BAA2B;IAC1C,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IAC/B,kFAAkF;IAClF,IAAI,CAAC,EAAE,0BAA0B,CAAC;IAClC,oGAAoG;IACpG,yBAAyB,CAAC,EAAE,MAAM,CAAC;CACpC;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,eAAe,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,UAAU,GAAG,WAAW,GAAG,kBAAkB,CAAC;IACtD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,kBAAkB;IACjC,yCAAyC;IACzC,KAAK,EAAE,MAAM,CAAC;IACd,6GAA6G;IAC7G,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,wBAAsB,WAAW,CAC/B,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,kBAAkB,EAC3B,YAAY,GAAE,2BAAgC,GAC7C,OAAO,CAAC,iBAAiB,CAAC,CAwG5B;AAyFD;;;;GAIG;AACH,iBAAe,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAOhF;AACD,eAAO,MAAM,2BAA2B,6BAAuB,CAAC;AAqFhE,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,KAAK,MAAM,EAAE,CAAC;IACrB,OAAO,EAAE;QACP,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,MAAM,CAAC;QAChB,YAAY,EAAE,MAAM,CAAC;QACrB,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,EAAE,MAAM,CAAC;QACnB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;CACH;AAED,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,EAChB,YAAY,GAAE,2BAAgC,GAC7C,OAAO,CAAC,aAAa,CAAC,CAoFxB;AAwFD,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,GAAG,SAAS,CAgBnF;AAyCD,uGAAuG;AACvG,wBAAsB,YAAY,CAAC,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC,OAAO,CAAC,CAOlH"}

package/dist/wrangler/deploy-stage.js

@@ -2,11 +2,11 @@ import { randomUUID } from 'node:crypto';
 import { existsSync, readFileSync } from 'node:fs';
 import { readFile, rm, writeFile } from 'node:fs/promises';
 import { dirname, join } from 'node:path';
-import typia from 'typia';
 import { parseJsonFileText } from '../lib/json.js';
 import { mergeEnv, printCommandOutput } from '../lib/run.js';
 import { CloudflareRestClient } from './cloudflare.js';
 import { parseFlatWranglerConfig, planFlatStageResources } from './flat-config.js';
+import { awaitLiveVersion, awaitVersionEndpoint, currentDeploymentVersionId, findVersionIdByTag, liveVersionCacheDirectory, writeCachedLiveVersion, } from './live-version.js';
 import { parseDevVarsExample } from './prepare-env.js';
 import { derivePullRequestStageConfig, derivePullRequestWranglerConfig, hasExactStageSegment, isPullRequestStage, parseDeploymentStage, planConfiguredStageResources, planPullRequestBindings, planPullRequestResources, pullRequestStage, } from './stage.js';
 /** The child environment `options` describe; every runner, test doubles included, spawns with exactly this. */
@@ -30,15 +30,6 @@ export class BunProcessRunner {
         return { exitCode, stdout, stderr };
     }
 }
-const isUnknownRecord = (() => {
-    const _io0 = input => Object.keys(input).every(key => {
-        const value = input[key];
-        if (undefined === value)
-            return true;
-        return true;
-    });
-    return input => "object" === typeof input && null !== input && false === Array.isArray(input) && _io0(input);
-})();
 export async function deployStage(cwd, options, dependencies = {}) {
     const stage = parseDeploymentStage(options.stage);
     const processEnv = dependencies.processEnv ?? process.env;
@@ -73,15 +64,23 @@ export async function deployStage(cwd, options, dependencies = {}) {
         // `reconcileStageResources` nor `versions list` looks at.
         const run = prepared.envFlag ? { cwd } : { cwd, unsetEnv: ['CLOUDFLARE_ENV'] };
         const workerName = prepared.plan.workerName;
+        const probe = {
+            deployments: () => wranglerJson(runner, ['deployments', 'status', '--name', workerName, '--json'], run),
+            versions: () => wranglerJson(runner, ['versions', 'list', '--name', workerName, '--json'], run),
+        };
         // The tagged-version lookup runs before the migrations: a cache hit means this exact build is
         // already live, so its migrations ran with it and re-applying them would touch the remote
         // database for nothing. The activation and upload paths below still migrate first.
+        //
+        // This reads Cloudflare every time and never the local cache. A cache hit here would mean
+        // "we believe this hash is live" — exactly the belief a rollback falsifies — and believing it
+        // would skip the deploy that repairs the rollback. Reading live state is what makes a
+        // redundant deploy a proven no-op instead of an assumed one, which is in turn what makes a
+        // cross-project `dependsOn: ["<other>:deploy"]` edge cheap enough to be the ordering mechanism.
         let taggedVersionId = null;
         if (versionTag && workerExists) {
-            const versions = await wranglerJson(runner, ['versions', 'list', '--name', workerName, '--json'], run);
-            const deployments = await wranglerJson(runner, ['deployments', 'status', '--name', workerName, '--json'], run);
-            taggedVersionId = findVersionIdByTag(versions, versionTag);
-            if (taggedVersionId && isFullCurrentDeployment(deployments, taggedVersionId)) {
+            taggedVersionId = findVersionIdByTag(await probe.versions(), versionTag);
+            if (taggedVersionId && currentDeploymentVersionId(await probe.deployments()) === taggedVersionId) {
                 return { stage, workerName, action: 'remote-cache-hit', versionTag };
             }
         }
@@ -101,6 +100,7 @@ export async function deployStage(cwd, options, dependencies = {}) {
                 ...envArgs,
                 '--yes',
             ], run);
+            await confirmVersionIsLive(probe, versionTag, { stage, workerName, accountId }, options, dependencies, cwd);
             return { stage, workerName, action: 'activated', versionTag };
         }
         const deployArgs = ['deploy', '--config', prepared.deployConfigPath, ...envArgs];
@@ -112,6 +112,9 @@ export async function deployStage(cwd, options, dependencies = {}) {
             deployArgs.push('--secrets-file', temporarySecretsPath);
         }
         await wrangler(runner, deployArgs, run);
+        if (versionTag) {
+            await confirmVersionIsLive(probe, versionTag, { stage, workerName, accountId }, options, dependencies, cwd);
+        }
         return { stage, workerName, action: 'deployed', ...(versionTag ? { versionTag } : {}) };
     }
     finally {
@@ -447,48 +450,30 @@ export function nxTaskVersionTag(environment) {
     }
     throw new Error('NX_TASK_HASH must be canonical decimal digits or at least 32 hexadecimal characters.');
 }
-export function findVersionIdByTag(value, tag) {
-    if (Array.isArray(value)) {
-        for (const entry of value) {
-            const found = findVersionIdByTag(entry, tag);
-            if (found)
-                return found;
-        }
-        return null;
-    }
-    if (!isUnknownRecord(value))
-        return null;
-    const annotations = isUnknownRecord(value.annotations) ? value.annotations : undefined;
-    const metadata = isUnknownRecord(value.metadata) ? value.metadata : undefined;
-    const annotationTag = annotations?.['workers/tag'];
-    const candidateTag = typeof annotationTag === 'string' ? annotationTag : typeof value.tag === 'string' ? value.tag : metadata?.tag;
-    if (candidateTag === tag) {
-        if (typeof value.id === 'string')
-            return value.id;
-        if (typeof value.version_id === 'string')
-            return value.version_id;
-    }
-    for (const nested of Object.values(value)) {
-        const found = findVersionIdByTag(nested, tag);
-        if (found)
-            return found;
-    }
-    return null;
-}
-export function isFullCurrentDeployment(value, versionId) {
-    if (Array.isArray(value))
-        return value.some((entry) => isFullCurrentDeployment(entry, versionId));
-    if (!isUnknownRecord(value))
-        return false;
-    if (Array.isArray(value.versions)) {
-        return (value.versions.length === 1 &&
-            value.versions.some((version) => isUnknownRecord(version) &&
-                (version.version_id === versionId || version.id === versionId) &&
-                Number(version.percentage) === 100));
+/**
+ * Turns "Cloudflare accepted the traffic shift" into "the new version answers".
+ *
+ * Without this the deploy step goes green while the edge still serves the previous version — the
+ * measured gap was about 20 s — so anything ordered after this deploy could call into code that
+ * has not shipped yet. The wait is what a `dependsOn: ["<other>:deploy"]` edge actually buys; an
+ * edge onto a step that returns early orders nothing.
+ */
+async function confirmVersionIsLive(probe, versionTag, identity, options, dependencies, cwd) {
+    const wait = dependencies.wait ?? {};
+    const live = await awaitLiveVersion(probe, versionTag, wait);
+    if (!live.ok)
+        throw new Error(`${identity.workerName}: ${live.error.message}`);
+    if (options.versionEndpoint) {
+        const answered = await awaitVersionEndpoint(options.versionEndpoint, versionTag, wait);
+        if (!answered.ok)
+            throw new Error(`${identity.workerName}: ${answered.error.message}`);
     }
-    return Object.values(value).some((entry) => isFullCurrentDeployment(entry, versionId));
+    const processEnv = dependencies.processEnv ?? process.env;
+    const directory = dependencies.liveVersionCacheDirectory ?? liveVersionCacheDirectory(cwd, processEnv);
+    await writeCachedLiveVersion(directory, { accountId: identity.accountId, workerName: identity.workerName, stage: identity.stage }, { versionTag, versionId: live.value.versionId, fetchedAt: Date.now() });
 }
-async function wranglerJson(runner, args, run) {
+/** One wrangler invocation whose stdout must be JSON; shared by the deploy and the read-only query. */
+export async function wranglerJson(runner, args, run) {
     const result = await wrangler(runner, args, run);
     try {
         return JSON.parse(result.stdout);