@smoothbricks/cli 0.11.16 → 0.11.18

package/src/wrangler/deploy-stage.test.ts

@@ -1,17 +1,18 @@
 import { afterEach, describe, expect, it } from 'bun:test';
-import { existsSync, readFileSync, statSync } from 'node:fs';
+import { existsSync, mkdtempSync, readFileSync, statSync } from 'node:fs';
 import { mkdir, mkdtemp, readdir, readFile, rm, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import type {
-  CloudflareClient,
-  CloudflareZone,
-  D1DatabaseRecord,
-  DnsRecord,
-  R2Bucket,
-  WorkerDomain,
-  WorkerRoute,
-  WorkerScript,
+import {
+  CloudflareApiError,
+  type CloudflareClient,
+  type CloudflareZone,
+  type D1DatabaseRecord,
+  type DnsRecord,
+  type R2Bucket,
+  type WorkerDomain,
+  type WorkerRoute,
+  type WorkerScript,
 } from './cloudflare.js';
 import {
   childEnvironment,
@@ -22,6 +23,12 @@ import {
   type ProcessRunOptions,
   writeTemporaryConfigForTest,
 } from './deploy-stage.js';
+import {
+  type FetchLike,
+  findVersionIdByTag,
+  LIVE_VERSION_CACHE_TTL_MS,
+  readCachedLiveVersion,
+} from './live-version.js';
 import type { LiveKvNamespace } from './stage.js';
 
 const HASH = '16577780061662788004';
@@ -58,19 +65,49 @@ class FakeRunner implements ProcessRunner {
   secretsJson: string | undefined;
   /** Runs before the fake reports success, so a test can read a temporary file the command was handed. */
   onCall: ((args: string[], cwd: string) => Promise<void>) | undefined;
+  /**
+   * How many `deployments status` reads still answer with the OLD version after a traffic shift.
+   * This is the whole point of the fake: Cloudflare accepts the shift before it serves it.
+   */
+  propagationPolls = 0;
+
+  private pendingVersionId: string | null = null;
 
   constructor(
-    private readonly versions: unknown = [],
-    private readonly deployment: unknown = {},
+    private versions: unknown = [],
+    private deployment: unknown = {},
   ) {}
 
+  /** The versions payload as a growable list, so an upload can add the version it just created. */
+  private versionList(): unknown[] {
+    const list: unknown[] = Array.isArray(this.versions) ? this.versions : [this.versions];
+    this.versions = list;
+    return list;
+  }
+
+  private shiftTrafficTo(versionId: string): void {
+    this.pendingVersionId = versionId;
+  }
+
+  private readDeployment(): unknown {
+    if (this.pendingVersionId !== null) {
+      if (this.propagationPolls > 0) {
+        this.propagationPolls -= 1;
+      } else {
+        this.deployment = { versions: [{ version_id: this.pendingVersionId, percentage: 100 }] };
+        this.pendingVersionId = null;
+      }
+    }
+    return this.deployment;
+  }
+
   async run(command: string, args: string[], options: ProcessRunOptions): Promise<ProcessResult> {
     this.calls.push({ command, args, cwd: options.cwd, env: childEnvironment(options) });
     if (args[0] === 'versions' && args[1] === 'list') {
       return success(this.versions);
     }
     if (args[0] === 'deployments' && args[1] === 'status') {
-      return success(this.deployment);
+      return success(this.readDeployment());
     }
     const configIndex = args.indexOf('--config');
     if (configIndex >= 0) {
@@ -84,6 +121,21 @@ class FakeRunner implements ProcessRunner {
       this.secretsMode = statSync(secretsPath).mode & 0o777;
       this.secretsJson = readFileSync(secretsPath, 'utf8');
     }
+    if (args[0] === 'versions' && args[1] === 'deploy') {
+      // Resolved with the same reader the deploy uses, so the fake cannot agree with a lookup
+      // production would miss.
+      const tag = args[args.indexOf('--version-tag') + 1];
+      const existing = tag ? findVersionIdByTag(this.versions, tag) : null;
+      if (existing) this.shiftTrafficTo(existing);
+    }
+    if (args[0] === 'deploy') {
+      const tagIndex = args.indexOf('--tag');
+      if (tagIndex >= 0) {
+        const versionId = `uploaded-${args[tagIndex + 1]}`;
+        this.versionList().push({ id: versionId, annotations: { 'workers/tag': args[tagIndex + 1] } });
+        this.shiftTrafficTo(versionId);
+      }
+    }
     await this.onCall?.(args, options.cwd);
     return success({});
   }
@@ -93,6 +145,10 @@ class FakeCloudflare implements CloudflareClient {
   namespaces: LiveKvNamespace[] = [];
   buckets: R2Bucket[] = [];
   scripts: WorkerScript[] = [{ id: 'fixture-worker-pr123' }];
+  /** Secret names each Worker already holds, by Worker name. */
+  secrets: Record<string, string[]> = {};
+  /** Every Worker whose secrets were queried, in order, so a test can prove one was never asked. */
+  secretQueries: string[] = [];
   domains: WorkerDomain[] = [];
   zones: CloudflareZone[] = [];
   routes: Record<string, WorkerRoute[]> = {};
@@ -132,6 +188,20 @@ class FakeCloudflare implements CloudflareClient {
   async listWorkerScripts(): Promise<WorkerScript[]> {
     return this.scripts;
   }
+  async listWorkerSecrets(workerName: string): Promise<string[]> {
+    this.secretQueries.push(workerName);
+    // Cloudflare answers 404 for a Worker that is not there. Wrangler used to hand that back as an
+    // empty list; it no longer does, and code that reads the failure as "no secrets" inverts the
+    // one check a first deployment depends on.
+    if (!this.scripts.some((script) => script.id === workerName)) {
+      throw new CloudflareApiError(
+        `Cloudflare API /workers/scripts/${workerName}/secrets failed: not found`,
+        404,
+        [10007],
+      );
+    }
+    return this.secrets[workerName] ?? [];
+  }
   async deleteWorkerScript(name: string): Promise<void> {
     this.mutations.push(`delete-worker:${name}`);
   }
@@ -179,8 +249,8 @@ class FakeCloudflare implements CloudflareClient {
   }
 }
 
-describe('deploy-stage remote version fallback', () => {
-  it('returns a remote cache hit for the active tagged 100% version', async () => {
+describe('deploy-stage against live state', () => {
+  it('uploads nothing and shifts no traffic when the live version already is the task hash', async () => {
     const root = await fixtureRoot();
     const runner = new FakeRunner([{ id: 'version-1', annotations: { 'workers/tag': `nx-${HASH}` } }], {
       versions: [{ version_id: 'version-1', percentage: 100 }],
@@ -189,14 +259,17 @@ describe('deploy-stage remote version fallback', () => {
     const result = await deployStage(root, { stage: 'pr123' }, dependencies(runner, new FakeCloudflare()));
 
     expect(result.action).toBe('remote-cache-hit');
+    // Two reads and nothing else. This is what makes a redundant deploy — the one a cross-project
+    // `dependsOn` edge adds — provably free instead of assumed free.
     expect(runner.calls.map((call) => call.args.slice(0, 2))).toEqual([
       ['versions', 'list'],
       ['deployments', 'status'],
     ]);
   });
 
-  it('activates an existing tagged version that is not current', async () => {
+  it('redeploys after a rollback, when the live version is no longer the task hash', async () => {
     const root = await fixtureRoot();
+    // The build for this hash is still uploaded; someone rolled traffic back to the older version.
     const runner = new FakeRunner([{ id: 'version-1', annotations: { 'workers/tag': `nx-${HASH}` } }], {
       versions: [{ version_id: 'version-2', percentage: 100 }],
     });
@@ -204,11 +277,108 @@ describe('deploy-stage remote version fallback', () => {
     const result = await deployStage(root, { stage: 'pr123' }, dependencies(runner, new FakeCloudflare()));
 
     expect(result.action).toBe('activated');
-    expect(runner.calls.at(-1)?.args.slice(0, 3)).toEqual(['versions', 'deploy', '--version-tag']);
-    expect(runner.configPathSeen).toBeDefined();
+    const shiftIndex = runner.calls.findIndex((call) => call.args[0] === 'versions' && call.args[1] === 'deploy');
+    expect(runner.calls[shiftIndex]?.args.slice(0, 4)).toEqual(['versions', 'deploy', '--version-tag', `nx-${HASH}`]);
+    // And the step does not return until it has read live state again after that shift.
+    expect(runner.calls.slice(shiftIndex + 1).some((call) => call.args[0] === 'deployments')).toBe(true);
     expect(existsSync(requiredTestValue(runner.configPathSeen, 'config path'))).toBe(false);
   });
 
+  it('waits out propagation before reporting the deploy done', async () => {
+    const root = await fixtureRoot();
+    const runner = new FakeRunner([{ id: 'version-1', annotations: { 'workers/tag': `nx-${HASH}` } }], {
+      versions: [{ version_id: 'version-2', percentage: 100 }],
+    });
+    runner.propagationPolls = 3;
+
+    const result = await deployStage(root, { stage: 'pr123' }, dependencies(runner, new FakeCloudflare()));
+
+    expect(result.action).toBe('activated');
+    const statusReads = runner.calls.filter((call) => call.args[0] === 'deployments').length;
+    expect(statusReads).toBe(5);
+  });
+
+  it('fails with what it expected and what it saw when the version never becomes live', async () => {
+    const root = await fixtureRoot();
+    const runner = new FakeRunner([{ id: 'version-1', annotations: { 'workers/tag': `nx-${HASH}` } }], {
+      versions: [{ version_id: 'version-2', percentage: 100 }],
+    });
+    runner.propagationPolls = Number.POSITIVE_INFINITY;
+
+    await expect(deployStage(root, { stage: 'pr123' }, dependencies(runner, new FakeCloudflare()))).rejects.toThrow(
+      `fixture-worker-pr123: deployed version nx-${HASH} was not serving traffic after 10s; live is an untagged version (version-2)`,
+    );
+  });
+
+  it('leaves the cache holding the tag it made live, so the next query needs no API call', async () => {
+    const root = await fixtureRoot();
+    const cacheDirectory = await mkdtemp(join(tmpdir(), 'smoo-live-version-'));
+    roots.push(cacheDirectory);
+    const runner = new FakeRunner([{ id: 'version-1', annotations: { 'workers/tag': `nx-${HASH}` } }], {
+      versions: [{ version_id: 'version-2', percentage: 100 }],
+    });
+
+    await deployStage(
+      root,
+      { stage: 'pr123' },
+      { ...dependencies(runner, new FakeCloudflare()), liveVersionCacheDirectory: cacheDirectory },
+    );
+
+    const cached = await readCachedLiveVersion(
+      cacheDirectory,
+      { accountId: 'account-1', workerName: 'fixture-worker-pr123', stage: 'pr123' },
+      LIVE_VERSION_CACHE_TTL_MS,
+    );
+    expect(cached).toMatchObject({ versionTag: `nx-${HASH}`, versionId: 'version-1' });
+  });
+
+  it('is not done until a declared version endpoint answers with the new tag', async () => {
+    const root = await fixtureRoot();
+    const runner = new FakeRunner([{ id: 'version-1', annotations: { 'workers/tag': `nx-${HASH}` } }], {
+      versions: [{ version_id: 'version-2', percentage: 100 }],
+    });
+    const bodies = [`nx-${'0'.repeat(20)}`, `nx-${'0'.repeat(20)}`, `nx-${HASH}`];
+    const requested: string[] = [];
+    const stubFetch: FetchLike = async (input) => {
+      requested.push(String(input));
+      return new Response(bodies.shift() ?? `nx-${HASH}`);
+    };
+
+    const result = await deployStage(
+      root,
+      { stage: 'pr123', versionEndpoint: 'https://fixture.example.test/__version' },
+      {
+        ...dependencies(runner, new FakeCloudflare()),
+        wait: { ...fakeWait(), fetch: stubFetch },
+      },
+    );
+
+    expect(result.action).toBe('activated');
+    expect(requested).toEqual([
+      'https://fixture.example.test/__version',
+      'https://fixture.example.test/__version',
+      'https://fixture.example.test/__version',
+    ]);
+  });
+
+  it('fails naming the endpoint answer when the edge never reports the new tag', async () => {
+    const root = await fixtureRoot();
+    const runner = new FakeRunner([{ id: 'version-1', annotations: { 'workers/tag': `nx-${HASH}` } }], {
+      versions: [{ version_id: 'version-2', percentage: 100 }],
+    });
+    const stubFetch: FetchLike = async () => new Response('nx-previous');
+
+    await expect(
+      deployStage(
+        root,
+        { stage: 'pr123', versionEndpoint: 'https://fixture.example.test/__version' },
+        { ...dependencies(runner, new FakeCloudflare()), wait: { ...fakeWait(), fetch: stubFetch } },
+      ),
+    ).rejects.toThrow(
+      `fixture-worker-pr123: https://fixture.example.test/__version did not report version nx-${HASH} after 10s; it reported nx-previous`,
+    );
+  });
+
   it('uploads a missing tag with a temporary config and secure secrets file, then removes both', async () => {
     const root = await fixtureRoot();
     await writeFile(join(root, '.dev.vars.example'), 'FIXTURE_SECRET=""\nFIXTURE_TOKEN=""\n');
@@ -231,9 +401,12 @@ describe('deploy-stage remote version fallback', () => {
     );
 
     expect(result.action).toBe('deployed');
-    expect(runner.calls.at(-1)?.args[0]).toBe('deploy');
-    expect(runner.calls.at(-1)?.args).toContain('--tag');
-    expect(runner.calls.at(-1)?.args).toContain(`nx-${HASH}`);
+    const upload = requiredTestValue(
+      runner.calls.find((call) => call.args[0] === 'deploy'),
+      'upload call',
+    );
+    expect(upload.args).toContain('--tag');
+    expect(upload.args).toContain(`nx-${HASH}`);
     expect(runner.secretsMode).toBe(0o600);
     expect(JSON.parse(requiredTestValue(runner.secretsJson, 'secrets JSON'))).toEqual({
       FIXTURE_SECRET: 'shared-secret',
@@ -243,11 +416,13 @@ describe('deploy-stage remote version fallback', () => {
     expect(existsSync(requiredTestValue(runner.secretsPathSeen, 'secrets path'))).toBe(false);
   });
 
-  it('passes only present manifest values for fixed stages and preserves absent remote secrets', async () => {
+  it('sends only the values it has and leaves a secret the Worker already holds untouched', async () => {
     const root = await fixtureRoot();
     await writeFile(join(root, '.dev.vars.example'), 'FIXTURE_SECRET=""\nFIXTURE_TOKEN=""\n');
     const runner = new FakeRunner([], {});
     const cloudflare = new FakeCloudflare();
+    cloudflare.scripts = [{ id: 'fixture-worker-staging' }];
+    cloudflare.secrets['fixture-worker-staging'] = ['FIXTURE_TOKEN'];
 
     const result = await deployStage(
       root,
@@ -263,6 +438,8 @@ describe('deploy-stage remote version fallback', () => {
       },
     );
 
+    // `--secrets-file` applies additively, so naming only what this shell has leaves FIXTURE_TOKEN
+    // exactly as the Worker holds it. That silence is only safe because the gate proved it is held.
     expect(result.action).toBe('deployed');
     expect(JSON.parse(requiredTestValue(runner.secretsJson, 'secrets JSON'))).toEqual({
       FIXTURE_SECRET: 'shared-secret',
@@ -313,6 +490,230 @@ describe('deploy-stage remote version fallback', () => {
   });
 });
 
+/**
+ * `smoo.wrangler.secretStages` answers two questions from one declaration, and both are load
+ * bearing: which secrets a stage must have before it may deploy, and which secrets it is allowed
+ * to receive at all. The second direction is the security-relevant one — a capability CI exports
+ * for preview stages must not ride a production deploy just because the variable is set.
+ */
+describe('stage-scoped deployment secrets', () => {
+  const STAGED_FIXTURE = `${FIXTURE}
+[env.production]
+name = "fixture-worker-production"
+workers_dev = false
+
+[env.production.vars]
+ENVIRONMENT = "production"
+`;
+
+  async function scopedRoot(secrets: string[], secretStages?: Record<string, string[]>): Promise<string> {
+    const root = await fixtureRoot(STAGED_FIXTURE);
+    await writeFile(join(root, '.dev.vars.example'), secrets.map((name) => `${name}=""\n`).join(''));
+    if (secretStages) {
+      await writeFile(
+        join(root, 'package.json'),
+        `${JSON.stringify({ name: '@acme/api', smoo: { wrangler: { secretStages } } }, null, 2)}\n`,
+      );
+    }
+    return root;
+  }
+
+  function environment(values: Record<string, string> = {}): NodeJS.ProcessEnv {
+    return { CLOUDFLARE_ACCOUNT_ID: 'account-1', CLOUDFLARE_API_TOKEN: 'token', ...values };
+  }
+
+  it('refuses a first deploy whose stage-required secret is exported nowhere, naming every one', async () => {
+    const root = await scopedRoot(['SESSION_SECRET', 'OAUTH_STATE_KEY'], {
+      OAUTH_STATE_KEY: ['staging', 'production'],
+    });
+    const runner = new FakeRunner([], {});
+    const cloudflare = new FakeCloudflare();
+
+    await expect(
+      deployStage(root, { stage: 'production' }, { runner, cloudflare, processEnv: environment() }),
+    ).rejects.toThrow(
+      /Refusing to deploy fixture-worker-production to production[\s\S]*SESSION_SECRET[\s\S]*OAUTH_STATE_KEY/,
+    );
+    expect(cloudflare.mutations).toEqual([]);
+    expect(runner.calls).toEqual([]);
+  });
+
+  it('treats a Worker that is not there as holding nothing, never as needing nothing', async () => {
+    const root = await scopedRoot(['OAUTH_STATE_KEY']);
+    const cloudflare = new FakeCloudflare();
+
+    // The double answers 404 for an absent Worker, exactly as Cloudflare does. Reading that error
+    // as "no secrets" would let this deploy through; asking at all would surface the 404 instead
+    // of the refusal. Neither happens: the script listing already said the Worker holds nothing.
+    await expect(
+      deployStage(
+        root,
+        { stage: 'production' },
+        { runner: new FakeRunner([], {}), cloudflare, processEnv: environment() },
+      ),
+    ).rejects.toThrow(/Refusing to deploy fixture-worker-production to production[\s\S]*OAUTH_STATE_KEY/);
+    expect(cloudflare.secretQueries).toEqual([]);
+    expect(cloudflare.mutations).toEqual([]);
+  });
+
+  it('requires an unscoped secret of every stage, including a pull-request stage', async () => {
+    const root = await scopedRoot(['SESSION_SECRET'], { OTHER_SECRET: ['staging'] });
+    await writeFile(join(root, '.dev.vars.example'), 'SESSION_SECRET=""\nOTHER_SECRET=""\n');
+    const cloudflare = new FakeCloudflare();
+
+    await expect(
+      deployStage(root, { stage: 'pr77' }, dependencies(new FakeRunner([], {}), cloudflare)),
+    ).rejects.toThrow(/fixture-worker-pr77[\s\S]*SESSION_SECRET — unscoped, so every stage requires it/);
+    expect(cloudflare.mutations).toEqual([]);
+  });
+
+  it('does not require a preview-scoped secret of production', async () => {
+    const root = await scopedRoot(['E2E_CONTROL_TOKEN'], { E2E_CONTROL_TOKEN: ['staging', 'preview'] });
+    const runner = new FakeRunner([], {});
+    const cloudflare = new FakeCloudflare();
+
+    const result = await deployStage(root, { stage: 'production' }, { runner, cloudflare, processEnv: environment() });
+
+    expect(result).toMatchObject({ action: 'deployed', workerName: 'fixture-worker-production' });
+    expect(runner.secretsPathSeen).toBeUndefined();
+  });
+
+  it('withholds a preview-scoped secret from production even when the deploying shell exports it', async () => {
+    const root = await scopedRoot(['API_TOKEN', 'E2E_CONTROL_TOKEN'], { E2E_CONTROL_TOKEN: ['staging', 'preview'] });
+    const runner = new FakeRunner([], {});
+    const cloudflare = new FakeCloudflare();
+    // The real environment, because that is what a child process inherits and what the shell of a
+    // laptop deploy actually looks like when CI has exported a preview capability.
+    process.env.E2E_CONTROL_TOKEN = 'teardown-value';
+
+    try {
+      const result = await deployStage(
+        root,
+        { stage: 'production' },
+        {
+          runner,
+          cloudflare,
+          processEnv: environment({ API_TOKEN: 'api-value', E2E_CONTROL_TOKEN: 'teardown-value' }),
+        },
+      );
+
+      expect(result.action).toBe('deployed');
+      expect(JSON.parse(requiredTestValue(runner.secretsJson, 'secrets JSON'))).toEqual({ API_TOKEN: 'api-value' });
+      // Not in the payload, and not readable by the deploy either: the capability is absent from
+      // this stage at the process boundary, not merely left out of a file.
+      for (const call of runner.calls) {
+        expect(call.env.E2E_CONTROL_TOKEN).toBeUndefined();
+      }
+      expect(runner.calls.length).toBeGreaterThan(0);
+    } finally {
+      delete process.env.E2E_CONTROL_TOKEN;
+    }
+  });
+
+  it('sends a preview-scoped secret to the stages it is scoped to', async () => {
+    const scopes = { E2E_CONTROL_TOKEN: ['staging', 'preview'] };
+    const values = { API_TOKEN: 'api-value', E2E_CONTROL_TOKEN: 'teardown-value' };
+
+    for (const stage of ['staging', 'pr77'] as const) {
+      const root = await scopedRoot(['API_TOKEN', 'E2E_CONTROL_TOKEN'], scopes);
+      const runner = new FakeRunner([], {});
+
+      await deployStage(root, { stage }, { runner, cloudflare: new FakeCloudflare(), processEnv: environment(values) });
+
+      expect(JSON.parse(requiredTestValue(runner.secretsJson, `secrets JSON for ${stage}`))).toEqual(values);
+    }
+  });
+
+  it('treats an empty scope as no stage at all, not as every stage', async () => {
+    const root = await scopedRoot(['API_TOKEN', 'LOCAL_ONLY_KEY'], { LOCAL_ONLY_KEY: [] });
+    const runner = new FakeRunner([], {});
+
+    // `[]` and "absent from the map" are opposite declarations. A check written as
+    // `!scope?.length` would collapse them and ship a local-development value to every stage.
+    const result = await deployStage(
+      root,
+      { stage: 'production' },
+      {
+        runner,
+        cloudflare: new FakeCloudflare(),
+        processEnv: environment({ API_TOKEN: 'api-value', LOCAL_ONLY_KEY: 'laptop-value' }),
+      },
+    );
+
+    expect(result.action).toBe('deployed');
+    expect(JSON.parse(requiredTestValue(runner.secretsJson, 'secrets JSON'))).toEqual({ API_TOKEN: 'api-value' });
+  });
+
+  it('refuses when the Worker holds a secret this stage is scoped out of, since a deploy cannot remove it', async () => {
+    const root = await scopedRoot(['E2E_CONTROL_TOKEN'], { E2E_CONTROL_TOKEN: ['staging', 'preview'] });
+    const cloudflare = new FakeCloudflare();
+    cloudflare.scripts = [{ id: 'fixture-worker-production' }];
+    cloudflare.secrets['fixture-worker-production'] = ['E2E_CONTROL_TOKEN'];
+
+    await expect(
+      deployStage(
+        root,
+        { stage: 'production' },
+        { runner: new FakeRunner([], {}), cloudflare, processEnv: environment() },
+      ),
+    ).rejects.toThrow(/keeps out of production[\s\S]*E2E_CONTROL_TOKEN — scoped to staging, preview/);
+    expect(cloudflare.mutations).toEqual([]);
+  });
+
+  it('refuses a scope written against a name no secret has, rather than scoping nothing', async () => {
+    const root = await scopedRoot(['E2E_CONTROL_TOKEN'], { E2E_CONTROL_TOEKN: ['staging'] });
+
+    await expect(
+      deployStage(
+        root,
+        { stage: 'production' },
+        { runner: new FakeRunner([], {}), cloudflare: new FakeCloudflare(), processEnv: environment() },
+      ),
+    ).rejects.toThrow(/secretStages scopes E2E_CONTROL_TOEKN, which .dev.vars.example does not declare/);
+  });
+
+  it('names a malformed scope declaration by its path in the manifest', async () => {
+    const root = await scopedRoot(['E2E_CONTROL_TOKEN'], { E2E_CONTROL_TOKEN: ['pr7'] });
+
+    await expect(
+      deployStage(
+        root,
+        { stage: 'production' },
+        { runner: new FakeRunner([], {}), cloudflare: new FakeCloudflare(), processEnv: environment() },
+      ),
+    ).rejects.toThrow(
+      /package\.json declares an invalid smoo\.wrangler block: smoo\.wrangler\.secretStages\.E2E_CONTROL_TOKEN\[0\]/,
+    );
+  });
+
+  it('keeps every secret value out of the refusal and off every command line', async () => {
+    const root = await scopedRoot(['API_TOKEN', 'SESSION_SECRET']);
+    const runner = new FakeRunner([], {});
+    const cloudflare = new FakeCloudflare();
+
+    const refused = await deployStage(
+      root,
+      { stage: 'production' },
+      { runner, cloudflare, processEnv: environment({ API_TOKEN: 'api-value' }) },
+    ).catch((error: unknown) => (error instanceof Error ? error.message : String(error)));
+
+    expect(refused).toContain('SESSION_SECRET');
+    expect(refused).not.toContain('api-value');
+
+    // And the same on the path that does deploy: values reach wrangler through a 0600 file only.
+    cloudflare.scripts = [{ id: 'fixture-worker-production' }];
+    cloudflare.secrets['fixture-worker-production'] = ['SESSION_SECRET'];
+    await deployStage(
+      root,
+      { stage: 'production' },
+      { runner, cloudflare, processEnv: environment({ API_TOKEN: 'api-value' }) },
+    );
+
+    expect(runner.calls.flatMap((call) => call.args).join('\u0000')).not.toContain('api-value');
+    expect(JSON.parse(requiredTestValue(runner.secretsJson, 'secrets JSON'))).toEqual({ API_TOKEN: 'api-value' });
+  });
+});
+
 describe('cleanup-pr exact stage matching', () => {
   it('rejects an invalid PR before touching the client', async () => {
     const cloudflare = new FakeCloudflare();
@@ -615,6 +1016,10 @@ describe('deployStage with a flat JSON config', () => {
       ['deployments', 'status'],
       ['d1', 'migrations'],
       ['versions', 'deploy'],
+      // The traffic shift is not the end of the deploy: the step re-reads live state and only
+      // returns once the tag it activated is the one being served.
+      ['deployments', 'status'],
+      ['versions', 'list'],
     ]);
   });
 
@@ -679,7 +1084,7 @@ describe('deployStage with a flat JSON config', () => {
 
     await expect(
       deployStage(root, { stage: 'pr7', config: configPath }, dependencies(new FakeRunner(), cloudflare)),
-    ).rejects.toThrow(/requires process environment values/);
+    ).rejects.toThrow(/Refusing to deploy fixture-website-preview-pr7 to pr7[\s\S]*FIXTURE_SECRET/);
     expect(cloudflare.mutations).toEqual([]);
   });
 
@@ -736,10 +1141,30 @@ async function fixtureRoot(toml = FIXTURE): Promise<string> {
   return root;
 }
 
+/**
+ * A wait whose clock only advances when the code under test sleeps: real bounds, no real seconds,
+ * and a deterministic poll count a test can assert on.
+ */
+function fakeWait(): { budgetMs: number; intervalMs: number; now: () => number; sleep: (ms: number) => Promise<void> } {
+  let clock = 0;
+  return {
+    budgetMs: 10_000,
+    intervalMs: 1_000,
+    now: () => clock,
+    sleep: async (ms: number) => {
+      clock += ms;
+    },
+  };
+}
+
 function dependencies(runner: ProcessRunner, cloudflare: CloudflareClient) {
+  const cacheDirectory = mkdtempSync(join(tmpdir(), 'smoo-live-version-'));
+  roots.push(cacheDirectory);
   return {
     runner,
     cloudflare,
+    wait: fakeWait(),
+    liveVersionCacheDirectory: cacheDirectory,
     processEnv: {
       CLOUDFLARE_ACCOUNT_ID: 'account-1',
       CLOUDFLARE_API_TOKEN: 'token',