@smoothbricks/cli 0.11.16 → 0.11.18

package/dist/wrangler/deploy-stage.d.ts

@@ -1,4 +1,5 @@
 import { type CloudflareClient } from './cloudflare.js';
+import { type VersionEndpointWaitOptions } from './live-version.js';
 import { type DeploymentStage } from './stage.js';
 export interface ProcessResult {
     exitCode: number;
@@ -24,6 +25,10 @@ export interface WranglerCommandDependencies {
     runner?: ProcessRunner;
     cloudflare?: CloudflareClient;
     processEnv?: NodeJS.ProcessEnv;
+    /** Bounds and clock for the post-deploy wait; tests drive it without sleeping. */
+    wait?: VersionEndpointWaitOptions;
+    /** Where a successful deploy records the tag it made live, for `smoo wrangler deployed-version`. */
+    liveVersionCacheDirectory?: string;
 }
 export interface DeployStageResult {
     stage: DeploymentStage;
@@ -36,6 +41,12 @@ export interface DeployStageOptions {
     stage: string;
     /** A build-generated flat wrangler.json to deploy instead of `./wrangler.toml` (see `prepareFlatConfig`). */
     config?: string;
+    /**
+     * A URL, served by this worker, whose trimmed body is the running version tag. When given, the
+     * deploy is not done until that URL answers with the tag it just made live — the control plane
+     * accepting a traffic shift is not the edge serving it.
+     */
+    versionEndpoint?: string;
 }
 export declare function deployStage(cwd: string, options: DeployStageOptions, dependencies?: WranglerCommandDependencies): Promise<DeployStageResult>;
 /**
@@ -60,7 +71,7 @@ export interface CleanupResult {
 }
 export declare function cleanupPullRequest(cwd: string, prNumber: number, dependencies?: WranglerCommandDependencies): Promise<CleanupResult>;
 export declare function nxTaskVersionTag(environment: NodeJS.ProcessEnv): string | undefined;
-export declare function findVersionIdByTag(value: unknown, tag: string): string | null;
-export declare function isFullCurrentDeployment(value: unknown, versionId: string): boolean;
+/** One wrangler invocation whose stdout must be JSON; shared by the deploy and the read-only query. */
+export declare function wranglerJson(runner: ProcessRunner, args: string[], run: ProcessRunOptions): Promise<unknown>;
 export {};
 //# sourceMappingURL=deploy-stage.d.ts.map

package/dist/wrangler/deploy-stage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy-stage.d.ts","sourceRoot":"","sources":["../../src/wrangler/deploy-stage.ts"],"names":[],"mappings":"AAOA,OAAO,EAAE,KAAK,gBAAgB,EAA+C,MAAM,iBAAiB,CAAC;AAGrG,OAAO,EAEL,KAAK,eAAe,EAYrB,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,6GAA6G;IAC7G,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,kHAAkH;IAClH,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;CAC1F;AAED,+GAA+G;AAC/G,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,CAAC,UAAU,CAE9E;AAED,qBAAa,gBAAiB,YAAW,aAAa;IAC9C,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,aAAa,CAAC,CAc7F;CACF;AAED,MAAM,WAAW,2BAA2B;IAC1C,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CAChC;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,eAAe,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,UAAU,GAAG,WAAW,GAAG,kBAAkB,CAAC;IACtD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAID,MAAM,WAAW,kBAAkB;IACjC,yCAAyC;IACzC,KAAK,EAAE,MAAM,CAAC;IACd,6GAA6G;IAC7G,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,wBAAsB,WAAW,CAC/B,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,kBAAkB,EAC3B,YAAY,GAAE,2BAAgC,GAC7C,OAAO,CAAC,iBAAiB,CAAC,CA4F5B;AAyFD;;;;GAIG;AACH,iBAAe,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAOhF;AACD,eAAO,MAAM,2BAA2B,6BAAuB,CAAC;AAqFhE,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,KAAK,MAAM,EAAE,CAAC;IACrB,OAAO,EAAE;QACP,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,MAAM,CAAC;QAChB,YAAY,EAAE,MAAM,CAAC;QACrB,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,EAAE,MAAM,CAAC;QACnB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;CACH;AAED,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,EAChB,YAAY,GAAE,2BAAgC,GAC7C,OAAO,CAAC,aAAa,CAAC,CAoFxB;AAwFD,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,GAAG,SAAS,CAgBnF;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAuB7E;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAelF"}
+{"version":3,"file":"deploy-stage.d.ts","sourceRoot":"","sources":["../../src/wrangler/deploy-stage.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,KAAK,gBAAgB,EAA+C,MAAM,iBAAiB,CAAC;AAErG,OAAO,EAOL,KAAK,0BAA0B,EAEhC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAEL,KAAK,eAAe,EAYrB,MAAM,YAAY,CAAC;AASpB,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,6GAA6G;IAC7G,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,kHAAkH;IAClH,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;CAC1F;AAED,+GAA+G;AAC/G,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,CAAC,UAAU,CAE9E;AAED,qBAAa,gBAAiB,YAAW,aAAa;IAC9C,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,aAAa,CAAC,CAc7F;CACF;AAED,MAAM,WAAW,2BAA2B;IAC1C,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IAC/B,kFAAkF;IAClF,IAAI,CAAC,EAAE,0BAA0B,CAAC;IAClC,oGAAoG;IACpG,yBAAyB,CAAC,EAAE,MAAM,CAAC;CACpC;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,eAAe,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,UAAU,GAAG,WAAW,GAAG,kBAAkB,CAAC;IACtD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,kBAAkB;IACjC,yCAAyC;IACzC,KAAK,EAAE,MAAM,CAAC;IACd,6GAA6G;IAC7G,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,wBAAsB,WAAW,CAC/B,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,kBAAkB,EAC3B,YAAY,GAAE,2BAAgC,GAC7C,OAAO,CAAC,iBAAiB,CAAC,CAmH5B;AA+ED;;;;GAIG;AACH,iBAAe,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAOhF;AACD,eAAO,MAAM,2BAA2B,6BAAuB,CAAC;AAoHhE,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,KAAK,MAAM,EAAE,CAAC;IACrB,OAAO,EAAE;QACP,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,MAAM,CAAC;QAChB,YAAY,EAAE,MAAM,CAAC;QACrB,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,EAAE,MAAM,CAAC;QACnB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;CACH;AAED,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,EAChB,YAAY,GAAE,2BAAgC,GAC7C,OAAO,CAAC,aAAa,CAAC,CAoFxB;AAwFD,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,GAAG,SAAS,CAgBnF;AAyCD,uGAAuG;AACvG,wBAAsB,YAAY,CAAC,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC,OAAO,CAAC,CAOlH"}

package/dist/wrangler/deploy-stage.js

@@ -1,14 +1,13 @@
 import { randomUUID } from 'node:crypto';
-import { existsSync, readFileSync } from 'node:fs';
 import { readFile, rm, writeFile } from 'node:fs/promises';
 import { dirname, join } from 'node:path';
-import typia from 'typia';
 import { parseJsonFileText } from '../lib/json.js';
 import { mergeEnv, printCommandOutput } from '../lib/run.js';
 import { CloudflareRestClient } from './cloudflare.js';
 import { parseFlatWranglerConfig, planFlatStageResources } from './flat-config.js';
-import { parseDevVarsExample } from './prepare-env.js';
+import { awaitLiveVersion, awaitVersionEndpoint, currentDeploymentVersionId, findVersionIdByTag, liveVersionCacheDirectory, writeCachedLiveVersion, } from './live-version.js';
 import { derivePullRequestStageConfig, derivePullRequestWranglerConfig, hasExactStageSegment, isPullRequestStage, parseDeploymentStage, planConfiguredStageResources, planPullRequestBindings, planPullRequestResources, pullRequestStage, } from './stage.js';
+import { planStageSecrets, readDeclaredSecretNames, readSecretStageMap, stageSecretRefusal, } from './stage-secrets.js';
 /** The child environment `options` describe; every runner, test doubles included, spawns with exactly this. */
 export function childEnvironment(options) {
     return mergeEnv(options.env, options.unsetEnv);
@@ -30,15 +29,6 @@ export class BunProcessRunner {
         return { exitCode, stdout, stderr };
     }
 }
-const isUnknownRecord = (() => {
-    const _io0 = input => Object.keys(input).every(key => {
-        const value = input[key];
-        if (undefined === value)
-            return true;
-        return true;
-    });
-    return input => "object" === typeof input && null !== input && false === Array.isArray(input) && _io0(input);
-})();
 export async function deployStage(cwd, options, dependencies = {}) {
     const stage = parseDeploymentStage(options.stage);
     const processEnv = dependencies.processEnv ?? process.env;
@@ -49,21 +39,26 @@ export async function deployStage(cwd, options, dependencies = {}) {
     const cloudflare = dependencies.cloudflare ??
         new CloudflareRestClient(accountId, requiredEnvironmentValue(apiToken, 'CLOUDFLARE_API_TOKEN'));
     const runner = dependencies.runner ?? new BunProcessRunner();
-    const secretNames = readSecretNames(cwd);
+    const secretPlan = planStageSecrets(readDeclaredSecretNames(cwd), stage, readSecretStageMap(cwd));
+    // Only the stage's own secrets, and only the ones a value exists for. A secret scoped to other
+    // stages is dropped here even when this shell exports it: that is the whole permission rule.
     const secretValues = {};
-    for (const name of secretNames) {
+    for (const name of secretPlan.required) {
         const value = processEnv[name];
         if (value)
             secretValues[name] = value;
     }
-    const missingSecrets = secretNames.filter((name) => !processEnv[name]);
+    const gate = stageSecretGate(secretPlan, new Set(Object.keys(secretValues)), cloudflare);
     let temporaryConfigPath;
     let temporarySecretsPath;
     try {
         const prepared = options.config
-            ? await prepareFlatConfig(options.config, stage, accountId, missingSecrets, cloudflare)
-            : await prepareTomlConfig(cwd, stage, accountId, missingSecrets, cloudflare);
+            ? await prepareFlatConfig(options.config, stage, accountId, gate, cloudflare)
+            : await prepareTomlConfig(cwd, stage, accountId, gate, cloudflare);
         temporaryConfigPath = prepared.temporaryConfigPath;
+        // The pull-request path already ran this before provisioning; the gate answers once per Worker.
+        // Everything below here writes to Cloudflare.
+        await gate(prepared.plan.workerName);
         const workerExists = await reconcileStageResources(prepared.plan, cloudflare);
         const versionTag = nxTaskVersionTag(processEnv);
         const envArgs = prepared.envFlag ? ['--env', prepared.envFlag] : [];
@@ -71,17 +66,31 @@ export async function deployStage(cwd, options, dependencies = {}) {
         // renames the worker `<name>-<CLOUDFLARE_ENV>`. The build that produced the flat config is the
         // caller that sets the variable, so the deploy would silently succeed under a name neither
         // `reconcileStageResources` nor `versions list` looks at.
-        const run = prepared.envFlag ? { cwd } : { cwd, unsetEnv: ['CLOUDFLARE_ENV'] };
+        //
+        // A secret this stage is scoped out of goes with it. Leaving it out of the secrets payload is
+        // what stops it being installed; withholding it from the child as well means the deploy cannot
+        // read it at all, so "this stage never sees that capability" holds at the process boundary and
+        // not merely in the file we happen to write.
+        const unsetEnv = [...(prepared.envFlag ? [] : ['CLOUDFLARE_ENV']), ...secretPlan.withheld];
+        const run = unsetEnv.length > 0 ? { cwd, unsetEnv } : { cwd };
         const workerName = prepared.plan.workerName;
+        const probe = {
+            deployments: () => wranglerJson(runner, ['deployments', 'status', '--name', workerName, '--json'], run),
+            versions: () => wranglerJson(runner, ['versions', 'list', '--name', workerName, '--json'], run),
+        };
         // The tagged-version lookup runs before the migrations: a cache hit means this exact build is
         // already live, so its migrations ran with it and re-applying them would touch the remote
         // database for nothing. The activation and upload paths below still migrate first.
+        //
+        // This reads Cloudflare every time and never the local cache. A cache hit here would mean
+        // "we believe this hash is live" — exactly the belief a rollback falsifies — and believing it
+        // would skip the deploy that repairs the rollback. Reading live state is what makes a
+        // redundant deploy a proven no-op instead of an assumed one, which is in turn what makes a
+        // cross-project `dependsOn: ["<other>:deploy"]` edge cheap enough to be the ordering mechanism.
         let taggedVersionId = null;
         if (versionTag && workerExists) {
-            const versions = await wranglerJson(runner, ['versions', 'list', '--name', workerName, '--json'], run);
-            const deployments = await wranglerJson(runner, ['deployments', 'status', '--name', workerName, '--json'], run);
-            taggedVersionId = findVersionIdByTag(versions, versionTag);
-            if (taggedVersionId && isFullCurrentDeployment(deployments, taggedVersionId)) {
+            taggedVersionId = findVersionIdByTag(await probe.versions(), versionTag);
+            if (taggedVersionId && currentDeploymentVersionId(await probe.deployments()) === taggedVersionId) {
                 return { stage, workerName, action: 'remote-cache-hit', versionTag };
             }
         }
@@ -101,6 +110,7 @@ export async function deployStage(cwd, options, dependencies = {}) {
                 ...envArgs,
                 '--yes',
             ], run);
+            await confirmVersionIsLive(probe, versionTag, { stage, workerName, accountId }, options, dependencies, cwd);
             return { stage, workerName, action: 'activated', versionTag };
         }
         const deployArgs = ['deploy', '--config', prepared.deployConfigPath, ...envArgs];
@@ -112,6 +122,9 @@ export async function deployStage(cwd, options, dependencies = {}) {
             deployArgs.push('--secrets-file', temporarySecretsPath);
         }
         await wrangler(runner, deployArgs, run);
+        if (versionTag) {
+            await confirmVersionIsLive(probe, versionTag, { stage, workerName, accountId }, options, dependencies, cwd);
+        }
         return { stage, workerName, action: 'deployed', ...(versionTag ? { versionTag } : {}) };
     }
     finally {
@@ -123,7 +136,7 @@ export async function deployStage(cwd, options, dependencies = {}) {
         }
     }
 }
-async function prepareTomlConfig(cwd, stage, accountId, missingSecrets, cloudflare) {
+async function prepareTomlConfig(cwd, stage, accountId, gate, cloudflare) {
     const committedConfigPath = join(cwd, 'wrangler.toml');
     const committedToml = await readFile(committedConfigPath, 'utf8');
     if (!isPullRequestStage(stage)) {
@@ -136,7 +149,7 @@ async function prepareTomlConfig(cwd, stage, accountId, missingSecrets, cloudfla
     }
     const liveNamespaces = await cloudflare.listKvNamespaces();
     const plan = planPullRequestResources(committedToml, stage, liveNamespaces);
-    const { kvNamespaceIds, d1DatabaseIds } = await provisionPullRequestResources(plan, missingSecrets, cloudflare, liveNamespaces);
+    const { kvNamespaceIds, d1DatabaseIds } = await provisionPullRequestResources(plan, gate, cloudflare, liveNamespaces);
     const derivedToml = derivePullRequestWranglerConfig(committedToml, {
         stage,
         accountId,
@@ -153,7 +166,7 @@ async function prepareTomlConfig(cwd, stage, accountId, missingSecrets, cloudfla
         envFlag: stage,
     };
 }
-async function prepareFlatConfig(configPath, stage, accountId, missingSecrets, cloudflare) {
+async function prepareFlatConfig(configPath, stage, accountId, gate, cloudflare) {
     const flat = parseJsonFileText(configPath, await readFile(configPath, 'utf8'), parseFlatWranglerConfig);
     if (!isPullRequestStage(stage)) {
         return {
@@ -164,7 +177,7 @@ async function prepareFlatConfig(configPath, stage, accountId, missingSecrets, c
     }
     const liveNamespaces = await cloudflare.listKvNamespaces();
     const plan = planPullRequestBindings(flat, stage, liveNamespaces);
-    const { kvNamespaceIds, d1DatabaseIds } = await provisionPullRequestResources(plan, missingSecrets, cloudflare, liveNamespaces);
+    const { kvNamespaceIds, d1DatabaseIds } = await provisionPullRequestResources(plan, gate, cloudflare, liveNamespaces);
     const derived = derivePullRequestStageConfig(flat, { stage, accountId, kvNamespaceIds, d1DatabaseIds });
     // Beside the original: its main/assets/migrations paths are relative to the file.
     const temporaryConfigPath = join(dirname(configPath), `.wrangler.smoo-${process.pid}-${randomUUID()}.json`);
@@ -196,15 +209,35 @@ function migrationBindings(config) {
         .filter((database) => typeof database.migrations_dir === 'string')
         .map((database) => database.binding);
 }
-async function refuseFirstDeploymentWithoutSecrets(cloudflare, workerName, missingSecrets) {
-    const firstDeployment = !(await cloudflare.listWorkerScripts()).some((script) => script.id === workerName);
-    if (firstDeployment && missingSecrets.length > 0) {
-        throw new Error(`First deployment of ${workerName} requires process environment values for: ${missingSecrets.join(', ')}.`);
-    }
+/**
+ * One answer per Worker, reused by both call sites so the read costs one round trip.
+ *
+ * What the Worker holds comes from the account's script listing first. A Worker absent from it
+ * holds nothing — exactly the first-deployment case — and Cloudflare answers 404 rather than an
+ * empty list when asked for a missing Worker's secrets. Reading that failure as "then nothing is
+ * needed" would disarm the check at the one moment it matters most, so it is never asked.
+ */
+function stageSecretGate(plan, exported, cloudflare) {
+    const answered = new Map();
+    return (workerName) => {
+        let pending = answered.get(workerName);
+        if (!pending) {
+            pending = assertStageSecrets(plan, exported, cloudflare, workerName);
+            answered.set(workerName, pending);
+        }
+        return pending;
+    };
 }
-/** Isolation refusals already ran in the plan; this is the first Cloudflare write. */
-async function provisionPullRequestResources(plan, missingSecrets, cloudflare, liveNamespaces) {
-    await refuseFirstDeploymentWithoutSecrets(cloudflare, plan.workerName, missingSecrets);
+async function assertStageSecrets(plan, exported, cloudflare, workerName) {
+    const live = (await cloudflare.listWorkerScripts()).some((script) => script.id === workerName);
+    const held = new Set(live ? await cloudflare.listWorkerSecrets(workerName) : []);
+    const refusal = stageSecretRefusal(plan, exported, held, workerName);
+    if (refusal)
+        throw new Error(refusal);
+}
+/** Isolation refusals already ran in the plan; the gate below is the last one before the first write. */
+async function provisionPullRequestResources(plan, gate, cloudflare, liveNamespaces) {
+    await gate(plan.workerName);
     const kvNamespaceIds = await ensureKvNamespaces(plan.kvNamespaces, liveNamespaces, cloudflare);
     const d1DatabaseIds = plan.d1Databases.length === 0
         ? new Map()
@@ -447,48 +480,30 @@ export function nxTaskVersionTag(environment) {
     }
     throw new Error('NX_TASK_HASH must be canonical decimal digits or at least 32 hexadecimal characters.');
 }
-export function findVersionIdByTag(value, tag) {
-    if (Array.isArray(value)) {
-        for (const entry of value) {
-            const found = findVersionIdByTag(entry, tag);
-            if (found)
-                return found;
-        }
-        return null;
-    }
-    if (!isUnknownRecord(value))
-        return null;
-    const annotations = isUnknownRecord(value.annotations) ? value.annotations : undefined;
-    const metadata = isUnknownRecord(value.metadata) ? value.metadata : undefined;
-    const annotationTag = annotations?.['workers/tag'];
-    const candidateTag = typeof annotationTag === 'string' ? annotationTag : typeof value.tag === 'string' ? value.tag : metadata?.tag;
-    if (candidateTag === tag) {
-        if (typeof value.id === 'string')
-            return value.id;
-        if (typeof value.version_id === 'string')
-            return value.version_id;
-    }
-    for (const nested of Object.values(value)) {
-        const found = findVersionIdByTag(nested, tag);
-        if (found)
-            return found;
-    }
-    return null;
-}
-export function isFullCurrentDeployment(value, versionId) {
-    if (Array.isArray(value))
-        return value.some((entry) => isFullCurrentDeployment(entry, versionId));
-    if (!isUnknownRecord(value))
-        return false;
-    if (Array.isArray(value.versions)) {
-        return (value.versions.length === 1 &&
-            value.versions.some((version) => isUnknownRecord(version) &&
-                (version.version_id === versionId || version.id === versionId) &&
-                Number(version.percentage) === 100));
+/**
+ * Turns "Cloudflare accepted the traffic shift" into "the new version answers".
+ *
+ * Without this the deploy step goes green while the edge still serves the previous version — the
+ * measured gap was about 20 s — so anything ordered after this deploy could call into code that
+ * has not shipped yet. The wait is what a `dependsOn: ["<other>:deploy"]` edge actually buys; an
+ * edge onto a step that returns early orders nothing.
+ */
+async function confirmVersionIsLive(probe, versionTag, identity, options, dependencies, cwd) {
+    const wait = dependencies.wait ?? {};
+    const live = await awaitLiveVersion(probe, versionTag, wait);
+    if (!live.ok)
+        throw new Error(`${identity.workerName}: ${live.error.message}`);
+    if (options.versionEndpoint) {
+        const answered = await awaitVersionEndpoint(options.versionEndpoint, versionTag, wait);
+        if (!answered.ok)
+            throw new Error(`${identity.workerName}: ${answered.error.message}`);
     }
-    return Object.values(value).some((entry) => isFullCurrentDeployment(entry, versionId));
+    const processEnv = dependencies.processEnv ?? process.env;
+    const directory = dependencies.liveVersionCacheDirectory ?? liveVersionCacheDirectory(cwd, processEnv);
+    await writeCachedLiveVersion(directory, { accountId: identity.accountId, workerName: identity.workerName, stage: identity.stage }, { versionTag, versionId: live.value.versionId, fetchedAt: Date.now() });
 }
-async function wranglerJson(runner, args, run) {
+/** One wrangler invocation whose stdout must be JSON; shared by the deploy and the read-only query. */
+export async function wranglerJson(runner, args, run) {
     const result = await wrangler(runner, args, run);
     try {
         return JSON.parse(result.stdout);
@@ -510,7 +525,3 @@ function requiredEnvironmentValue(value, name) {
         throw new Error(`${name} is required.`);
     return value;
 }
-function readSecretNames(cwd) {
-    const path = join(cwd, '.dev.vars.example');
-    return existsSync(path) ? parseDevVarsExample(readFileSync(path, 'utf8')) : [];
-}

package/dist/wrangler/deployed-version.d.ts

@@ -0,0 +1,44 @@
+import { type ProcessRunner } from './deploy-stage.js';
+import { type DeploymentStage } from './stage.js';
+export interface DeployedVersionOptions {
+    /** `staging`, `production`, or `prN`. */
+    stage: string;
+    /** The build-generated flat wrangler.json the deploy would use, when the project deploys one. */
+    config?: string;
+    /** Ask Cloudflare even when a fresh cache entry exists. */
+    refresh?: boolean;
+}
+export interface DeployedVersionDependencies {
+    runner?: ProcessRunner;
+    processEnv?: NodeJS.ProcessEnv;
+    cacheDirectory?: string;
+    ttlMs?: number;
+    now?: () => number;
+}
+export interface DeployedVersionReport {
+    workerName: string;
+    stage: DeploymentStage;
+    versionTag: string | null;
+    versionId: string;
+    source: 'cloudflare' | 'cache';
+}
+/**
+ * The worker `stage` deploys to, from committed configuration alone.
+ *
+ * A pull-request stage's worker name is derived from the staging name the same way the deploy
+ * derives it, but WITHOUT the account listing the deploy needs for its KV/D1/R2 isolation: a
+ * question about what is live must not be able to create anything.
+ */
+export declare function stageWorkerName(cwd: string, stage: DeploymentStage, configPath?: string): Promise<string>;
+/**
+ * Answers with the tag serving 100% of this worker's traffic, or refuses.
+ *
+ * Refusing is the whole contract. A missing credential, an API error, or a traffic split has no
+ * honest answer, and returning a placeholder such as `unknown` would be worse than the error: a
+ * later run comparing against that placeholder would read it as a match and conclude the desired
+ * version is already live. For the same reason nothing here is ever written to the cache except a
+ * real observation, and the answer never contains a timestamp or anything else that varies per
+ * invocation.
+ */
+export declare function deployedVersion(cwd: string, options: DeployedVersionOptions, dependencies?: DeployedVersionDependencies): Promise<DeployedVersionReport>;
+//# sourceMappingURL=deployed-version.d.ts.map

package/dist/wrangler/deployed-version.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deployed-version.d.ts","sourceRoot":"","sources":["../../src/wrangler/deployed-version.ts"],"names":[],"mappings":"AAUA,OAAO,EAAoB,KAAK,aAAa,EAAwC,MAAM,mBAAmB,CAAC;AAU/G,OAAO,EACL,KAAK,eAAe,EAMrB,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,sBAAsB;IACrC,yCAAyC;IACzC,KAAK,EAAE,MAAM,CAAC;IACd,iGAAiG;IACjG,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,2DAA2D;IAC3D,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,2BAA2B;IAC1C,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IAC/B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,eAAe,CAAC;IACvB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC;CAChC;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAe/G;AAED;;;;;;;;;GASG;AACH,wBAAsB,eAAe,CACnC,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,sBAAsB,EAC/B,YAAY,GAAE,2BAAgC,GAC7C,OAAO,CAAC,qBAAqB,CAAC,CAqChC"}

package/dist/wrangler/deployed-version.js

@@ -0,0 +1,87 @@
+// `smoo wrangler deployed-version --stage <stage>` — what is serving this project's worker right now.
+//
+// Read-only by construction: it resolves the worker name from the committed config and asks
+// Cloudflare. It never provisions, never derives a pull-request stage's resources, and never
+// writes anything except its own cache entry.
+import { existsSync } from 'node:fs';
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { parseJsonFileText } from '../lib/json.js';
+import { BunProcessRunner, wranglerJson } from './deploy-stage.js';
+import { parseFlatWranglerConfig, planFlatStageResources } from './flat-config.js';
+import { LIVE_VERSION_CACHE_TTL_MS, liveVersionCacheDirectory, readCachedLiveVersion, readLiveVersion, writeCachedLiveVersion, } from './live-version.js';
+import { isPullRequestStage, parseDeploymentStage, planConfiguredStageResources, stageResourceName, stagingWorkerBaseName, } from './stage.js';
+/**
+ * The worker `stage` deploys to, from committed configuration alone.
+ *
+ * A pull-request stage's worker name is derived from the staging name the same way the deploy
+ * derives it, but WITHOUT the account listing the deploy needs for its KV/D1/R2 isolation: a
+ * question about what is live must not be able to create anything.
+ */
+export async function stageWorkerName(cwd, stage, configPath) {
+    if (configPath) {
+        const flat = parseJsonFileText(configPath, await readFile(configPath, 'utf8'), parseFlatWranglerConfig);
+        return isPullRequestStage(stage)
+            ? stageResourceName(stagingWorkerBaseName(flat.name), stage)
+            : planFlatStageResources(flat, stage).workerName;
+    }
+    const tomlPath = join(cwd, 'wrangler.toml');
+    if (!existsSync(tomlPath)) {
+        throw new Error(`${tomlPath} does not exist; pass --config for a build-generated flat configuration.`);
+    }
+    const toml = await readFile(tomlPath, 'utf8');
+    return isPullRequestStage(stage)
+        ? stageResourceName(stagingWorkerBaseName(planConfiguredStageResources(toml, 'staging').workerName), stage)
+        : planConfiguredStageResources(toml, stage).workerName;
+}
+/**
+ * Answers with the tag serving 100% of this worker's traffic, or refuses.
+ *
+ * Refusing is the whole contract. A missing credential, an API error, or a traffic split has no
+ * honest answer, and returning a placeholder such as `unknown` would be worse than the error: a
+ * later run comparing against that placeholder would read it as a match and conclude the desired
+ * version is already live. For the same reason nothing here is ever written to the cache except a
+ * real observation, and the answer never contains a timestamp or anything else that varies per
+ * invocation.
+ */
+export async function deployedVersion(cwd, options, dependencies = {}) {
+    const stage = parseDeploymentStage(options.stage);
+    const processEnv = dependencies.processEnv ?? process.env;
+    const accountId = processEnv.CLOUDFLARE_ACCOUNT_ID;
+    if (!accountId)
+        throw new Error('CLOUDFLARE_ACCOUNT_ID is required.');
+    if (!processEnv.CLOUDFLARE_API_TOKEN)
+        throw new Error('CLOUDFLARE_API_TOKEN is required.');
+    const workerName = await stageWorkerName(cwd, stage, options.config);
+    const cacheDirectory = dependencies.cacheDirectory ?? liveVersionCacheDirectory(cwd, processEnv);
+    const key = { accountId, workerName, stage };
+    const ttlMs = dependencies.ttlMs ?? LIVE_VERSION_CACHE_TTL_MS;
+    const now = dependencies.now ?? Date.now;
+    if (options.refresh !== true) {
+        const cached = await readCachedLiveVersion(cacheDirectory, key, ttlMs, now);
+        if (cached) {
+            return { workerName, stage, versionTag: cached.versionTag, versionId: cached.versionId, source: 'cache' };
+        }
+    }
+    const runner = dependencies.runner ?? new BunProcessRunner();
+    const run = { cwd, unsetEnv: ['CLOUDFLARE_ENV'] };
+    const probe = {
+        deployments: () => wranglerJson(runner, ['deployments', 'status', '--name', workerName, '--json'], run),
+        versions: () => wranglerJson(runner, ['versions', 'list', '--name', workerName, '--json'], run),
+    };
+    const live = await readLiveVersion(probe);
+    if (!live.ok)
+        throw new Error(`${workerName} (${stage}): ${live.error.message}`);
+    await writeCachedLiveVersion(cacheDirectory, key, {
+        versionTag: live.value.tag,
+        versionId: live.value.versionId,
+        fetchedAt: now(),
+    });
+    return {
+        workerName,
+        stage,
+        versionTag: live.value.tag,
+        versionId: live.value.versionId,
+        source: 'cloudflare',
+    };
+}

package/dist/wrangler/live-version.d.ts

@@ -0,0 +1,146 @@
+/** Same shape as the release tooling's Result: a known operational failure is a value, not a throw. */
+export type Result<T, E> = {
+    ok: true;
+    value: T;
+} | {
+    ok: false;
+    error: E;
+};
+/** The version Cloudflare is serving to 100% of traffic for one worker. */
+export interface LiveVersion {
+    versionId: string;
+    /** `wrangler versions deploy --version-tag` matches on this; a version deployed outside Nx has none. */
+    tag: string | null;
+}
+export type LiveVersionFailure = {
+    kind: 'never-deployed';
+    message: string;
+} | {
+    kind: 'split-traffic';
+    message: string;
+};
+/** Reads the two `wrangler` JSON payloads the live version is derived from. */
+export interface LiveVersionProbe {
+    /** `wrangler deployments status --name <worker> --json` */
+    deployments(): Promise<unknown>;
+    /** `wrangler versions list --name <worker> --json` */
+    versions(): Promise<unknown>;
+}
+/**
+ * Every `{ id -> tag }` pair the payload carries, in document order.
+ *
+ * Wrangler nests versions differently per subcommand and per version of itself, spells the tag
+ * three ways (`annotations['workers/tag']`, a bare `tag`, `metadata.tag`) and the id two (`id`,
+ * `version_id`). One walk collects the relation once; both directions of the lookup are then a Map
+ * read rather than a second recursive scan that could disagree with the first.
+ */
+export declare function collectVersionTags(value: unknown): Map<string, string>;
+/** The version id whose tag is `tag`, or null. */
+export declare function findVersionIdByTag(value: unknown, tag: string): string | null;
+/** One version's share of the current deployment's traffic. */
+export interface DeployedVersionShare {
+    versionId: string | null;
+    percentage: number;
+}
+/**
+ * The current deployment's traffic split, or null when the payload names no deployment at all.
+ *
+ * "Nothing is deployed" and "two versions share the traffic" are different facts with different
+ * remedies, and a caller that collapses them cannot tell an operator which one it hit — so the
+ * split is returned whole and both questions are answered from it.
+ */
+export declare function currentDeploymentVersions(value: unknown): DeployedVersionShare[] | null;
+/**
+ * The one version serving 100% of traffic, or null when there is none or the deployment is split.
+ *
+ * A split is not "close enough": with two versions live, "is our version live" has no single
+ * answer, and answering it optimistically is how a deploy reports success while part of the
+ * traffic still reaches the old code.
+ */
+export declare function currentDeploymentVersionId(value: unknown): string | null;
+/** The version serving all traffic for this worker, with the tag it was uploaded under. */
+export declare function readLiveVersion(probe: LiveVersionProbe): Promise<Result<LiveVersion, LiveVersionFailure>>;
+/**
+ * How long a deploy waits for the version it just activated to become the one being served.
+ *
+ * The bound is the point: an unbounded loop turns a stuck propagation into a hung CI job nobody
+ * reads, and a fixed sleep turns it into a green job that lied. Both are worse than a red job
+ * naming what it expected and what it saw.
+ */
+export declare const LIVE_VERSION_WAIT_BUDGET_MS = 120000;
+/** Cloudflare's control plane converges in seconds; polling faster than this only burns API quota. */
+export declare const LIVE_VERSION_POLL_INTERVAL_MS = 2000;
+export interface LiveVersionWaitOptions {
+    budgetMs?: number;
+    intervalMs?: number;
+    now?: () => number;
+    sleep?: (ms: number) => Promise<void>;
+}
+export interface LiveVersionNotObserved {
+    kind: 'not-observed';
+    message: string;
+    expected: string;
+    observed: string;
+}
+/**
+ * Polls until the worker's live version carries `expectedTag`, or the budget runs out.
+ *
+ * The tag is the match, not the version id: the tag IS the desired-state identity (`nx-<task
+ * hash>`), it is what both `wrangler deploy --tag` and `wrangler versions deploy --version-tag`
+ * were told to make live, and it is the one name the caller knows before the upload has produced
+ * a version id.
+ *
+ * Returns the failure rather than throwing it: a deploy that cannot be observed is an operational
+ * outcome the caller has to report, not a broken invariant.
+ */
+export declare function awaitLiveVersion(probe: LiveVersionProbe, expectedTag: string, options?: LiveVersionWaitOptions): Promise<Result<LiveVersion, LiveVersionNotObserved>>;
+/**
+ * Exactly the call the wait makes. Demanding all of `typeof fetch` would force every caller — the
+ * tests included — to also supply `preconnect`, which nothing here uses.
+ */
+export type FetchLike = (input: string, init?: RequestInit) => Promise<Response>;
+export interface VersionEndpointWaitOptions extends LiveVersionWaitOptions {
+    fetch?: FetchLike;
+}
+/**
+ * Polls a worker-served endpoint until it answers with `expectedTag`.
+ *
+ * The control plane agreeing is necessary and not sufficient — that gap is exactly what this
+ * change's predecessor measured — so a project that can prove the edge serves the new code says so
+ * with an endpoint echoing its own version tag (Workers read it from the version-metadata
+ * binding). The contract is deliberately one shape: the trimmed response body IS the tag.
+ */
+export declare function awaitVersionEndpoint(url: string, expectedTag: string, options?: VersionEndpointWaitOptions): Promise<Result<void, LiveVersionNotObserved>>;
+/**
+ * How long `smoo wrangler deployed-version` trusts its own last answer.
+ *
+ * This TTL is a convenience for operators and repeated local queries, NOT a correctness mechanism:
+ * nothing that decides whether to deploy may read it. The deploy's own liveness check always calls
+ * Cloudflare, because a cached "live already equals the desired tag" is precisely the belief a
+ * rollback falsifies, and acting on it would skip the deploy that repairs the rollback.
+ */
+export declare const LIVE_VERSION_CACHE_TTL_MS = 45000;
+export interface LiveVersionCacheKey {
+    accountId: string;
+    workerName: string;
+    stage: string;
+}
+export interface CachedLiveVersion {
+    versionTag: string | null;
+    versionId: string;
+    fetchedAt: number;
+}
+/**
+ * One file per key, so two deploys running in parallel cannot clobber each other's answer; a
+ * shared map would need a lock to say the same thing.
+ */
+export declare function liveVersionCachePath(cacheDirectory: string, key: LiveVersionCacheKey): string;
+export declare function readCachedLiveVersion(cacheDirectory: string, key: LiveVersionCacheKey, ttlMs: number, now?: () => number): Promise<CachedLiveVersion | null>;
+export declare function writeCachedLiveVersion(cacheDirectory: string, key: LiveVersionCacheKey, entry: CachedLiveVersion): Promise<void>;
+/**
+ * Where the cache lives. Nx's workspace data directory already exists, is already gitignored, and
+ * is already wiped when the workspace is reset — three properties a hand-rolled directory would
+ * each have to re-earn, and one ($HOME) that would leak one checkout's answers into another's.
+ */
+export declare function liveVersionCacheDirectory(workspaceRoot: string, environment: NodeJS.ProcessEnv): string;
+//# sourceMappingURL=live-version.d.ts.map

package/dist/wrangler/live-version.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"live-version.d.ts","sourceRoot":"","sources":["../../src/wrangler/live-version.ts"],"names":[],"mappings":"AAYA,uGAAuG;AACvG,MAAM,MAAM,MAAM,CAAC,CAAC,EAAE,CAAC,IAAI;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAE,CAAC;AAE5E,2EAA2E;AAC3E,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,wGAAwG;IACxG,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;CACpB;AAED,MAAM,MAAM,kBAAkB,GAC1B;IAAE,IAAI,EAAE,gBAAgB,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC3C;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/C,+EAA+E;AAC/E,MAAM,WAAW,gBAAgB;IAC/B,2DAA2D;IAC3D,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAChC,sDAAsD;IACtD,QAAQ,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;CAC9B;AAID;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAItE;AAqBD,kDAAkD;AAClD,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAK7E;AAED,+DAA+D;AAC/D,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,OAAO,GAAG,oBAAoB,EAAE,GAAG,IAAI,CAqBvF;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAKxE;AAED,2FAA2F;AAC3F,wBAAsB,eAAe,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC,CAiB/G;AAED;;;;;;GAMG;AACH,eAAO,MAAM,2BAA2B,SAAU,CAAC;AACnD,sGAAsG;AACtG,eAAO,MAAM,6BAA6B,OAAQ,CAAC;AAEnD,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,cAAc,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAkCD;;;;;;;;;;GAUG;AACH,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,gBAAgB,EACvB,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,sBAA2B,GACnC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,sBAAsB,CAAC,CAAC,CAoBtD;AAED;;;GAGG;AACH,MAAM,MAAM,SAAS,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAEjF,MAAM,WAAW,0BAA2B,SAAQ,sBAAsB;IACxE,KAAK,CAAC,EAAE,SAAS,CAAC;CACnB;AAED;;;;;;;GAOG;AACH,wBAAsB,oBAAoB,CACxC,GAAG,EAAE,MAAM,EACX,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,0BAA+B,GACvC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC,CAkB/C;AAcD;;;;;;;GAOG;AACH,eAAO,MAAM,yBAAyB,QAAS,CAAC;AAEhD,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAID;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,cAAc,EAAE,MAAM,EAAE,GAAG,EAAE,mBAAmB,GAAG,MAAM,CAG7F;AAED,wBAAsB,qBAAqB,CACzC,cAAc,EAAE,MAAM,EACtB,GAAG,EAAE,mBAAmB,EACxB,KAAK,EAAE,MAAM,EACb,GAAG,GAAE,MAAM,MAAiB,GAC3B,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAUnC;AAED,wBAAsB,sBAAsB,CAC1C,cAAc,EAAE,MAAM,EACtB,GAAG,EAAE,mBAAmB,EACxB,KAAK,EAAE,iBAAiB,GACvB,OAAO,CAAC,IAAI,CAAC,CAIf;AAED;;;;GAIG;AACH,wBAAgB,yBAAyB,CAAC,aAAa,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAEvG"}