@smoothbricks/cli 0.11.16 → 0.11.18

package/dist/wrangler/live-version.js

@@ -0,0 +1,326 @@
+import * as _validateReport_1 from "typia/lib/internal/_validateReport";
+// What is live right now, as opposed to what we last uploaded.
+//
+// `wrangler versions deploy` returns when Cloudflare ACCEPTS the traffic shift, not when the edge
+// serves it. A deploy that returns is therefore not yet a deploy that answers: the site that signs
+// in to its stage's backend measured the previous backend version's response about 20 s after the
+// backend's deploy step had already gone green. Everything here exists to turn "we asked" into
+// "we observed".
+import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+import typia from 'typia';
+const isUnknownRecord = (() => {
+    const _io0 = input => Object.keys(input).every(key => {
+        const value = input[key];
+        if (undefined === value)
+            return true;
+        return true;
+    });
+    return input => "object" === typeof input && null !== input && false === Array.isArray(input) && _io0(input);
+})();
+/**
+ * Every `{ id -> tag }` pair the payload carries, in document order.
+ *
+ * Wrangler nests versions differently per subcommand and per version of itself, spells the tag
+ * three ways (`annotations['workers/tag']`, a bare `tag`, `metadata.tag`) and the id two (`id`,
+ * `version_id`). One walk collects the relation once; both directions of the lookup are then a Map
+ * read rather than a second recursive scan that could disagree with the first.
+ */
+export function collectVersionTags(value) {
+    const pairs = new Map();
+    collectInto(value, pairs);
+    return pairs;
+}
+function collectInto(value, pairs) {
+    if (Array.isArray(value)) {
+        for (const entry of value)
+            collectInto(entry, pairs);
+        return;
+    }
+    if (!isUnknownRecord(value))
+        return;
+    const annotations = isUnknownRecord(value.annotations) ? value.annotations : undefined;
+    const metadata = isUnknownRecord(value.metadata) ? value.metadata : undefined;
+    const annotationTag = annotations?.['workers/tag'];
+    const candidateTag = typeof annotationTag === 'string' ? annotationTag : typeof value.tag === 'string' ? value.tag : metadata?.tag;
+    const candidateId = typeof value.id === 'string' ? value.id : typeof value.version_id === 'string' ? value.version_id : undefined;
+    if (typeof candidateTag === 'string' && candidateId !== undefined && !pairs.has(candidateId)) {
+        pairs.set(candidateId, candidateTag);
+    }
+    for (const nested of Object.values(value))
+        collectInto(nested, pairs);
+}
+/** The version id whose tag is `tag`, or null. */
+export function findVersionIdByTag(value, tag) {
+    for (const [id, candidate] of collectVersionTags(value)) {
+        if (candidate === tag)
+            return id;
+    }
+    return null;
+}
+/**
+ * The current deployment's traffic split, or null when the payload names no deployment at all.
+ *
+ * "Nothing is deployed" and "two versions share the traffic" are different facts with different
+ * remedies, and a caller that collapses them cannot tell an operator which one it hit — so the
+ * split is returned whole and both questions are answered from it.
+ */
+export function currentDeploymentVersions(value) {
+    if (Array.isArray(value)) {
+        for (const entry of value) {
+            const found = currentDeploymentVersions(entry);
+            if (found)
+                return found;
+        }
+        return null;
+    }
+    if (!isUnknownRecord(value))
+        return null;
+    if (Array.isArray(value.versions)) {
+        return value.versions.map((version) => {
+            if (!isUnknownRecord(version))
+                return { versionId: null, percentage: 0 };
+            const id = version.version_id ?? version.id;
+            return { versionId: typeof id === 'string' ? id : null, percentage: Number(version.percentage) };
+        });
+    }
+    for (const nested of Object.values(value)) {
+        const found = currentDeploymentVersions(nested);
+        if (found)
+            return found;
+    }
+    return null;
+}
+/**
+ * The one version serving 100% of traffic, or null when there is none or the deployment is split.
+ *
+ * A split is not "close enough": with two versions live, "is our version live" has no single
+ * answer, and answering it optimistically is how a deploy reports success while part of the
+ * traffic still reaches the old code.
+ */
+export function currentDeploymentVersionId(value) {
+    const shares = currentDeploymentVersions(value);
+    if (shares?.length !== 1)
+        return null;
+    const [only] = shares;
+    return only.percentage === 100 ? only.versionId : null;
+}
+/** The version serving all traffic for this worker, with the tag it was uploaded under. */
+export async function readLiveVersion(probe) {
+    const deployments = await probe.deployments();
+    const shares = currentDeploymentVersions(deployments);
+    const versionId = currentDeploymentVersionId(deployments);
+    if (!versionId) {
+        return shares && shares.length > 0
+            ? {
+                ok: false,
+                error: {
+                    kind: 'split-traffic',
+                    message: 'no single worker version is serving 100% of traffic; refusing to name one as live',
+                },
+            }
+            : { ok: false, error: { kind: 'never-deployed', message: 'this worker has no active deployment' } };
+    }
+    const tag = collectVersionTags(await probe.versions()).get(versionId) ?? null;
+    return { ok: true, value: { versionId, tag } };
+}
+/**
+ * How long a deploy waits for the version it just activated to become the one being served.
+ *
+ * The bound is the point: an unbounded loop turns a stuck propagation into a hung CI job nobody
+ * reads, and a fixed sleep turns it into a green job that lied. Both are worse than a red job
+ * naming what it expected and what it saw.
+ */
+export const LIVE_VERSION_WAIT_BUDGET_MS = 120_000;
+/** Cloudflare's control plane converges in seconds; polling faster than this only burns API quota. */
+export const LIVE_VERSION_POLL_INTERVAL_MS = 2_000;
+/**
+ * Runs `attempt` until it succeeds or the budget expires, and reports the LAST thing it saw.
+ *
+ * Both waits below need the same deadline arithmetic and the same "what did you see instead"
+ * record; sharing it keeps the two from drifting into disagreeing about when a wait is over.
+ */
+async function pollWithinBudget(attempt, options) {
+    const budgetMs = options.budgetMs ?? LIVE_VERSION_WAIT_BUDGET_MS;
+    const intervalMs = options.intervalMs ?? LIVE_VERSION_POLL_INTERVAL_MS;
+    const now = options.now ?? Date.now;
+    const sleep = options.sleep ?? sleepFor;
+    const deadline = now() + budgetMs;
+    for (;;) {
+        const result = await attempt();
+        if (result.done)
+            return { ok: true, value: result.value };
+        if (now() >= deadline)
+            return { ok: false, error: { observed: result.observed, waitedMs: budgetMs } };
+        await sleep(intervalMs);
+    }
+}
+function sleepFor(ms) {
+    const { promise, resolve } = Promise.withResolvers();
+    setTimeout(resolve, ms);
+    return promise;
+}
+/**
+ * Polls until the worker's live version carries `expectedTag`, or the budget runs out.
+ *
+ * The tag is the match, not the version id: the tag IS the desired-state identity (`nx-<task
+ * hash>`), it is what both `wrangler deploy --tag` and `wrangler versions deploy --version-tag`
+ * were told to make live, and it is the one name the caller knows before the upload has produced
+ * a version id.
+ *
+ * Returns the failure rather than throwing it: a deploy that cannot be observed is an operational
+ * outcome the caller has to report, not a broken invariant.
+ */
+export async function awaitLiveVersion(probe, expectedTag, options = {}) {
+    const polled = await pollWithinBudget(async () => {
+        const live = await readLiveVersion(probe);
+        if (!live.ok)
+            return { done: false, observed: live.error.message };
+        const { tag, versionId } = live.value;
+        if (tag === expectedTag)
+            return { done: true, value: live.value };
+        return { done: false, observed: tag ? `${tag} (${versionId})` : `an untagged version (${versionId})` };
+    }, options);
+    if (polled.ok)
+        return polled;
+    return {
+        ok: false,
+        error: {
+            kind: 'not-observed',
+            expected: expectedTag,
+            observed: polled.error.observed,
+            message: `deployed version ${expectedTag} was not serving traffic after ` +
+                `${Math.round(polled.error.waitedMs / 1000)}s; live is ${polled.error.observed}`,
+        },
+    };
+}
+/**
+ * Polls a worker-served endpoint until it answers with `expectedTag`.
+ *
+ * The control plane agreeing is necessary and not sufficient — that gap is exactly what this
+ * change's predecessor measured — so a project that can prove the edge serves the new code says so
+ * with an endpoint echoing its own version tag (Workers read it from the version-metadata
+ * binding). The contract is deliberately one shape: the trimmed response body IS the tag.
+ */
+export async function awaitVersionEndpoint(url, expectedTag, options = {}) {
+    const request = options.fetch ?? fetch;
+    const polled = await pollWithinBudget(async () => {
+        const observed = await probeVersionEndpoint(request, url);
+        return observed === expectedTag ? { done: true, value: undefined } : { done: false, observed };
+    }, options);
+    if (polled.ok)
+        return polled;
+    return {
+        ok: false,
+        error: {
+            kind: 'not-observed',
+            expected: expectedTag,
+            observed: polled.error.observed,
+            message: `${url} did not report version ${expectedTag} after ` +
+                `${Math.round(polled.error.waitedMs / 1000)}s; it reported ${polled.error.observed}`,
+        },
+    };
+}
+async function probeVersionEndpoint(request, url) {
+    try {
+        const response = await request(url, { headers: { accept: 'text/plain' } });
+        const body = (await response.text()).trim();
+        return response.ok ? body : `HTTP ${response.status} ${body}`.trim();
+    }
+    catch (error) {
+        // A worker mid-rollout refuses connections; that is a poll result, not a reason to abandon the
+        // wait. It only becomes the failure when it is still the answer at the deadline.
+        return error instanceof Error ? error.message : String(error);
+    }
+}
+/**
+ * How long `smoo wrangler deployed-version` trusts its own last answer.
+ *
+ * This TTL is a convenience for operators and repeated local queries, NOT a correctness mechanism:
+ * nothing that decides whether to deploy may read it. The deploy's own liveness check always calls
+ * Cloudflare, because a cached "live already equals the desired tag" is precisely the belief a
+ * rollback falsifies, and acting on it would skip the deploy that repairs the rollback.
+ */
+export const LIVE_VERSION_CACHE_TTL_MS = 45_000;
+const parseCachedLiveVersion = (() => {
+    const _io0 = input => (null === input.versionTag || "string" === typeof input.versionTag) && "string" === typeof input.versionId && "number" === typeof input.fetchedAt;
+    const _vo0 = (input, _path, _exceptionable = true) => [null === input.versionTag || "string" === typeof input.versionTag || _report(_exceptionable, {
+            path: _path + ".versionTag",
+            expected: "(null | string)",
+            value: input.versionTag
+        }), "string" === typeof input.versionId || _report(_exceptionable, {
+            path: _path + ".versionId",
+            expected: "string",
+            value: input.versionId
+        }), "number" === typeof input.fetchedAt || _report(_exceptionable, {
+            path: _path + ".fetchedAt",
+            expected: "number",
+            value: input.fetchedAt
+        })].every(flag => flag);
+    const __is = input => "object" === typeof input && null !== input && _io0(input);
+    let errors;
+    let _report;
+    const __validate = input => {
+        if (false === __is(input)) {
+            errors = [];
+            _report = _validateReport_1._validateReport(errors);
+            ((input, _path, _exceptionable = true) => ("object" === typeof input && null !== input || _report(true, {
+                path: _path + "",
+                expected: "CachedLiveVersion",
+                value: input
+            })) && _vo0(input, _path + "", true) || _report(true, {
+                path: _path + "",
+                expected: "CachedLiveVersion",
+                value: input
+            }))(input, "$input", true);
+            const success = 0 === errors.length;
+            return success ? {
+                success,
+                data: input
+            } : {
+                success,
+                errors,
+                data: input
+            };
+        }
+        return {
+            success: true,
+            data: input
+        };
+    };
+    return input => __validate(JSON.parse(input));
+})();
+/**
+ * One file per key, so two deploys running in parallel cannot clobber each other's answer; a
+ * shared map would need a lock to say the same thing.
+ */
+export function liveVersionCachePath(cacheDirectory, key) {
+    const name = [key.accountId, key.workerName, key.stage].map(encodeURIComponent).join('_');
+    return join(cacheDirectory, 'smoo-live-version', `${name}.json`);
+}
+export async function readCachedLiveVersion(cacheDirectory, key, ttlMs, now = Date.now) {
+    let text;
+    try {
+        text = await readFile(liveVersionCachePath(cacheDirectory, key), 'utf8');
+    }
+    catch {
+        return null;
+    }
+    const parsed = parseCachedLiveVersion(text);
+    if (!parsed.success)
+        return null;
+    return now() - parsed.data.fetchedAt < ttlMs ? parsed.data : null;
+}
+export async function writeCachedLiveVersion(cacheDirectory, key, entry) {
+    const path = liveVersionCachePath(cacheDirectory, key);
+    await mkdir(dirname(path), { recursive: true });
+    await writeFile(path, `${JSON.stringify(entry)}\n`);
+}
+/**
+ * Where the cache lives. Nx's workspace data directory already exists, is already gitignored, and
+ * is already wiped when the workspace is reset — three properties a hand-rolled directory would
+ * each have to re-earn, and one ($HOME) that would leak one checkout's answers into another's.
+ */
+export function liveVersionCacheDirectory(workspaceRoot, environment) {
+    return environment.NX_WORKSPACE_DATA_DIRECTORY ?? join(workspaceRoot, '.nx', 'workspace-data');
+}

package/dist/wrangler/stage-secrets.d.ts

@@ -0,0 +1,57 @@
+import { type DeploymentStage } from './stage.js';
+/**
+ * How a declaration names a stage. The fixed stages go by their own name; every `prN` stage is
+ * `preview`, because a scope is written once and pull-request numbers are not knowable in advance.
+ */
+export type SecretStageScope = 'staging' | 'production' | 'preview';
+/**
+ * `smoo.wrangler.secretStages`: a declared secret name mapped to the stages it belongs to. The map
+ * answers two questions with one declaration, and both directions matter:
+ *
+ * - requirement — a stage the secret belongs to refuses to deploy without a value for it;
+ * - permission — a stage the secret does *not* belong to never receives it, however loudly the
+ *   deploying shell exports it. A test-only capability exported by CI for preview stages must not
+ *   ride along into production just because the variable happens to be set.
+ *
+ * A declared name absent from the map belongs to every stage. A name mapped to `[]` belongs to no
+ * stage, which is how a value that exists only for local development is declared.
+ */
+export type SecretStageMap = Record<string, SecretStageScope[]>;
+/** Secret NAMES the project declares. Values live on the Worker; the repo only ever holds the keys. */
+export declare function readDeclaredSecretNames(cwd: string): string[];
+/** `smoo.wrangler.secretStages` from the project's package.json; no file and no block scope nothing. */
+export declare function readSecretStageMap(cwd: string): SecretStageMap;
+/** Which of a project's declared secrets one stage may see, and which belong to other stages. */
+export interface StageSecretPlan {
+    stage: DeploymentStage;
+    /** Declared names this stage requires — and the only ones a deploy of it may carry. */
+    required: string[];
+    /** Declared names scoped to other stages: withheld from this deploy even when a value is exported. */
+    withheld: string[];
+    /** The declaration itself, so a refusal can say why each name is where it is. */
+    scopes: SecretStageMap;
+}
+/**
+ * Splits the declared secrets by whether `stage` is in scope for each.
+ *
+ * A scope on an undeclared name is refused rather than ignored: it is almost always a typo of a
+ * real secret's name, and its effect is the dangerous direction — the misspelt entry scopes
+ * nothing while the real secret, still absent from the map, reaches every stage.
+ */
+export declare function planStageSecrets(declared: string[], stage: DeploymentStage, scopes: SecretStageMap): StageSecretPlan;
+/**
+ * Why this deploy must not proceed, or nothing when it may.
+ *
+ * Two refusals, reported together so one run names every problem:
+ *
+ * - a required secret with no value anywhere. `--secrets-file` applies additively, so a deploy
+ *   that never mentions a secret leaves whatever the Worker already holds — silence that reads as
+ *   success while a secret introduced after the first deploy never arrives, and the code that
+ *   needs it fails at runtime instead of here.
+ * - a withheld secret the Worker already holds. Filtering it out of this deploy's payload cannot
+ *   remove it, so the scope would be nominal rather than enforced until someone deletes it.
+ *
+ * A value is never read, never formatted, and never named beyond its key.
+ */
+export declare function stageSecretRefusal(plan: StageSecretPlan, exported: ReadonlySet<string>, held: ReadonlySet<string>, workerName: string): string | undefined;
+//# sourceMappingURL=stage-secrets.d.ts.map

package/dist/wrangler/stage-secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stage-secrets.d.ts","sourceRoot":"","sources":["../../src/wrangler/stage-secrets.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,KAAK,eAAe,EAAsB,MAAM,YAAY,CAAC;AAEtE;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,YAAY,GAAG,SAAS,CAAC;AAEpE;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;AAahE,uGAAuG;AACvG,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAG7D;AAED,wGAAwG;AACxG,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,CAQ9D;AAED,iGAAiG;AACjG,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,eAAe,CAAC;IACvB,uFAAuF;IACvF,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,sGAAsG;IACtG,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,iFAAiF;IACjF,MAAM,EAAE,cAAc,CAAC;CACxB;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,cAAc,GAAG,eAAe,CAsBpH;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,eAAe,EACrB,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,EAC7B,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,EACzB,UAAU,EAAE,MAAM,GACjB,MAAM,GAAG,SAAS,CAsBpB"}

package/dist/wrangler/stage-secrets.js

@@ -0,0 +1,178 @@
+import * as _accessExpressionAsString_1 from "typia/lib/internal/_accessExpressionAsString";
+const __typia_transform__accessExpressionAsString = _accessExpressionAsString_1._accessExpressionAsString;
+import * as _validateReport_1 from "typia/lib/internal/_validateReport";
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import typia from 'typia';
+import { formatValidationErrors, parseJsonFileText } from '../lib/json.js';
+import { parseDevVarsExample } from './prepare-env.js';
+import { isPullRequestStage } from './stage.js';
+const validateWranglerManifest = (() => {
+    const _io0 = input => undefined === input.smoo || "object" === typeof input.smoo && null !== input.smoo && false === Array.isArray(input.smoo) && _io1(input.smoo);
+    const _io1 = input => undefined === input.wrangler || "object" === typeof input.wrangler && null !== input.wrangler && false === Array.isArray(input.wrangler) && _io2(input.wrangler);
+    const _io2 = input => undefined === input.secretStages || "object" === typeof input.secretStages && null !== input.secretStages && false === Array.isArray(input.secretStages) && _io3(input.secretStages);
+    const _io3 = input => Object.keys(input).every(key => {
+        const value = input[key];
+        if (undefined === value)
+            return true;
+        return Array.isArray(value) && value.every(elem => "preview" === elem || "production" === elem || "staging" === elem);
+    });
+    const _vo0 = (input, _path, _exceptionable = true) => [undefined === input.smoo || ("object" === typeof input.smoo && null !== input.smoo && false === Array.isArray(input.smoo) || _report(_exceptionable, {
+            path: _path + ".smoo",
+            expected: "(undefined | { wrangler?: { secretStages?: SecretStageMap | undefined; } | undefined; })",
+            value: input.smoo
+        })) && _vo1(input.smoo, _path + ".smoo", true && _exceptionable) || _report(_exceptionable, {
+            path: _path + ".smoo",
+            expected: "(undefined | { wrangler?: { secretStages?: SecretStageMap | undefined; } | undefined; })",
+            value: input.smoo
+        })].every(flag => flag);
+    const _vo1 = (input, _path, _exceptionable = true) => [undefined === input.wrangler || ("object" === typeof input.wrangler && null !== input.wrangler && false === Array.isArray(input.wrangler) || _report(_exceptionable, {
+            path: _path + ".wrangler",
+            expected: "(undefined | { secretStages?: SecretStageMap | undefined; })",
+            value: input.wrangler
+        })) && _vo2(input.wrangler, _path + ".wrangler", true && _exceptionable) || _report(_exceptionable, {
+            path: _path + ".wrangler",
+            expected: "(undefined | { secretStages?: SecretStageMap | undefined; })",
+            value: input.wrangler
+        })].every(flag => flag);
+    const _vo2 = (input, _path, _exceptionable = true) => [undefined === input.secretStages || ("object" === typeof input.secretStages && null !== input.secretStages && false === Array.isArray(input.secretStages) || _report(_exceptionable, {
+            path: _path + ".secretStages",
+            expected: "(SecretStageMap | undefined)",
+            value: input.secretStages
+        })) && _vo3(input.secretStages, _path + ".secretStages", true && _exceptionable) || _report(_exceptionable, {
+            path: _path + ".secretStages",
+            expected: "(SecretStageMap | undefined)",
+            value: input.secretStages
+        })].every(flag => flag);
+    const _vo3 = (input, _path, _exceptionable = true) => [false === _exceptionable || Object.keys(input).map(key => {
+            const value = input[key];
+            if (undefined === value)
+                return true;
+            return (Array.isArray(value) || _report(_exceptionable, {
+                path: _path + __typia_transform__accessExpressionAsString(key),
+                expected: "Array<SecretStageScope>",
+                value: value
+            })) && value.map((elem, _index2) => "preview" === elem || "production" === elem || "staging" === elem || _report(_exceptionable, {
+                path: _path + __typia_transform__accessExpressionAsString(key) + "[" + _index2 + "]",
+                expected: "(\"preview\" | \"production\" | \"staging\")",
+                value: elem
+            })).every(flag => flag) || _report(_exceptionable, {
+                path: _path + __typia_transform__accessExpressionAsString(key),
+                expected: "Array<SecretStageScope>",
+                value: value
+            });
+        }).every(flag => flag)].every(flag => flag);
+    const __is = input => "object" === typeof input && null !== input && false === Array.isArray(input) && _io0(input);
+    let errors;
+    let _report;
+    const __validate = input => {
+        if (false === __is(input)) {
+            errors = [];
+            _report = _validateReport_1._validateReport(errors);
+            ((input, _path, _exceptionable = true) => ("object" === typeof input && null !== input && false === Array.isArray(input) || _report(true, {
+                path: _path + "",
+                expected: "WranglerPackageManifest",
+                value: input
+            })) && _vo0(input, _path + "", true) || _report(true, {
+                path: _path + "",
+                expected: "WranglerPackageManifest",
+                value: input
+            }))(input, "$input", true);
+            const success = 0 === errors.length;
+            return success ? {
+                success,
+                data: input
+            } : {
+                success,
+                errors,
+                data: input
+            };
+        }
+        return {
+            success: true,
+            data: input
+        };
+    };
+    return input => __validate(JSON.parse(input));
+})();
+/** Secret NAMES the project declares. Values live on the Worker; the repo only ever holds the keys. */
+export function readDeclaredSecretNames(cwd) {
+    const path = join(cwd, '.dev.vars.example');
+    return existsSync(path) ? parseDevVarsExample(readFileSync(path, 'utf8')) : [];
+}
+/** `smoo.wrangler.secretStages` from the project's package.json; no file and no block scope nothing. */
+export function readSecretStageMap(cwd) {
+    const path = join(cwd, 'package.json');
+    if (!existsSync(path))
+        return {};
+    const result = parseJsonFileText(path, readFileSync(path, 'utf8'), validateWranglerManifest);
+    if (!result.success) {
+        throw new Error(`${path} declares an invalid smoo.wrangler block: ${formatValidationErrors(result.errors)}`);
+    }
+    return result.data.smoo?.wrangler?.secretStages ?? {};
+}
+/**
+ * Splits the declared secrets by whether `stage` is in scope for each.
+ *
+ * A scope on an undeclared name is refused rather than ignored: it is almost always a typo of a
+ * real secret's name, and its effect is the dangerous direction — the misspelt entry scopes
+ * nothing while the real secret, still absent from the map, reaches every stage.
+ */
+export function planStageSecrets(declared, stage, scopes) {
+    const declaredNames = new Set(declared);
+    const undeclared = Object.keys(scopes).filter((name) => !declaredNames.has(name));
+    if (undeclared.length > 0) {
+        throw new Error(`smoo.wrangler.secretStages scopes ${undeclared.join(', ')}, which .dev.vars.example does not declare. ` +
+            'A scope on a name no secret has leaves the secret it was meant for unscoped, so that secret reaches every stage.');
+    }
+    // Every `prN` stage answers to one written token: a scope cannot name pull requests in advance.
+    const scope = isPullRequestStage(stage) ? 'preview' : stage;
+    const required = [];
+    const withheld = [];
+    for (const name of declared) {
+        const declaredScope = scopes[name];
+        if (declaredScope === undefined || declaredScope.includes(scope)) {
+            required.push(name);
+        }
+        else {
+            withheld.push(name);
+        }
+    }
+    return { stage, required, withheld, scopes };
+}
+/**
+ * Why this deploy must not proceed, or nothing when it may.
+ *
+ * Two refusals, reported together so one run names every problem:
+ *
+ * - a required secret with no value anywhere. `--secrets-file` applies additively, so a deploy
+ *   that never mentions a secret leaves whatever the Worker already holds — silence that reads as
+ *   success while a secret introduced after the first deploy never arrives, and the code that
+ *   needs it fails at runtime instead of here.
+ * - a withheld secret the Worker already holds. Filtering it out of this deploy's payload cannot
+ *   remove it, so the scope would be nominal rather than enforced until someone deletes it.
+ *
+ * A value is never read, never formatted, and never named beyond its key.
+ */
+export function stageSecretRefusal(plan, exported, held, workerName) {
+    const unavailable = plan.required.filter((name) => !exported.has(name) && !held.has(name));
+    const installed = plan.withheld.filter((name) => held.has(name));
+    if (unavailable.length === 0 && installed.length === 0)
+        return undefined;
+    const lines = [`Refusing to deploy ${workerName} to ${plan.stage}.`];
+    if (unavailable.length > 0) {
+        lines.push(`Stage ${plan.stage} requires these secrets and no value exists for them, neither in this environment nor on the Worker:`, ...unavailable.map((name) => `  ${name} — ${scopeDescription(name, plan.scopes)}`), 'Export each one in the deploying shell before the deploy. Once the Worker exists,', `\`wrangler secret put <NAME> --name ${workerName}\` supplies it too.`);
+    }
+    if (installed.length > 0) {
+        lines.push(`The Worker holds these secrets, which smoo.wrangler.secretStages keeps out of ${plan.stage}:`, ...installed.map((name) => `  ${name} — ${scopeDescription(name, plan.scopes)}`), `Delete each one with \`wrangler secret delete <NAME> --name ${workerName}\`. A deploy of this stage`, 'never sends them, so leaving them installed would keep the scope nominal.');
+    }
+    return lines.join('\n');
+}
+function scopeDescription(name, scopes) {
+    const scope = scopes[name];
+    if (scope === undefined)
+        return 'unscoped, so every stage requires it';
+    if (scope.length === 0)
+        return 'scoped to no stage (local development only)';
+    return `scoped to ${scope.join(', ')}`;
+}

package/managed/raw/tooling/direnv/devenv.smoo.nix

@@ -354,7 +354,15 @@
       export GOFLAGS="''${GOFLAGS:--trimpath}"
       unset GOROOT
       bun "$DEVENV_ROOT/setup-environment.ts" || exit $?
-      export NX_SOCKET_DIR="$DEVENV_RUNTIME/nx"
+      # One socket dir per Nx workspace. DEVENV_RUNTIME is keyed to the devenv
+      # ROOT, so every workspace sharing one devenv - a sibling repository, a
+      # copy-on-write clone, a scratch workspace created inside this shell -
+      # would land on one socket. The first daemon to claim it then refuses
+      # every message from the others ("received a message from a different
+      # workspace"), which reads as a hung Nx in a workspace that did nothing
+      # wrong. Nx's own diagnostic names this exact cause.
+      nx_workspace_root="$(cd "$DEVENV_ROOT/../.." >/dev/null 2>&1 && pwd || printf '%s' "$PWD")"
+      export NX_SOCKET_DIR="$DEVENV_RUNTIME/nx-$(printf '%s' "$nx_workspace_root" | cksum | cut -d' ' -f1)"
       mkdir -p "$NX_SOCKET_DIR"
       ${lib.optionalString pkgs.stdenv.isDarwin ''
         unset CC CXX

package/managed/raw/tooling/git-hooks/pre-push.sh

@@ -1,25 +1,25 @@
 #!/usr/bin/env bash
-# macOS-only Linux compile gate. Everything in tooling depends only on
-# devenv.nix packages, so this hook must also work without devenv on PATH —
-# but it may not pretend a check ran that never did. Nx task hashes can
-# differ between the bare shell and the linux-cross profile, so a bare miss
-# proves nothing on its own. Policy, in order:
-# 1. Bare `nx run-many -t cargo-lint-cross`: a hit is a prior real
-#    `cargo clippy --target x86_64-unknown-linux-gnu`; pass with no toolchain.
-# 2. If a Nix-built devenv is on PATH, `bun run check:linux` enters the
-#    linux-cross profile properly and its result decides the push.
-# 3. Otherwise refuse with the recovery command instead of a toolchain error
-
-# A Nix-built devenv binary (under /nix/store), skipping the repo wrapper
-# scripts that also answer to this name but cannot enter a profile alone.
-has_nix_devenv() {
-  while IFS= read -r candidate; do
-    case "$(realpath "$candidate" 2>/dev/null)" in
-      /nix/store/*) return 0 ;;
-    esac
-  done < <(which -a devenv 2>/dev/null)
-  return 1
-}
+# macOS-only Linux cross-compile gate. This hook is a cache PROBE and nothing
+# else: it reads the nx cache and never compiles. A hit means a real
+# `cargo clippy --target x86_64-unknown-linux-gnu` already passed for exactly
+# this tree, so the push is safe with no toolchain present. Anything else
+# refuses the push and names the one command that fixes it.
+#
+# Why probe-only. The cross-clippy needs the linux-cross C toolchain, which
+# lives in a devenv profile. A hook that entered that profile spent minutes
+# compiling on a push the user expected to take a second, and it did so in an
+# environment they never asked for. Pushing is not the place to discover that
+# the tree has not been compiled for Linux; `bun run check:linux` is.
+#
+# CC_x86_64_unknown_linux_gnu is unset for the probe deliberately. The target's
+# own guard reads it to decide whether the toolchain is present, so leaving it
+# set would let a push made from inside an already-entered linux-cross shell
+# fall through into a real multi-minute compile. It is not a declared input of
+# the target, so unsetting it cannot change the task hash — a warm entry still
+# hits.
+#
+# Everything in tooling depends only on devenv.nix packages, so this hook also
+# works with no devenv on PATH. It must never pretend a check ran that did not.
 
 cd "$(git rev-parse --show-toplevel)"
 TOOLING="$PWD/tooling"
@@ -31,17 +31,18 @@ case "$(uname -s)" in
   *) exit 0 ;;
 esac
 
-if nx run-many -t cargo-lint-cross; then
+if env -u CC_x86_64_unknown_linux_gnu nx run-many -t cargo-lint-cross --output-style=static; then
   exit 0
 fi
 
-if has_nix_devenv; then
-  exec bun run check:linux
-fi
-
 cat >&2 <<'EOF'
-pre-push: cargo-lint-cross is not cached for this tree and no Nix-built
-devenv is on PATH to enter the linux-cross profile. Run `bun run check:linux`
-from a shell with nix on PATH, wait for it to pass, then push again.
+
+pre-push: the Linux cross-compile check is NOT cached for this tree, so this
+push would ship code that has never been compiled for Linux. This hook only
+reads the cache; it does not build. The "needs the linux-cross C toolchain"
+line above is the probe refusing to compile, not a broken toolchain.
+
+  Run:  bun run check:linux
+  Wait for it to pass, then push again.
 EOF
 exit 1