@smoothbricks/cli 0.11.17 → 0.11.18

package/dist/secrets/index.js

@@ -19,7 +19,7 @@
  * payment library's own `publishable_key_mismatch` refusal.
  */
 import { spawnSync } from 'node:child_process';
-import { existsSync, readFileSync } from 'node:fs';
+import { existsSync, readdirSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { repositoryOwnerFromUrl, repositorySecretMapping } from '../lib/secret-names.js';
 import { readPackageJsonObject, repositoryInfo } from '../lib/workspace.js';
@@ -36,9 +36,17 @@ export function reconcileSecrets(sources) {
     // GITHUB_CLIENT_SECRET would report one value as two secrets, one of them
     // permanently "declared by nothing".
     const carriesKnownEnvName = new Set(names.size > 0 ? [...names].map((name) => sources.secretNames[name] ?? name) : []);
-    for (const secret of sources.repositorySecrets) {
+    // A value only an environment holds is still a value: leaving it out of the
+    // rows is how an operator ends up hunting for a secret that is already set.
+    const addUndeclared = (secret) => {
         if (!carriesKnownEnvName.has(secret))
             names.add(secret);
+    };
+    for (const secret of sources.repositorySecrets)
+        addUndeclared(secret);
+    for (const held of Object.values(sources.environmentSecrets ?? {})) {
+        for (const secret of held)
+            addUndeclared(secret);
     }
     return [...names]
         .sort((left, right) => left.localeCompare(right))
@@ -52,6 +60,10 @@ export function reconcileSecrets(sources) {
         suppliedByWorkflow: sources.workflowSecrets.includes(name),
         fetchableLocally: sources.localCommands.includes(name),
         onRepository: sources.repositorySecrets.includes(sources.secretNames[name] ?? name),
+        heldByEnvironment: Object.entries(sources.environmentSecrets ?? {})
+            .filter(([, held]) => held.includes(sources.secretNames[name] ?? name))
+            .map(([environment]) => environment)
+            .sort((left, right) => left.localeCompare(right)),
     }));
 }
 /**
@@ -60,8 +72,25 @@ export function reconcileSecrets(sources) {
  * separately from "declared but not wired into any workflow", because the
  * remedies differ — set a secret, versus declare it in `smoo.github`.
  */
-export function unsatisfiedSecrets(rows) {
-    return rows.filter((row) => row.suppliedByWorkflow && !row.onRepository);
+export function unsatisfiedSecrets(rows, boundEnvironments = []) {
+    return rows.filter((row) => {
+        if (!row.suppliedByWorkflow)
+            return false;
+        if (row.onRepository)
+            return false;
+        // With no environment bound, the repository is the only scope a job reads.
+        // With environments bound, each one can carry the value instead - so the
+        // name is satisfied only when every bound environment holds it.
+        if (boundEnvironments.length === 0)
+            return true;
+        return !boundEnvironments.every((environment) => row.heldByEnvironment.includes(environment));
+    });
+}
+/** Bound environments that lack their own value and cannot fall back to the repository. */
+export function environmentsMissing(row, boundEnvironments) {
+    if (row.onRepository)
+        return [];
+    return boundEnvironments.filter((environment) => !row.heldByEnvironment.includes(environment));
 }
 /** Worker-declared names no managed workflow passes: a CI deploy will run without them. */
 export function unwiredSecrets(rows) {
@@ -92,6 +121,83 @@ export function workflowSecretNames(root) {
         names.add(smoo.privateNpm.publishTokenEnv);
     return [...names].sort((left, right) => left.localeCompare(right));
 }
+/**
+ * GitHub Environments the rendered workflows bind, read from the workflow
+ * files rather than from config: a binding may be hand-authored inside a
+ * `smoo-local` block, and the file is what GitHub executes either way. A job
+ * bound to an environment resolves `secrets.X` from that environment first and
+ * from the repository second, so these names are the scopes a value can live
+ * in. Expressions are skipped - a computed environment names no fixed scope.
+ */
+export function workflowEnvironments(root) {
+    const directory = join(root, '.github', 'workflows');
+    if (!existsSync(directory))
+        return [];
+    const environments = new Set();
+    for (const entry of readdirSync(directory)) {
+        if (!entry.endsWith('.yml') && !entry.endsWith('.yaml'))
+            continue;
+        for (const bound of environmentBindings(readFileSync(join(directory, entry), 'utf8'))) {
+            environments.add(bound);
+        }
+    }
+    return [...environments].sort((left, right) => left.localeCompare(right));
+}
+/**
+ * The environments one workflow file binds, in both spellings GitHub accepts:
+ * `environment: staging`, and the block form whose `name:` sits under it when
+ * the job also records a deployment URL. Only a `name:` indented inside an
+ * `environment:` block is a binding - a workflow's, a job's and a step's are
+ * not, and reading those as environments would send an operator to set
+ * secrets in scopes that do not exist.
+ */
+function environmentBindings(text) {
+    const lines = text.split('\n');
+    const bound = [];
+    for (let index = 0; index < lines.length; index += 1) {
+        const binding = /^(\s*)environment:(.*)$/.exec(lines[index] ?? '');
+        if (!binding)
+            continue;
+        const indent = (binding[1] ?? '').length;
+        const value = binding[2] ?? '';
+        // Nothing but a comment after the colon is the block form; anything else
+        // is the value itself.
+        if (!/^\s*(?:#.*)?$/.test(value)) {
+            const name = literalEnvironmentName(value);
+            if (name !== null)
+                bound.push(name);
+            continue;
+        }
+        for (let next = index + 1; next < lines.length; next += 1) {
+            const line = lines[next] ?? '';
+            const content = line.trimStart();
+            if (content.length === 0 || content.startsWith('#'))
+                continue;
+            if (line.length - content.length <= indent)
+                break;
+            const named = /^name:(.*)$/.exec(content);
+            if (!named)
+                continue;
+            const name = literalEnvironmentName(named[1] ?? '');
+            if (name !== null)
+                bound.push(name);
+            break;
+        }
+    }
+    return bound;
+}
+/**
+ * The fixed name a YAML value denotes, or null when it denotes no fixed scope:
+ * an expression is computed per run, and a flow mapping or a list is not a
+ * name. Names may contain spaces, which is why the renderer quotes them.
+ */
+function literalEnvironmentName(value) {
+    const scalar = value.replace(/\s+#.*$/, '').trim();
+    if (scalar.length === 0 || scalar.includes('${{'))
+        return null;
+    const unquoted = /^(['"])(.*)\1$/.exec(scalar)?.[2] ?? scalar;
+    return /^[A-Za-z0-9._-][A-Za-z0-9._ -]*$/.test(unquoted) ? unquoted : null;
+}
 /**
  * Env name -> repository secret for every name in play, following the naming
  * convention and honouring the declared exceptions a repository still needs.

package/dist/secrets/repository.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Which GitHub repository `smoo secrets` reads and writes.
+ *
+ * `gh` refuses on a checkout with more than one remote ("multiple remotes
+ * detected"), which is exactly the public/private mirror layout this CLI's own
+ * users run — so the repository has to be resolved here, from the checkout,
+ * before `gh` is spawned. The current branch's upstream decides it: a branch
+ * that pushes to the private mirror is a branch whose secrets live there. That
+ * is a fact the checkout already records, not a preference to configure.
+ */
+export interface RepositoryChoice {
+    /** `owner/name`, the form `gh --repo` takes. */
+    readonly repo: string;
+    /** Why this repository, for the operator to read back. */
+    readonly source: string;
+}
+/** `owner/name` from any git remote URL form, or null when it names no repository. */
+export declare function repositorySlugFromUrl(url: string): string | null;
+/**
+ * Pure resolution, so the precedence is testable without a checkout.
+ *
+ * A requested value is either a remote name or an `owner/name` slug; naming a
+ * remote is what an operator reaches for first (`-R private-repo`), and
+ * refusing it because it lacks a slash would be pedantry.
+ *
+ * With no request and no upstream - a branch pushed by explicit refspec, which
+ * is how the mirror layout is driven - the remote-tracking refs still record
+ * where this branch has been pushed. One remote carrying it is an answer; two
+ * is a genuine ambiguity worth refusing.
+ */
+export declare function chooseRepository(inputs: {
+    readonly remotes: ReadonlyMap<string, string>;
+    readonly upstreamRemote: string | null;
+    /** Remotes that already carry the current branch, from its remote-tracking refs. */
+    readonly remotesCarryingBranch?: readonly string[];
+    /** Current branch name, for the refusal to say which branch decided nothing. */
+    readonly branch?: string | null;
+    readonly requested: string | undefined;
+}): {
+    ok: true;
+    choice: RepositoryChoice;
+} | {
+    ok: false;
+    reason: string;
+};
+/** Remote name -> URL, in config order. */
+export declare function readRemotes(root: string): Map<string, string>;
+/** Remotes with a remote-tracking ref for the current branch: where it has been pushed. */
+export declare function readRemotesCarryingBranch(root: string, remotes: ReadonlyMap<string, string>): string[];
+/** The remote the current branch tracks, or null when it tracks nothing. */
+export declare function readUpstreamRemote(root: string): string | null;
+/** The repository to operate on, resolved from the checkout. */
+export declare function resolveRepository(root: string, requested: string | undefined): {
+    ok: true;
+    choice: RepositoryChoice;
+} | {
+    ok: false;
+    reason: string;
+};
+//# sourceMappingURL=repository.d.ts.map

package/dist/secrets/repository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repository.d.ts","sourceRoot":"","sources":["../../src/secrets/repository.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAIH,MAAM,WAAW,gBAAgB;IAC/B,gDAAgD;IAChD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,0DAA0D;IAC1D,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,sFAAsF;AACtF,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAehE;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE;IACvC,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,oFAAoF;IACpF,QAAQ,CAAC,qBAAqB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnD,gFAAgF;IAChF,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;CACxC,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAoDzE;AAOD,2CAA2C;AAC3C,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAS7D;AAED,2FAA2F;AAC3F,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,MAAM,EAAE,CAUtG;AAED,4EAA4E;AAC5E,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAI9D;AAED,gEAAgE;AAChE,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,GAAG,SAAS,GAC5B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAUxE"}

package/dist/secrets/repository.js

@@ -0,0 +1,145 @@
+/**
+ * Which GitHub repository `smoo secrets` reads and writes.
+ *
+ * `gh` refuses on a checkout with more than one remote ("multiple remotes
+ * detected"), which is exactly the public/private mirror layout this CLI's own
+ * users run — so the repository has to be resolved here, from the checkout,
+ * before `gh` is spawned. The current branch's upstream decides it: a branch
+ * that pushes to the private mirror is a branch whose secrets live there. That
+ * is a fact the checkout already records, not a preference to configure.
+ */
+import { spawnSync } from 'node:child_process';
+/** `owner/name` from any git remote URL form, or null when it names no repository. */
+export function repositorySlugFromUrl(url) {
+    const withoutProtocol = url
+        .trim()
+        .replace(/^[a-z+]+:\/\//i, '')
+        .replace(/^[^@/]+@/, '');
+    // A remainder starting with `/` or `.` carries no host, so it is a path on
+    // this machine - a valid git remote, never a GitHub repository.
+    if (withoutProtocol.startsWith('/') || withoutProtocol.startsWith('.'))
+        return null;
+    const path = withoutProtocol.replace(/^[^/:]+(?::\d+)?[/:]/, '');
+    const segments = path
+        .replace(/\.git$/i, '')
+        .split('/')
+        .filter((segment) => segment.length > 0);
+    if (segments.length < 2)
+        return null;
+    return `${segments[segments.length - 2]}/${segments[segments.length - 1]}`;
+}
+/**
+ * Pure resolution, so the precedence is testable without a checkout.
+ *
+ * A requested value is either a remote name or an `owner/name` slug; naming a
+ * remote is what an operator reaches for first (`-R private-repo`), and
+ * refusing it because it lacks a slash would be pedantry.
+ *
+ * With no request and no upstream - a branch pushed by explicit refspec, which
+ * is how the mirror layout is driven - the remote-tracking refs still record
+ * where this branch has been pushed. One remote carrying it is an answer; two
+ * is a genuine ambiguity worth refusing.
+ */
+export function chooseRepository(inputs) {
+    const { remotes, upstreamRemote, requested } = inputs;
+    const remotesCarryingBranch = inputs.remotesCarryingBranch ?? [];
+    if (requested !== undefined && requested.length > 0) {
+        const url = remotes.get(requested);
+        if (url !== undefined) {
+            const slug = repositorySlugFromUrl(url);
+            if (slug === null)
+                return { ok: false, reason: `remote ${requested} (${url}) names no owner/name` };
+            return { ok: true, choice: { repo: slug, source: `remote ${requested}` } };
+        }
+        if (requested.includes('/'))
+            return { ok: true, choice: { repo: requested, source: 'requested' } };
+        return {
+            ok: false,
+            reason: `${requested} is neither a remote of this checkout nor an owner/name. ` +
+                `Remotes: ${[...remotes.keys()].join(', ') || 'none'}`,
+        };
+    }
+    if (upstreamRemote !== null) {
+        const url = remotes.get(upstreamRemote);
+        const slug = url === undefined ? null : repositorySlugFromUrl(url);
+        if (slug !== null) {
+            return { ok: true, choice: { repo: slug, source: `upstream of the current branch (${upstreamRemote})` } };
+        }
+    }
+    if (remotesCarryingBranch.length === 1) {
+        const name = remotesCarryingBranch[0] ?? '';
+        const url = remotes.get(name);
+        const slug = url === undefined ? null : repositorySlugFromUrl(url);
+        if (slug !== null) {
+            return { ok: true, choice: { repo: slug, source: `the only remote carrying this branch (${name})` } };
+        }
+    }
+    if (remotes.size === 1) {
+        const [name, url] = [...remotes][0];
+        const slug = repositorySlugFromUrl(url);
+        if (slug !== null)
+            return { ok: true, choice: { repo: slug, source: `the only remote (${name})` } };
+    }
+    const origin = remotes.get('origin');
+    const originSlug = origin === undefined ? null : repositorySlugFromUrl(origin);
+    if (originSlug !== null)
+        return { ok: true, choice: { repo: originSlug, source: 'remote origin' } };
+    const candidates = [...remotes].map(([name, url]) => `${name} -> ${repositorySlugFromUrl(url) ?? url}`).join(', ');
+    const branchClause = inputs.branch === undefined || inputs.branch === null
+        ? 'this checkout has no current branch'
+        : `branch ${inputs.branch} has no upstream and no remote carries it`;
+    return {
+        ok: false,
+        reason: `${branchClause}, and there is no origin, so the repository is ambiguous. ` +
+            `Pass -R with one of: ${candidates || 'no remotes at all'}`,
+    };
+}
+function git(root, args) {
+    const result = spawnSync('git', [...args], { cwd: root, encoding: 'utf8' });
+    return result.status === 0 ? result.stdout.trim() : null;
+}
+/** Remote name -> URL, in config order. */
+export function readRemotes(root) {
+    const remotes = new Map();
+    const config = git(root, ['config', '--get-regexp', '^remote\\..*\\.url']);
+    if (config === null)
+        return remotes;
+    for (const line of config.split('\n')) {
+        const match = /^remote\.(.+)\.url\s+(.+)$/.exec(line.trim());
+        if (match !== null && match[1] !== undefined && match[2] !== undefined)
+            remotes.set(match[1], match[2]);
+    }
+    return remotes;
+}
+/** Remotes with a remote-tracking ref for the current branch: where it has been pushed. */
+export function readRemotesCarryingBranch(root, remotes) {
+    const branch = git(root, ['rev-parse', '--abbrev-ref', 'HEAD']);
+    if (branch === null || branch === 'HEAD')
+        return [];
+    const carrying = [];
+    for (const name of remotes.keys()) {
+        if (git(root, ['rev-parse', '--verify', '--quiet', `refs/remotes/${name}/${branch}`]) !== null) {
+            carrying.push(name);
+        }
+    }
+    return carrying;
+}
+/** The remote the current branch tracks, or null when it tracks nothing. */
+export function readUpstreamRemote(root) {
+    const branch = git(root, ['rev-parse', '--abbrev-ref', 'HEAD']);
+    if (branch === null || branch === 'HEAD')
+        return null;
+    return git(root, ['config', '--get', `branch.${branch}.remote`]);
+}
+/** The repository to operate on, resolved from the checkout. */
+export function resolveRepository(root, requested) {
+    const remotes = readRemotes(root);
+    const branch = git(root, ['rev-parse', '--abbrev-ref', 'HEAD']);
+    return chooseRepository({
+        remotes,
+        upstreamRemote: readUpstreamRemote(root),
+        remotesCarryingBranch: readRemotesCarryingBranch(root, remotes),
+        branch: branch === 'HEAD' ? null : branch,
+        requested,
+    });
+}

package/dist/wrangler/cloudflare.d.ts

@@ -5,6 +5,10 @@ export interface R2Bucket {
 export interface WorkerScript {
     id: string;
 }
+/** One secret bound to a Worker. Cloudflare answers names and types only; a value is never readable. */
+export interface WorkerSecret {
+    name: string;
+}
 export interface WorkerRoute {
     id: string;
     pattern: string;
@@ -40,6 +44,8 @@ export interface CloudflareClient {
     deleteR2Object(bucket: string, key: string): Promise<void>;
     deleteR2Bucket(name: string): Promise<void>;
     listWorkerScripts(): Promise<WorkerScript[]>;
+    /** Names only; the Worker's stored values are write-only from outside. */
+    listWorkerSecrets(workerName: string): Promise<string[]>;
     deleteWorkerScript(name: string): Promise<void>;
     listWorkerDomains(): Promise<WorkerDomain[]>;
     createWorkerDomain(hostname: string, workerName: string, zoneId: string): Promise<void>;
@@ -75,6 +81,7 @@ export declare class CloudflareRestClient implements CloudflareClient {
     deleteR2Object(bucket: string, key: string): Promise<void>;
     deleteR2Bucket(name: string): Promise<void>;
     listWorkerScripts(): Promise<WorkerScript[]>;
+    listWorkerSecrets(workerName: string): Promise<string[]>;
     deleteWorkerScript(name: string): Promise<void>;
     listWorkerDomains(): Promise<WorkerDomain[]>;
     createWorkerDomain(hostname: string, workerName: string, zoneId: string): Promise<void>;

package/dist/wrangler/cloudflare.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cloudflare.d.ts","sourceRoot":"","sources":["../../src/wrangler/cloudflare.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,gBAAgB;IAC/B,gBAAgB,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IAC/C,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAC3D,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,aAAa,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IACrC,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACjD,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,iBAAiB,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAC7C,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,iBAAiB,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAC7C,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxF,kBAAkB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,SAAS,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IACvC,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IACzD,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtF,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IACrD,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9E,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE,eAAe,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAC/C,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC1D,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/C;AA6ED,qBAAa,kBAAmB,SAAQ,KAAK;IAGzC,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE;IAH1B,YACE,OAAO,EAAE,MAAM,EACN,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EAAE,EAGzB;CACF;AAED,KAAK,iBAAiB,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAElF,qBAAa,oBAAqB,YAAW,gBAAgB;IAKzD,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAL1B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IAErC,YACE,SAAS,EAAE,MAAM,EACA,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,iBAAyB,EAMpD;IAED,gBAAgB,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC,CAE7C;IAEK,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAS/D;IAED,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE3C;IAED,aAAa,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC,CAMnC;IAED,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE1C;IAEK,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAMrD;IAED,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAMzD;IAED,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE1C;IAED,iBAAiB,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC,CAG3C;IAED,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE9C;IAED,iBAAiB,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC,CAE3C;IAED,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAKtF;IAED,kBAAkB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE5C;IAED,SAAS,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC,CAErC;IAED,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAGvD;IAED,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAKpF;IAED,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAIhE;IAED,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAEnD;IAED,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAK5E;IAED,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAI/D;IAED,eAAe,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAE7C;IAEK,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAS9D;IAED,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE5C;IAED,6DAA6D;YAC/C,QAAQ;YAQR,SAAS;YAkBT,UAAU;IAgCxB,yFAAyF;YAC3E,OAAO;IAQrB;;;;OAIG;YACW,MAAM;YAMN,IAAI;CAWnB"}
+{"version":3,"file":"cloudflare.d.ts","sourceRoot":"","sources":["../../src/wrangler/cloudflare.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,wGAAwG;AACxG,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,gBAAgB;IAC/B,gBAAgB,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IAC/C,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAC3D,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,aAAa,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IACrC,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACjD,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,iBAAiB,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAC7C,0EAA0E;IAC1E,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACzD,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,iBAAiB,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAC7C,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxF,kBAAkB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,SAAS,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IACvC,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IACzD,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtF,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IACrD,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9E,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE,eAAe,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAC/C,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC1D,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/C;AA8ED,qBAAa,kBAAmB,SAAQ,KAAK;IAGzC,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE;IAH1B,YACE,OAAO,EAAE,MAAM,EACN,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EAAE,EAGzB;CACF;AAED,KAAK,iBAAiB,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAElF,qBAAa,oBAAqB,YAAW,gBAAgB;IAKzD,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAL1B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IAErC,YACE,SAAS,EAAE,MAAM,EACA,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,iBAAyB,EAMpD;IAED,gBAAgB,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC,CAE7C;IAEK,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAS/D;IAED,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE3C;IAED,aAAa,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC,CAMnC;IAED,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE1C;IAEK,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAMrD;IAED,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAMzD;IAED,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE1C;IAED,iBAAiB,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC,CAG3C;IAEK,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAQ7D;IAED,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE9C;IAED,iBAAiB,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC,CAE3C;IAED,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAKtF;IAED,kBAAkB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE5C;IAED,SAAS,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC,CAErC;IAED,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAGvD;IAED,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAKpF;IAED,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAIhE;IAED,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAEnD;IAED,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAK5E;IAED,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAI/D;IAED,eAAe,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAE7C;IAEK,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAS9D;IAED,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE5C;IAED,6DAA6D;YAC/C,QAAQ;YAQR,SAAS;YAkBT,UAAU;IAgCxB,yFAAyF;YAC3E,OAAO;IAQrB;;;;OAIG;YACW,MAAM;YAMN,IAAI;CAWnB"}

package/dist/wrangler/cloudflare.js

@@ -29,6 +29,10 @@ const isWorkerScripts = (() => {
     const _io0 = input => "string" === typeof input.id;
     return input => Array.isArray(input) && input.every(elem => "object" === typeof elem && null !== elem && _io0(elem));
 })();
+const isWorkerSecrets = (() => {
+    const _io0 = input => "string" === typeof input.name;
+    return input => Array.isArray(input) && input.every(elem => "object" === typeof elem && null !== elem && _io0(elem));
+})();
 const isWorkerDomains = (() => {
     const _io0 = input => "string" === typeof input.id && "string" === typeof input.hostname && (undefined === input.service || "string" === typeof input.service);
     return input => Array.isArray(input) && input.every(elem => "object" === typeof elem && null !== elem && _io0(elem));
@@ -158,6 +162,12 @@ export class CloudflareRestClient {
         // `workers/scripts` takes no pagination parameters: the account's scripts arrive in one answer.
         return this.listOnce(`${this.accountPath}/workers/scripts`, isWorkerScripts);
     }
+    async listWorkerSecrets(workerName) {
+        // Unpaginated, like the script listing itself. A Worker that does not exist answers 404 rather
+        // than an empty list, so the caller must establish that the Worker is there before asking.
+        const secrets = await this.listOnce(`${this.accountPath}/workers/scripts/${encodeURIComponent(workerName)}/secrets`, isWorkerSecrets);
+        return secrets.map((secret) => secret.name);
+    }
     deleteWorkerScript(name) {
         return this.mutate(`${this.accountPath}/workers/scripts/${encodeURIComponent(name)}`, { method: 'DELETE' });
     }

package/dist/wrangler/deploy-stage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy-stage.d.ts","sourceRoot":"","sources":["../../src/wrangler/deploy-stage.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,KAAK,gBAAgB,EAA+C,MAAM,iBAAiB,CAAC;AAErG,OAAO,EAOL,KAAK,0BAA0B,EAEhC,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAEL,KAAK,eAAe,EAYrB,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,6GAA6G;IAC7G,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,kHAAkH;IAClH,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;CAC1F;AAED,+GAA+G;AAC/G,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,CAAC,UAAU,CAE9E;AAED,qBAAa,gBAAiB,YAAW,aAAa;IAC9C,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,aAAa,CAAC,CAc7F;CACF;AAED,MAAM,WAAW,2BAA2B;IAC1C,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IAC/B,kFAAkF;IAClF,IAAI,CAAC,EAAE,0BAA0B,CAAC;IAClC,oGAAoG;IACpG,yBAAyB,CAAC,EAAE,MAAM,CAAC;CACpC;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,eAAe,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,UAAU,GAAG,WAAW,GAAG,kBAAkB,CAAC;IACtD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,kBAAkB;IACjC,yCAAyC;IACzC,KAAK,EAAE,MAAM,CAAC;IACd,6GAA6G;IAC7G,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,wBAAsB,WAAW,CAC/B,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,kBAAkB,EAC3B,YAAY,GAAE,2BAAgC,GAC7C,OAAO,CAAC,iBAAiB,CAAC,CAwG5B;AAyFD;;;;GAIG;AACH,iBAAe,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAOhF;AACD,eAAO,MAAM,2BAA2B,6BAAuB,CAAC;AAqFhE,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,KAAK,MAAM,EAAE,CAAC;IACrB,OAAO,EAAE;QACP,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,MAAM,CAAC;QAChB,YAAY,EAAE,MAAM,CAAC;QACrB,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,EAAE,MAAM,CAAC;QACnB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;CACH;AAED,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,EAChB,YAAY,GAAE,2BAAgC,GAC7C,OAAO,CAAC,aAAa,CAAC,CAoFxB;AAwFD,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,GAAG,SAAS,CAgBnF;AAyCD,uGAAuG;AACvG,wBAAsB,YAAY,CAAC,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC,OAAO,CAAC,CAOlH"}
+{"version":3,"file":"deploy-stage.d.ts","sourceRoot":"","sources":["../../src/wrangler/deploy-stage.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,KAAK,gBAAgB,EAA+C,MAAM,iBAAiB,CAAC;AAErG,OAAO,EAOL,KAAK,0BAA0B,EAEhC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAEL,KAAK,eAAe,EAYrB,MAAM,YAAY,CAAC;AASpB,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,6GAA6G;IAC7G,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,kHAAkH;IAClH,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;CAC1F;AAED,+GAA+G;AAC/G,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,CAAC,UAAU,CAE9E;AAED,qBAAa,gBAAiB,YAAW,aAAa;IAC9C,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,aAAa,CAAC,CAc7F;CACF;AAED,MAAM,WAAW,2BAA2B;IAC1C,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IAC/B,kFAAkF;IAClF,IAAI,CAAC,EAAE,0BAA0B,CAAC;IAClC,oGAAoG;IACpG,yBAAyB,CAAC,EAAE,MAAM,CAAC;CACpC;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,eAAe,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,UAAU,GAAG,WAAW,GAAG,kBAAkB,CAAC;IACtD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,kBAAkB;IACjC,yCAAyC;IACzC,KAAK,EAAE,MAAM,CAAC;IACd,6GAA6G;IAC7G,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,wBAAsB,WAAW,CAC/B,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,kBAAkB,EAC3B,YAAY,GAAE,2BAAgC,GAC7C,OAAO,CAAC,iBAAiB,CAAC,CAmH5B;AA+ED;;;;GAIG;AACH,iBAAe,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAOhF;AACD,eAAO,MAAM,2BAA2B,6BAAuB,CAAC;AAoHhE,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,KAAK,MAAM,EAAE,CAAC;IACrB,OAAO,EAAE;QACP,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,MAAM,CAAC;QAChB,YAAY,EAAE,MAAM,CAAC;QACrB,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,EAAE,MAAM,CAAC;QACnB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;CACH;AAED,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,EAChB,YAAY,GAAE,2BAAgC,GAC7C,OAAO,CAAC,aAAa,CAAC,CAoFxB;AAwFD,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,GAAG,SAAS,CAgBnF;AAyCD,uGAAuG;AACvG,wBAAsB,YAAY,CAAC,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC,OAAO,CAAC,CAOlH"}

package/dist/wrangler/deploy-stage.js

@@ -1,5 +1,4 @@
 import { randomUUID } from 'node:crypto';
-import { existsSync, readFileSync } from 'node:fs';
 import { readFile, rm, writeFile } from 'node:fs/promises';
 import { dirname, join } from 'node:path';
 import { parseJsonFileText } from '../lib/json.js';
@@ -7,8 +6,8 @@ import { mergeEnv, printCommandOutput } from '../lib/run.js';
 import { CloudflareRestClient } from './cloudflare.js';
 import { parseFlatWranglerConfig, planFlatStageResources } from './flat-config.js';
 import { awaitLiveVersion, awaitVersionEndpoint, currentDeploymentVersionId, findVersionIdByTag, liveVersionCacheDirectory, writeCachedLiveVersion, } from './live-version.js';
-import { parseDevVarsExample } from './prepare-env.js';
 import { derivePullRequestStageConfig, derivePullRequestWranglerConfig, hasExactStageSegment, isPullRequestStage, parseDeploymentStage, planConfiguredStageResources, planPullRequestBindings, planPullRequestResources, pullRequestStage, } from './stage.js';
+import { planStageSecrets, readDeclaredSecretNames, readSecretStageMap, stageSecretRefusal, } from './stage-secrets.js';
 /** The child environment `options` describe; every runner, test doubles included, spawns with exactly this. */
 export function childEnvironment(options) {
     return mergeEnv(options.env, options.unsetEnv);
@@ -40,21 +39,26 @@ export async function deployStage(cwd, options, dependencies = {}) {
     const cloudflare = dependencies.cloudflare ??
         new CloudflareRestClient(accountId, requiredEnvironmentValue(apiToken, 'CLOUDFLARE_API_TOKEN'));
     const runner = dependencies.runner ?? new BunProcessRunner();
-    const secretNames = readSecretNames(cwd);
+    const secretPlan = planStageSecrets(readDeclaredSecretNames(cwd), stage, readSecretStageMap(cwd));
+    // Only the stage's own secrets, and only the ones a value exists for. A secret scoped to other
+    // stages is dropped here even when this shell exports it: that is the whole permission rule.
     const secretValues = {};
-    for (const name of secretNames) {
+    for (const name of secretPlan.required) {
         const value = processEnv[name];
         if (value)
             secretValues[name] = value;
     }
-    const missingSecrets = secretNames.filter((name) => !processEnv[name]);
+    const gate = stageSecretGate(secretPlan, new Set(Object.keys(secretValues)), cloudflare);
     let temporaryConfigPath;
     let temporarySecretsPath;
     try {
         const prepared = options.config
-            ? await prepareFlatConfig(options.config, stage, accountId, missingSecrets, cloudflare)
-            : await prepareTomlConfig(cwd, stage, accountId, missingSecrets, cloudflare);
+            ? await prepareFlatConfig(options.config, stage, accountId, gate, cloudflare)
+            : await prepareTomlConfig(cwd, stage, accountId, gate, cloudflare);
         temporaryConfigPath = prepared.temporaryConfigPath;
+        // The pull-request path already ran this before provisioning; the gate answers once per Worker.
+        // Everything below here writes to Cloudflare.
+        await gate(prepared.plan.workerName);
         const workerExists = await reconcileStageResources(prepared.plan, cloudflare);
         const versionTag = nxTaskVersionTag(processEnv);
         const envArgs = prepared.envFlag ? ['--env', prepared.envFlag] : [];
@@ -62,7 +66,13 @@ export async function deployStage(cwd, options, dependencies = {}) {
         // renames the worker `<name>-<CLOUDFLARE_ENV>`. The build that produced the flat config is the
         // caller that sets the variable, so the deploy would silently succeed under a name neither
         // `reconcileStageResources` nor `versions list` looks at.
-        const run = prepared.envFlag ? { cwd } : { cwd, unsetEnv: ['CLOUDFLARE_ENV'] };
+        //
+        // A secret this stage is scoped out of goes with it. Leaving it out of the secrets payload is
+        // what stops it being installed; withholding it from the child as well means the deploy cannot
+        // read it at all, so "this stage never sees that capability" holds at the process boundary and
+        // not merely in the file we happen to write.
+        const unsetEnv = [...(prepared.envFlag ? [] : ['CLOUDFLARE_ENV']), ...secretPlan.withheld];
+        const run = unsetEnv.length > 0 ? { cwd, unsetEnv } : { cwd };
         const workerName = prepared.plan.workerName;
         const probe = {
             deployments: () => wranglerJson(runner, ['deployments', 'status', '--name', workerName, '--json'], run),
@@ -126,7 +136,7 @@ export async function deployStage(cwd, options, dependencies = {}) {
         }
     }
 }
-async function prepareTomlConfig(cwd, stage, accountId, missingSecrets, cloudflare) {
+async function prepareTomlConfig(cwd, stage, accountId, gate, cloudflare) {
     const committedConfigPath = join(cwd, 'wrangler.toml');
     const committedToml = await readFile(committedConfigPath, 'utf8');
     if (!isPullRequestStage(stage)) {
@@ -139,7 +149,7 @@ async function prepareTomlConfig(cwd, stage, accountId, missingSecrets, cloudfla
     }
     const liveNamespaces = await cloudflare.listKvNamespaces();
     const plan = planPullRequestResources(committedToml, stage, liveNamespaces);
-    const { kvNamespaceIds, d1DatabaseIds } = await provisionPullRequestResources(plan, missingSecrets, cloudflare, liveNamespaces);
+    const { kvNamespaceIds, d1DatabaseIds } = await provisionPullRequestResources(plan, gate, cloudflare, liveNamespaces);
     const derivedToml = derivePullRequestWranglerConfig(committedToml, {
         stage,
         accountId,
@@ -156,7 +166,7 @@ async function prepareTomlConfig(cwd, stage, accountId, missingSecrets, cloudfla
         envFlag: stage,
     };
 }
-async function prepareFlatConfig(configPath, stage, accountId, missingSecrets, cloudflare) {
+async function prepareFlatConfig(configPath, stage, accountId, gate, cloudflare) {
     const flat = parseJsonFileText(configPath, await readFile(configPath, 'utf8'), parseFlatWranglerConfig);
     if (!isPullRequestStage(stage)) {
         return {
@@ -167,7 +177,7 @@ async function prepareFlatConfig(configPath, stage, accountId, missingSecrets, c
     }
     const liveNamespaces = await cloudflare.listKvNamespaces();
     const plan = planPullRequestBindings(flat, stage, liveNamespaces);
-    const { kvNamespaceIds, d1DatabaseIds } = await provisionPullRequestResources(plan, missingSecrets, cloudflare, liveNamespaces);
+    const { kvNamespaceIds, d1DatabaseIds } = await provisionPullRequestResources(plan, gate, cloudflare, liveNamespaces);
     const derived = derivePullRequestStageConfig(flat, { stage, accountId, kvNamespaceIds, d1DatabaseIds });
     // Beside the original: its main/assets/migrations paths are relative to the file.
     const temporaryConfigPath = join(dirname(configPath), `.wrangler.smoo-${process.pid}-${randomUUID()}.json`);
@@ -199,15 +209,35 @@ function migrationBindings(config) {
         .filter((database) => typeof database.migrations_dir === 'string')
         .map((database) => database.binding);
 }
-async function refuseFirstDeploymentWithoutSecrets(cloudflare, workerName, missingSecrets) {
-    const firstDeployment = !(await cloudflare.listWorkerScripts()).some((script) => script.id === workerName);
-    if (firstDeployment && missingSecrets.length > 0) {
-        throw new Error(`First deployment of ${workerName} requires process environment values for: ${missingSecrets.join(', ')}.`);
-    }
+/**
+ * One answer per Worker, reused by both call sites so the read costs one round trip.
+ *
+ * What the Worker holds comes from the account's script listing first. A Worker absent from it
+ * holds nothing — exactly the first-deployment case — and Cloudflare answers 404 rather than an
+ * empty list when asked for a missing Worker's secrets. Reading that failure as "then nothing is
+ * needed" would disarm the check at the one moment it matters most, so it is never asked.
+ */
+function stageSecretGate(plan, exported, cloudflare) {
+    const answered = new Map();
+    return (workerName) => {
+        let pending = answered.get(workerName);
+        if (!pending) {
+            pending = assertStageSecrets(plan, exported, cloudflare, workerName);
+            answered.set(workerName, pending);
+        }
+        return pending;
+    };
 }
-/** Isolation refusals already ran in the plan; this is the first Cloudflare write. */
-async function provisionPullRequestResources(plan, missingSecrets, cloudflare, liveNamespaces) {
-    await refuseFirstDeploymentWithoutSecrets(cloudflare, plan.workerName, missingSecrets);
+async function assertStageSecrets(plan, exported, cloudflare, workerName) {
+    const live = (await cloudflare.listWorkerScripts()).some((script) => script.id === workerName);
+    const held = new Set(live ? await cloudflare.listWorkerSecrets(workerName) : []);
+    const refusal = stageSecretRefusal(plan, exported, held, workerName);
+    if (refusal)
+        throw new Error(refusal);
+}
+/** Isolation refusals already ran in the plan; the gate below is the last one before the first write. */
+async function provisionPullRequestResources(plan, gate, cloudflare, liveNamespaces) {
+    await gate(plan.workerName);
     const kvNamespaceIds = await ensureKvNamespaces(plan.kvNamespaces, liveNamespaces, cloudflare);
     const d1DatabaseIds = plan.d1Databases.length === 0
         ? new Map()
@@ -495,7 +525,3 @@ function requiredEnvironmentValue(value, name) {
         throw new Error(`${name} is required.`);
     return value;
 }
-function readSecretNames(cwd) {
-    const path = join(cwd, '.dev.vars.example');
-    return existsSync(path) ? parseDevVarsExample(readFileSync(path, 'utf8')) : [];
-}