@smoothbricks/cli 0.11.17 → 0.11.19

package/dist/secrets/repository.js

@@ -0,0 +1,145 @@
+/**
+ * Which GitHub repository `smoo secrets` reads and writes.
+ *
+ * `gh` refuses on a checkout with more than one remote ("multiple remotes
+ * detected"), which is exactly the public/private mirror layout this CLI's own
+ * users run — so the repository has to be resolved here, from the checkout,
+ * before `gh` is spawned. The current branch's upstream decides it: a branch
+ * that pushes to the private mirror is a branch whose secrets live there. That
+ * is a fact the checkout already records, not a preference to configure.
+ */
+import { spawnSync } from 'node:child_process';
+/** `owner/name` from any git remote URL form, or null when it names no repository. */
+export function repositorySlugFromUrl(url) {
+    const withoutProtocol = url
+        .trim()
+        .replace(/^[a-z+]+:\/\//i, '')
+        .replace(/^[^@/]+@/, '');
+    // A remainder starting with `/` or `.` carries no host, so it is a path on
+    // this machine - a valid git remote, never a GitHub repository.
+    if (withoutProtocol.startsWith('/') || withoutProtocol.startsWith('.'))
+        return null;
+    const path = withoutProtocol.replace(/^[^/:]+(?::\d+)?[/:]/, '');
+    const segments = path
+        .replace(/\.git$/i, '')
+        .split('/')
+        .filter((segment) => segment.length > 0);
+    if (segments.length < 2)
+        return null;
+    return `${segments[segments.length - 2]}/${segments[segments.length - 1]}`;
+}
+/**
+ * Pure resolution, so the precedence is testable without a checkout.
+ *
+ * A requested value is either a remote name or an `owner/name` slug; naming a
+ * remote is what an operator reaches for first (`-R private-repo`), and
+ * refusing it because it lacks a slash would be pedantry.
+ *
+ * With no request and no upstream - a branch pushed by explicit refspec, which
+ * is how the mirror layout is driven - the remote-tracking refs still record
+ * where this branch has been pushed. One remote carrying it is an answer; two
+ * is a genuine ambiguity worth refusing.
+ */
+export function chooseRepository(inputs) {
+    const { remotes, upstreamRemote, requested } = inputs;
+    const remotesCarryingBranch = inputs.remotesCarryingBranch ?? [];
+    if (requested !== undefined && requested.length > 0) {
+        const url = remotes.get(requested);
+        if (url !== undefined) {
+            const slug = repositorySlugFromUrl(url);
+            if (slug === null)
+                return { ok: false, reason: `remote ${requested} (${url}) names no owner/name` };
+            return { ok: true, choice: { repo: slug, source: `remote ${requested}` } };
+        }
+        if (requested.includes('/'))
+            return { ok: true, choice: { repo: requested, source: 'requested' } };
+        return {
+            ok: false,
+            reason: `${requested} is neither a remote of this checkout nor an owner/name. ` +
+                `Remotes: ${[...remotes.keys()].join(', ') || 'none'}`,
+        };
+    }
+    if (upstreamRemote !== null) {
+        const url = remotes.get(upstreamRemote);
+        const slug = url === undefined ? null : repositorySlugFromUrl(url);
+        if (slug !== null) {
+            return { ok: true, choice: { repo: slug, source: `upstream of the current branch (${upstreamRemote})` } };
+        }
+    }
+    if (remotesCarryingBranch.length === 1) {
+        const name = remotesCarryingBranch[0] ?? '';
+        const url = remotes.get(name);
+        const slug = url === undefined ? null : repositorySlugFromUrl(url);
+        if (slug !== null) {
+            return { ok: true, choice: { repo: slug, source: `the only remote carrying this branch (${name})` } };
+        }
+    }
+    if (remotes.size === 1) {
+        const [name, url] = [...remotes][0];
+        const slug = repositorySlugFromUrl(url);
+        if (slug !== null)
+            return { ok: true, choice: { repo: slug, source: `the only remote (${name})` } };
+    }
+    const origin = remotes.get('origin');
+    const originSlug = origin === undefined ? null : repositorySlugFromUrl(origin);
+    if (originSlug !== null)
+        return { ok: true, choice: { repo: originSlug, source: 'remote origin' } };
+    const candidates = [...remotes].map(([name, url]) => `${name} -> ${repositorySlugFromUrl(url) ?? url}`).join(', ');
+    const branchClause = inputs.branch === undefined || inputs.branch === null
+        ? 'this checkout has no current branch'
+        : `branch ${inputs.branch} has no upstream and no remote carries it`;
+    return {
+        ok: false,
+        reason: `${branchClause}, and there is no origin, so the repository is ambiguous. ` +
+            `Pass -R with one of: ${candidates || 'no remotes at all'}`,
+    };
+}
+function git(root, args) {
+    const result = spawnSync('git', [...args], { cwd: root, encoding: 'utf8' });
+    return result.status === 0 ? result.stdout.trim() : null;
+}
+/** Remote name -> URL, in config order. */
+export function readRemotes(root) {
+    const remotes = new Map();
+    const config = git(root, ['config', '--get-regexp', '^remote\\..*\\.url']);
+    if (config === null)
+        return remotes;
+    for (const line of config.split('\n')) {
+        const match = /^remote\.(.+)\.url\s+(.+)$/.exec(line.trim());
+        if (match !== null && match[1] !== undefined && match[2] !== undefined)
+            remotes.set(match[1], match[2]);
+    }
+    return remotes;
+}
+/** Remotes with a remote-tracking ref for the current branch: where it has been pushed. */
+export function readRemotesCarryingBranch(root, remotes) {
+    const branch = git(root, ['rev-parse', '--abbrev-ref', 'HEAD']);
+    if (branch === null || branch === 'HEAD')
+        return [];
+    const carrying = [];
+    for (const name of remotes.keys()) {
+        if (git(root, ['rev-parse', '--verify', '--quiet', `refs/remotes/${name}/${branch}`]) !== null) {
+            carrying.push(name);
+        }
+    }
+    return carrying;
+}
+/** The remote the current branch tracks, or null when it tracks nothing. */
+export function readUpstreamRemote(root) {
+    const branch = git(root, ['rev-parse', '--abbrev-ref', 'HEAD']);
+    if (branch === null || branch === 'HEAD')
+        return null;
+    return git(root, ['config', '--get', `branch.${branch}.remote`]);
+}
+/** The repository to operate on, resolved from the checkout. */
+export function resolveRepository(root, requested) {
+    const remotes = readRemotes(root);
+    const branch = git(root, ['rev-parse', '--abbrev-ref', 'HEAD']);
+    return chooseRepository({
+        remotes,
+        upstreamRemote: readUpstreamRemote(root),
+        remotesCarryingBranch: readRemotesCarryingBranch(root, remotes),
+        branch: branch === 'HEAD' ? null : branch,
+        requested,
+    });
+}

package/dist/wrangler/cloudflare.d.ts

@@ -5,6 +5,10 @@ export interface R2Bucket {
 export interface WorkerScript {
     id: string;
 }
+/** One secret bound to a Worker. Cloudflare answers names and types only; a value is never readable. */
+export interface WorkerSecret {
+    name: string;
+}
 export interface WorkerRoute {
     id: string;
     pattern: string;
@@ -40,6 +44,8 @@ export interface CloudflareClient {
     deleteR2Object(bucket: string, key: string): Promise<void>;
     deleteR2Bucket(name: string): Promise<void>;
     listWorkerScripts(): Promise<WorkerScript[]>;
+    /** Names only; the Worker's stored values are write-only from outside. */
+    listWorkerSecrets(workerName: string): Promise<string[]>;
     deleteWorkerScript(name: string): Promise<void>;
     listWorkerDomains(): Promise<WorkerDomain[]>;
     createWorkerDomain(hostname: string, workerName: string, zoneId: string): Promise<void>;
@@ -75,6 +81,7 @@ export declare class CloudflareRestClient implements CloudflareClient {
     deleteR2Object(bucket: string, key: string): Promise<void>;
     deleteR2Bucket(name: string): Promise<void>;
     listWorkerScripts(): Promise<WorkerScript[]>;
+    listWorkerSecrets(workerName: string): Promise<string[]>;
     deleteWorkerScript(name: string): Promise<void>;
     listWorkerDomains(): Promise<WorkerDomain[]>;
     createWorkerDomain(hostname: string, workerName: string, zoneId: string): Promise<void>;

package/dist/wrangler/cloudflare.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cloudflare.d.ts","sourceRoot":"","sources":["../../src/wrangler/cloudflare.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,gBAAgB;IAC/B,gBAAgB,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IAC/C,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAC3D,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,aAAa,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IACrC,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACjD,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,iBAAiB,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAC7C,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,iBAAiB,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAC7C,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxF,kBAAkB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,SAAS,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IACvC,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IACzD,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtF,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IACrD,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9E,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE,eAAe,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAC/C,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC1D,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/C;AA6ED,qBAAa,kBAAmB,SAAQ,KAAK;IAGzC,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE;IAH1B,YACE,OAAO,EAAE,MAAM,EACN,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EAAE,EAGzB;CACF;AAED,KAAK,iBAAiB,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAElF,qBAAa,oBAAqB,YAAW,gBAAgB;IAKzD,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAL1B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IAErC,YACE,SAAS,EAAE,MAAM,EACA,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,iBAAyB,EAMpD;IAED,gBAAgB,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC,CAE7C;IAEK,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAS/D;IAED,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE3C;IAED,aAAa,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC,CAMnC;IAED,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE1C;IAEK,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAMrD;IAED,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAMzD;IAED,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE1C;IAED,iBAAiB,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC,CAG3C;IAED,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE9C;IAED,iBAAiB,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC,CAE3C;IAED,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAKtF;IAED,kBAAkB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE5C;IAED,SAAS,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC,CAErC;IAED,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAGvD;IAED,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAKpF;IAED,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAIhE;IAED,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAEnD;IAED,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAK5E;IAED,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAI/D;IAED,eAAe,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAE7C;IAEK,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAS9D;IAED,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE5C;IAED,6DAA6D;YAC/C,QAAQ;YAQR,SAAS;YAkBT,UAAU;IAgCxB,yFAAyF;YAC3E,OAAO;IAQrB;;;;OAIG;YACW,MAAM;YAMN,IAAI;CAWnB"}
+{"version":3,"file":"cloudflare.d.ts","sourceRoot":"","sources":["../../src/wrangler/cloudflare.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAElD,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,wGAAwG;AACxG,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,SAAS;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,gBAAgB;IAC/B,gBAAgB,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IAC/C,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IAC3D,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,aAAa,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IACrC,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACjD,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,iBAAiB,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAC7C,0EAA0E;IAC1E,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACzD,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,iBAAiB,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IAC7C,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxF,kBAAkB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,SAAS,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IACvC,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IACzD,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtF,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IACrD,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9E,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE,eAAe,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAC/C,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC1D,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC/C;AA8ED,qBAAa,kBAAmB,SAAQ,KAAK;IAGzC,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE;IAH1B,YACE,OAAO,EAAE,MAAM,EACN,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EAAE,EAGzB;CACF;AAED,KAAK,iBAAiB,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAElF,qBAAa,oBAAqB,YAAW,gBAAgB;IAKzD,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAL1B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAS;IAErC,YACE,SAAS,EAAE,MAAM,EACA,QAAQ,EAAE,MAAM,EAChB,OAAO,GAAE,iBAAyB,EAMpD;IAED,gBAAgB,IAAI,OAAO,CAAC,eAAe,EAAE,CAAC,CAE7C;IAEK,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAS/D;IAED,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE3C;IAED,aAAa,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC,CAMnC;IAED,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE1C;IAEK,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAMrD;IAED,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAMzD;IAED,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE1C;IAED,iBAAiB,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC,CAG3C;IAEK,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAQ7D;IAED,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE9C;IAED,iBAAiB,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC,CAE3C;IAED,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAKtF;IAED,kBAAkB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE5C;IAED,SAAS,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC,CAErC;IAED,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAGvD;IAED,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAKpF;IAED,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAIhE;IAED,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAEnD;IAED,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAK5E;IAED,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAI/D;IAED,eAAe,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAE7C;IAEK,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAS9D;IAED,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE5C;IAED,6DAA6D;YAC/C,QAAQ;YAQR,SAAS;YAkBT,UAAU;IAgCxB,yFAAyF;YAC3E,OAAO;IAQrB;;;;OAIG;YACW,MAAM;YAMN,IAAI;CAWnB"}

package/dist/wrangler/cloudflare.js

@@ -29,6 +29,10 @@ const isWorkerScripts = (() => {
     const _io0 = input => "string" === typeof input.id;
     return input => Array.isArray(input) && input.every(elem => "object" === typeof elem && null !== elem && _io0(elem));
 })();
+const isWorkerSecrets = (() => {
+    const _io0 = input => "string" === typeof input.name;
+    return input => Array.isArray(input) && input.every(elem => "object" === typeof elem && null !== elem && _io0(elem));
+})();
 const isWorkerDomains = (() => {
     const _io0 = input => "string" === typeof input.id && "string" === typeof input.hostname && (undefined === input.service || "string" === typeof input.service);
     return input => Array.isArray(input) && input.every(elem => "object" === typeof elem && null !== elem && _io0(elem));
@@ -158,6 +162,12 @@ export class CloudflareRestClient {
         // `workers/scripts` takes no pagination parameters: the account's scripts arrive in one answer.
         return this.listOnce(`${this.accountPath}/workers/scripts`, isWorkerScripts);
     }
+    async listWorkerSecrets(workerName) {
+        // Unpaginated, like the script listing itself. A Worker that does not exist answers 404 rather
+        // than an empty list, so the caller must establish that the Worker is there before asking.
+        const secrets = await this.listOnce(`${this.accountPath}/workers/scripts/${encodeURIComponent(workerName)}/secrets`, isWorkerSecrets);
+        return secrets.map((secret) => secret.name);
+    }
     deleteWorkerScript(name) {
         return this.mutate(`${this.accountPath}/workers/scripts/${encodeURIComponent(name)}`, { method: 'DELETE' });
     }

package/dist/wrangler/deploy-stage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy-stage.d.ts","sourceRoot":"","sources":["../../src/wrangler/deploy-stage.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,KAAK,gBAAgB,EAA+C,MAAM,iBAAiB,CAAC;AAErG,OAAO,EAOL,KAAK,0BAA0B,EAEhC,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAEL,KAAK,eAAe,EAYrB,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,6GAA6G;IAC7G,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,kHAAkH;IAClH,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;CAC1F;AAED,+GAA+G;AAC/G,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,CAAC,UAAU,CAE9E;AAED,qBAAa,gBAAiB,YAAW,aAAa;IAC9C,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,aAAa,CAAC,CAc7F;CACF;AAED,MAAM,WAAW,2BAA2B;IAC1C,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IAC/B,kFAAkF;IAClF,IAAI,CAAC,EAAE,0BAA0B,CAAC;IAClC,oGAAoG;IACpG,yBAAyB,CAAC,EAAE,MAAM,CAAC;CACpC;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,eAAe,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,UAAU,GAAG,WAAW,GAAG,kBAAkB,CAAC;IACtD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,kBAAkB;IACjC,yCAAyC;IACzC,KAAK,EAAE,MAAM,CAAC;IACd,6GAA6G;IAC7G,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,wBAAsB,WAAW,CAC/B,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,kBAAkB,EAC3B,YAAY,GAAE,2BAAgC,GAC7C,OAAO,CAAC,iBAAiB,CAAC,CAwG5B;AAyFD;;;;GAIG;AACH,iBAAe,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAOhF;AACD,eAAO,MAAM,2BAA2B,6BAAuB,CAAC;AAqFhE,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,KAAK,MAAM,EAAE,CAAC;IACrB,OAAO,EAAE;QACP,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,MAAM,CAAC;QAChB,YAAY,EAAE,MAAM,CAAC;QACrB,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,EAAE,MAAM,CAAC;QACnB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;CACH;AAED,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,EAChB,YAAY,GAAE,2BAAgC,GAC7C,OAAO,CAAC,aAAa,CAAC,CAoFxB;AAwFD,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,GAAG,SAAS,CAgBnF;AAyCD,uGAAuG;AACvG,wBAAsB,YAAY,CAAC,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC,OAAO,CAAC,CAOlH"}
+{"version":3,"file":"deploy-stage.d.ts","sourceRoot":"","sources":["../../src/wrangler/deploy-stage.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,KAAK,gBAAgB,EAA+C,MAAM,iBAAiB,CAAC;AAErG,OAAO,EAOL,KAAK,0BAA0B,EAEhC,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAEL,KAAK,eAAe,EAYrB,MAAM,YAAY,CAAC;AASpB,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,6GAA6G;IAC7G,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,kHAAkH;IAClH,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;CAC1F;AAED,+GAA+G;AAC/G,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,iBAAiB,GAAG,MAAM,CAAC,UAAU,CAE9E;AAED,qBAAa,gBAAiB,YAAW,aAAa;IAC9C,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,aAAa,CAAC,CAc7F;CACF;AAED,MAAM,WAAW,2BAA2B;IAC1C,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,UAAU,CAAC,EAAE,gBAAgB,CAAC;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IAC/B,kFAAkF;IAClF,IAAI,CAAC,EAAE,0BAA0B,CAAC;IAClC,oGAAoG;IACpG,yBAAyB,CAAC,EAAE,MAAM,CAAC;CACpC;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,eAAe,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,UAAU,GAAG,WAAW,GAAG,kBAAkB,CAAC;IACtD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,kBAAkB;IACjC,yCAAyC;IACzC,KAAK,EAAE,MAAM,CAAC;IACd,6GAA6G;IAC7G,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,wBAAsB,WAAW,CAC/B,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,kBAAkB,EAC3B,YAAY,GAAE,2BAAgC,GAC7C,OAAO,CAAC,iBAAiB,CAAC,CAmH5B;AA+ED;;;;GAIG;AACH,iBAAe,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAOhF;AACD,eAAO,MAAM,2BAA2B,6BAAuB,CAAC;AAoHhE,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,KAAK,MAAM,EAAE,CAAC;IACrB,OAAO,EAAE;QACP,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,MAAM,CAAC;QAChB,YAAY,EAAE,MAAM,CAAC;QACrB,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,EAAE,MAAM,CAAC;QACnB,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;CACH;AAED,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,EAChB,YAAY,GAAE,2BAAgC,GAC7C,OAAO,CAAC,aAAa,CAAC,CAoFxB;AAwFD,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,GAAG,SAAS,CAgBnF;AAyCD,uGAAuG;AACvG,wBAAsB,YAAY,CAAC,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,iBAAiB,GAAG,OAAO,CAAC,OAAO,CAAC,CAOlH"}

package/dist/wrangler/deploy-stage.js

@@ -1,5 +1,4 @@
 import { randomUUID } from 'node:crypto';
-import { existsSync, readFileSync } from 'node:fs';
 import { readFile, rm, writeFile } from 'node:fs/promises';
 import { dirname, join } from 'node:path';
 import { parseJsonFileText } from '../lib/json.js';
@@ -7,8 +6,8 @@ import { mergeEnv, printCommandOutput } from '../lib/run.js';
 import { CloudflareRestClient } from './cloudflare.js';
 import { parseFlatWranglerConfig, planFlatStageResources } from './flat-config.js';
 import { awaitLiveVersion, awaitVersionEndpoint, currentDeploymentVersionId, findVersionIdByTag, liveVersionCacheDirectory, writeCachedLiveVersion, } from './live-version.js';
-import { parseDevVarsExample } from './prepare-env.js';
 import { derivePullRequestStageConfig, derivePullRequestWranglerConfig, hasExactStageSegment, isPullRequestStage, parseDeploymentStage, planConfiguredStageResources, planPullRequestBindings, planPullRequestResources, pullRequestStage, } from './stage.js';
+import { planStageSecrets, readDeclaredSecretNames, readSecretStageMap, stageSecretRefusal, } from './stage-secrets.js';
 /** The child environment `options` describe; every runner, test doubles included, spawns with exactly this. */
 export function childEnvironment(options) {
     return mergeEnv(options.env, options.unsetEnv);
@@ -40,21 +39,26 @@ export async function deployStage(cwd, options, dependencies = {}) {
     const cloudflare = dependencies.cloudflare ??
         new CloudflareRestClient(accountId, requiredEnvironmentValue(apiToken, 'CLOUDFLARE_API_TOKEN'));
     const runner = dependencies.runner ?? new BunProcessRunner();
-    const secretNames = readSecretNames(cwd);
+    const secretPlan = planStageSecrets(readDeclaredSecretNames(cwd), stage, readSecretStageMap(cwd));
+    // Only the stage's own secrets, and only the ones a value exists for. A secret scoped to other
+    // stages is dropped here even when this shell exports it: that is the whole permission rule.
     const secretValues = {};
-    for (const name of secretNames) {
+    for (const name of secretPlan.required) {
         const value = processEnv[name];
         if (value)
             secretValues[name] = value;
     }
-    const missingSecrets = secretNames.filter((name) => !processEnv[name]);
+    const gate = stageSecretGate(secretPlan, new Set(Object.keys(secretValues)), cloudflare);
     let temporaryConfigPath;
     let temporarySecretsPath;
     try {
         const prepared = options.config
-            ? await prepareFlatConfig(options.config, stage, accountId, missingSecrets, cloudflare)
-            : await prepareTomlConfig(cwd, stage, accountId, missingSecrets, cloudflare);
+            ? await prepareFlatConfig(options.config, stage, accountId, gate, cloudflare)
+            : await prepareTomlConfig(cwd, stage, accountId, gate, cloudflare);
         temporaryConfigPath = prepared.temporaryConfigPath;
+        // The pull-request path already ran this before provisioning; the gate answers once per Worker.
+        // Everything below here writes to Cloudflare.
+        await gate(prepared.plan.workerName);
         const workerExists = await reconcileStageResources(prepared.plan, cloudflare);
         const versionTag = nxTaskVersionTag(processEnv);
         const envArgs = prepared.envFlag ? ['--env', prepared.envFlag] : [];
@@ -62,7 +66,13 @@ export async function deployStage(cwd, options, dependencies = {}) {
         // renames the worker `<name>-<CLOUDFLARE_ENV>`. The build that produced the flat config is the
         // caller that sets the variable, so the deploy would silently succeed under a name neither
         // `reconcileStageResources` nor `versions list` looks at.
-        const run = prepared.envFlag ? { cwd } : { cwd, unsetEnv: ['CLOUDFLARE_ENV'] };
+        //
+        // A secret this stage is scoped out of goes with it. Leaving it out of the secrets payload is
+        // what stops it being installed; withholding it from the child as well means the deploy cannot
+        // read it at all, so "this stage never sees that capability" holds at the process boundary and
+        // not merely in the file we happen to write.
+        const unsetEnv = [...(prepared.envFlag ? [] : ['CLOUDFLARE_ENV']), ...secretPlan.withheld];
+        const run = unsetEnv.length > 0 ? { cwd, unsetEnv } : { cwd };
         const workerName = prepared.plan.workerName;
         const probe = {
             deployments: () => wranglerJson(runner, ['deployments', 'status', '--name', workerName, '--json'], run),
@@ -126,7 +136,7 @@ export async function deployStage(cwd, options, dependencies = {}) {
         }
     }
 }
-async function prepareTomlConfig(cwd, stage, accountId, missingSecrets, cloudflare) {
+async function prepareTomlConfig(cwd, stage, accountId, gate, cloudflare) {
     const committedConfigPath = join(cwd, 'wrangler.toml');
     const committedToml = await readFile(committedConfigPath, 'utf8');
     if (!isPullRequestStage(stage)) {
@@ -139,7 +149,7 @@ async function prepareTomlConfig(cwd, stage, accountId, missingSecrets, cloudfla
     }
     const liveNamespaces = await cloudflare.listKvNamespaces();
     const plan = planPullRequestResources(committedToml, stage, liveNamespaces);
-    const { kvNamespaceIds, d1DatabaseIds } = await provisionPullRequestResources(plan, missingSecrets, cloudflare, liveNamespaces);
+    const { kvNamespaceIds, d1DatabaseIds } = await provisionPullRequestResources(plan, gate, cloudflare, liveNamespaces);
     const derivedToml = derivePullRequestWranglerConfig(committedToml, {
         stage,
         accountId,
@@ -156,7 +166,7 @@ async function prepareTomlConfig(cwd, stage, accountId, missingSecrets, cloudfla
         envFlag: stage,
     };
 }
-async function prepareFlatConfig(configPath, stage, accountId, missingSecrets, cloudflare) {
+async function prepareFlatConfig(configPath, stage, accountId, gate, cloudflare) {
     const flat = parseJsonFileText(configPath, await readFile(configPath, 'utf8'), parseFlatWranglerConfig);
     if (!isPullRequestStage(stage)) {
         return {
@@ -167,7 +177,7 @@ async function prepareFlatConfig(configPath, stage, accountId, missingSecrets, c
     }
     const liveNamespaces = await cloudflare.listKvNamespaces();
     const plan = planPullRequestBindings(flat, stage, liveNamespaces);
-    const { kvNamespaceIds, d1DatabaseIds } = await provisionPullRequestResources(plan, missingSecrets, cloudflare, liveNamespaces);
+    const { kvNamespaceIds, d1DatabaseIds } = await provisionPullRequestResources(plan, gate, cloudflare, liveNamespaces);
     const derived = derivePullRequestStageConfig(flat, { stage, accountId, kvNamespaceIds, d1DatabaseIds });
     // Beside the original: its main/assets/migrations paths are relative to the file.
     const temporaryConfigPath = join(dirname(configPath), `.wrangler.smoo-${process.pid}-${randomUUID()}.json`);
@@ -199,15 +209,35 @@ function migrationBindings(config) {
         .filter((database) => typeof database.migrations_dir === 'string')
         .map((database) => database.binding);
 }
-async function refuseFirstDeploymentWithoutSecrets(cloudflare, workerName, missingSecrets) {
-    const firstDeployment = !(await cloudflare.listWorkerScripts()).some((script) => script.id === workerName);
-    if (firstDeployment && missingSecrets.length > 0) {
-        throw new Error(`First deployment of ${workerName} requires process environment values for: ${missingSecrets.join(', ')}.`);
-    }
+/**
+ * One answer per Worker, reused by both call sites so the read costs one round trip.
+ *
+ * What the Worker holds comes from the account's script listing first. A Worker absent from it
+ * holds nothing — exactly the first-deployment case — and Cloudflare answers 404 rather than an
+ * empty list when asked for a missing Worker's secrets. Reading that failure as "then nothing is
+ * needed" would disarm the check at the one moment it matters most, so it is never asked.
+ */
+function stageSecretGate(plan, exported, cloudflare) {
+    const answered = new Map();
+    return (workerName) => {
+        let pending = answered.get(workerName);
+        if (!pending) {
+            pending = assertStageSecrets(plan, exported, cloudflare, workerName);
+            answered.set(workerName, pending);
+        }
+        return pending;
+    };
 }
-/** Isolation refusals already ran in the plan; this is the first Cloudflare write. */
-async function provisionPullRequestResources(plan, missingSecrets, cloudflare, liveNamespaces) {
-    await refuseFirstDeploymentWithoutSecrets(cloudflare, plan.workerName, missingSecrets);
+async function assertStageSecrets(plan, exported, cloudflare, workerName) {
+    const live = (await cloudflare.listWorkerScripts()).some((script) => script.id === workerName);
+    const held = new Set(live ? await cloudflare.listWorkerSecrets(workerName) : []);
+    const refusal = stageSecretRefusal(plan, exported, held, workerName);
+    if (refusal)
+        throw new Error(refusal);
+}
+/** Isolation refusals already ran in the plan; the gate below is the last one before the first write. */
+async function provisionPullRequestResources(plan, gate, cloudflare, liveNamespaces) {
+    await gate(plan.workerName);
     const kvNamespaceIds = await ensureKvNamespaces(plan.kvNamespaces, liveNamespaces, cloudflare);
     const d1DatabaseIds = plan.d1Databases.length === 0
         ? new Map()
@@ -495,7 +525,3 @@ function requiredEnvironmentValue(value, name) {
         throw new Error(`${name} is required.`);
     return value;
 }
-function readSecretNames(cwd) {
-    const path = join(cwd, '.dev.vars.example');
-    return existsSync(path) ? parseDevVarsExample(readFileSync(path, 'utf8')) : [];
-}

package/dist/wrangler/stage-secrets.d.ts

@@ -0,0 +1,57 @@
+import { type DeploymentStage } from './stage.js';
+/**
+ * How a declaration names a stage. The fixed stages go by their own name; every `prN` stage is
+ * `preview`, because a scope is written once and pull-request numbers are not knowable in advance.
+ */
+export type SecretStageScope = 'staging' | 'production' | 'preview';
+/**
+ * `smoo.wrangler.secretStages`: a declared secret name mapped to the stages it belongs to. The map
+ * answers two questions with one declaration, and both directions matter:
+ *
+ * - requirement — a stage the secret belongs to refuses to deploy without a value for it;
+ * - permission — a stage the secret does *not* belong to never receives it, however loudly the
+ *   deploying shell exports it. A test-only capability exported by CI for preview stages must not
+ *   ride along into production just because the variable happens to be set.
+ *
+ * A declared name absent from the map belongs to every stage. A name mapped to `[]` belongs to no
+ * stage, which is how a value that exists only for local development is declared.
+ */
+export type SecretStageMap = Record<string, SecretStageScope[]>;
+/** Secret NAMES the project declares. Values live on the Worker; the repo only ever holds the keys. */
+export declare function readDeclaredSecretNames(cwd: string): string[];
+/** `smoo.wrangler.secretStages` from the project's package.json; no file and no block scope nothing. */
+export declare function readSecretStageMap(cwd: string): SecretStageMap;
+/** Which of a project's declared secrets one stage may see, and which belong to other stages. */
+export interface StageSecretPlan {
+    stage: DeploymentStage;
+    /** Declared names this stage requires — and the only ones a deploy of it may carry. */
+    required: string[];
+    /** Declared names scoped to other stages: withheld from this deploy even when a value is exported. */
+    withheld: string[];
+    /** The declaration itself, so a refusal can say why each name is where it is. */
+    scopes: SecretStageMap;
+}
+/**
+ * Splits the declared secrets by whether `stage` is in scope for each.
+ *
+ * A scope on an undeclared name is refused rather than ignored: it is almost always a typo of a
+ * real secret's name, and its effect is the dangerous direction — the misspelt entry scopes
+ * nothing while the real secret, still absent from the map, reaches every stage.
+ */
+export declare function planStageSecrets(declared: string[], stage: DeploymentStage, scopes: SecretStageMap): StageSecretPlan;
+/**
+ * Why this deploy must not proceed, or nothing when it may.
+ *
+ * Two refusals, reported together so one run names every problem:
+ *
+ * - a required secret with no value anywhere. `--secrets-file` applies additively, so a deploy
+ *   that never mentions a secret leaves whatever the Worker already holds — silence that reads as
+ *   success while a secret introduced after the first deploy never arrives, and the code that
+ *   needs it fails at runtime instead of here.
+ * - a withheld secret the Worker already holds. Filtering it out of this deploy's payload cannot
+ *   remove it, so the scope would be nominal rather than enforced until someone deletes it.
+ *
+ * A value is never read, never formatted, and never named beyond its key.
+ */
+export declare function stageSecretRefusal(plan: StageSecretPlan, exported: ReadonlySet<string>, held: ReadonlySet<string>, workerName: string): string | undefined;
+//# sourceMappingURL=stage-secrets.d.ts.map

package/dist/wrangler/stage-secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stage-secrets.d.ts","sourceRoot":"","sources":["../../src/wrangler/stage-secrets.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,KAAK,eAAe,EAAsB,MAAM,YAAY,CAAC;AAEtE;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GAAG,SAAS,GAAG,YAAY,GAAG,SAAS,CAAC;AAEpE;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,EAAE,gBAAgB,EAAE,CAAC,CAAC;AAahE,uGAAuG;AACvG,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAG7D;AAED,wGAAwG;AACxG,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,CAQ9D;AAED,iGAAiG;AACjG,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,eAAe,CAAC;IACvB,uFAAuF;IACvF,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,sGAAsG;IACtG,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,iFAAiF;IACjF,MAAM,EAAE,cAAc,CAAC;CACxB;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,cAAc,GAAG,eAAe,CAsBpH;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,eAAe,EACrB,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,EAC7B,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,EACzB,UAAU,EAAE,MAAM,GACjB,MAAM,GAAG,SAAS,CAsBpB"}

package/dist/wrangler/stage-secrets.js

@@ -0,0 +1,178 @@
+import * as _accessExpressionAsString_1 from "typia/lib/internal/_accessExpressionAsString";
+const __typia_transform__accessExpressionAsString = _accessExpressionAsString_1._accessExpressionAsString;
+import * as _validateReport_1 from "typia/lib/internal/_validateReport";
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import typia from 'typia';
+import { formatValidationErrors, parseJsonFileText } from '../lib/json.js';
+import { parseDevVarsExample } from './prepare-env.js';
+import { isPullRequestStage } from './stage.js';
+const validateWranglerManifest = (() => {
+    const _io0 = input => undefined === input.smoo || "object" === typeof input.smoo && null !== input.smoo && false === Array.isArray(input.smoo) && _io1(input.smoo);
+    const _io1 = input => undefined === input.wrangler || "object" === typeof input.wrangler && null !== input.wrangler && false === Array.isArray(input.wrangler) && _io2(input.wrangler);
+    const _io2 = input => undefined === input.secretStages || "object" === typeof input.secretStages && null !== input.secretStages && false === Array.isArray(input.secretStages) && _io3(input.secretStages);
+    const _io3 = input => Object.keys(input).every(key => {
+        const value = input[key];
+        if (undefined === value)
+            return true;
+        return Array.isArray(value) && value.every(elem => "preview" === elem || "production" === elem || "staging" === elem);
+    });
+    const _vo0 = (input, _path, _exceptionable = true) => [undefined === input.smoo || ("object" === typeof input.smoo && null !== input.smoo && false === Array.isArray(input.smoo) || _report(_exceptionable, {
+            path: _path + ".smoo",
+            expected: "(undefined | { wrangler?: { secretStages?: SecretStageMap | undefined; } | undefined; })",
+            value: input.smoo
+        })) && _vo1(input.smoo, _path + ".smoo", true && _exceptionable) || _report(_exceptionable, {
+            path: _path + ".smoo",
+            expected: "(undefined | { wrangler?: { secretStages?: SecretStageMap | undefined; } | undefined; })",
+            value: input.smoo
+        })].every(flag => flag);
+    const _vo1 = (input, _path, _exceptionable = true) => [undefined === input.wrangler || ("object" === typeof input.wrangler && null !== input.wrangler && false === Array.isArray(input.wrangler) || _report(_exceptionable, {
+            path: _path + ".wrangler",
+            expected: "(undefined | { secretStages?: SecretStageMap | undefined; })",
+            value: input.wrangler
+        })) && _vo2(input.wrangler, _path + ".wrangler", true && _exceptionable) || _report(_exceptionable, {
+            path: _path + ".wrangler",
+            expected: "(undefined | { secretStages?: SecretStageMap | undefined; })",
+            value: input.wrangler
+        })].every(flag => flag);
+    const _vo2 = (input, _path, _exceptionable = true) => [undefined === input.secretStages || ("object" === typeof input.secretStages && null !== input.secretStages && false === Array.isArray(input.secretStages) || _report(_exceptionable, {
+            path: _path + ".secretStages",
+            expected: "(SecretStageMap | undefined)",
+            value: input.secretStages
+        })) && _vo3(input.secretStages, _path + ".secretStages", true && _exceptionable) || _report(_exceptionable, {
+            path: _path + ".secretStages",
+            expected: "(SecretStageMap | undefined)",
+            value: input.secretStages
+        })].every(flag => flag);
+    const _vo3 = (input, _path, _exceptionable = true) => [false === _exceptionable || Object.keys(input).map(key => {
+            const value = input[key];
+            if (undefined === value)
+                return true;
+            return (Array.isArray(value) || _report(_exceptionable, {
+                path: _path + __typia_transform__accessExpressionAsString(key),
+                expected: "Array<SecretStageScope>",
+                value: value
+            })) && value.map((elem, _index2) => "preview" === elem || "production" === elem || "staging" === elem || _report(_exceptionable, {
+                path: _path + __typia_transform__accessExpressionAsString(key) + "[" + _index2 + "]",
+                expected: "(\"preview\" | \"production\" | \"staging\")",
+                value: elem
+            })).every(flag => flag) || _report(_exceptionable, {
+                path: _path + __typia_transform__accessExpressionAsString(key),
+                expected: "Array<SecretStageScope>",
+                value: value
+            });
+        }).every(flag => flag)].every(flag => flag);
+    const __is = input => "object" === typeof input && null !== input && false === Array.isArray(input) && _io0(input);
+    let errors;
+    let _report;
+    const __validate = input => {
+        if (false === __is(input)) {
+            errors = [];
+            _report = _validateReport_1._validateReport(errors);
+            ((input, _path, _exceptionable = true) => ("object" === typeof input && null !== input && false === Array.isArray(input) || _report(true, {
+                path: _path + "",
+                expected: "WranglerPackageManifest",
+                value: input
+            })) && _vo0(input, _path + "", true) || _report(true, {
+                path: _path + "",
+                expected: "WranglerPackageManifest",
+                value: input
+            }))(input, "$input", true);
+            const success = 0 === errors.length;
+            return success ? {
+                success,
+                data: input
+            } : {
+                success,
+                errors,
+                data: input
+            };
+        }
+        return {
+            success: true,
+            data: input
+        };
+    };
+    return input => __validate(JSON.parse(input));
+})();
+/** Secret NAMES the project declares. Values live on the Worker; the repo only ever holds the keys. */
+export function readDeclaredSecretNames(cwd) {
+    const path = join(cwd, '.dev.vars.example');
+    return existsSync(path) ? parseDevVarsExample(readFileSync(path, 'utf8')) : [];
+}
+/** `smoo.wrangler.secretStages` from the project's package.json; no file and no block scope nothing. */
+export function readSecretStageMap(cwd) {
+    const path = join(cwd, 'package.json');
+    if (!existsSync(path))
+        return {};
+    const result = parseJsonFileText(path, readFileSync(path, 'utf8'), validateWranglerManifest);
+    if (!result.success) {
+        throw new Error(`${path} declares an invalid smoo.wrangler block: ${formatValidationErrors(result.errors)}`);
+    }
+    return result.data.smoo?.wrangler?.secretStages ?? {};
+}
+/**
+ * Splits the declared secrets by whether `stage` is in scope for each.
+ *
+ * A scope on an undeclared name is refused rather than ignored: it is almost always a typo of a
+ * real secret's name, and its effect is the dangerous direction — the misspelt entry scopes
+ * nothing while the real secret, still absent from the map, reaches every stage.
+ */
+export function planStageSecrets(declared, stage, scopes) {
+    const declaredNames = new Set(declared);
+    const undeclared = Object.keys(scopes).filter((name) => !declaredNames.has(name));
+    if (undeclared.length > 0) {
+        throw new Error(`smoo.wrangler.secretStages scopes ${undeclared.join(', ')}, which .dev.vars.example does not declare. ` +
+            'A scope on a name no secret has leaves the secret it was meant for unscoped, so that secret reaches every stage.');
+    }
+    // Every `prN` stage answers to one written token: a scope cannot name pull requests in advance.
+    const scope = isPullRequestStage(stage) ? 'preview' : stage;
+    const required = [];
+    const withheld = [];
+    for (const name of declared) {
+        const declaredScope = scopes[name];
+        if (declaredScope === undefined || declaredScope.includes(scope)) {
+            required.push(name);
+        }
+        else {
+            withheld.push(name);
+        }
+    }
+    return { stage, required, withheld, scopes };
+}
+/**
+ * Why this deploy must not proceed, or nothing when it may.
+ *
+ * Two refusals, reported together so one run names every problem:
+ *
+ * - a required secret with no value anywhere. `--secrets-file` applies additively, so a deploy
+ *   that never mentions a secret leaves whatever the Worker already holds — silence that reads as
+ *   success while a secret introduced after the first deploy never arrives, and the code that
+ *   needs it fails at runtime instead of here.
+ * - a withheld secret the Worker already holds. Filtering it out of this deploy's payload cannot
+ *   remove it, so the scope would be nominal rather than enforced until someone deletes it.
+ *
+ * A value is never read, never formatted, and never named beyond its key.
+ */
+export function stageSecretRefusal(plan, exported, held, workerName) {
+    const unavailable = plan.required.filter((name) => !exported.has(name) && !held.has(name));
+    const installed = plan.withheld.filter((name) => held.has(name));
+    if (unavailable.length === 0 && installed.length === 0)
+        return undefined;
+    const lines = [`Refusing to deploy ${workerName} to ${plan.stage}.`];
+    if (unavailable.length > 0) {
+        lines.push(`Stage ${plan.stage} requires these secrets and no value exists for them, neither in this environment nor on the Worker:`, ...unavailable.map((name) => `  ${name} — ${scopeDescription(name, plan.scopes)}`), 'Export each one in the deploying shell before the deploy. Once the Worker exists,', `\`wrangler secret put <NAME> --name ${workerName}\` supplies it too.`);
+    }
+    if (installed.length > 0) {
+        lines.push(`The Worker holds these secrets, which smoo.wrangler.secretStages keeps out of ${plan.stage}:`, ...installed.map((name) => `  ${name} — ${scopeDescription(name, plan.scopes)}`), `Delete each one with \`wrangler secret delete <NAME> --name ${workerName}\`. A deploy of this stage`, 'never sends them, so leaving them installed would keep the scope nominal.');
+    }
+    return lines.join('\n');
+}
+function scopeDescription(name, scopes) {
+    const scope = scopes[name];
+    if (scope === undefined)
+        return 'unscoped, so every stage requires it';
+    if (scope.length === 0)
+        return 'scoped to no stage (local development only)';
+    return `scoped to ${scope.join(', ')}`;
+}

package/managed/raw/tooling/direnv/devenv.smoo.nix

@@ -354,7 +354,15 @@
       export GOFLAGS="''${GOFLAGS:--trimpath}"
       unset GOROOT
       bun "$DEVENV_ROOT/setup-environment.ts" || exit $?
-      export NX_SOCKET_DIR="$DEVENV_RUNTIME/nx"
+      # One socket dir per Nx workspace. DEVENV_RUNTIME is keyed to the devenv
+      # ROOT, so every workspace sharing one devenv - a sibling repository, a
+      # copy-on-write clone, a scratch workspace created inside this shell -
+      # would land on one socket. The first daemon to claim it then refuses
+      # every message from the others ("received a message from a different
+      # workspace"), which reads as a hung Nx in a workspace that did nothing
+      # wrong. Nx's own diagnostic names this exact cause.
+      nx_workspace_root="$(cd "$DEVENV_ROOT/../.." >/dev/null 2>&1 && pwd || printf '%s' "$PWD")"
+      export NX_SOCKET_DIR="$DEVENV_RUNTIME/nx-$(printf '%s' "$nx_workspace_root" | cksum | cut -d' ' -f1)"
       mkdir -p "$NX_SOCKET_DIR"
       ${lib.optionalString pkgs.stdenv.isDarwin ''
         unset CC CXX