@smoothbricks/cli 0.11.19 → 0.11.21

package/src/secrets/status.ts

@@ -0,0 +1,297 @@
+/**
+ * The value model behind `smoo secrets`: one row per secret name, reconciled
+ * from every source that has an opinion about it, plus the machine-readable
+ * document `smoo secrets status --json` emits.
+ *
+ * Everything here is pure and depends on nothing but typia, which is what lets
+ * `@smoothbricks/cli/secrets` be imported for the types alone — a consumer
+ * driving a UI or a repository's own operations CLI gets the document type and
+ * a validator without pulling in `gh`, the filesystem readers, or commander.
+ * The readers that produce these facts live in ./index.ts; the operator
+ * commands that print them live in ./commands.ts.
+ */
+
+import typia from 'typia';
+import type { SecretStageMap, SecretStageScope } from '../wrangler/stage-secrets.js';
+
+export type { SecretStageScope };
+
+/** Where an env name is described, which repository secret carries it, and whether that exists. */
+export interface SecretRow {
+  name: string;
+  /** The repository secret this env name reads from, by convention or declaration. */
+  repositorySecret: string;
+  /** Wrangler projects whose `.dev.vars.example` declares it. */
+  declaredByWorkers: string[];
+  /** True when a managed workflow renders `secrets.<name>` into a job. */
+  suppliedByWorkflow: boolean;
+  /** True when `smoo.secrets` can fetch it for a developer shell; equivalently, `localGroup` is set. */
+  fetchableLocally: boolean;
+  /**
+   * How `smoo.secrets` resolves it locally: the group that resolves it, and
+   * the group this repository's own declarations derive. They differ exactly
+   * when the entry overrides the derivation, which is the one thing a reader
+   * must never have to infer. Absent when nothing fetches the name locally.
+   */
+  localGroup?: { resolves: string; derived: string };
+  /** True when the repository holds a secret of this name. */
+  onRepository: boolean;
+  /**
+   * GitHub Environments holding their own value for this name. A job bound to
+   * an environment reads that value in preference to the repository's, which
+   * is how one name carries test credentials on a preview stage and live ones
+   * in production.
+   */
+  heldByEnvironment: string[];
+}
+
+/**
+ * One `smoo.secrets` entry as the reconciliation needs it: the name, the
+ * group that resolves it, and the group this repository's declarations
+ * derive. ../secrets/resolver.ts produces these from the same file shell
+ * entry routes with.
+ */
+export interface LocalSecret {
+  name: string;
+  group: string;
+  derivedGroup: string;
+}
+
+export interface SecretSources {
+  /** Worker label -> env names it declares. */
+  workerSecrets: Record<string, readonly string[]>;
+  /** Env names a managed workflow passes into a job. */
+  workflowSecrets: readonly string[];
+  /** Env name -> repository secret, by convention with declared exceptions. */
+  secretNames: Readonly<Record<string, string>>;
+  /** Every `smoo.secrets` entry with the group that resolves it. */
+  localSecrets: readonly LocalSecret[];
+  /** Repository secret names GitHub currently holds. */
+  repositorySecrets: readonly string[];
+  /** Environment name -> secret names that environment holds. */
+  environmentSecrets?: Readonly<Record<string, readonly string[]>>;
+}
+
+/**
+ * One row per name known to any source, sorted, so a reader sees the whole
+ * picture rather than one source's view of it.
+ */
+export function reconcileSecrets(sources: SecretSources): SecretRow[] {
+  const declaredByAnyWorker: string[] = Object.values(sources.workerSecrets).flatMap((names) => [...names]);
+  const localSecrets = new Map(sources.localSecrets.map((secret) => [secret.name, secret]));
+  const names = new Set<string>([...declaredByAnyWorker, ...sources.workflowSecrets, ...localSecrets.keys()]);
+  // A repository secret that already carries a known env name is that name's
+  // row, not a row of its own: listing ACME_GITHUB_CLIENT_SECRET beside
+  // GITHUB_CLIENT_SECRET would report one value as two secrets, one of them
+  // permanently "declared by nothing".
+  const carriesKnownEnvName = new Set(
+    names.size > 0 ? [...names].map((name) => sources.secretNames[name] ?? name) : [],
+  );
+  // A value only an environment holds is still a value: leaving it out of the
+  // rows is how an operator ends up hunting for a secret that is already set.
+  const addUndeclared = (secret: string): void => {
+    if (!carriesKnownEnvName.has(secret)) names.add(secret);
+  };
+  for (const secret of sources.repositorySecrets) addUndeclared(secret);
+  for (const held of Object.values(sources.environmentSecrets ?? {})) {
+    for (const secret of held) addUndeclared(secret);
+  }
+  return [...names]
+    .sort((left, right) => left.localeCompare(right))
+    .map((name) => {
+      const local = localSecrets.get(name);
+      return {
+        name,
+        repositorySecret: sources.secretNames[name] ?? name,
+        declaredByWorkers: Object.entries(sources.workerSecrets)
+          .filter(([, declared]) => declared.includes(name))
+          .map(([label]) => label)
+          .sort((left, right) => left.localeCompare(right)),
+        suppliedByWorkflow: sources.workflowSecrets.includes(name),
+        fetchableLocally: local !== undefined,
+        ...(local === undefined ? {} : { localGroup: { resolves: local.group, derived: local.derivedGroup } }),
+        onRepository: sources.repositorySecrets.includes(sources.secretNames[name] ?? name),
+        heldByEnvironment: Object.entries(sources.environmentSecrets ?? {})
+          .filter(([, held]) => held.includes(sources.secretNames[name] ?? name))
+          .map(([environment]) => environment)
+          .sort((left, right) => left.localeCompare(right)),
+      };
+    });
+}
+
+/**
+ * The rows a CI deploy cannot satisfy: a Worker declares the name, a workflow
+ * promises to pass it, and the repository has no value to pass. Reported
+ * separately from "declared but not wired into any workflow", because the
+ * remedies differ — set a secret, versus declare it in `smoo.github`.
+ */
+export function unsatisfiedSecrets(rows: readonly SecretRow[], boundEnvironments: readonly string[] = []): SecretRow[] {
+  return rows.filter((row) => {
+    if (!row.suppliedByWorkflow) return false;
+    if (row.onRepository) return false;
+    // With no environment bound, the repository is the only scope a job reads.
+    // With environments bound, each one can carry the value instead - so the
+    // name is satisfied only when every bound environment holds it.
+    if (boundEnvironments.length === 0) return true;
+    return !boundEnvironments.every((environment) => row.heldByEnvironment.includes(environment));
+  });
+}
+
+/** Bound environments that lack their own value and cannot fall back to the repository. */
+export function environmentsMissing(row: SecretRow, boundEnvironments: readonly string[]): string[] {
+  if (row.onRepository) return [];
+  return boundEnvironments.filter((environment) => !row.heldByEnvironment.includes(environment));
+}
+
+/** Worker-declared names no managed workflow passes: a CI deploy will run without them. */
+export function unwiredSecrets(rows: readonly SecretRow[]): SecretRow[] {
+  return rows.filter((row) => row.declaredByWorkers.length > 0 && !row.suppliedByWorkflow);
+}
+
+/**
+ * Every stage a scope can name, in the order the document lists them. A
+ * declared secret absent from `smoo.wrangler.secretStages` belongs to all of
+ * them, which is the rule this constant spells out exactly once.
+ */
+const EVERY_STAGE: readonly SecretStageScope[] = ['preview', 'production', 'staging'];
+
+/** The repository the status was read from, and how that repository was chosen. */
+export interface SecretsStatusRepository {
+  /** `owner/name`, the form `gh --repo` takes. */
+  repo: string;
+  /** Why this repository — the checkout fact that decided it, verbatim from the resolver. */
+  source: string;
+  /** How many secrets it holds at repository scope. */
+  secretCount: number;
+}
+
+/**
+ * One GitHub Environment the status looked at. Discriminated on `readable`
+ * because an environment `gh` refused to list is not an empty one: reporting
+ * it as empty would call values missing that may well be set, and the reason
+ * is the only thing that lets an operator tell the two apart.
+ */
+export type SecretsStatusEnvironment =
+  | {
+      name: string;
+      /** True when a managed workflow binds a job to it, so a job reads it before the repository. */
+      bound: boolean;
+      readable: true;
+      secretCount: number;
+    }
+  | {
+      name: string;
+      bound: boolean;
+      readable: false;
+      /** What `gh` said, so nothing below claims what this environment holds. */
+      reason: string;
+    };
+
+/** A reconciled row, plus which deployment stages require the name to have a value. */
+export interface SecretsStatusRow extends SecretRow {
+  /**
+   * Stages that refuse to deploy without a value, from `smoo.wrangler.secretStages`
+   * unioned over every wrangler project declaring the name: absent from the map
+   * means every stage, mapped to `[]` means none. A name no wrangler project
+   * declares is `[]` too — `declaredByWorkers` tells those two apart.
+   */
+  requiredByStages: SecretStageScope[];
+}
+
+/** A name a workflow passes that no scope the job reads can supply: this is what fails a deploy. */
+export interface UnsatisfiedSecret {
+  name: string;
+  repositorySecret: string;
+  /**
+   * Bound environments holding no value for it. Empty means no environment is
+   * bound and the repository itself is the scope to set it in.
+   */
+  missingIn: string[];
+}
+
+/**
+ * Everything `smoo secrets status` learned, in one document.
+ *
+ * `unsatisfied` is the exit code's reason and not a convenience: the rule that
+ * decides whether a value exists in a scope a bound job reads is smoo's, and a
+ * consumer re-deriving it from `secrets` would be maintaining a second copy of
+ * it.
+ */
+export interface SecretsStatusDocument {
+  /** Document shape, so a consumer refuses a document it does not understand instead of misreading it. */
+  version: 1;
+  repository: SecretsStatusRepository;
+  /** Every environment looked at: those the workflows bind, then any asked for with `--env`. */
+  environments: SecretsStatusEnvironment[];
+  /** One row per name any source knows, sorted by name. */
+  secrets: SecretsStatusRow[];
+  /** Empty exactly when the command exits 0. */
+  unsatisfied: UnsatisfiedSecret[];
+}
+
+/** The facts a document is projected from, all gathered before anything is printed. */
+export interface SecretsStatusFacts {
+  repository: SecretsStatusRepository;
+  environments: readonly SecretsStatusEnvironment[];
+  rows: readonly SecretRow[];
+  /** Worker label -> its `smoo.wrangler.secretStages` declaration; a worker with no block is absent. */
+  stageScopes: Readonly<Record<string, SecretStageMap>>;
+}
+
+/**
+ * The stages that require a value for one name: the union over every worker
+ * declaring it, since a name two projects share must exist wherever either of
+ * them deploys.
+ */
+function requiredByStages(
+  name: string,
+  workers: readonly string[],
+  stageScopes: Readonly<Record<string, SecretStageMap>>,
+): SecretStageScope[] {
+  const required = new Set<SecretStageScope>();
+  for (const worker of workers) {
+    const scoped = stageScopes[worker]?.[name];
+    // No scope declared for a name the worker declares is "every stage": the
+    // map is an exception list, not a registry.
+    for (const stage of scoped ?? EVERY_STAGE) required.add(stage);
+  }
+  return EVERY_STAGE.filter((stage) => required.has(stage));
+}
+
+/** The document, from facts. Pure: every read happened before this was called. */
+export function projectSecretsStatus(facts: SecretsStatusFacts): SecretsStatusDocument {
+  const secrets: SecretsStatusRow[] = facts.rows.map((row) => ({
+    ...row,
+    requiredByStages: requiredByStages(row.name, row.declaredByWorkers, facts.stageScopes),
+  }));
+  // Only an environment a workflow binds *and* `gh` could list is a scope a job
+  // is known to read: an unreadable one is unknown, not empty.
+  const bound = facts.environments
+    .filter((environment) => environment.bound && environment.readable)
+    .map((environment) => environment.name);
+  return {
+    version: 1,
+    repository: facts.repository,
+    environments: [...facts.environments],
+    secrets,
+    unsatisfied: unsatisfiedSecrets(secrets, bound).map((row) => ({
+      name: row.name,
+      repositorySecret: row.repositorySecret,
+      missingIn: environmentsMissing(row, bound),
+    })),
+  };
+}
+
+/**
+ * The consumer's boundary: text off a `smoo secrets status --json` run into a
+ * validated document, or typia's own account of every field that disagreed.
+ */
+export const parseSecretsStatusDocument = typia.json.createValidateParse<SecretsStatusDocument>();
+
+/**
+ * The emitter's boundary: the projection is checked against its declared type
+ * before it becomes text. A shape bug then fails here, naming the field, rather
+ * than reaching a consumer as a document its validator rejects with no idea who
+ * produced it.
+ */
+export const stringifySecretsStatusDocument = typia.json.createAssertStringify<SecretsStatusDocument>();

package/src/wrangler/deploy-stage.test.ts

@@ -1120,6 +1120,99 @@ describe('writeTemporaryConfig', () => {
   });
 });
 
+// The same project as FIXTURE/ROUTED_FIXTURE, in the format Cloudflare now recommends. The
+// deploy has to reach the same worker, the same routes and the same derived stage from it.
+const JSONC_FIXTURE = `{
+  // A worker whose stages are derived, written as JSONC.
+  "env": {
+    "staging": {
+      "name": "fixture-worker-staging",
+      "workers_dev": false,
+      "routes": [{ "pattern": "*.staging.example.test/*", "zone_name": "example.test" }],
+      "vars": { "ENVIRONMENT": "staging" },
+    },
+  },
+}
+`;
+
+describe('deployStage with a JSONC source config', () => {
+  it('deploys staging from wrangler.jsonc itself, with --env and no temporary file', async () => {
+    const root = await fixtureRoot(JSONC_FIXTURE, 'wrangler.jsonc');
+    const runner = new FakeRunner();
+    const cloudflare = new FakeCloudflare();
+    cloudflare.scripts = [{ id: 'fixture-worker-staging' }];
+    cloudflare.zones = [{ id: 'zone-1', name: 'example.test' }];
+
+    const result = await deployStage(root, { stage: 'staging' }, dependencies(runner, cloudflare));
+
+    expect(result).toMatchObject({ workerName: 'fixture-worker-staging', action: 'deployed' });
+    const deploy = requiredTestValue(
+      runner.calls.find((call) => call.args[0] === 'deploy'),
+      'deploy call',
+    );
+    expect(deploy.args.slice(0, 5)).toEqual(['deploy', '--config', join(root, 'wrangler.jsonc'), '--env', 'staging']);
+    expect(cloudflare.mutations).toEqual([
+      'create-dns:zone-1:*.staging.example.test:staging.example.test',
+      'create-route:zone-1:*.staging.example.test/*:fixture-worker-staging',
+    ]);
+    expect((await readdir(root)).filter((name) => name.startsWith('.wrangler.smoo-'))).toEqual([]);
+  });
+
+  it('derives a pull-request stage into a temporary JSON config beside the source', async () => {
+    const root = await fixtureRoot(JSONC_FIXTURE, 'wrangler.jsonc');
+    const runner = new FakeRunner();
+    const cloudflare = new FakeCloudflare();
+    cloudflare.zones = [{ id: 'zone-1', name: 'example.test' }];
+    let derivedConfig: Record<string, unknown> | undefined;
+    let derivedPath: string | undefined;
+    runner.onCall = async (args) => {
+      if (args[0] !== 'deploy') return;
+      derivedPath = args[args.indexOf('--config') + 1];
+      derivedConfig = JSON.parse(await readFile(derivedPath ?? '', 'utf8'));
+    };
+
+    const result = await deployStage(root, { stage: 'pr123' }, dependencies(runner, cloudflare));
+
+    expect(result).toMatchObject({ workerName: 'fixture-worker-pr123', action: 'deployed' });
+    // Wrangler picks its parser by extension, so the derived config is JSON whatever the source was.
+    expect(derivedPath?.startsWith(join(root, '.wrangler.smoo-'))).toBe(true);
+    expect(derivedPath?.endsWith('.json')).toBe(true);
+    expect(derivedConfig?.env).toEqual({
+      staging: {
+        name: 'fixture-worker-staging',
+        workers_dev: false,
+        routes: [{ pattern: '*.staging.example.test/*', zone_name: 'example.test' }],
+        vars: { ENVIRONMENT: 'staging' },
+      },
+      pr123: {
+        name: 'fixture-worker-pr123',
+        workers_dev: false,
+        routes: [{ pattern: '*.pr123.example.test/*', zone_name: 'example.test' }],
+        vars: { ENVIRONMENT: 'pr123' },
+      },
+    });
+    const deploy = requiredTestValue(
+      runner.calls.find((call) => call.args[0] === 'deploy'),
+      'deploy call',
+    );
+    expect(deploy.args.slice(3, 5)).toEqual(['--env', 'pr123']);
+    // The committed source is never rewritten, and the derived copy does not outlive the deploy.
+    expect(await readFile(join(root, 'wrangler.jsonc'), 'utf8')).toBe(JSONC_FIXTURE);
+    expect((await readdir(root)).filter((name) => name.startsWith('.wrangler.smoo-'))).toEqual([]);
+  });
+
+  it('refuses a project carrying two source configs before it reads either', async () => {
+    const root = await fixtureRoot(JSONC_FIXTURE, 'wrangler.jsonc');
+    await writeFile(join(root, 'wrangler.toml'), FIXTURE);
+    const cloudflare = new FakeCloudflare();
+
+    await expect(deployStage(root, { stage: 'staging' }, dependencies(new FakeRunner(), cloudflare))).rejects.toThrow(
+      `${root} declares more than one Wrangler configuration: wrangler.jsonc, wrangler.toml.`,
+    );
+    expect(cloudflare.mutations).toEqual([]);
+  });
+});
+
 /** Runs `action` with the variables set on this process, restoring the previous values afterwards. */
 async function withProcessEnv<T>(variables: Record<string, string>, action: () => Promise<T>): Promise<T> {
   const previous = Object.fromEntries(Object.keys(variables).map((name) => [name, process.env[name]]));
@@ -1134,10 +1227,10 @@ async function withProcessEnv<T>(variables: Record<string, string>, action: () =
   }
 }
 
-async function fixtureRoot(toml = FIXTURE): Promise<string> {
+async function fixtureRoot(config = FIXTURE, file = 'wrangler.toml'): Promise<string> {
   const root = await mkdtemp(join(tmpdir(), 'smoo-wrangler-test-'));
   roots.push(root);
-  await writeFile(join(root, 'wrangler.toml'), toml);
+  await writeFile(join(root, file), config);
   return root;
 }
 

package/src/wrangler/deploy-stage.ts

@@ -4,7 +4,7 @@ import { dirname, join } from 'node:path';
 import { parseJsonFileText } from '../lib/json.js';
 import { mergeEnv, printCommandOutput } from '../lib/run.js';
 import { type CloudflareClient, CloudflareRestClient, type D1DatabaseRecord } from './cloudflare.js';
-import { type FlatWranglerConfig, parseFlatWranglerConfig, planFlatStageResources } from './flat-config.js';
+import { type FlatWranglerConfig, parseFlatWranglerConfig } from './flat-config.js';
 import {
   awaitLiveVersion,
   awaitVersionEndpoint,
@@ -15,11 +15,12 @@ import {
   type VersionEndpointWaitOptions,
   writeCachedLiveVersion,
 } from './live-version.js';
+import { readWranglerSourceConfig } from './source-config.js';
 import {
   type ConfiguredStageResourcePlan,
   type DeploymentStage,
+  derivePullRequestDocument,
   derivePullRequestStageConfig,
-  derivePullRequestWranglerConfig,
   hasExactStageSegment,
   isPullRequestStage,
   type LiveKvNamespace,
@@ -28,6 +29,7 @@ import {
   planConfiguredStageResources,
   planPullRequestBindings,
   planPullRequestResources,
+  planStageResources,
   pullRequestStage,
 } from './stage.js';
 import {
@@ -99,7 +101,7 @@ export interface DeployStageResult {
 export interface DeployStageOptions {
   /** `staging`, `production`, or `prN`. */
   stage: string;
-  /** A build-generated flat wrangler.json to deploy instead of `./wrangler.toml` (see `prepareFlatConfig`). */
+  /** A build-generated flat wrangler.json to deploy instead of the project's own config (see `prepareFlatConfig`). */
   config?: string;
   /**
    * A URL, served by this worker, whose trimmed body is the running version tag. When given, the
@@ -137,7 +139,7 @@ export async function deployStage(
   try {
     const prepared = options.config
       ? await prepareFlatConfig(options.config, stage, accountId, gate, cloudflare)
-      : await prepareTomlConfig(cwd, stage, accountId, gate, cloudflare);
+      : await prepareSourceConfig(cwd, stage, accountId, gate, cloudflare);
     temporaryConfigPath = prepared.temporaryConfigPath;
     // The pull-request path already ran this before provisioning; the gate answers once per Worker.
     // Everything below here writes to Cloudflare.
@@ -234,44 +236,45 @@ interface PreparedConfig {
   deployConfigPath: string;
   temporaryConfigPath?: string;
   plan: ConfiguredStageResourcePlan;
-  /** D1 bindings whose migrations run before the deploy (flat configs only; TOML deploys keep migrations out of scope). */
+  /** D1 bindings whose migrations run before the deploy (flat configs only; source configs keep migrations out of scope). */
   d1MigrationBindings: string[];
-  /** `--env <stage>` for TOML configs with env blocks; a flat config is already resolved, so no flag. */
+  /** `--env <stage>` for a source config with env blocks; a flat config is already resolved, so no flag. */
   envFlag?: DeploymentStage;
 }
 
-async function prepareTomlConfig(
+/**
+ * The project's own `wrangler.jsonc`/`wrangler.json`/`wrangler.toml`, whichever it declares.
+ * Format stops mattering at `readWranglerSourceConfig`: everything below derives from the model.
+ */
+async function prepareSourceConfig(
   cwd: string,
   stage: DeploymentStage,
   accountId: string,
   gate: SecretGate,
   cloudflare: CloudflareClient,
 ): Promise<PreparedConfig> {
-  const committedConfigPath = join(cwd, 'wrangler.toml');
-  const committedToml = await readFile(committedConfigPath, 'utf8');
+  const source = readWranglerSourceConfig(cwd);
   if (!isPullRequestStage(stage)) {
     return {
-      deployConfigPath: committedConfigPath,
-      plan: planConfiguredStageResources(committedToml, stage),
+      deployConfigPath: source.path,
+      plan: planConfiguredStageResources(source.document, stage),
       d1MigrationBindings: [],
       envFlag: stage,
     };
   }
   const liveNamespaces = await cloudflare.listKvNamespaces();
-  const plan = planPullRequestResources(committedToml, stage, liveNamespaces);
+  const plan = planPullRequestResources(source.document, stage, liveNamespaces);
   const { kvNamespaceIds, d1DatabaseIds } = await provisionPullRequestResources(plan, gate, cloudflare, liveNamespaces);
-  const derivedToml = derivePullRequestWranglerConfig(committedToml, {
-    stage,
-    accountId,
-    kvNamespaceIds,
-    d1DatabaseIds,
-  });
-  const temporaryConfigPath = join(cwd, `.wrangler.smoo-${process.pid}-${randomUUID()}.toml`);
-  await writeTemporaryConfig(temporaryConfigPath, derivedToml);
+  const derived = derivePullRequestDocument(source.document, { stage, accountId, kvNamespaceIds, d1DatabaseIds });
+  // JSON whatever the source format was: wrangler picks its parser by extension, and a file
+  // written to be read once and deleted has no reader for the comments a TOML rewrite preserved.
+  // Beside the original, because its main/assets/migrations paths are relative to the file.
+  const temporaryConfigPath = join(dirname(source.path), `.wrangler.smoo-${process.pid}-${randomUUID()}.json`);
+  await writeTemporaryConfig(temporaryConfigPath, `${JSON.stringify(derived, null, 2)}\n`);
   return {
     deployConfigPath: temporaryConfigPath,
     temporaryConfigPath,
-    plan: planConfiguredStageResources(derivedToml, stage),
+    plan: planConfiguredStageResources(derived, stage),
     d1MigrationBindings: [],
     envFlag: stage,
   };
@@ -288,7 +291,7 @@ async function prepareFlatConfig(
   if (!isPullRequestStage(stage)) {
     return {
       deployConfigPath: configPath,
-      plan: planFlatStageResources(flat, stage),
+      plan: planStageResources(flat, stage),
       d1MigrationBindings: migrationBindings(flat),
     };
   }
@@ -302,7 +305,7 @@ async function prepareFlatConfig(
   return {
     deployConfigPath: temporaryConfigPath,
     temporaryConfigPath,
-    plan: planFlatStageResources(derived, stage),
+    plan: planStageResources(derived, stage),
     d1MigrationBindings: migrationBindings(derived),
   };
 }

package/src/wrangler/deployed-version.ts

@@ -4,12 +4,10 @@
 // Cloudflare. It never provisions, never derives a pull-request stage's resources, and never
 // writes anything except its own cache entry.
 
-import { existsSync } from 'node:fs';
 import { readFile } from 'node:fs/promises';
-import { join } from 'node:path';
 import { parseJsonFileText } from '../lib/json.js';
 import { BunProcessRunner, type ProcessRunner, type ProcessRunOptions, wranglerJson } from './deploy-stage.js';
-import { parseFlatWranglerConfig, planFlatStageResources } from './flat-config.js';
+import { parseFlatWranglerConfig } from './flat-config.js';
 import {
   LIVE_VERSION_CACHE_TTL_MS,
   type LiveVersionProbe,
@@ -18,11 +16,13 @@ import {
   readLiveVersion,
   writeCachedLiveVersion,
 } from './live-version.js';
+import { readWranglerSourceConfig } from './source-config.js';
 import {
   type DeploymentStage,
   isPullRequestStage,
   parseDeploymentStage,
   planConfiguredStageResources,
+  planStageResources,
   stageResourceName,
   stagingWorkerBaseName,
 } from './stage.js';
@@ -64,16 +64,12 @@ export async function stageWorkerName(cwd: string, stage: DeploymentStage, confi
     const flat = parseJsonFileText(configPath, await readFile(configPath, 'utf8'), parseFlatWranglerConfig);
     return isPullRequestStage(stage)
       ? stageResourceName(stagingWorkerBaseName(flat.name), stage)
-      : planFlatStageResources(flat, stage).workerName;
+      : planStageResources(flat, stage).workerName;
   }
-  const tomlPath = join(cwd, 'wrangler.toml');
-  if (!existsSync(tomlPath)) {
-    throw new Error(`${tomlPath} does not exist; pass --config for a build-generated flat configuration.`);
-  }
-  const toml = await readFile(tomlPath, 'utf8');
+  const { document } = readWranglerSourceConfig(cwd);
   return isPullRequestStage(stage)
-    ? stageResourceName(stagingWorkerBaseName(planConfiguredStageResources(toml, 'staging').workerName), stage)
-    : planConfiguredStageResources(toml, stage).workerName;
+    ? stageResourceName(stagingWorkerBaseName(planConfiguredStageResources(document, 'staging').workerName), stage)
+    : planConfiguredStageResources(document, stage).workerName;
 }
 
 /**

package/src/wrangler/flat-config.test.ts

@@ -1,6 +1,11 @@
 import { describe, expect, it } from 'bun:test';
-import { type FlatWranglerConfig, parseFlatWranglerConfig, planFlatStageResources } from './flat-config.js';
-import { type DerivePullRequestConfigOptions, derivePullRequestStageConfig, planPullRequestBindings } from './stage.js';
+import { type FlatWranglerConfig, parseFlatWranglerConfig } from './flat-config.js';
+import {
+  type DerivePullRequestConfigOptions,
+  derivePullRequestStageConfig,
+  planPullRequestBindings,
+  planStageResources,
+} from './stage.js';
 
 // The shape the Cloudflare Vite adapter emits for a site built with
 // CLOUDFLARE_ENV=staging: one flat document, ids already resolved.
@@ -181,9 +186,9 @@ describe('derivePullRequestStageConfig for a flat config', () => {
   });
 });
 
-describe('planFlatStageResources', () => {
+describe('planStageResources', () => {
   it('reads the bindings a reconcile needs from a flat config', () => {
-    const plan = planFlatStageResources(CONFIG, 'staging');
+    const plan = planStageResources(CONFIG, 'staging');
     expect(plan.workerName).toBe('site-preview-staging');
     expect(plan.kvNamespaces).toEqual([{ binding: 'SESSION', id: 'kv-staging' }]);
     expect(plan.r2Buckets).toEqual([{ binding: 'MEDIA', bucketName: 'site-media-staging' }]);

package/src/wrangler/flat-config.ts

@@ -1,6 +1,6 @@
 import typia from 'typia';
 import { formatValidationErrors } from '../lib/json.js';
-import type { ConfiguredStageResourcePlan, DeploymentStage, StageConfigFields } from './stage.js';
+import type { StageConfigFields } from './stage.js';
 
 /**
  * A Wrangler configuration with no `env` blocks: the shape build tools emit
@@ -11,7 +11,6 @@ import type { ConfiguredStageResourcePlan, DeploymentStage, StageConfigFields }
  */
 export interface FlatWranglerConfig extends StageConfigFields {
   env?: unknown;
-  [key: string]: unknown;
 }
 
 const parseFlatWranglerConfigText = typia.json.createValidateParse<FlatWranglerConfig>();
@@ -27,21 +26,3 @@ export function parseFlatWranglerConfig(json: string): FlatWranglerConfig {
   }
   return result.data;
 }
-
-/** The reconcile plan (`reconcileStageResources`) read off a flat config for any stage. */
-export function planFlatStageResources(
-  config: FlatWranglerConfig,
-  stage: DeploymentStage,
-): ConfiguredStageResourcePlan {
-  return {
-    stage,
-    workerName: config.name,
-    kvNamespaces: (config.kv_namespaces ?? []).map(({ binding, id }) => ({ binding, id })),
-    r2Buckets: (config.r2_buckets ?? []).map((bucket) => ({ binding: bucket.binding, bucketName: bucket.bucket_name })),
-    routes: (config.routes ?? []).map((route) => ({
-      pattern: route.pattern,
-      ...(typeof route.zone_name === 'string' ? { zoneName: route.zone_name } : {}),
-      customDomain: route.custom_domain === true,
-    })),
-  };
-}