@o/scripts 0.16.19 → 0.16.20-canary.1791839822276

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@o/scripts",
-  "version": "0.16.19",
+  "version": "0.16.20-canary.1791839822276",
   "type": "module",
   "main": "./src/cmd.ts",
   "sideEffects": false,
@@ -21,6 +21,7 @@
   },
   "scripts": {
     "lint": "oxlint src",
+    "test": "bun test src",
     "lint:fix": "oxfmt src && oxlint --fix --fix-suggestions src",
     "typecheck": "tko run typecheck"
   },
@@ -29,8 +30,8 @@
   },
   "dependencies": {
     "@clack/prompts": "^0.8.2",
-    "@o/helpers": "0.16.19",
-    "@o/run": "0.16.19",
+    "@o/helpers": "0.16.20-canary.1791839822276",
+    "@o/run": "0.16.20-canary.1791839822276",
     "picocolors": "^1.1.1",
     "@aws-sdk/client-s3": "^3.709.0",
     "fs-extra": "^11.2.0",
@@ -52,6 +53,5 @@
       "optional": true
     }
   },
-  "devDependencies": null,
-  "optionalDependencies": null
+  "releaseSourceCommit": "e7c02e302d6227ce686b136dcb361e5823d58d33"
 }

package/src/ensure-zero-sqlite.ts

@@ -1,31 +1,29 @@
+import { spawnSync } from 'node:child_process'
+
 import { cmd } from './cmd'
 
-const SQLITE_NODE_PATH =
-  'node_modules/@rocicorp/zero-sqlite3/build/Release/better_sqlite3.node'
+await cmd`ensure zero-sqlite3 native module is available`.run(() => {
+  const result = spawnSync(
+    'node',
+    [
+      '--input-type=commonjs',
+      '-e',
+      `const { createRequire } = require('node:module');
+const { resolve } = require('node:path');
+const load = createRequire(resolve('package.json'));
+const Database = load('@rocicorp/zero-sqlite3');
+const database = new Database(':memory:');
+database.close();`,
+    ],
+    { stdio: 'inherit' }
+  )
 
-await cmd`ensure zero-sqlite3 native module is built`.run(async ({ $, fs }) => {
-  if (fs.existsSync(SQLITE_NODE_PATH)) {
-    return
+  if (result.error) {
+    throw result.error
   }
-
-  // bun trustedDependencies doesn't reliably run zero-sqlite3's install script,
-  // so build/fetch the native module ourselves. run the package's OWN install
-  // chain (`npm run install` = `prebuild-install || <binding exists?> ||
-  // node-gyp rebuild`), which prefers the PREBUILT binary and only source-builds
-  // as a last resort. @rocicorp/zero-sqlite3 >=1.1.2 is prebuilt-ONLY — its npm
-  // tarball omits generated headers (e.g. unicode_case_data.h), so a direct
-  // `npm run build-release` (node-gyp) fails; prebuild-install is the supported
-  // path. success is "the binding now exists" (the install chain can exit
-  // non-zero from a failed prebuild-install fallback even when an earlier step
-  // already produced the binding).
-  const result = await $`cd node_modules/@rocicorp/zero-sqlite3 && npm run install`
-    .quiet()
-    .nothrow()
-
-  if (!fs.existsSync(SQLITE_NODE_PATH)) {
-    console.error(
-      'zero-sqlite3 native module unavailable, will fall back to wasm:',
-      result.stderr.toString()
+  if (result.status !== 0) {
+    throw new Error(
+      'zero-sqlite3 native module unavailable; install a compatible prebuilt for the current Node runtime'
     )
   }
 })

package/src/env-update.test.ts

@@ -0,0 +1,72 @@
+import { afterEach, expect, test } from 'bun:test'
+import { execFileSync } from 'node:child_process'
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join, resolve } from 'node:path'
+
+const script = resolve(import.meta.dir, 'env-update.ts')
+const directories: string[] = []
+
+afterEach(() => {
+  for (const directory of directories.splice(0)) {
+    rmSync(directory, { recursive: true, force: true })
+  }
+})
+
+test('preserves explicit workflow bindings per block while adding new keys', () => {
+  const directory = mkdtempSync(join(tmpdir(), 'o-env-update-'))
+  directories.push(directory)
+  mkdirSync(join(directory, 'src'))
+  mkdirSync(join(directory, '.github/workflows'), { recursive: true })
+  writeFileSync(join(directory, 'package.json'), '{}')
+  writeFileSync(
+    join(directory, 'src/env.ts'),
+    `export const production = {
+      NEW_SERVICE_KEY: Symbol.for('take-out/env/expected'),
+      UNCHANGED_KEY: Symbol.for('take-out/env/expected'),
+      ADDED_KEY: Symbol.for('take-out/env/expected'),
+    }
+    export const versions = { ZERO_VERSION: '1.9.0' }
+    `
+  )
+
+  const workflow = join(directory, '.github/workflows/deploy.yml')
+  const initial = `jobs:
+  production:
+    env:
+      # 🔒 start - this is generated by "bun env:update"
+      NEW_SERVICE_KEY: \${{ secrets.DEPLOYED_SERVICE_KEY }}
+      UNCHANGED_KEY: \${{ secrets.UNCHANGED_KEY }}
+      ZERO_VERSION: \${{ secrets.ZERO_VERSION }}
+      REMOVED_KEY: \${{ secrets.REMOVED_KEY }}
+      # 🔒 end - this is generated by "bun env:update"
+  staging:
+    env:
+      # 🔒 start - this is generated by "bun env:update"
+      NEW_SERVICE_KEY: '\${{ secrets.STAGING_SERVICE_KEY }}' # explicit staging binding
+      UNCHANGED_KEY: \${{ secrets.UNCHANGED_KEY }}
+      # 🔒 end - this is generated by "bun env:update"
+`
+  writeFileSync(workflow, initial)
+
+  const run = () => execFileSync(process.execPath, [script], { cwd: directory })
+  run()
+  const generated = readFileSync(workflow, 'utf8')
+  const expected = initial
+    .replaceAll(
+      '      NEW_SERVICE_KEY:',
+      '      ADDED_KEY: ${{ secrets.ADDED_KEY }}\n      NEW_SERVICE_KEY:'
+    )
+    .replace('ZERO_VERSION: ${{ secrets.ZERO_VERSION }}', "ZERO_VERSION: '1.9.0'")
+    .replace('      REMOVED_KEY: ${{ secrets.REMOVED_KEY }}\n', '')
+  // the version is generated in every block, including newly populated blocks.
+  expect(generated).toBe(
+    expected.replace(
+      '      UNCHANGED_KEY: ${{ secrets.UNCHANGED_KEY }}\n      # 🔒 end',
+      "      UNCHANGED_KEY: ${{ secrets.UNCHANGED_KEY }}\n      ZERO_VERSION: '1.9.0'\n      # 🔒 end"
+    )
+  )
+
+  run()
+  expect(readFileSync(workflow, 'utf8')).toBe(generated)
+})

package/src/env-update.ts

@@ -201,49 +201,56 @@ await cmd`sync environment variables from src/env.ts to matching files`
       content: string,
       startMarker: string,
       endMarker: string,
-      newSection: string
+      newSection: string | ((section: string, indent: string) => string)
     ): string {
       const re = new RegExp(
         `^([ \\t]*)${escapeRegExp(startMarker)}(.|\n)*?${escapeRegExp(endMarker)}`,
         'gm'
       )
-      return content.replace(re, (_match, indent) => {
-        return `${indent}${startMarker}\n${newSection}\n${indent}${endMarker}`
+      return content.replace(re, (match, indent) => {
+        const section =
+          typeof newSection === 'function' ? newSection(match, indent) : newSection
+        return `${indent}${startMarker}\n${section}\n${indent}${endMarker}`
       })
     }
 
     function applyYamlMarkers(filePath: string, content: string): string {
-      const markerMatch = content.match(
-        new RegExp(`^(\\s*)${escapeRegExp(yamlStart)}`, 'm')
-      )
-      const indent = markerMatch?.[1] || '      '
-
       const beforeMarker = content.slice(0, content.indexOf(yamlStart))
       const isMap = /x-[\w-]+:.*&[\w-]+/s.test(beforeMarker)
       const isGithubActions = filePath.includes('.github/workflows')
 
-      const envLines = entries
-        .map(({ key, defaultValue }) => {
-          const dep = depResolved[key]
-          const val = dep || defaultValue
-
-          if (isGithubActions) {
-            // deps-derived versions track package.json — emit a literal so a
-            // stale repo secret can never shadow them (a stale ZERO_VERSION
-            // secret once pinned an old zero-cache protocol against a newer
-            // client). matches the .env codegen below, which already does this.
-            return dep
-              ? `${indent}${key}: '${dep}'`
-              : `${indent}${key}: \${{ secrets.${key} }}`
+      return replaceMarkerSection(content, yamlStart, yamlEnd, (section, indent) => {
+        // bindings belong to their block; jobs may use different deployed secrets.
+        const bindings = new Map<string, string>()
+        if (isGithubActions) {
+          for (const match of section.matchAll(
+            /^[ \t]*([A-Za-z_][\w]*):[ \t]*(\S[^\r\n]*)/gm
+          )) {
+            bindings.set(match[1]!, match[2]!)
           }
+        }
 
-          return isMap
-            ? `${indent}${key}: \${${key}:-${val}}`
-            : `${indent}- ${key}=\${${key}:-${val}}`
-        })
-        .join('\n')
-
-      return replaceMarkerSection(content, yamlStart, yamlEnd, envLines)
+        return entries
+          .map(({ key, defaultValue }) => {
+            const dep = depResolved[key]
+            const val = dep || defaultValue
+
+            if (isGithubActions) {
+              // deps-derived versions track package.json — emit a literal so a
+              // stale repo secret can never shadow them (a stale ZERO_VERSION
+              // secret once pinned an old zero-cache protocol against a newer
+              // client). matches the .env codegen below, which already does this.
+              return dep
+                ? `${indent}${key}: '${dep}'`
+                : `${indent}${key}: ${bindings.get(key) ?? `\${{ secrets.${key} }}`}`
+            }
+
+            return isMap
+              ? `${indent}${key}: \${${key}:-${val}}`
+              : `${indent}- ${key}=\${${key}:-${val}}`
+          })
+          .join('\n')
+      })
     }
 
     function applyDotenvSection(_filePath: string, content: string): string {

package/src/up.ts

@@ -7,6 +7,9 @@ interface PackageJson {
   devDependencies?: Record<string, string>
   peerDependencies?: Record<string, string>
   optionalDependencies?: Record<string, string>
+  workspaces?: string[] | { packages?: string[] }
+  upgradePackageJsonGlobs?: string[]
+  upgradeSets?: Record<string, string[]>
 }
 
 await cmd`upgrade packages by name or pattern`
@@ -22,6 +25,9 @@ await cmd`upgrade packages by name or pattern`
       fs.readFileSync(path.join(rootDir, 'package.json'), 'utf-8')
     )
     const upgradeSets: Record<string, string[]> = rootPackageJson.upgradeSets || {}
+    const upgradePackageJsonGlobs = Array.isArray(rootPackageJson.upgradePackageJsonGlobs)
+      ? rootPackageJson.upgradePackageJsonGlobs
+      : []
 
     for (const arg of args.rest) {
       if (arg in upgradeSets) {
@@ -48,18 +54,30 @@ await cmd`upgrade packages by name or pattern`
       process.exit(1)
     }
 
-    function findPackageJsonFiles(dir: string): string[] {
+    function findPackageJsonFiles(
+      dir: string,
+      extraPackageJsonGlobs = upgradePackageJsonGlobs
+    ): string[] {
       const results: string[] = []
+      const seen = new Set<string>()
+
+      const addPackageJson = (packageJsonPath: string) => {
+        if (seen.has(packageJsonPath)) return
+        seen.add(packageJsonPath)
+        results.push(packageJsonPath)
+      }
 
       if (fs.existsSync(path.join(dir, 'package.json'))) {
-        results.push(path.join(dir, 'package.json'))
+        addPackageJson(path.join(dir, 'package.json'))
       }
 
       // check if it's a monorepo with workspaces
       try {
         const packageJson = JSON.parse(
           fs.readFileSync(path.join(dir, 'package.json'), 'utf-8')
-        )
+        ) as PackageJson
+        const packageJsonGlobs = [...extraPackageJsonGlobs]
+
         if (packageJson.workspaces) {
           let workspacePaths: string[] = []
 
@@ -69,9 +87,15 @@ await cmd`upgrade packages by name or pattern`
             workspacePaths = packageJson.workspaces.packages
           }
 
-          for (const workspace of workspacePaths) {
+          packageJsonGlobs.unshift(...workspacePaths)
+        }
+
+        if (packageJsonGlobs.length > 0) {
+          for (const workspace of packageJsonGlobs) {
             // handle glob patterns like "packages/*", "code/**/*", "./code/ui/**/*"
-            const normalizedWorkspace = workspace.replace(/^\.\//, '')
+            const normalizedWorkspace = workspace
+              .replace(/^\.\//, '')
+              .replace(/\/package\.json$/, '')
 
             if (normalizedWorkspace.includes('**')) {
               // nested glob pattern - use glob to find all package.json files
@@ -87,7 +111,7 @@ await cmd`upgrade packages by name or pattern`
                         const subPath = path.join(searchDir, entry.name)
                         const pkgPath = path.join(subPath, 'package.json')
                         if (fs.existsSync(pkgPath)) {
-                          results.push(pkgPath)
+                          addPackageJson(pkgPath)
                         }
                         // recurse into subdirectories
                         findPackages(subPath)
@@ -112,7 +136,7 @@ await cmd`upgrade packages by name or pattern`
 
                 for (const subdir of subdirs) {
                   if (fs.existsSync(path.join(subdir, 'package.json'))) {
-                    results.push(path.join(subdir, 'package.json'))
+                    addPackageJson(path.join(subdir, 'package.json'))
                   }
                 }
               }
@@ -120,7 +144,7 @@ await cmd`upgrade packages by name or pattern`
               // exact path like "code/tamagui.dev" or "./code/sandbox"
               const pkgPath = path.join(dir, normalizedWorkspace, 'package.json')
               if (fs.existsSync(pkgPath)) {
-                results.push(pkgPath)
+                addPackageJson(pkgPath)
               }
             }
           }
@@ -219,7 +243,7 @@ await cmd`upgrade packages by name or pattern`
     }
 
     async function updatePackages(
-      packagesByWorkspace: Map<string, { dir: string; packages: string[] }>,
+      packagesByManifest: Map<string, { dir: string; packages: string[] }>,
       rootDir: string,
       packageJsonFiles: string[]
     ) {
@@ -234,7 +258,7 @@ await cmd`upgrade packages by name or pattern`
 
       // collect all unique packages to update
       const allPackages = new Set<string>()
-      for (const { packages } of packagesByWorkspace.values()) {
+      for (const { packages } of packagesByManifest.values()) {
         packages.forEach((pkg) => allPackages.add(pkg))
       }
 
@@ -272,14 +296,14 @@ await cmd`upgrade packages by name or pattern`
       let totalUpdates = 0
 
       for (const packageJsonPath of packageJsonFiles) {
-        const packagesInWorkspace =
-          packagesByWorkspace.get(getWorkspaceName(packageJsonPath, rootDir))?.packages ||
+        const packagesInManifest =
+          packagesByManifest.get(getWorkspaceName(packageJsonPath, rootDir))?.packages ||
           []
 
-        if (packagesInWorkspace.length > 0) {
+        if (packagesInManifest.length > 0) {
           const updates = updatePackageJsonVersions(
             packageJsonPath,
-            packagesInWorkspace,
+            packagesInManifest,
             versionMap
           )
           if (updates > 0) {
@@ -330,9 +354,11 @@ await cmd`upgrade packages by name or pattern`
     const packageJsonFiles = findPackageJsonFiles(rootDir)
     console.info(`Found ${packageJsonFiles.length} package.json files`)
 
+    const workspacePackageJsonFiles = findPackageJsonFiles(rootDir, [])
+
     // get workspace package names to exclude from updates
     const workspacePackageNames = new Set<string>()
-    for (const packageJsonPath of packageJsonFiles) {
+    for (const packageJsonPath of workspacePackageJsonFiles) {
       if (packageJsonPath === path.join(rootDir, 'package.json')) continue
 
       try {
@@ -350,8 +376,8 @@ await cmd`upgrade packages by name or pattern`
       `Found ${workspacePackageNames.size} workspace packages to exclude from updates`
     )
 
-    // build map of packages to update per workspace
-    const packagesByWorkspace = new Map<string, { dir: string; packages: string[] }>()
+    // build map of packages to update per manifest
+    const packagesByManifest = new Map<string, { dir: string; packages: string[] }>()
     const allMatchingDeps = new Set<string>()
 
     for (const packageJsonPath of packageJsonFiles) {
@@ -374,7 +400,7 @@ await cmd`upgrade packages by name or pattern`
       if (matchingDeps.length > 0) {
         const dir = packageJsonPath.replace('/package.json', '')
         const name = getWorkspaceName(packageJsonPath, rootDir)
-        packagesByWorkspace.set(name, { dir, packages: matchingDeps })
+        packagesByManifest.set(name, { dir, packages: matchingDeps })
       }
     }
 
@@ -397,7 +423,7 @@ await cmd`upgrade packages by name or pattern`
         allMatchingDeps.add(pkg)
       }
 
-      packagesByWorkspace.set('root', {
+      packagesByManifest.set('root', {
         dir: rootDir,
         packages: exactPatterns,
       })
@@ -417,14 +443,14 @@ await cmd`upgrade packages by name or pattern`
       console.info(
         `Found ${allMatchingDeps.size} dependencies matching patterns: ${packagePatterns.join(', ')}`
       )
-      console.info(`Found matches in ${packagesByWorkspace.size} workspace(s)`)
+      console.info(`Found matches in ${packagesByManifest.size} package manifest(s)`)
     }
 
     if (globalTag) {
       console.info(`🏷️ Using tag '${globalTag}'`)
     }
 
-    await updatePackages(packagesByWorkspace, rootDir, packageJsonFiles)
+    await updatePackages(packagesByManifest, rootDir, packageJsonFiles)
 
     // sync resolved $dep: values (like ZERO_VERSION) to all env targets
     if (