@rexezuge/tooling 0.0.0-stage → 1.0.0

package/dist/scripts/verify-migrations.js

@@ -0,0 +1,302 @@
+/**
+ * Verify the migration set is complete, ordered, and locked; write the lock.
+ *
+ * Provenance: Edge-Sonic's `scripts/migrations/{verify-migrations,lock-check}.ts`
+ * (the rule module plus its entrypoint) and AWS's `verify-migrations.ts`,
+ * converged. Every copy checks the same properties of a `migrations/` directory;
+ * they differ in lock-file naming, in whether the lock is enforced on CI, and in
+ * how much of D1's ordering semantics they encode.
+ *
+ * ### Why a checksum lock at all
+ *
+ * D1 records *which* migrations it has applied — the filename and a timestamp —
+ * but not *what the file contained* when it applied them. So editing a migration
+ * that has already run is not caught by anything: the deploy still succeeds, the
+ * local database built from the baseline plus the edited file picks up the new
+ * statements, and production keeps the schema it had. The two databases then
+ * differ silently and permanently, and the next migration that assumes the newer
+ * shape fails only in production. A committed digest per file turns that into a
+ * CI failure.
+ *
+ * ### What the checks are, and where each comes from
+ *
+ * - **`NNNN_snake_case.sql`** (AWS) — the numbering *is* the ordering: D1 sorts by
+ *   filename, so a file that sorts *after* the ones already applied is the only
+ *   kind that can be introduced safely.
+ * - **Contiguous prefixes** (AWS) — a hole means one database applied 0001 and
+ *   0003 while another applied only 0001, and nothing downstream can tell which.
+ *   Checked **only when no squash baseline exists**: a squash legitimately
+ *   absorbs its predecessors, so numbering restarts wherever it starts, and a
+ *   contiguity rule that fires on a squash is a rule that blocks the squash.
+ * - **One entry per file** (all) — a file with no recorded digest is one nothing
+ *   can say anything about.
+ * - **Digest unchanged** (all) — the edited-after-locking failure.
+ * - **No orphan entries** (Edge-Sonic) — a locked file that is gone has been
+ *   applied to a live database and is no longer reproducible from this repo.
+ * - **Strictly increasing prefixes** (Edge-Sonic's `out-of-order`) — a file
+ *   sorting *before* the newest locked one can never reach a database that has
+ *   applied that newest one, so its statements would only run on a fresh build.
+ * - **No duplicate prefixes** (Edge-Sonic) — two files numbered `0033_` are not a
+ *   style problem: D1 orders them by the rest of the filename, so which one lands
+ *   on a given database depends on a lexicographic tiebreak nobody intended.
+ *
+ * ### The squash baseline
+ *
+ * `0008_squash.sql` holds the combined schema of every migration before it, and
+ * those files are deleted when it is created. A later squash repeats that. So a
+ * squash legitimately (a) rewrites one file and (b) removes files the lock still
+ * lists, and neither may be reported as drift. The baseline is the
+ * highest-numbered `NNNN_squash.sql` **on disk**, never the value the lock claims
+ * — deriving it means a stale or forged `baseline` cannot widen the exempt set.
+ *
+ * ### The one write path
+ *
+ * `--write` is add-only where it counts: it records unlocked files, refreshes the
+ * baseline's own entry, and drops entries the baseline absorbed. Every other
+ * entry is left exactly as it is, so an incremental `edited` finding **survives a
+ * `--write`** — re-baselining one means deleting its entry by hand, which shows
+ * up in the diff. There is deliberately no `--force`, because a write that could
+ * bless a drift would be the operator blessing their own edit.
+ */
+import { createHash } from 'node:crypto';
+import { pathToFileURL } from 'node:url';
+import { existsSync, readFileSync, readdirSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+/**
+ * The lock's filename, beside the `.sql` files.
+ *
+ * Named `migrations.lock.json` rather than `migrations.json` so it cannot be
+ * mistaken for a migration: wrangler applies `*.sql` only, and a lock named like
+ * one would be a deploy-time mystery.
+ */
+const LOCK_NAME = 'migrations.lock.json';
+/** The filename shape every migration must have. `NNNN_` is fixed at four digits. */
+const NAME_PATTERN = /^(\d{4})_[a-z0-9_]+\.sql$/;
+/** The squashed-baseline shape. The highest-numbered match is the baseline. */
+const SQUASH_PATTERN = /^\d{4}_squash\.sql$/;
+/** The lock's format version. Bumped only on an incompatible shape change. */
+const LOCK_VERSION = 1;
+function sha256Hex(content) {
+    return createHash('sha256').update(content, 'utf8').digest('hex');
+}
+/**
+ * The highest-numbered `NNNN_squash.sql` on disk, or `undefined` when the repo
+ * has not squashed — in which case every migration is incremental and therefore
+ * every one of them is immutable.
+ */
+export function baselineOf(files) {
+    let highest;
+    for (const name of files) {
+        if (SQUASH_PATTERN.test(name) && (highest === undefined || name > highest)) {
+            highest = name;
+        }
+    }
+    return highest;
+}
+/** True when `name` is at or before the baseline, i.e. the set a squash absorbs. */
+function isSubsumed(name, baseline) {
+    return baseline !== undefined && name <= baseline;
+}
+/**
+ * Read the migration set and validate its shape without consulting the lock.
+ *
+ * The lock is read here too, so one walk answers both "what is on disk" and "what
+ * is recorded"; a lock that is merely *absent* is reported by `verifyMigrations`
+ * rather than here, because that is the bootstrap case rather than a defect.
+ */
+function inspectMigrations(migrationsDir) {
+    const problems = [];
+    if (!existsSync(migrationsDir)) {
+        problems.push({ problem: `${migrationsDir} does not exist` });
+        return { files: [], problems, lock: null };
+    }
+    // Top level only, matching wrangler's default `${migrationsDir}/*.sql`, so the
+    // lock describes exactly the set wrangler will run. `migrations.lock.json` is
+    // not one of them, because it is not a `.sql` file.
+    const files = readdirSync(migrationsDir)
+        .filter((name) => name.endsWith('.sql'))
+        .sort((left, right) => left.localeCompare(right));
+    for (const name of files) {
+        if (!NAME_PATTERN.test(name)) {
+            problems.push({ problem: `${name} does not match NNNN_snake_case.sql` });
+        }
+    }
+    const baseline = baselineOf(files);
+    const prefixes = files.map((name) => NAME_PATTERN.exec(name)?.[1]);
+    // Strictly increasing: the property D1 actually depends on. A duplicate or a
+    // descending prefix means two files compete for the same slot in the apply
+    // order, and which one wins is a lexicographic tiebreak nobody intended.
+    for (let index = 1; index < prefixes.length; index += 1) {
+        const previous = prefixes[index - 1];
+        const current = prefixes[index];
+        if (previous !== undefined && current !== undefined && current <= previous) {
+            problems.push({
+                problem: `${files[index] ?? '?'} sorts at or before ${files[index - 1] ?? '?'} — D1 applies in filename order, so one of the two can never run`,
+            });
+        }
+    }
+    // Contiguity is checked only with no squash on disk: a squash deletes the files
+    // it absorbs, so numbering restarts wherever it starts and a hole is the
+    // expected shape rather than a defect.
+    if (baseline === undefined) {
+        for (let index = 0; index < prefixes.length; index += 1) {
+            const expected = String(index + 1).padStart(4, '0');
+            if (prefixes[index] !== expected) {
+                problems.push({
+                    problem: `migration numbering is not contiguous: expected ${expected}_*.sql, found ${files[index] ?? '?'}`,
+                });
+            }
+        }
+    }
+    const lockPath = join(migrationsDir, LOCK_NAME);
+    let lock = null;
+    if (existsSync(lockPath)) {
+        try {
+            lock = JSON.parse(readFileSync(lockPath, 'utf8'));
+        }
+        catch {
+            problems.push({ problem: `${LOCK_NAME} is not valid JSON` });
+        }
+    }
+    return { files, problems, lock };
+}
+/**
+ * The lock as `--write` would leave it.
+ *
+ * `null` when the existing lock cannot be trusted as a base, which is exactly
+ * when a `--write` must refuse rather than overwrite contents it failed to
+ * understand. A lock that is merely *absent* is not malformed: that is the
+ * bootstrap case, and it is built from disk like any other.
+ */
+function buildUpdatedLock(migrationsDir, files, existing, baseline) {
+    const digestOf = (name) => sha256Hex(readFileSync(join(migrationsDir, name), 'utf8'));
+    if (existing === null) {
+        return { version: LOCK_VERSION, ...(baseline !== undefined && { baseline }), migrations: files.map((name) => ({ name, sha256: digestOf(name) })) };
+    }
+    const kept = new Map();
+    for (const file of files) {
+        const recorded = existing.migrations.find((entry) => entry.name === file);
+        if (recorded === undefined)
+            continue;
+        // The baseline is the one file a squash is allowed to rewrite.
+        kept.set(file, file === baseline ? digestOf(file) : recorded.sha256);
+    }
+    // Unlocked files are added — that is the new-migration case. Every other entry
+    // is carried across untouched, so an `edited` finding survives the write.
+    for (const file of files) {
+        if (!kept.has(file) && !existing.migrations.some((entry) => entry.name === file)) {
+            kept.set(file, digestOf(file));
+        }
+    }
+    // Entries the baseline absorbed are dropped: committing a squash looks exactly
+    // like this, and neither it nor a rewritten baseline can hide a divergence,
+    // because a database that applied those files already has them recorded in D1's
+    // own `d1_migrations`.
+    for (const entry of existing.migrations) {
+        if (!files.includes(entry.name) && !isSubsumed(entry.name, baseline)) {
+            kept.set(entry.name, entry.sha256);
+        }
+    }
+    return {
+        version: LOCK_VERSION,
+        ...(baseline !== undefined && { baseline }),
+        migrations: [...kept]
+            .sort(([left], [right]) => left.localeCompare(right))
+            .map(([name, sha256]) => ({ name, sha256 })),
+    };
+}
+/** Verify (or with `write: true`, record) the lock against the files. */
+function verifyMigrations(migrationsDir, options = {}) {
+    const report = inspectMigrations(migrationsDir);
+    const baseline = baselineOf(report.files);
+    // A malformed lock is a finding in its own right, and a `--write` must not
+    // overwrite contents it failed to understand.
+    if (report.problems.length > 0) {
+        return report;
+    }
+    if (options.write === true) {
+        const updated = buildUpdatedLock(migrationsDir, report.files, report.lock, baseline);
+        const next = `${JSON.stringify(updated, null, 2)}\n`;
+        const path = join(migrationsDir, LOCK_NAME);
+        const before = existsSync(path) ? readFileSync(path, 'utf8') : null;
+        if (before !== next) {
+            writeFileSync(path, next, 'utf8');
+        }
+        report.lock = updated;
+        return report;
+    }
+    const lock = report.lock;
+    if (lock === null) {
+        report.problems.push({ problem: `${LOCK_NAME} is missing — run migrations:lock` });
+        return report;
+    }
+    const recorded = new Map(lock.migrations.map((entry) => [entry.name, entry.sha256]));
+    for (const name of report.files) {
+        const expected = recorded.get(name);
+        if (expected === undefined) {
+            report.problems.push({ problem: `${name} has no lock entry — run migrations:lock` });
+            continue;
+        }
+        // At or before the baseline, a squash rewrites its own file, and that is the
+        // whole reason a baseline exists.
+        if (isSubsumed(name, baseline))
+            continue;
+        const actual = sha256Hex(readFileSync(join(migrationsDir, name), 'utf8'));
+        if (actual !== expected) {
+            report.problems.push({
+                problem: `${name} changed after locking (expected ${expected.slice(0, 12)}…, got ${actual.slice(0, 12)}…)`,
+            });
+        }
+    }
+    for (const entry of lock.migrations) {
+        if (report.files.includes(entry.name))
+            continue;
+        if (isSubsumed(entry.name, baseline))
+            continue;
+        report.problems.push({ problem: `${entry.name} is in the lock but no longer exists` });
+    }
+    // A file sorting before the newest locked one can never reach a database that
+    // has already applied that newest one, so its statements would only run on a
+    // fresh build — the same silent split the checksum exists to prevent.
+    const newest = [...recorded.keys()].sort((left, right) => left.localeCompare(right)).at(-1);
+    if (newest !== undefined) {
+        for (const name of report.files) {
+            if (name < newest && !recorded.has(name)) {
+                report.problems.push({
+                    problem: `${name} sorts before ${newest}, which is already locked — D1 applies in filename order, so it would never run on a database that has applied ${newest}`,
+                });
+            }
+        }
+    }
+    return report;
+}
+/** CLI entry: `verifyMigrationsCli(['[migrations-dir]?', '--write'?'])`. */
+function verifyMigrationsCli(argv = process.argv.slice(2)) {
+    const dir = argv.find((arg) => !arg.startsWith('--')) ?? 'migrations';
+    const write = argv.includes('--write');
+    const report = verifyMigrations(dir, { write });
+    if (report.problems.length > 0) {
+        console.error(`Migration validation failed for ${dir}:`);
+        for (const problem of report.problems)
+            console.error(`  - ${problem.problem}`);
+        return 1;
+    }
+    if (write) {
+        console.log(`Migration lock written (${report.files.length} files).`);
+        return 0;
+    }
+    console.log(`Migration validation passed (${report.files.length} files, lock in sync).`);
+    return 0;
+}
+export { inspectMigrations, verifyMigrations, verifyMigrationsCli, LOCK_NAME, LOCK_VERSION };
+// Run only when this file is the entrypoint.
+//
+// The rules above are pure and the tests import them directly, so a module-level
+// call would shell out (and exit) during a test run. The URL comparison rather than
+// an unconditional call is the same guard Durable-DAV's init-secrets.ts uses, and
+// it is what keeps the rule modules importable — which is the whole reason they are
+// separate modules in the first place.
+if (process.argv[1] !== undefined && import.meta.url === pathToFileURL(process.argv[1]).href) {
+    process.exit(verifyMigrationsCli(process.argv.slice(2)));
+}
+//# sourceMappingURL=verify-migrations.js.map

package/dist/scripts/verify-migrations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-migrations.js","sourceRoot":"","sources":["../../src/scripts/verify-migrations.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2DG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC/E,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAmCjC;;;;;;GAMG;AACH,MAAM,SAAS,GAAG,sBAAsB,CAAC;AAEzC,qFAAqF;AACrF,MAAM,YAAY,GAAG,2BAA2B,CAAC;AAEjD,+EAA+E;AAC/E,MAAM,cAAc,GAAG,qBAAqB,CAAC;AAE7C,8EAA8E;AAC9E,MAAM,YAAY,GAAG,CAAC,CAAC;AAEvB,SAAS,SAAS,CAAC,OAAe;IAChC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACpE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,KAAwB;IACjD,IAAI,OAA2B,CAAC;IAChC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,IAAI,GAAG,OAAO,CAAC,EAAE,CAAC;YAC3E,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,oFAAoF;AACpF,SAAS,UAAU,CAAC,IAAY,EAAE,QAA4B;IAC5D,OAAO,QAAQ,KAAK,SAAS,IAAI,IAAI,IAAI,QAAQ,CAAC;AACpD,CAAC;AAED;;;;;;GAMG;AACH,SAAS,iBAAiB,CAAC,aAAqB;IAC9C,MAAM,QAAQ,GAAuB,EAAE,CAAC;IACxC,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QAC/B,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,GAAG,aAAa,iBAAiB,EAAE,CAAC,CAAC;QAC9D,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC7C,CAAC;IAED,+EAA+E;IAC/E,8EAA8E;IAC9E,oDAAoD;IACpD,MAAM,KAAK,GAAG,WAAW,CAAC,aAAa,CAAC;SACrC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;SACvC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;IAEpD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,GAAG,IAAI,qCAAqC,EAAE,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAEnE,6EAA6E;IAC7E,2EAA2E;IAC3E,yEAAyE;IACzE,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACxD,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACrC,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,QAAQ,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC3E,QAAQ,CAAC,IAAI,CAAC;gBACZ,OAAO,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,GAAG,uBAAuB,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,GAAG,kEAAkE;aAChJ,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,gFAAgF;IAChF,yEAAyE;IACzE,uCAAuC;IACvC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,QAAQ,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YACxD,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YACpD,IAAI,QAAQ,CAAC,KAAK,CAAC,KAAK,QAAQ,EAAE,CAAC;gBACjC,QAAQ,CAAC,IAAI,CAAC;oBACZ,OAAO,EAAE,mDAAmD,QAAQ,iBAAiB,KAAK,CAAC,KAAK,CAAC,IAAI,GAAG,EAAE;iBAC3G,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;IAChD,IAAI,IAAI,GAA6B,IAAI,CAAC;IAC1C,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAsB,CAAC;QACzE,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,GAAG,SAAS,oBAAoB,EAAE,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;AACnC,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,gBAAgB,CACvB,aAAqB,EACrB,KAAwB,EACxB,QAAkC,EAClC,QAA4B;IAE5B,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAU,EAAE,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IAEtG,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;IACrJ,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,QAAQ,GAAG,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;QAC1E,IAAI,QAAQ,KAAK,SAAS;YAAE,SAAS;QACrC,+DAA+D;QAC/D,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACvE,CAAC;IACD,+EAA+E;IAC/E,0EAA0E;IAC1E,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;YACjF,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IACD,+EAA+E;IAC/E,4EAA4E;IAC5E,gFAAgF;IAChF,uBAAuB;IACvB,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,UAAU,EAAE,CAAC;QACxC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC;YACrE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IAED,OAAO;QACL,OAAO,EAAE,YAAY;QACrB,GAAG,CAAC,QAAQ,KAAK,SAAS,IAAI,EAAE,QAAQ,EAAE,CAAC;QAC3C,UAAU,EAAE,CAAC,GAAG,IAAI,CAAC;aAClB,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;aACpD,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;KAC/C,CAAC;AACJ,CAAC;AAED,yEAAyE;AACzE,SAAS,gBAAgB,CAAC,aAAqB,EAAE,UAA+B,EAAE;IAChF,MAAM,MAAM,GAAG,iBAAiB,CAAC,aAAa,CAAC,CAAC;IAChD,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAE1C,2EAA2E;IAC3E,8CAA8C;IAC9C,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,IAAI,OAAO,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,gBAAgB,CAAC,aAAa,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACrF,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;QACrD,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACpE,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QACpC,CAAC;QACD,MAAM,CAAC,IAAI,GAAG,OAAO,CAAC;QACtB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IACzB,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,GAAG,SAAS,mCAAmC,EAAE,CAAC,CAAC;QACnF,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACrF,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAChC,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,GAAG,IAAI,0CAA0C,EAAE,CAAC,CAAC;YACrF,SAAS;QACX,CAAC;QACD,6EAA6E;QAC7E,kCAAkC;QAClC,IAAI,UAAU,CAAC,IAAI,EAAE,QAAQ,CAAC;YAAE,SAAS;QACzC,MAAM,MAAM,GAAG,SAAS,CAAC,YAAY,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QAC1E,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;YACxB,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;gBACnB,OAAO,EAAE,GAAG,IAAI,oCAAoC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI;aAC3G,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QACpC,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,SAAS;QAChD,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC;YAAE,SAAS;QAC/C,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC,IAAI,sCAAsC,EAAE,CAAC,CAAC;IACzF,CAAC;IAED,8EAA8E;IAC9E,6EAA6E;IAC7E,sEAAsE;IACtE,MAAM,MAAM,GAAG,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5F,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YAChC,IAAI,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;oBACnB,OAAO,EAAE,GAAG,IAAI,iBAAiB,MAAM,kHAAkH,MAAM,EAAE;iBAClK,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,4EAA4E;AAC5E,SAAS,mBAAmB,CAAC,OAA0B,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAC1E,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,YAAY,CAAC;IACtE,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IAChD,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,OAAO,CAAC,KAAK,CAAC,mCAAmC,GAAG,GAAG,CAAC,CAAC;QACzD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ;YAAE,OAAO,CAAC,KAAK,CAAC,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/E,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAI,KAAK,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CAAC,2BAA2B,MAAM,CAAC,KAAK,CAAC,MAAM,UAAU,CAAC,CAAC;QACtE,OAAO,CAAC,CAAC;IACX,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,gCAAgC,MAAM,CAAC,KAAK,CAAC,MAAM,wBAAwB,CAAC,CAAC;IACzF,OAAO,CAAC,CAAC;AACX,CAAC;AAED,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC;AAG7F,6CAA6C;AAC7C,EAAE;AACF,iFAAiF;AACjF,oFAAoF;AACpF,kFAAkF;AAClF,oFAAoF;AACpF,uCAAuC;AACvC,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7F,OAAO,CAAC,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC3D,CAAC"}

package/dist/scripts/verify-spa-shell.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env tsx
+export {};
+//# sourceMappingURL=verify-spa-shell.d.ts.map

package/dist/scripts/verify-spa-shell.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-spa-shell.d.ts","sourceRoot":"","sources":["../../src/scripts/verify-spa-shell.ts"],"names":[],"mappings":""}

package/dist/scripts/verify-spa-shell.js

@@ -0,0 +1,53 @@
+#!/usr/bin/env tsx
+/**
+ * Fail when the SPA shell the API worker serves is missing or self-inconsistent.
+ *
+ * Provenance: Durable-DAV's and Durable-DAV-Router's `scripts/verify-spa-shell.mjs`
+ * and Edge-Sonic's typed `scripts/build/verify-spa-shell.ts`. The rules — which of
+ * the ways a shell can be wrong to look for — live in `spa-shell.ts`, so they are
+ * unit tested without a build on disk; this file is the entrypoint that turns the
+ * verdict into an exit code.
+ *
+ * What it catches:
+ *
+ * - the `postinstall` stub, or no build at all, still in place;
+ * - `spa-shell.ts` referencing `/assets/...` bundles that were not emitted (a
+ *   partially cleaned or half-copied `dist/`, which serves a shell whose JS 404s
+ *   and therefore renders no operator UI at all);
+ * - `spa-shell.ts` and `apps/web/dist/index.html` disagreeing, i.e. only one of
+ *   the two halves of the build was refreshed.
+ *
+ * **The build is a precondition of this check, not a convenience.** Both paths are
+ * gitignored and `postinstall` writes a deliberately empty stub, so verifying
+ * without building cannot pass — and it fails with precisely the message above,
+ * which is the check working rather than the check being wrong.
+ *
+ * Usage, from the repo root:
+ *
+ * ```bash
+ * pnpm exec tsx scripts/verify-spa-shell.ts            # defaults to ./ as root
+ * pnpm exec tsx scripts/verify-spa-shell.ts --root /path/to/repo
+ * ```
+ */
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { verifySpaShell } from './spa-shell';
+/**
+ * The repository root, derived from this file rather than from `process.cwd()`.
+ *
+ * Two levels up, because this file sits in `scripts/`. Deriving it means the gate
+ * reads the same tree whatever directory it is invoked from — which is the
+ * difference between a gate and a gate that passes because nobody ran it from the
+ * right place.
+ */
+const REPOSITORY_ROOT = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..');
+const root = process.argv[2] === undefined ? REPOSITORY_ROOT : path.resolve(process.argv[2]);
+const { problems } = verifySpaShell({ root });
+if (problems.length > 0) {
+    console.error('SPA shell check failed:');
+    for (const problem of problems)
+        console.error(`  - ${problem}`);
+    process.exit(1);
+}
+console.log(`SPA shell check passed (${path.join(root, 'apps/api/src/generated/spa-shell.ts')} matches ${path.join(root, 'apps/web/dist')}).`);
+//# sourceMappingURL=verify-spa-shell.js.map

package/dist/scripts/verify-spa-shell.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify-spa-shell.js","sourceRoot":"","sources":["../../src/scripts/verify-spa-shell.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE7C;;;;;;;GAOG;AACH,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;AAEzF,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAE7F,MAAM,EAAE,QAAQ,EAAE,GAAG,cAAc,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;AAE9C,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;IACxB,OAAO,CAAC,KAAK,CAAC,yBAAyB,CAAC,CAAC;IACzC,KAAK,MAAM,OAAO,IAAI,QAAQ;QAAE,OAAO,CAAC,KAAK,CAAC,OAAO,OAAO,EAAE,CAAC,CAAC;IAChE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,OAAO,CAAC,GAAG,CAAC,2BAA2B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,qCAAqC,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC,IAAI,CAAC,CAAC"}

package/dist/scripts/wrangler-config/cli.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Running `wrangler` and reading its output.
+ *
+ * Provenance: ported from Edge-Sonic's `scripts/lib/wrangler-config/cli.ts`.
+ */
+/**
+ * Runs a wrangler subcommand and returns stdout.
+ *
+ * Arguments are passed as an argv array rather than interpolated into a shell
+ * string, so a value containing shell metacharacters cannot alter the command.
+ */
+export declare function runWrangler(args: readonly string[], input?: string): string;
+/**
+ * Parses a JSON array from a command's stdout, naming the command on failure.
+ *
+ * Several wrangler subcommands print a human-readable table when they detect a
+ * TTY, so "not JSON" is an expected outcome that the caller often has a table
+ * parser for. Passing the command description turns that into a catchable,
+ * self-explanatory error instead of an unlabelled `SyntaxError`.
+ */
+export declare function parseJsonArray<T>(output: string, commandDescription: string): T[];
+//# sourceMappingURL=cli.d.ts.map

package/dist/scripts/wrangler-config/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../../../src/scripts/wrangler-config/cli.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,CAgB3E;AAED;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,GAAG,CAAC,EAAE,CAUjF"}

package/dist/scripts/wrangler-config/cli.js

@@ -0,0 +1,51 @@
+/**
+ * Running `wrangler` and reading its output.
+ *
+ * Provenance: ported from Edge-Sonic's `scripts/lib/wrangler-config/cli.ts`.
+ */
+import { execFileSync } from 'node:child_process';
+/**
+ * Runs a wrangler subcommand and returns stdout.
+ *
+ * Arguments are passed as an argv array rather than interpolated into a shell
+ * string, so a value containing shell metacharacters cannot alter the command.
+ */
+export function runWrangler(args, input) {
+    try {
+        // `pnpm` is resolved from PATH deliberately: the scripts run on CI runners and
+        // in local shells, and both resolve it the same way.
+        // eslint-disable-next-line sonarjs/no-os-command-from-path
+        return execFileSync('pnpm', ['exec', 'wrangler', ...args], {
+            encoding: 'utf8',
+            stdio: [input === undefined ? 'ignore' : 'pipe', 'pipe', 'pipe'],
+            ...(input !== undefined && { input }),
+        });
+    }
+    catch (error) {
+        const maybeProcessError = error;
+        const stdout = maybeProcessError.stdout ? maybeProcessError.stdout.toString() : '';
+        const stderr = maybeProcessError.stderr ? maybeProcessError.stderr.toString() : '';
+        throw new Error(`Command failed: pnpm exec wrangler ${args.join(' ')}\n${stdout}${stderr || maybeProcessError.message || ''}`);
+    }
+}
+/**
+ * Parses a JSON array from a command's stdout, naming the command on failure.
+ *
+ * Several wrangler subcommands print a human-readable table when they detect a
+ * TTY, so "not JSON" is an expected outcome that the caller often has a table
+ * parser for. Passing the command description turns that into a catchable,
+ * self-explanatory error instead of an unlabelled `SyntaxError`.
+ */
+export function parseJsonArray(output, commandDescription) {
+    try {
+        const parsed = JSON.parse(output);
+        if (Array.isArray(parsed)) {
+            return parsed;
+        }
+    }
+    catch {
+        // Fall through to the explicit error below.
+    }
+    throw new Error(`Expected JSON array output from ${commandDescription}. Output:\n${output}`);
+}
+//# sourceMappingURL=cli.js.map

package/dist/scripts/wrangler-config/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../../../src/scripts/wrangler-config/cli.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,IAAuB,EAAE,KAAc;IACjE,IAAI,CAAC;QACH,+EAA+E;QAC/E,qDAAqD;QACrD,2DAA2D;QAC3D,OAAO,YAAY,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,GAAG,IAAI,CAAC,EAAE;YACzD,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;YAChE,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,EAAE,KAAK,EAAE,CAAC;SACtC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,MAAM,iBAAiB,GAAG,KAAiF,CAAC;QAC5G,MAAM,MAAM,GAAW,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3F,MAAM,MAAM,GAAW,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3F,MAAM,IAAI,KAAK,CAAC,sCAAsC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,MAAM,GAAG,MAAM,IAAI,iBAAiB,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC,CAAC;IACjI,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAI,MAAc,EAAE,kBAA0B;IAC1E,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,OAAO,MAAa,CAAC;QACvB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,4CAA4C;IAC9C,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,mCAAmC,kBAAkB,cAAc,MAAM,EAAE,CAAC,CAAC;AAC/F,CAAC"}

package/dist/scripts/wrangler-config/patches.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Reading, writing and patching `wrangler.jsonc`.
+ *
+ * Provenance: ported from Edge-Sonic's `scripts/lib/wrangler-config/patches.ts`.
+ *
+ * The config is JSONC — `//` comments and trailing commas — so it is edited
+ * through jsonc-parser's `modify`/`applyEdits` rather than parsed and re-serialized.
+ * A round trip through `JSON.parse` would drop every comment and reformat the
+ * file, which is a diff nobody can review and a reason to regenerate the config by
+ * hand instead.
+ */
+import { type WranglerConfig } from './types';
+/** The config's current text and its parsed form. */
+export interface ConfigFile {
+    content: string;
+    config: WranglerConfig;
+}
+export declare function readConfig(): ConfigFile;
+/**
+ * Apply one edit to the config text, preserving comments and formatting.
+ */
+export declare function writeConfigValue(content: string, path: Array<string | number>, value: unknown): string;
+/** Write the config, guaranteeing a trailing newline so Prettier sees a fixed point. */
+export declare function writeConfig(content: string): void;
+/**
+ * The top-level keys a caller wants to merge into the config, from the environment.
+ *
+ * `WRANGLER_PATCH_JSON` is how a repository variable supplies per-environment
+ * settings without a second file: a repo with one worker and three environments
+ * patches the routes and the vars rather than keeping three templates in step.
+ */
+export declare function parseTopLevelPatch(): Record<string, unknown> | undefined;
+/** The `vars` entries a caller wants to merge, from the environment. */
+export declare function parseVarsPatch(): Record<string, string> | undefined;
+/**
+ * Materialize the config: the repository variable when it is set, otherwise the
+ * committed template.
+ */
+export declare function prepareConfigFile(): void;
+/**
+ * Refuse a config older than the template requires.
+ *
+ * The template is the one file in the repo that says which wrangler behaviour the
+ * worker was written against, and a config written by an older template can name
+ * bindings the worker no longer reads. Failing here rather than at deploy time is
+ * the whole reason the check exists.
+ */
+export declare function ensureMinimumConfigVersion(): void;
+export declare function applyTopLevelPatch(): void;
+export declare function applyVarsPatch(): void;
+//# sourceMappingURL=patches.d.ts.map

package/dist/scripts/wrangler-config/patches.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"patches.d.ts","sourceRoot":"","sources":["../../../src/scripts/wrangler-config/patches.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,EAA8B,KAAK,cAAc,EAAE,MAAM,SAAS,CAAC;AAE1E,qDAAqD;AACrD,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,cAAc,CAAC;CACxB;AAED,wBAAgB,UAAU,IAAI,UAAU,CAGvC;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC,EAAE,KAAK,EAAE,OAAO,GAAG,MAAM,CAGtG;AAED,wFAAwF;AACxF,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAEjD;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAExE;AAED,wEAAwE;AACxE,wBAAgB,cAAc,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAgBnE;AAkBD;;;GAGG;AACH,wBAAgB,iBAAiB,IAAI,IAAI,CASxC;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,IAAI,IAAI,CAYjD;AAED,wBAAgB,kBAAkB,IAAI,IAAI,CAYzC;AAED,wBAAgB,cAAc,IAAI,IAAI,CAmBrC"}