@smoothbricks/cli 0.10.3 → 0.10.4

package/src/release/index.ts

@@ -1,13 +1,23 @@
+import { existsSync, readFileSync } from 'node:fs';
 import { appendFile, mkdtemp, rm, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { join, resolve } from 'node:path';
 import { createInterface } from 'node:readline/promises';
 import { Writable } from 'node:stream';
 import { $ } from 'bun';
+import typia from 'typia';
 import { githubCiApplyOutputs, githubCiNxRunMany } from '../github-ci/index.js';
 import { assertNoConflictMarkers } from '../lib/conflict-markers.js';
 import { withDevenvEnv } from '../lib/devenv.js';
-import { isRecord, readJsonObject, stringProperty } from '../lib/json.js';
+import {
+  type NxJson,
+  type NxProjectJson,
+  type NxTargetConfig,
+  type PackageJson,
+  parseNxJsonText,
+  parseNxProjectJsonText,
+  parsePackageJsonText,
+} from '../lib/json.js';
 import { decode, run, runInteractiveStatus, runResult } from '../lib/run.js';
 import { listReleasePackages, readPackageJson, repositoryInfo } from '../lib/workspace.js';
 import { readPackedPackageJson, validatePackedWorkspaceDependencies } from '../monorepo/packed-manifest.js';
@@ -572,7 +582,7 @@ async function publishPlaceholderPackage(
           name: pkg.name,
           version: NPM_BOOTSTRAP_VERSION,
           description: `Bootstrap placeholder for ${pkg.name}. Real releases are published by SmoothBricks CI.`,
-          license: stringProperty(pkg.json, 'license') ?? 'UNLICENSED',
+          license: pkg.json.license ?? 'UNLICENSED',
           repository: pkg.json.repository,
           publishConfig: { access: 'public' },
         },
@@ -596,7 +606,7 @@ function safeTarballPrefix(name: string): string {
 
 async function assertPackedWorkspaceDependencies(root: string, tarball: string, pkg: ReleasePackage): Promise<void> {
   const manifest = await readPackedPackageJson(root, tarball, pkg.name);
-  const failures = validatePackedWorkspaceDependencies(root, pkg, manifest);
+  const failures = validatePackedWorkspaceDependencies(root, pkg, manifest, { mode: 'publish' });
   if (failures.length > 0) {
     throw new Error(failures.join('\n'));
   }
@@ -783,8 +793,7 @@ async function packageVersionAtRef(root: string, packagePath: string, ref: strin
     return null;
   }
   try {
-    const parsed = JSON.parse(decode(result.stdout));
-    return isRecord(parsed) ? stringProperty(parsed, 'version') : null;
+    return parsePackageJsonText(decode(result.stdout))?.version ?? null;
   } catch {
     return null;
   }
@@ -1264,74 +1273,83 @@ async function packageChangedFilesSince(root: string, ref: string, packagePath:
     .map((path) => (path.startsWith(packagePrefix) ? path.slice(packagePrefix.length) : path));
 }
 
-async function packageJsonAtRef(
-  root: string,
-  ref: string,
-  packagePath: string,
-): Promise<Record<string, unknown> | null> {
+async function packageJsonAtRef(root: string, ref: string, packagePath: string): Promise<PackageJson | null> {
   const result = await $`git show ${`${ref}:${packagePath}/package.json`}`.cwd(root).quiet().nothrow();
   if (result.exitCode !== 0) {
     return null;
   }
   try {
-    const parsed = JSON.parse(decode(result.stdout));
-    return isRecord(parsed) ? parsed : null;
+    return parsePackageJsonText(decode(result.stdout));
   } catch {
     return null;
   }
 }
 
-async function currentPackageJson(root: string, packagePath: string): Promise<Record<string, unknown> | null> {
+async function currentPackageJson(root: string, packagePath: string): Promise<PackageJson | null> {
   return readPackageJson(join(root, packagePath, 'package.json'))?.json ?? null;
 }
 
 async function packageBuildInputPatterns(root: string, projectName: string, _packagePath: string): Promise<string[]> {
   const project = await nxProjectJson(root, projectName);
-  const nxJson = readJsonObject(join(root, 'nx.json')) ?? {};
-  return resolveBuildInputPatterns(project, nxJson);
+  return resolveBuildInputPatterns(project, readNxJson(join(root, 'nx.json')));
 }
 
-async function nxProjectJson(root: string, projectName: string): Promise<Record<string, unknown>> {
+async function nxProjectJson(root: string, projectName: string): Promise<NxProjectJson> {
   const result = await $`nx show project ${projectName} --json`.cwd(root).quiet();
-  const parsed = JSON.parse(decode(result.stdout));
-  if (!isRecord(parsed)) {
+  const parsed = parseNxProjectJsonText(decode(result.stdout));
+  if (!parsed) {
     throw new Error(`Unable to inspect Nx project ${projectName}.`);
   }
   return parsed;
 }
 
-function resolveBuildInputPatterns(project: Record<string, unknown>, nxJson: Record<string, unknown>): string[] {
-  const targets = recordProperty(project, 'targets');
+function readNxJson(path: string): NxJson {
+  if (!existsSync(path)) {
+    return {};
+  }
+  try {
+    return parseNxJsonText(readFileSync(path, 'utf8')) ?? {};
+  } catch {
+    return {};
+  }
+}
+
+function resolveBuildInputPatterns(project: NxProjectJson, nxJson: NxJson): string[] {
+  const targets = project.targets;
   if (!targets) {
     return [];
   }
   return normalizeInputPatterns(collectBuildInputs(targets), nxJson);
 }
 
-function collectBuildInputs(targets: Record<string, unknown>): string[] {
-  const build = recordProperty(targets, 'build');
+function collectBuildInputs(targets: Record<string, NxTargetConfig>): string[] {
+  const build = targets.build;
   if (!build) {
     return ['production'];
   }
-  const directInputs = stringArrayProperty(build, 'inputs');
+  const directInputs = stringInputs(build.inputs);
   if (directInputs.length > 0) {
     return directInputs;
   }
   const inputs: string[] = [];
-  for (const dependency of stringArrayProperty(build, 'dependsOn')) {
-    if (dependency.startsWith('^')) {
+  for (const dependency of build.dependsOn ?? []) {
+    if (typeof dependency !== 'string' || dependency.startsWith('^')) {
       continue;
     }
     const targetName = dependency.includes(':') ? dependency.split(':')[1] : dependency;
     if (!targetName) {
       continue;
     }
-    inputs.push(...stringArrayProperty(recordProperty(targets, targetName), 'inputs'));
+    inputs.push(...stringInputs(targets[targetName]?.inputs));
   }
   return inputs.length > 0 ? inputs : ['production'];
 }
 
-function normalizeInputPatterns(inputs: string[], nxJson: Record<string, unknown>): string[] {
+function stringInputs(inputs: NxTargetConfig['inputs'] | undefined): string[] {
+  return Array.isArray(inputs) ? inputs.filter((entry): entry is string => typeof entry === 'string') : [];
+}
+
+function normalizeInputPatterns(inputs: string[], nxJson: NxJson): string[] {
   const patterns: string[] = [];
   const seen = new Set<string>();
   for (const input of inputs) {
@@ -1342,14 +1360,13 @@ function normalizeInputPatterns(inputs: string[], nxJson: Record<string, unknown
   return patterns;
 }
 
-function expandInputPattern(input: string, nxJson: Record<string, unknown>, seen: Set<string>): string[] {
+function expandInputPattern(input: string, nxJson: NxJson, seen: Set<string>): string[] {
   if (seen.has(input)) {
     return [];
   }
   seen.add(input);
   if (!input.includes('{')) {
-    const namedInputs = recordProperty(nxJson, 'namedInputs');
-    const namedInput = namedInputs?.[input];
+    const namedInput = nxJson.namedInputs?.[input];
     if (Array.isArray(namedInput)) {
       return namedInput.flatMap((entry) => (typeof entry === 'string' ? expandInputPattern(entry, nxJson, seen) : []));
     }
@@ -1364,19 +1381,6 @@ function expandInputPattern(input: string, nxJson: Record<string, unknown>, seen
   return [`${excluded ? '!' : ''}${packageRelative}`];
 }
 
-function recordProperty(record: Record<string, unknown> | null, key: string): Record<string, unknown> | null {
-  if (!record) {
-    return null;
-  }
-  const value = record[key];
-  return isRecord(value) ? value : null;
-}
-
-function stringArrayProperty(record: Record<string, unknown> | null, key: string): string[] {
-  const value = record?.[key];
-  return Array.isArray(value) ? value.filter((entry): entry is string => typeof entry === 'string') : [];
-}
-
 async function packageHasHistory(root: string, packagePath: string): Promise<boolean> {
   const result = await $`git log --format=%H -- ${packagePath}`.cwd(root).quiet().nothrow();
   if (result.exitCode !== 0) {
@@ -1615,7 +1619,7 @@ async function runLatestNpmTrust(
   if (status === 0) {
     return 'configured';
   }
-  throw new Error(`nix shell nixpkgs#nodejs_latest -c npm ${npmArgs.join(' ')} failed with exit code ${status}`);
+  throw new Error(npmCommandFailedMessage(npmArgs, status));
 }
 
 async function listTrustedPublishers(root: string, pkg: Pick<ReleasePackage, 'name'>): Promise<TrustedPublisherLookup> {
@@ -1624,7 +1628,7 @@ async function listTrustedPublishers(root: string, pkg: Pick<ReleasePackage, 'na
   if (result.exitCode !== 0 && /\bEOTP\b/.test(`${result.stdout}\n${result.stderr}`)) {
     const status = await runInteractiveStatus('nix', ['shell', 'nixpkgs#nodejs_latest', '-c', 'npm', ...args], root);
     if (status !== 0) {
-      throw new Error(`nix shell nixpkgs#nodejs_latest -c npm ${args.join(' ')} failed with exit code ${status}`);
+      throw new Error(npmCommandFailedMessage(args, status));
     }
     result = await runResult('nix', ['shell', 'nixpkgs#nodejs_latest', '-c', 'npm', ...args], root);
   }
@@ -1632,15 +1636,47 @@ async function listTrustedPublishers(root: string, pkg: Pick<ReleasePackage, 'na
     return npmTrustAccessDetails(root, pkg.name);
   }
   if (result.exitCode !== 0) {
-    throw new Error(
-      `nix shell nixpkgs#nodejs_latest -c npm ${args.join(' ')} failed with exit code ${result.exitCode}`,
-    );
+    throw new Error(npmCommandFailedMessage(args, result.exitCode, result.stdout, result.stderr));
   }
   return parseTrustedPublishers(result.stdout, pkg.name);
 }
 
+/** npm trust list/setup requires an authenticated package owner. */
 export function npmTrustListAccessDenied(stdout: string, stderr: string): boolean {
-  return /\bE403\b/.test(`${stdout}\n${stderr}`);
+  const output = `${stdout}\n${stderr}`;
+  // E403: authenticated but not an owner. E401 / login-required: no usable session.
+  return (
+    /\bE403\b/.test(output) ||
+    /\bE401\b/.test(output) ||
+    /You must be logged in to publish packages/i.test(output) ||
+    /npm error 401 Unauthorized/i.test(output)
+  );
+}
+
+function npmCommandFailedMessage(npmArgs: string[], exitCode: number, stdout = '', stderr = ''): string {
+  const command = `nix shell nixpkgs#nodejs_latest -c npm ${npmArgs.join(' ')}`;
+  const detail = npmFailureDetail(stdout, stderr);
+  return detail.length > 0
+    ? `${command} failed with exit code ${exitCode}\n${detail}`
+    : `${command} failed with exit code ${exitCode}`;
+}
+
+function npmFailureDetail(stdout: string, stderr: string): string {
+  const chunks = [stderr.trim(), stdout.trim()].filter((chunk) => chunk.length > 0);
+  if (chunks.length === 0) {
+    return '';
+  }
+  // Prefer the actionable npm error line over notice spam when present.
+  const joined = chunks.join('\n');
+  const errorLines = joined
+    .split('\n')
+    .map((line) => line.trimEnd())
+    .filter((line) => /npm error|error code|401 Unauthorized|403 Forbidden|E401|E403|logged in/i.test(line));
+  if (errorLines.length > 0) {
+    return errorLines.slice(0, 8).join('\n');
+  }
+  // Fall back to a short tail of combined output.
+  return joined.split('\n').slice(-12).join('\n');
 }
 
 async function npmTrustAccessDetails(root: string, packageName: string): Promise<NpmTrustAccessDenied> {
@@ -1665,36 +1701,31 @@ export function parseTrustedPublishers(stdout: string, packageName: string): Tru
   if (stdout.trim().length === 0) {
     return [];
   }
-  const parsed = JSON.parse(stdout) as unknown;
+  // createIsParse returns null for non-matching shapes and bare `null`.
+  const parsed = parseTrustedPublisherJson(stdout);
   if (parsed === null) {
-    return [];
-  }
-  if (Array.isArray(parsed)) {
-    return parsed.map((value) => parseTrustedPublisher(value, packageName));
-  }
-  if (isRecord(parsed)) {
-    return [parseTrustedPublisher(parsed, packageName)];
+    if (stdout.trim() === 'null') {
+      return [];
+    }
+    throw new Error(`${packageName}: npm trust list returned invalid trusted publisher JSON.`);
   }
-  throw new Error(`${packageName}: npm trust list returned invalid JSON.`);
+  return (Array.isArray(parsed) ? parsed : [parsed]).map((value) => ({
+    id: value.id,
+    type: value.type,
+    file: value.file,
+    repository: value.repository,
+  }));
 }
 
-function parseTrustedPublisher(value: unknown, packageName: string): TrustedPublisher {
-  if (!isRecord(value)) {
-    throw new Error(`${packageName}: npm trust list returned invalid trusted publisher entry.`);
-  }
-  const id = stringProperty(value, 'id');
-  const type = stringProperty(value, 'type');
-  if (!id || !type) {
-    throw new Error(`${packageName}: npm trust list returned a trusted publisher without id or type.`);
-  }
-  return {
-    id,
-    type,
-    file: stringProperty(value, 'file') ?? undefined,
-    repository: stringProperty(value, 'repository') ?? undefined,
-  };
+interface TrustedPublisherJson {
+  id: string;
+  type: string;
+  file?: string;
+  repository?: string;
 }
 
+const parseTrustedPublisherJson = typia.json.createIsParse<TrustedPublisherJson | TrustedPublisherJson[]>();
+
 async function runLatestNpmPublish(root: string, npmArgs: string[]): Promise<void> {
   await runLatestNpm(root, npmArgs, { NODE_AUTH_TOKEN: '', NPM_TOKEN: '' });
 }

package/src/wrangler/prepare-env.ts

@@ -20,13 +20,50 @@ import { existsSync, readFileSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { $ } from 'bun';
 import { type AST, getStaticTOMLValue, parseTOML } from 'toml-eslint-parser';
+import typia from 'typia';
 
-// ── runtime narrowing (wrangler JSON is external data — no casts) ─────────────
+// ── runtime narrowing (wrangler TOML/JSON is external data — no casts) ───────
 
-export function isRecord(v: unknown): v is Record<string, unknown> {
-  return typeof v === 'object' && v !== null && !Array.isArray(v);
+interface WranglerTomlRoot {
+  env?: Record<string, WranglerEnvBlock | undefined>;
 }
 
+interface WranglerEnvBlock {
+  vars?: Record<string, unknown>;
+  kv_namespaces?: WranglerKvRow[];
+  d1_databases?: WranglerD1Row[];
+  [key: string]: unknown;
+}
+
+interface WranglerKvRow {
+  binding?: string;
+  id?: string;
+}
+
+interface WranglerD1Row {
+  binding?: string;
+  database_id?: string;
+  database_name?: string;
+}
+
+interface WranglerSecretRow {
+  name?: string;
+}
+
+interface ShellErrorShape {
+  stderr?: unknown;
+  exitCode?: unknown;
+}
+
+const isWranglerTomlRoot = typia.createIs<WranglerTomlRoot>();
+const isWranglerEnvBlock = typia.createIs<WranglerEnvBlock>();
+const isWranglerKvRow = typia.createIs<WranglerKvRow>();
+const isWranglerD1Row = typia.createIs<WranglerD1Row>();
+const isWranglerSecretRow = typia.createIs<WranglerSecretRow>();
+const isKvNamespaceRow = typia.createIs<{ id: string; title: string }>();
+const isD1DatabaseRow = typia.createIs<{ uuid: string; name: string }>();
+const isShellErrorShape = typia.createIs<ShellErrorShape>();
+
 // ── wrangler.toml editors (CST: read via getStaticTOMLValue, write via
 // node-range splice — comment/format-preserving by construction, no regex) ─────
 
@@ -36,15 +73,14 @@ function tables(toml: string): AST.TOMLTable[] {
 }
 
 /** Whole doc as a JS object (comments/format dropped — reads only). */
-function tomlValue(toml: string): Record<string, unknown> {
-  const value = getStaticTOMLValue(parseTOML(toml));
-  return isRecord(value) ? value : {};
+function tomlValue(toml: string): WranglerTomlRoot {
+  const value: unknown = getStaticTOMLValue(parseTOML(toml));
+  return isWranglerTomlRoot(value) ? value : {};
 }
 
-function envRecord(toml: string, env: string): Record<string, unknown> | null {
-  const envs = tomlValue(toml).env;
-  const block = isRecord(envs) ? envs[env] : undefined;
-  return isRecord(block) ? block : null;
+function envRecord(toml: string, env: string): WranglerEnvBlock | null {
+  const block = tomlValue(toml).env?.[env];
+  return isWranglerEnvBlock(block) ? block : null;
 }
 
 function sameKey(a: (string | number)[], b: (string | number)[]): boolean {
@@ -68,8 +104,13 @@ function arrayTableKv(
   field: string,
 ): AST.TOMLKeyValue | null {
   const block = envRecord(toml, env);
-  const rows = isRecord(block) && Array.isArray(block[arrayKey]) ? block[arrayKey] : [];
-  const index = rows.findIndex((r) => isRecord(r) && r.binding === binding);
+  const rows = Array.isArray(block?.[arrayKey]) ? block[arrayKey] : [];
+  const index = rows.findIndex((row) => {
+    if (arrayKey === 'd1_databases') {
+      return isWranglerD1Row(row) && row.binding === binding;
+    }
+    return isWranglerKvRow(row) && row.binding === binding;
+  });
   if (index < 0) return null;
   const table = tables(toml).find((t) => t.kind === 'array' && sameKey(t.resolvedKey, ['env', env, arrayKey, index]));
   return table ? kvIn(toml, table, field) : null;
@@ -88,7 +129,7 @@ function endOfLine(toml: string, offset: number): number {
 /** First `[env.<name>]` (source order; also derived from a nested `[env.<name>.*]`), or null when no env declared. */
 export function firstWranglerEnv(toml: string): string | null {
   const envs = tomlValue(toml).env;
-  if (!isRecord(envs)) return null;
+  if (!envs) return null;
   const [first] = Object.keys(envs);
   return first ?? null;
 }
@@ -96,14 +137,12 @@ export function firstWranglerEnv(toml: string): string | null {
 /** True if the toml declares `[env.<env>]` (or any `[env.<env>.*]` sub-table). */
 export function hasEnvBlock(toml: string, env: string): boolean {
   const envs = tomlValue(toml).env;
-  return isRecord(envs) && env in envs;
+  return !!envs && env in envs;
 }
 
 /** A `[env.<env>.vars]` value, or null if unset/empty. Reads committed public config. */
 export function getVar(toml: string, env: string, name: string): string | null {
-  const block = envRecord(toml, env);
-  const vars = isRecord(block?.vars) ? block.vars : {};
-  const value = vars[name];
+  const value = envRecord(toml, env)?.vars?.[name];
   return typeof value === 'string' && value ? value : null;
 }
 
@@ -117,10 +156,8 @@ export function setVar(toml: string, env: string, name: string, value: string):
 
 /** The id written for `[[env.<env>.kv_namespaces]]` binding, or null if absent/empty. */
 export function getKvId(toml: string, env: string, binding: string): string | null {
-  const block = envRecord(toml, env);
-  const rows = isRecord(block) && Array.isArray(block.kv_namespaces) ? block.kv_namespaces : [];
-  for (const row of rows) {
-    if (isRecord(row) && row.binding === binding && typeof row.id === 'string') return row.id || null;
+  for (const row of envRecord(toml, env)?.kv_namespaces ?? []) {
+    if (row.binding === binding && typeof row.id === 'string') return row.id || null;
   }
   return null;
 }
@@ -166,21 +203,16 @@ export function blankKvIds(toml: string, env: string): string {
 
 /** The database_id written for `[[env.<env>.d1_databases]]` binding, or null if absent/empty. */
 export function getD1Id(toml: string, env: string, binding: string): string | null {
-  const block = envRecord(toml, env);
-  const rows = isRecord(block) && Array.isArray(block.d1_databases) ? block.d1_databases : [];
-  for (const row of rows) {
-    if (isRecord(row) && row.binding === binding && typeof row.database_id === 'string') return row.database_id || null;
+  for (const row of envRecord(toml, env)?.d1_databases ?? []) {
+    if (row.binding === binding && typeof row.database_id === 'string') return row.database_id || null;
   }
   return null;
 }
 
 /** The `database_name` for `[[env.<env>.d1_databases]]` binding, or null. Source of truth for which DB to create/reuse. */
 export function getD1Name(toml: string, env: string, binding: string): string | null {
-  const block = envRecord(toml, env);
-  const rows = isRecord(block) && Array.isArray(block.d1_databases) ? block.d1_databases : [];
-  for (const row of rows) {
-    if (isRecord(row) && row.binding === binding && typeof row.database_name === 'string')
-      return row.database_name || null;
+  for (const row of envRecord(toml, env)?.d1_databases ?? []) {
+    if (row.binding === binding && typeof row.database_name === 'string') return row.database_name || null;
   }
   return null;
 }
@@ -260,12 +292,13 @@ export function parseDevVarsExample(text: string): string[] {
 export function readManifest(root: string, env: string): Manifest {
   const toml = readFileSync(join(root, 'wrangler.toml'), 'utf8');
   const block = envRecord(toml, env);
-  const varsRec = isRecord(block?.vars) ? block.vars : {};
-  const vars = Object.keys(varsRec);
-  const kvRows = isRecord(block) && Array.isArray(block.kv_namespaces) ? block.kv_namespaces : [];
-  const kvBindings = kvRows.flatMap((row) => (isRecord(row) && typeof row.binding === 'string' ? [row.binding] : []));
-  const d1Rows = isRecord(block) && Array.isArray(block.d1_databases) ? block.d1_databases : [];
-  const d1Bindings = d1Rows.flatMap((row) => (isRecord(row) && typeof row.binding === 'string' ? [row.binding] : []));
+  const vars = Object.keys(block?.vars ?? {});
+  const kvBindings = (block?.kv_namespaces ?? []).flatMap((row) =>
+    typeof row.binding === 'string' ? [row.binding] : [],
+  );
+  const d1Bindings = (block?.d1_databases ?? []).flatMap((row) =>
+    typeof row.binding === 'string' ? [row.binding] : [],
+  );
   const examplePath = join(root, '.dev.vars.example');
   const secrets = existsSync(examplePath) ? parseDevVarsExample(readFileSync(examplePath, 'utf8')) : [];
   return { kvBindings, d1Bindings, vars, secrets };
@@ -300,25 +333,19 @@ export interface KvNamespace {
 
 function asKvNamespaces(json: unknown): KvNamespace[] {
   if (!Array.isArray(json)) return [];
-  const out: KvNamespace[] = [];
-  for (const row of json) {
-    if (isRecord(row) && typeof row.id === 'string' && typeof row.title === 'string') {
-      out.push({ id: row.id, title: row.title });
-    }
-  }
-  return out;
+  return json.filter(isKvNamespaceRow);
 }
 
 function asSecretNames(json: unknown): string[] {
   if (!Array.isArray(json)) return [];
-  return json.flatMap((row) => (isRecord(row) && typeof row.name === 'string' ? [row.name] : []));
+  return json.flatMap((row) => (isWranglerSecretRow(row) && typeof row.name === 'string' ? [row.name] : []));
 }
 
 /** Best-effort ERROR line from a Bun ShellError (thrown on non-zero exit). */
 export function errText(err: unknown): string {
-  if (!isRecord(err)) return 'unknown error';
-  const stderr = 'stderr' in err && err.stderr != null ? String(err.stderr) : '';
-  const exit = 'exitCode' in err ? String(err.exitCode) : '?';
+  if (!isShellErrorShape(err)) return 'unknown error';
+  const stderr = err.stderr != null ? String(err.stderr) : '';
+  const exit = err.exitCode != null ? String(err.exitCode) : '?';
   return stderr.split('\n').find((l) => l.includes('ERROR')) ?? `exit ${exit}`;
 }
 
@@ -358,13 +385,7 @@ export interface D1Database {
 
 function asD1Databases(json: unknown): D1Database[] {
   if (!Array.isArray(json)) return [];
-  const out: D1Database[] = [];
-  for (const row of json) {
-    if (isRecord(row) && typeof row.uuid === 'string' && typeof row.name === 'string') {
-      out.push({ uuid: row.uuid, name: row.name });
-    }
-  }
-  return out;
+  return json.filter(isD1DatabaseRow);
 }
 
 /** Live D1 databases on the account (`d1 list --json`); `[]` when offline/unauthenticated. */

package/src/wrangler/scaffold.test.ts

@@ -2,6 +2,7 @@ import { describe, expect, it, spyOn } from 'bun:test';
 import { mkdir, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
+import { type PackageJson, parsePackageJsonText } from '../lib/json.js';
 import { scaffold } from './scaffold.js';
 
 describe('scaffold', () => {
@@ -164,27 +165,23 @@ async function createWorkspace(
   return root;
 }
 
-function nxTargets(pkg: Record<string, unknown>): Record<string, unknown> {
-  const nx = pkg.nx;
-  if (!isRecord(nx) || !isRecord(nx.targets)) {
+function nxTargets(pkg: PackageJson): NonNullable<NonNullable<PackageJson['nx']>['targets']> {
+  const targets = pkg.nx?.targets;
+  if (!targets) {
     throw new Error('nx.targets not found');
   }
-  return nx.targets;
+  return targets;
 }
 
-function isRecord(value: unknown): value is Record<string, unknown> {
-  return typeof value === 'object' && value !== null && !Array.isArray(value);
-}
-
-async function readJson(path: string): Promise<Record<string, unknown>> {
-  const parsed: unknown = JSON.parse(await readFile(path, 'utf8'));
-  if (!isRecord(parsed)) {
+async function readJson(path: string): Promise<PackageJson> {
+  const parsed = parsePackageJsonText(await readFile(path, 'utf8'));
+  if (!parsed) {
     throw new Error('expected JSON object');
   }
   return parsed;
 }
 
-async function writeJson(path: string, value: Record<string, unknown>): Promise<void> {
+async function writeJson(path: string, value: PackageJson): Promise<void> {
   await mkdir(join(path, '..'), { recursive: true });
   await writeFile(path, `${JSON.stringify(value, null, 2)}\n`);
 }

package/src/wrangler/scaffold.ts

@@ -6,8 +6,8 @@
  * .dev.vars.example), so it never drifts from what the worker declares.
  */
 import { existsSync, mkdirSync, writeFileSync } from 'node:fs';
-import { join, relative } from 'node:path';
-import { getOrCreateRecord, recordProperty, writeJsonObject } from '../lib/json.js';
+import { join } from 'node:path';
+import { ensureNx, ensureNxTargets, type NxTargetConfig, type PackageJson, writeJsonObject } from '../lib/json.js';
 import { getWorkspacePackageManifests } from '../lib/workspace.js';
 
 export interface ScaffoldOptions {
@@ -19,22 +19,21 @@ export interface ScaffoldOptions {
 function resolveProject(
   root: string,
   project: string,
-): { dir: string; label: string; packageJsonPath: string; json: Record<string, unknown> } {
+): { dir: string; label: string; packageJsonPath: string; json: PackageJson } {
   const manifests = getWorkspacePackageManifests(root);
   const match = manifests.find((m) => {
-    const nx = recordProperty(m.json, 'nx');
-    const nxName = nx && typeof nx.name === 'string' ? nx.name : null;
-    return nxName === project || m.name === project || relative(root, m.path) === project;
+    const nxName = m.json.nx?.name;
+    return nxName === project || m.name === project || m.path === project;
   });
   if (!match) {
-    const known = manifests.map((m) => recordProperty(m.json, 'nx')?.name ?? m.name).join(', ');
+    const known = manifests.map((m) => m.json.nx?.name ?? m.name).join(', ');
     throw new Error(`project "${project}" not found. Known: ${known}`);
   }
-  const dir = match.path; // WorkspacePackageManifest.path is absolute
+  const dir = join(root, match.path);
   if (!existsSync(join(dir, 'wrangler.toml'))) {
     throw new Error(`"${project}" has no wrangler.toml — not a wrangler project`);
   }
-  return { dir, label: relative(root, dir), packageJsonPath: match.packageJsonPath, json: match.json };
+  return { dir, label: match.path, packageJsonPath: match.packageJsonPath, json: match.json };
 }
 
 /** The generated starter script — generic, manifest-driven, prompt-batteries included. */
@@ -226,13 +225,14 @@ export function scaffold(root: string, project: string, options: ScaffoldOptions
   console.log(`${existed ? 'overwrote' : 'created'}      ${label}/scripts/prepare-env.ts`);
 
   // Wire the nx target (idempotent).
-  const nx = getOrCreateRecord(json, 'nx');
-  const targets = getOrCreateRecord(nx, 'targets');
-  if (!recordProperty(targets, 'prepare-env')) {
-    targets['prepare-env'] = {
+  const nx = ensureNx(json);
+  const targets = ensureNxTargets(nx);
+  if (!targets['prepare-env']) {
+    const prepareEnvTarget: NxTargetConfig = {
       executor: 'nx:run-commands',
       options: { command: 'bun scripts/prepare-env.ts', cwd: '{projectRoot}' },
     };
+    targets['prepare-env'] = prepareEnvTarget;
     writeJsonObject(packageJsonPath, json);
     console.log(`updated       ${label}/package.json prepare-env target`);
   }