@smoothbricks/cli 0.10.6 → 0.10.8

package/dist/wrangler/environment.js

@@ -0,0 +1,297 @@
+import { createHash } from 'node:crypto';
+import { getStaticTOMLValue, parseTOML } from 'toml-eslint-parser';
+import typia from 'typia';
+import { cloneEnvBlock } from './prepare-env.js';
+const MAX_PULL_REQUEST_NUMBER = 999999999;
+const ENVIRONMENT_PATTERN = /^(?:staging|production|pr[1-9][0-9]{0,8})$/;
+export function pullRequestEnvironment(prNumber) {
+    if (!Number.isInteger(prNumber) || prNumber < 1 || prNumber > MAX_PULL_REQUEST_NUMBER) {
+        throw new Error(`Pull request number must be an integer from 1 through ${MAX_PULL_REQUEST_NUMBER}.`);
+    }
+    return `pr${prNumber}`;
+}
+export function parseEnvironmentToken(value) {
+    if (!ENVIRONMENT_PATTERN.test(value)) {
+        throw new Error('Environment must be exactly staging, production, or pr followed by an integer from 1 through 999999999.');
+    }
+    if (value === 'staging' || value === 'production')
+        return value;
+    return pullRequestEnvironment(Number(value.slice(2)));
+}
+export function isPullRequestEnvironment(environment) {
+    return environment.startsWith('pr');
+}
+export function environmentDomain(environment, zone) {
+    const token = parseEnvironmentToken(environment);
+    if (!zone || zone.startsWith('.') || zone.endsWith('.')) {
+        throw new Error('Zone must be a non-empty DNS name without leading or trailing dots.');
+    }
+    return token === 'production' ? zone : `${token}.${zone}`;
+}
+export function environmentResourceName(base, environment) {
+    const token = parseEnvironmentToken(environment);
+    if (!base) {
+        throw new Error('Resource base name must not be empty.');
+    }
+    return token === 'production' ? base : `${base}-${token}`;
+}
+export function hasExactEnvironmentSegment(value, environment) {
+    const escaped = environment.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    return new RegExp(`(?:^|[-.])${escaped}(?=$|[-.])`).test(value);
+}
+const isWranglerRoot = (() => {
+    const _io0 = input => undefined === input.env || "object" === typeof input.env && null !== input.env && false === Array.isArray(input.env) && _io1(input.env);
+    const _io1 = input => Object.keys(input).every(key => {
+        const value = input[key];
+        if (undefined === value)
+            return true;
+        return undefined === value || "object" === typeof value && null !== value && false === Array.isArray(value) && _io2(value);
+    });
+    const _io2 = input => true && true && true && true && true && true && Object.keys(input).every(key => {
+        if (["name", "routes", "kv_namespaces", "r2_buckets", "ratelimits", "vars"].some(prop => key === prop))
+            return true;
+        const value = input[key];
+        if (undefined === value)
+            return true;
+        return true;
+    });
+    return input => "object" === typeof input && null !== input && false === Array.isArray(input) && _io0(input);
+})();
+const isWranglerEnvironment = (() => {
+    const _io0 = input => true && true && true && true && true && true && Object.keys(input).every(key => {
+        if (["name", "routes", "kv_namespaces", "r2_buckets", "ratelimits", "vars"].some(prop => key === prop))
+            return true;
+        const value = input[key];
+        if (undefined === value)
+            return true;
+        return true;
+    });
+    return input => "object" === typeof input && null !== input && false === Array.isArray(input) && _io0(input);
+})();
+const isUnknownRecord = (() => {
+    const _io0 = input => Object.keys(input).every(key => {
+        const value = input[key];
+        if (undefined === value)
+            return true;
+        return true;
+    });
+    return input => "object" === typeof input && null !== input && false === Array.isArray(input) && _io0(input);
+})();
+const isUnknownRows = (() => {
+    const _io0 = input => Object.keys(input).every(key => {
+        const value = input[key];
+        if (undefined === value)
+            return true;
+        return true;
+    });
+    return input => Array.isArray(input) && input.every(elem => "object" === typeof elem && null !== elem && false === Array.isArray(elem) && _io0(elem));
+})();
+export function planConfiguredEnvironmentResources(toml, environment) {
+    const block = parseRoot(toml).env?.[environment];
+    if (!isWranglerEnvironment(block)) {
+        throw new Error(`Wrangler configuration must declare [env.${environment}].`);
+    }
+    const workerName = requiredString(block, 'name', `[env.${environment}]`);
+    return {
+        environment,
+        workerName,
+        kvNamespaces: readKvBindings(block.kv_namespaces),
+        r2Buckets: readRows(block.r2_buckets).map((row) => {
+            const binding = requiredString(row, 'binding', 'R2 binding');
+            return { binding, bucketName: requiredString(row, 'bucket_name', `R2 binding ${binding}`) };
+        }),
+        routes: readRows(block.routes).map((row) => ({
+            pattern: requiredString(row, 'pattern', 'route'),
+            ...(typeof row.zone_name === 'string' ? { zoneName: row.zone_name } : {}),
+            customDomain: row.custom_domain === true,
+        })),
+    };
+}
+function parseRoot(toml) {
+    const value = getStaticTOMLValue(parseTOML(toml));
+    if (!isWranglerRoot(value)) {
+        throw new Error('Wrangler configuration is not a valid TOML environment document.');
+    }
+    return value;
+}
+function stagingEnvironment(toml) {
+    const staging = parseRoot(toml).env?.staging;
+    if (!isWranglerEnvironment(staging)) {
+        throw new Error('Wrangler configuration must declare [env.staging].');
+    }
+    return staging;
+}
+function stagingWorkerName(staging) {
+    if (typeof staging.name !== 'string' || !staging.name.endsWith('-staging')) {
+        throw new Error('[env.staging].name must end with the exact suffix -staging.');
+    }
+    return { workerName: staging.name, workerBaseName: staging.name.slice(0, -'-staging'.length) };
+}
+export function planPullRequestResources(toml, environment, liveNamespaces) {
+    parseEnvironmentToken(environment);
+    const staging = stagingEnvironment(toml);
+    const { workerBaseName } = stagingWorkerName(staging);
+    const namespaceById = new Map(liveNamespaces.map((namespace) => [namespace.id, namespace]));
+    const kvNamespaces = readKvBindings(staging.kv_namespaces).map(({ binding, id }) => {
+        const stagingNamespace = namespaceById.get(id);
+        if (!stagingNamespace) {
+            throw new Error(`Staging KV binding ${binding} references namespace ${id}, which is absent from the account listing.`);
+        }
+        const title = replaceExactToken(stagingNamespace.title, 'staging', environment);
+        if (title === stagingNamespace.title) {
+            throw new Error(`Staging KV namespace title ${stagingNamespace.title} has no exact staging segment.`);
+        }
+        return { binding, stagingId: id, stagingTitle: stagingNamespace.title, title };
+    });
+    const r2Buckets = readRows(staging.r2_buckets).map((row) => {
+        const binding = requiredString(row, 'binding', 'R2 binding');
+        const stagingBucket = requiredString(row, 'bucket_name', `R2 binding ${binding}`);
+        const bucketName = replaceExactToken(stagingBucket, 'staging', environment);
+        if (bucketName === stagingBucket) {
+            throw new Error(`Staging R2 bucket ${stagingBucket} has no exact staging segment.`);
+        }
+        return { binding, bucketName };
+    });
+    const routes = readRows(staging.routes).map((row) => ({
+        pattern: replaceHostnameLabel(requiredString(row, 'pattern', 'route'), environment),
+        ...(typeof row.zone_name === 'string' ? { zoneName: row.zone_name } : {}),
+        customDomain: row.custom_domain === true,
+    }));
+    return {
+        environment,
+        workerName: environmentResourceName(workerBaseName, environment),
+        workerBaseName,
+        kvNamespaces,
+        r2Buckets,
+        routes,
+    };
+}
+export function derivePullRequestWranglerConfig(toml, options) {
+    const environment = options.environment;
+    parseEnvironmentToken(environment);
+    if (!options.accountId) {
+        throw new Error('Cloudflare account id is required to derive rate-limit namespaces.');
+    }
+    const staging = stagingEnvironment(toml);
+    const { workerBaseName } = stagingWorkerName(staging);
+    const cloned = cloneEnvBlock(toml, 'staging', environment);
+    const program = parseTOML(cloned);
+    const rootValue = getStaticTOMLValue(program);
+    if (!isWranglerRoot(rootValue)) {
+        throw new Error('Derived Wrangler configuration is not a valid environment document.');
+    }
+    const root = rootValue;
+    const edits = [];
+    for (const table of program.body[0].body) {
+        if (table.type !== 'TOMLTable' || table.resolvedKey[0] !== 'env' || table.resolvedKey[1] !== environment) {
+            continue;
+        }
+        const tableValue = valueAtPath(root, table.resolvedKey);
+        if (!isUnknownRecord(tableValue)) {
+            continue;
+        }
+        for (const keyValue of table.body) {
+            const key = cloned.slice(keyValue.key.range[0], keyValue.key.range[1]).trim();
+            const current = tableValue[key];
+            const next = deriveFieldValue(table.resolvedKey.slice(2), tableValue, key, current, environment, workerBaseName, options.accountId, options.kvNamespaceIds);
+            if (next !== current) {
+                edits.push({ start: keyValue.value.range[0], end: keyValue.value.range[1], value: tomlLiteral(next) });
+            }
+        }
+    }
+    let derived = cloned;
+    for (const edit of edits.sort((left, right) => right.start - left.start)) {
+        derived = derived.slice(0, edit.start) + edit.value + derived.slice(edit.end);
+    }
+    parseTOML(derived);
+    return derived;
+}
+function deriveFieldValue(path, table, key, current, environment, workerBaseName, accountId, kvNamespaceIds) {
+    const section = path[0];
+    if (path.length === 0 && key === 'name') {
+        return environmentResourceName(workerBaseName, environment);
+    }
+    if (section === 'routes' && key === 'pattern' && typeof current === 'string') {
+        return replaceHostnameLabel(current, environment);
+    }
+    if (section === 'vars' && typeof current === 'string') {
+        if (key === 'ENVIRONMENT') {
+            return environment;
+        }
+        if (key === 'AUTH_KEYS_INSTANCE_NAME') {
+            return replaceExactToken(current, 'staging', environment);
+        }
+        return replaceHostnameLabel(current, environment);
+    }
+    if (section === 'send_email' && key === 'allowed_sender_addresses' && Array.isArray(current)) {
+        return current.map((value) => (typeof value === 'string' ? replaceHostnameLabel(value, environment) : value));
+    }
+    if (section === 'kv_namespaces' && key === 'id' && typeof current === 'string') {
+        const derived = kvNamespaceIds.get(current);
+        if (!derived) {
+            throw new Error(`No derived KV namespace id was supplied for staging namespace ${current}.`);
+        }
+        return derived;
+    }
+    if (section === 'r2_buckets' && key === 'bucket_name' && typeof current === 'string') {
+        return replaceExactToken(current, 'staging', environment);
+    }
+    if (section === 'ratelimits' && key === 'namespace_id') {
+        const bindingName = requiredString(table, 'name', 'Rate-limit binding');
+        return rateLimitNamespaceId(accountId, workerBaseName, environment, bindingName);
+    }
+    return current;
+}
+export function rateLimitNamespaceId(accountId, workerBaseName, environment, bindingName) {
+    const token = parseEnvironmentToken(environment);
+    const digest = createHash('sha256').update(`${accountId}:${workerBaseName}:${token}:${bindingName}`).digest();
+    const value = digest.readUInt32BE(0) & 2147483647;
+    return String(value === 0 ? 1 : value);
+}
+function replaceHostnameLabel(value, environment) {
+    return value.replace(/(^|[.@/])staging(?=\.)/g, `$1${environment}`);
+}
+function replaceExactToken(value, from, to) {
+    const escaped = from.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    return value.replace(new RegExp(`(^|[-.])${escaped}(?=$|[-.])`, 'g'), `$1${to}`);
+}
+function readKvBindings(value) {
+    return readRows(value).map((row) => ({
+        binding: requiredString(row, 'binding', 'KV namespace'),
+        id: requiredString(row, 'id', 'KV namespace'),
+    }));
+}
+function readRows(value) {
+    return isUnknownRows(value) ? value : [];
+}
+function requiredString(row, key, context) {
+    const value = row[key];
+    if (typeof value !== 'string' || !value) {
+        throw new Error(`${context} must declare a non-empty ${key}.`);
+    }
+    return value;
+}
+function valueAtPath(root, path) {
+    let value = root;
+    for (const segment of path) {
+        if (typeof segment === 'number') {
+            if (!Array.isArray(value))
+                return undefined;
+            value = value[segment];
+        }
+        else {
+            if (!isUnknownRecord(value))
+                return undefined;
+            value = value[segment];
+        }
+    }
+    return value;
+}
+function tomlLiteral(value) {
+    if (typeof value === 'string' || typeof value === 'number' || typeof value === 'boolean' || Array.isArray(value)) {
+        const literal = JSON.stringify(value);
+        if (literal !== undefined)
+            return literal;
+    }
+    throw new Error(`Cannot materialize Wrangler TOML value of type ${typeof value}.`);
+}

package/managed/raw/tooling/devenv

@@ -0,0 +1,71 @@
+#!/usr/bin/env bash
+# Wrapper script to run devenv from anywhere in the monorepo
+# This allows us to keep all devenv files in tooling/direnv
+
+# Save the current working directory
+ORIGINAL_PWD="$(pwd)"
+SELF_PATH="$(realpath "$0")"
+
+# Find the root of the git repository
+TOOLING_DIR="$(dirname "$SELF_PATH")"
+DEVENV_DIR="$TOOLING_DIR/direnv"
+if [ ! -d "$DEVENV_DIR" ]; then
+    echo "Error: Could not find devenv directory at $DEVENV_DIR" >&2
+    exit 1
+fi
+
+# Find the actual Nix-built devenv binary, skipping every wrapper script.
+# WHY: PATH routinely holds more than one of these wrappers at once — this
+# repo's tooling/devenv, sibling repos' wrappers, and direnv-stacked parent
+# environments. A plain "not equal to SELF_PATH" check happily selects a
+# *different* wrapper and exec's it, so `devenv` bounces into the wrong repo
+# (or self-execs forever on cheap checks like `devenv version`). The real devenv
+# is always the Nix-managed executable under /nix/store, so match that and ignore
+# every wrapper regardless of PATH ordering. (Matching the store path is also more
+# robust than a "is it a binary" test: Nix sometimes ships tools as makeWrapper
+# shell scripts, which are still the correct entry point.)
+DEVENV_BIN=""
+while IFS= read -r candidate; do
+    candidate_path="$(realpath "$candidate")"
+    case "$candidate_path" in
+        /nix/store/*)
+            if [ -f "$candidate_path" ] && [ -x "$candidate_path" ]; then
+                DEVENV_BIN="$candidate_path"
+                break
+            fi
+            ;;
+    esac
+done < <(which -a devenv 2>/dev/null)
+
+if [ -z "$DEVENV_BIN" ]; then
+    echo "Error: Could not find the Nix-built devenv binary (under /nix/store) in PATH" >&2
+    exit 1
+fi
+
+# If we're in a project, just run devenv
+if [ -f devenv.nix ]; then
+  exec "$DEVENV_BIN" "$@"
+fi
+
+# Change to the tooling/direnv directory where devenv files are located
+cd "$DEVENV_DIR" || exit 1
+
+# Export the original directory so enterShell can use it
+export DEVENV_SHELL_PWD="$ORIGINAL_PWD"
+
+# Run the actual devenv command with all arguments passed through.
+# For updates, refresh nvfetcher-managed overlay sources first so packages like
+# jmunch-mcp and jcodemunch-mcp are current before devenv.lock is updated.
+if [ "${1:-}" = "update" ]; then
+    if [ -f "$DEVENV_DIR/nixpkgs-overlay/nvfetcher.toml" ]; then
+      echo "Running nvfetcher for nixpkgs-overlay/..."
+      (cd "$DEVENV_DIR/nixpkgs-overlay" && echo "
+[keys]
+github = \"$(gh auth token)\"
+" > .gh-auth && (nvfetcher -k .gh-auth -o _sources || true) && rm .gh-auth)
+    fi
+
+    exec "$DEVENV_BIN" "$@"
+fi
+
+exec "$DEVENV_BIN" "$@"

package/managed/raw/tooling/direnv/github-actions-bootstrap.sh

@@ -4,15 +4,14 @@ set -euo pipefail
 NIX_STORE_NAR="${NIX_STORE_NAR:-/tmp/nix-store.nar}"
 nix_store_cmd="/nix/var/nix/profiles/default/bin/nix-store"
 DEVENV_FLAKE="${DEVENV_FLAKE:-github:cachix/devenv}"
-# Host CI cache (GARM bind-mount). Prefer env from runner profile.
-# Path comes from the runner (GARM profile). Ephemeral runners leave unset;
-# devenv enterShell defaults to $PWD/.cache/ttsc.
-TTSC_CACHE_DIR="${TTSC_CACHE_DIR:-}"
 # Resolve from this script's location, not the caller's cwd. GitHub Actions
 # runs this from tooling/direnv today, but direct cwd-changing helpers are easy
 # to misuse and break on repeated calls.
 script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
 repo_root="$(cd "$script_dir/../.." && pwd)"
+# Host CI supplies its bind-mounted cache through the runner profile. Ephemeral
+# runners must use the same repository path restored by cache-ttsc-plugins.
+TTSC_CACHE_DIR="${TTSC_CACHE_DIR:-$repo_root/.cache/ttsc}"
 
 clear_devenv_cache_state() {
   rm -rf "$repo_root/tooling/direnv/.devenv" "$repo_root/tooling/direnv/.direnv"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@smoothbricks/cli",
-  "version": "0.10.6",
+  "version": "0.10.8",
   "type": "module",
   "description": "SmoothBricks monorepo automation CLI",
   "bin": {
@@ -47,6 +47,13 @@
       "development": "./src/wrangler/prepare-env.ts",
       "import": "./dist/wrangler/prepare-env.js",
       "default": "./dist/wrangler/prepare-env.js"
+    },
+    "./wrangler/environment": {
+      "types": "./dist/wrangler/environment.d.ts",
+      "bun": "./src/wrangler/environment.ts",
+      "development": "./src/wrangler/environment.ts",
+      "import": "./dist/wrangler/environment.js",
+      "default": "./dist/wrangler/environment.js"
     }
   },
   "sideEffects": [
@@ -64,8 +71,8 @@
   "dependencies": {
     "@arethetypeswrong/core": "^0.18.2",
     "@prettier/sync": "^0.6.1",
-    "@smoothbricks/nx-plugin": "0.3.4",
-    "@smoothbricks/validation": "0.1.4",
+    "@smoothbricks/nx-plugin": "0.3.5",
+    "@smoothbricks/validation": "0.1.5",
     "commander": "^14.0.3",
     "prettier": "^3.6.1",
     "publint": "^0.3.18",
@@ -73,7 +80,7 @@
     "sherif": "^1.11.1",
     "toml-eslint-parser": "^1.0.3",
     "tslib": "^2.8.1",
-    "typia": "13.1.19"
+    "typia": "13.2.0"
   },
   "devDependencies": {
     "fast-check": "^4.4.0"

package/src/cli.ts

@@ -2,7 +2,9 @@ import { Command, CommanderError } from 'commander';
 import { variants } from './generate/index.js';
 import { cliPackageVersion } from './lib/cli-package.js';
 import { findRepoRoot } from './lib/run.js';
+import { ensureChromium } from './playwright/index.js';
 import { resolvePrConflicts } from './pr/index.js';
+import { cleanupPullRequest, deployEnvironment } from './wrangler/deploy-environment.js';
 import { scaffold } from './wrangler/scaffold.js';
 
 export async function runCli(argv = process.argv.slice(2)): Promise<void> {
@@ -348,10 +350,17 @@ function buildProgram(): Command {
     .command('nx-run-many')
     .requiredOption('--targets <targets>')
     .option('--projects <projects>')
+    .option('--projects-with-targets <targets>', 'select projects owning any comma-separated target or target glob')
     .option('--configuration <configuration>')
     .option('--collect-outputs <directory>')
     .action(
-      async (options: { targets: string; projects?: string; configuration?: string; collectOutputs?: string }) => {
+      async (options: {
+        targets: string;
+        projects?: string;
+        projectsWithTargets?: string;
+        configuration?: string;
+        collectOutputs?: string;
+      }) => {
         const { githubCiNxRunMany } = await import('./github-ci/index.js');
         await githubCiNxRunMany(await findRepoRoot(), options);
       },
@@ -366,14 +375,14 @@ function buildProgram(): Command {
     });
   githubCi
     .command('nx-deploy')
-    .requiredOption('--configuration <configuration>')
+    .option('--environment <environment>', 'explicit staging, production, or prN override')
     .option('--mode <mode>', 'auto, affected, or run-many', 'run-many')
     .option('--name <name>')
     .option('--step <step>')
     .option('--verify', 'run build, lint, and test before deploy')
     .action(
       async (options: {
-        configuration: string;
+        environment?: string;
         mode?: 'auto' | 'affected' | 'run-many';
         name?: string;
         step?: string;
@@ -396,6 +405,15 @@ function buildProgram(): Command {
       }
     });
 
+  const playwright = program.command('playwright').description('Manage Playwright browsers');
+  const playwrightEnsure = playwright.command('ensure').description('Ensure a Playwright browser is available');
+  playwrightEnsure
+    .command('chromium')
+    .description('Ensure Chromium is available for browser tests')
+    .action(async () => {
+      await ensureChromium();
+    });
+
   const wrangler = program.command('wrangler').description('Cloudflare wrangler project helpers');
   wrangler
     .command('scaffold <project>')
@@ -404,6 +422,18 @@ function buildProgram(): Command {
     .action(async (project: string, options: { force?: boolean }) => {
       scaffold(await findRepoRoot(), project, { force: options.force });
     });
+  wrangler
+    .command('deploy-environment')
+    .requiredOption('--environment <environment>', 'staging, production, or prN')
+    .action(async (options: { environment: string }) => {
+      await deployEnvironment(process.cwd(), options.environment);
+    });
+  wrangler
+    .command('cleanup-pr')
+    .requiredOption('--pr <number>', 'pull-request number')
+    .action(async (options: { pr: string }) => {
+      await cleanupPullRequest(process.cwd(), Number(options.pr));
+    });
 
   return program;
 }