@smoothbricks/cli 0.11.18 → 0.11.20

package/dist/wrangler/source-config.js

@@ -0,0 +1,110 @@
+// Where a project's Wrangler configuration lives, and how its file formats become one model.
+//
+// Wrangler reads whichever of `wrangler.jsonc`, `wrangler.json` and `wrangler.toml` it finds
+// first and says nothing about the rest: with a `.jsonc` and a `.toml` side by side, wrangler
+// 4.131.0 deploys the `.jsonc` silently, whichever of the two the repo is actually editing.
+// Discovery here follows the same precedence but refuses the pick, naming every file it found.
+//
+// Both JSON spellings go through the JSONC parser because wrangler does — comments and trailing
+// commas parse in `wrangler.json` too (verified against wrangler 4.131.0) — so the format only
+// ever decides which parser runs. Past this module there is one model and no config text.
+import { existsSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { getStaticTOMLValue, parseTOML } from 'toml-eslint-parser';
+import typia from 'typia';
+/** Wrangler's own precedence: the first of these that exists is the one it reads. */
+export const WRANGLER_SOURCE_CONFIG_FILES = ['wrangler.jsonc', 'wrangler.json', 'wrangler.toml'];
+const isWranglerDocument = (() => {
+    const _io0 = input => (undefined === input.env || "object" === typeof input.env && null !== input.env && false === Array.isArray(input.env) && _io1(input.env)) && Object.keys(input).every(key => {
+        if (["env"].some(prop => key === prop))
+            return true;
+        const value = input[key];
+        if (undefined === value)
+            return true;
+        return true;
+    });
+    const _io1 = input => Object.keys(input).every(key => {
+        const value = input[key];
+        if (undefined === value)
+            return true;
+        return undefined === value || "object" === typeof value && null !== value && false === Array.isArray(value) && _io2(value);
+    });
+    const _io2 = input => Object.keys(input).every(key => {
+        const value = input[key];
+        if (undefined === value)
+            return true;
+        return true;
+    });
+    return input => "object" === typeof input && null !== input && false === Array.isArray(input) && _io0(input);
+})();
+/**
+ * The one source config this project declares. Two configs is a refusal, not a precedence
+ * exercise: the repo would deploy whichever file wrangler prefers, which is not necessarily the
+ * one anybody is editing.
+ */
+export function discoverWranglerSourceConfig(cwd) {
+    const found = WRANGLER_SOURCE_CONFIG_FILES.filter((file) => existsSync(join(cwd, file)));
+    const [first] = found;
+    if (first === undefined) {
+        throw new Error(`${cwd} declares no Wrangler configuration (${WRANGLER_SOURCE_CONFIG_FILES.join(', ')}); pass --config for a build-generated flat configuration.`);
+    }
+    if (found.length > 1) {
+        throw new Error(`${cwd} declares more than one Wrangler configuration: ${found.join(', ')}. Wrangler would read ${first} and ignore the rest without saying so; keep exactly one.`);
+    }
+    return { path: join(cwd, first), format: first === 'wrangler.toml' ? 'toml' : 'jsonc' };
+}
+/** The discovered source config, parsed into the model every stage derivation reads. */
+export function readWranglerSourceConfig(cwd) {
+    const { path, format } = discoverWranglerSourceConfig(cwd);
+    return { path, document: parseWranglerConfig(path, readFileSync(path, 'utf8'), format) };
+}
+/** One document out of either format. The text is never handed on: everything downstream reads data. */
+export function parseWranglerConfig(path, text, format) {
+    const value = parseConfigText(path, text, format);
+    // TOML carries values JSON does not, and the temporary per-stage config is JSON whatever the
+    // source format was. Name them here rather than let JSON.stringify shift a date by its timezone
+    // or write `null` for an infinity halfway through a deploy.
+    if (format === 'toml')
+        assertJsonRepresentable(value, '', path);
+    if (!isWranglerDocument(value)) {
+        throw new Error(`${path} is not a Wrangler configuration document: expected an object, optionally with env blocks.`);
+    }
+    return value;
+}
+function parseConfigText(path, text, format) {
+    try {
+        return format === 'toml' ? getStaticTOMLValue(parseTOML(text)) : Bun.JSONC.parse(text);
+    }
+    catch (error) {
+        const detail = error instanceof Error ? error.message : String(error);
+        throw new Error(`${path} is not valid ${format === 'toml' ? 'TOML' : 'JSONC'}: ${detail}`);
+    }
+}
+function assertJsonRepresentable(value, path, file) {
+    if (value === null || typeof value === 'string' || typeof value === 'boolean')
+        return;
+    if (typeof value === 'number') {
+        if (Number.isFinite(value))
+            return;
+        throw new Error(`${file} declares ${value} at ${path}, which JSON cannot carry; write a finite number.`);
+    }
+    if (Array.isArray(value)) {
+        for (const [index, item] of value.entries()) {
+            assertJsonRepresentable(item, `${path}[${index}]`, file);
+        }
+        return;
+    }
+    if (isPlainObject(value)) {
+        for (const [key, item] of Object.entries(value)) {
+            assertJsonRepresentable(item, path ? `${path}.${key}` : key, file);
+        }
+        return;
+    }
+    throw new Error(`${file} declares a bare TOML ${value instanceof Date ? 'date or time' : typeof value} at ${path}, which JSON cannot carry; quote it as a string.`);
+}
+function isPlainObject(value) {
+    if (typeof value !== 'object' || value === null)
+        return false;
+    const prototype = Object.getPrototypeOf(value);
+    return prototype === Object.prototype || prototype === null;
+}

package/dist/wrangler/stage.d.ts

@@ -5,6 +5,23 @@ export declare function isPullRequestStage(stage: DeploymentStage): stage is `pr
 export declare function stageDomain(stage: string, zone: string): string;
 export declare function stageResourceName(base: string, stage: string): string;
 export declare function hasExactStageSegment(value: string, stage: `pr${number}`): boolean;
+/**
+ * A whole Wrangler configuration as data — the one model both source formats parse into
+ * (`source-config.ts` owns the parsers). Nothing in this module reads configuration text, which
+ * is what makes a stage derive identically from `wrangler.toml` and from `wrangler.jsonc`.
+ */
+export interface WranglerDocument {
+    env?: Record<string, WranglerEnvironment | undefined>;
+    [key: string]: unknown;
+}
+/**
+ * One `env` block, still unparsed. `StageConfigFields` is the typed statement of what this
+ * module reads out of it; every other key is carried into a derived stage, never interpreted.
+ */
+export interface WranglerEnvironment {
+    [key: string]: unknown;
+}
+/** One reconciled binding of the plan: exactly what Cloudflare is asked about, and nothing else. */
 export interface KvBinding {
     binding: string;
     id: string;
@@ -13,44 +30,52 @@ export interface R2Binding {
     binding: string;
     bucketName: string;
 }
-/** One-stage bindings that a TOML env block and a flat JSON config both present. */
-export interface StageConfigFields {
-    name: string;
-    routes?: StageRoute[];
-    vars?: Record<string, unknown>;
-    kv_namespaces?: KvBinding[];
-    r2_buckets?: {
-        binding: string;
-        bucket_name: string;
-    }[];
-    d1_databases?: StageD1Binding[];
-    services?: StageServiceBinding[];
-    ratelimits?: StageRateLimit[];
-    send_email?: Array<{
-        allowed_sender_addresses?: unknown;
-        [key: string]: unknown;
-    }>;
-}
 export interface StageRoute {
     pattern: string;
     zone_name?: string;
     custom_domain?: boolean;
+    [key: string]: unknown;
+}
+export interface StageKvBinding {
+    binding: string;
+    id: string;
+    [key: string]: unknown;
+}
+export interface StageR2Binding {
+    binding: string;
+    bucket_name: string;
+    [key: string]: unknown;
 }
 export interface StageD1Binding {
     binding: string;
     database_name: string;
     database_id: string;
     migrations_dir?: string;
+    [key: string]: unknown;
 }
 export interface StageServiceBinding {
     binding: string;
     service: string;
     environment?: string;
+    [key: string]: unknown;
 }
 export interface StageRateLimit {
     name: string;
     namespace_id: string;
-    simple?: unknown;
+    [key: string]: unknown;
+}
+/** One-stage bindings that an env block and a flat JSON config both present. */
+export interface StageConfigFields {
+    name: string;
+    routes?: StageRoute[];
+    vars?: Record<string, unknown>;
+    kv_namespaces?: StageKvBinding[];
+    r2_buckets?: StageR2Binding[];
+    d1_databases?: StageD1Binding[];
+    services?: StageServiceBinding[];
+    ratelimits?: StageRateLimit[];
+    send_email?: Record<string, unknown>[];
+    [key: string]: unknown;
 }
 export interface LiveKvNamespace {
     id: string;
@@ -91,7 +116,9 @@ export interface ConfiguredStageResourcePlan {
         customDomain: boolean;
     }>;
 }
-export declare function planConfiguredStageResources(toml: string, stage: DeploymentStage): ConfiguredStageResourcePlan;
+/** The reconcile plan (`reconcileStageResources`) read off one resolved stage's bindings. */
+export declare function planStageResources(config: StageConfigFields, stage: DeploymentStage): ConfiguredStageResourcePlan;
+export declare function planConfiguredStageResources(document: WranglerDocument, stage: DeploymentStage): ConfiguredStageResourcePlan;
 /** The staging worker name without its required `-staging` suffix. */
 export declare function stagingWorkerBaseName(name: string): string;
 /**
@@ -99,8 +126,8 @@ export declare function stagingWorkerBaseName(name: string): string;
  * pull-request stage: it would deploy unrouted and Wrangler would expose it on workers.dev.
  */
 export declare function assertPullRequestRoutable(name: string, routes: StageRoute[] | undefined): void;
-export declare function planPullRequestResources(toml: string, stage: `pr${number}`, liveNamespaces: LiveKvNamespace[]): PullRequestResourcePlan;
-/** KV/R2/D1 isolation and route checks for a pull-request stage, shared by TOML and JSON. */
+export declare function planPullRequestResources(document: WranglerDocument, stage: `pr${number}`, liveNamespaces: LiveKvNamespace[]): PullRequestResourcePlan;
+/** KV/R2/D1 isolation and route checks for a pull-request stage, shared by every source format. */
 export declare function planPullRequestBindings(config: StageConfigFields, stage: `pr${number}`, liveNamespaces: LiveKvNamespace[]): PullRequestResourcePlan;
 export interface DerivePullRequestConfigOptions {
     stage: `pr${number}`;
@@ -110,6 +137,11 @@ export interface DerivePullRequestConfigOptions {
 }
 /** Staging bindings rewritten for a pull-request stage; keys this module does not model are left to the caller. */
 export declare function derivePullRequestStageConfig<T extends StageConfigFields>(config: T, options: DerivePullRequestConfigOptions): T;
-export declare function derivePullRequestWranglerConfig(toml: string, options: DerivePullRequestConfigOptions): string;
+/**
+ * The whole document with `env.<prN>` added, derived from `env.staging`. Nothing read from disk
+ * is mutated — every level the derivation touches is rebuilt — so the committed source config is
+ * still exactly what the repo wrote once the deploy is done with it.
+ */
+export declare function derivePullRequestDocument(document: WranglerDocument, options: DerivePullRequestConfigOptions): WranglerDocument;
 export declare function rateLimitNamespaceId(accountId: string, workerBaseName: string, stage: string, bindingName: string): string;
 //# sourceMappingURL=stage.d.ts.map

package/dist/wrangler/stage.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"stage.d.ts","sourceRoot":"","sources":["../../src/wrangler/stage.ts"],"names":[],"mappings":"AAMA,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,YAAY,GAAG,KAAK,MAAM,EAAE,CAAC;AAKvE,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,KAAK,MAAM,EAAE,CAKhE;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,eAAe,CAQnE;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,eAAe,GAAG,KAAK,IAAI,KAAK,MAAM,EAAE,CAIjF;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAM/D;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAMrE;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,MAAM,EAAE,GAAG,OAAO,CAGjF;AAmBD,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,EAAE,MAAM,CAAC;CACZ;AACD,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,oFAAoF;AACpF,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,UAAU,EAAE,CAAC;IACtB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,aAAa,CAAC,EAAE,SAAS,EAAE,CAAC;IAC5B,UAAU,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACxD,YAAY,CAAC,EAAE,cAAc,EAAE,CAAC;IAChC,QAAQ,CAAC,EAAE,mBAAmB,EAAE,CAAC;IACjC,UAAU,CAAC,EAAE,cAAc,EAAE,CAAC;IAC9B,UAAU,CAAC,EAAE,KAAK,CAAC;QAAE,wBAAwB,CAAC,EAAE,OAAO,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC,CAAC;CACpF;AAED,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAOD,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,KAAK,MAAM,EAAE,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,qBAAqB,EAAE,CAAC;IACtC,WAAW,EAAE,qBAAqB,EAAE,CAAC;IACrC,SAAS,EAAE,SAAS,EAAE,CAAC;IACvB,MAAM,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CAC9E;AACD,MAAM,WAAW,2BAA2B;IAC1C,KAAK,EAAE,eAAe,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,SAAS,EAAE,CAAC;IAC1B,SAAS,EAAE,SAAS,EAAE,CAAC;IACvB,MAAM,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CAC9E;AAED,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,GAAG,2BAA2B,CAa9G;AAkBD,sEAAsE;AACtE,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAK1D;AASD;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,SAAS,GAAG,IAAI,CAO9F;AAqBD,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,KAAK,MAAM,EAAE,EACpB,cAAc,EAAE,eAAe,EAAE,GAChC,uBAAuB,CAEzB;AAED,6FAA6F;AAC7F,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,iBAAiB,EACzB,KAAK,EAAE,KAAK,MAAM,EAAE,EACpB,cAAc,EAAE,eAAe,EAAE,GAChC,uBAAuB,CAyCzB;AAED,MAAM,WAAW,8BAA8B;IAC7C,KAAK,EAAE,KAAK,MAAM,EAAE,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,aAAa,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC5C;AAkFD,mHAAmH;AACnH,wBAAgB,4BAA4B,CAAC,CAAC,SAAS,iBAAiB,EACtE,MAAM,EAAE,CAAC,EACT,OAAO,EAAE,8BAA8B,GACtC,CAAC,CA+DH;AASD,wBAAgB,+BAA+B,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,8BAA8B,GAAG,MAAM,CA4C7G;AAED,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,MAAM,EACjB,cAAc,EAAE,MAAM,EACtB,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,GAClB,MAAM,CAKR"}
+{"version":3,"file":"stage.d.ts","sourceRoot":"","sources":["../../src/wrangler/stage.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,eAAe,GAAG,SAAS,GAAG,YAAY,GAAG,KAAK,MAAM,EAAE,CAAC;AAKvE,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,KAAK,MAAM,EAAE,CAKhE;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,eAAe,CAQnE;AAED,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,eAAe,GAAG,KAAK,IAAI,KAAK,MAAM,EAAE,CAIjF;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAM/D;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAMrE;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,MAAM,EAAE,GAAG,OAAO,CAGjF;AAED;;;;GAIG;AACH,MAAM,WAAW,gBAAgB;IAC/B,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,GAAG,SAAS,CAAC,CAAC;IACtD,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,oGAAoG;AACpG,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,EAAE,MAAM,CAAC;CACZ;AACD,MAAM,WAAW,SAAS;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;CACpB;AAMD,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,EAAE,MAAM,CAAC;IACX,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,gFAAgF;AAChF,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,UAAU,EAAE,CAAC;IACtB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,aAAa,CAAC,EAAE,cAAc,EAAE,CAAC;IACjC,UAAU,CAAC,EAAE,cAAc,EAAE,CAAC;IAC9B,YAAY,CAAC,EAAE,cAAc,EAAE,CAAC;IAChC,QAAQ,CAAC,EAAE,mBAAmB,EAAE,CAAC;IACjC,UAAU,CAAC,EAAE,cAAc,EAAE,CAAC;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IACvC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAOD,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,KAAK,MAAM,EAAE,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,cAAc,EAAE,MAAM,CAAC;IACvB,YAAY,EAAE,qBAAqB,EAAE,CAAC;IACtC,WAAW,EAAE,qBAAqB,EAAE,CAAC;IACrC,SAAS,EAAE,SAAS,EAAE,CAAC;IACvB,MAAM,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CAC9E;AACD,MAAM,WAAW,2BAA2B;IAC1C,KAAK,EAAE,eAAe,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,SAAS,EAAE,CAAC;IAC1B,SAAS,EAAE,SAAS,EAAE,CAAC;IACvB,MAAM,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CAC9E;AAED,6FAA6F;AAC7F,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,iBAAiB,EAAE,KAAK,EAAE,eAAe,GAAG,2BAA2B,CAYjH;AAED,wBAAgB,4BAA4B,CAC1C,QAAQ,EAAE,gBAAgB,EAC1B,KAAK,EAAE,eAAe,GACrB,2BAA2B,CAE7B;AA6BD,sEAAsE;AACtE,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAK1D;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,GAAG,SAAS,GAAG,IAAI,CAO9F;AAED,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,gBAAgB,EAC1B,KAAK,EAAE,KAAK,MAAM,EAAE,EACpB,cAAc,EAAE,eAAe,EAAE,GAChC,uBAAuB,CAEzB;AAED,mGAAmG;AACnG,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,iBAAiB,EACzB,KAAK,EAAE,KAAK,MAAM,EAAE,EACpB,cAAc,EAAE,eAAe,EAAE,GAChC,uBAAuB,CAyCzB;AAED,MAAM,WAAW,8BAA8B;IAC7C,KAAK,EAAE,KAAK,MAAM,EAAE,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,aAAa,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC5C;AAkFD,mHAAmH;AACnH,wBAAgB,4BAA4B,CAAC,CAAC,SAAS,iBAAiB,EACtE,MAAM,EAAE,CAAC,EACT,OAAO,EAAE,8BAA8B,GACtC,CAAC,CA+DH;AASD;;;;GAIG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,gBAAgB,EAC1B,OAAO,EAAE,8BAA8B,GACtC,gBAAgB,CAQlB;AAED,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,MAAM,EACjB,cAAc,EAAE,MAAM,EACtB,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,GAClB,MAAM,CAKR"}

package/dist/wrangler/stage.js

@@ -1,7 +1,5 @@
 import { createHash } from 'node:crypto';
-import { getStaticTOMLValue, parseTOML } from 'toml-eslint-parser';
 import typia from 'typia';
-import { cloneEnvBlock } from './prepare-env.js';
 import { derivedStagingName, hasStageLabel, replaceExactToken, replaceHostnameLabel } from './stage-labels.js';
 const MAX_PULL_REQUEST_NUMBER = 999_999_999;
 const STAGE_PATTERN = /^(?:staging|production|pr[1-9][0-9]{0,8})$/;
@@ -42,17 +40,8 @@ export function hasExactStageSegment(value, stage) {
     const escaped = stage.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
     return new RegExp(`(?:^|[-.])${escaped}(?=$|[-.])`).test(value);
 }
-const isWranglerRoot = (() => {
-    const _io0 = input => undefined === input.env || "object" === typeof input.env && null !== input.env && false === Array.isArray(input.env) && _io1(input.env);
-    const _io1 = input => Object.keys(input).every(key => {
-        const value = input[key];
-        if (undefined === value)
-            return true;
-        return undefined === value || "object" === typeof value && null !== value && false === Array.isArray(value) && _io2(value);
-    });
-    const _io2 = input => true && true && true && true && true && true && true && true && true && Object.keys(input).every(key => {
-        if (["name", "routes", "kv_namespaces", "r2_buckets", "d1_databases", "services", "ratelimits", "vars", "send_email"].some(prop => key === prop))
-            return true;
+const isWranglerEnvironment = (() => {
+    const _io0 = input => Object.keys(input).every(key => {
         const value = input[key];
         if (undefined === value)
             return true;
@@ -60,10 +49,8 @@ const isWranglerRoot = (() => {
     });
     return input => "object" === typeof input && null !== input && false === Array.isArray(input) && _io0(input);
 })();
-const isWranglerEnvironment = (() => {
-    const _io0 = input => true && true && true && true && true && true && true && true && true && Object.keys(input).every(key => {
-        if (["name", "routes", "kv_namespaces", "r2_buckets", "d1_databases", "services", "ratelimits", "vars", "send_email"].some(prop => key === prop))
-            return true;
+const isUnknownRecord = (() => {
+    const _io0 = input => Object.keys(input).every(key => {
         const value = input[key];
         if (undefined === value)
             return true;
@@ -71,51 +58,73 @@ const isWranglerEnvironment = (() => {
     });
     return input => "object" === typeof input && null !== input && false === Array.isArray(input) && _io0(input);
 })();
-const isUnknownRecord = (() => {
+const isUnknownRows = (() => {
     const _io0 = input => Object.keys(input).every(key => {
         const value = input[key];
         if (undefined === value)
             return true;
         return true;
     });
-    return input => "object" === typeof input && null !== input && false === Array.isArray(input) && _io0(input);
+    return input => Array.isArray(input) && input.every(elem => "object" === typeof elem && null !== elem && false === Array.isArray(elem) && _io0(elem));
 })();
-const isUnknownRows = (() => {
+const isRouteRows = (() => {
     const _io0 = input => Object.keys(input).every(key => {
         const value = input[key];
         if (undefined === value)
             return true;
         return true;
     });
-    return input => Array.isArray(input) && input.every(elem => "object" === typeof elem && null !== elem && false === Array.isArray(elem) && _io0(elem));
+    return input => Array.isArray(input) && input.every(elem => null !== elem && undefined !== elem && ("string" === typeof elem || "object" === typeof elem && null !== elem && false === Array.isArray(elem) && _io0(elem)));
 })();
-export function planConfiguredStageResources(toml, stage) {
-    const block = parseRoot(toml).env?.[stage];
-    if (!isWranglerEnvironment(block)) {
-        throw new Error(`Wrangler configuration must declare [env.${stage}].`);
-    }
-    const workerName = requiredString(block, 'name', `[env.${stage}]`);
+/** The reconcile plan (`reconcileStageResources`) read off one resolved stage's bindings. */
+export function planStageResources(config, stage) {
     return {
         stage,
-        workerName,
-        kvNamespaces: readKvBindings(block.kv_namespaces),
-        r2Buckets: readR2Bindings(block.r2_buckets),
-        routes: readRoutes(block.routes),
+        workerName: config.name,
+        kvNamespaces: (config.kv_namespaces ?? []).map(({ binding, id }) => ({ binding, id })),
+        r2Buckets: (config.r2_buckets ?? []).map((bucket) => ({ binding: bucket.binding, bucketName: bucket.bucket_name })),
+        routes: (config.routes ?? []).map((route) => ({
+            pattern: route.pattern,
+            ...(typeof route.zone_name === 'string' ? { zoneName: route.zone_name } : {}),
+            customDomain: route.custom_domain === true,
+        })),
     };
 }
-function parseRoot(toml) {
-    const value = getStaticTOMLValue(parseTOML(toml));
-    if (!isWranglerRoot(value)) {
-        throw new Error('Wrangler configuration is not a valid TOML environment document.');
-    }
-    return value;
+export function planConfiguredStageResources(document, stage) {
+    return planStageResources(stageEnvironmentConfig(document, stage), stage);
 }
-function stagingEnvironment(toml) {
-    const staging = parseRoot(toml).env?.staging;
-    if (!isWranglerEnvironment(staging)) {
-        throw new Error('Wrangler configuration must declare [env.staging].');
+/** The `env.<stage>` block as the stage model, or the refusal that it is not declared. */
+function stageEnvironmentConfig(document, stage) {
+    const block = document.env?.[stage];
+    if (!isWranglerEnvironment(block)) {
+        throw new Error(`Wrangler configuration must declare [env.${stage}].`);
     }
-    return staging;
+    return environmentStageConfig(block, `[env.${stage}]`);
+}
+/**
+ * One env block as the stage model: every field the derivation reads proven present and typed,
+ * every other key carried verbatim. A field absent from the source stays absent, so the same
+ * worker written as TOML and as JSONC produces the same model down to the key set.
+ */
+function environmentStageConfig(environment, label) {
+    const config = { ...environment, name: requiredString(environment, 'name', label) };
+    if (environment.routes !== undefined)
+        config.routes = readStageRoutes(environment.routes);
+    if (isUnknownRecord(environment.vars))
+        config.vars = environment.vars;
+    if (environment.kv_namespaces !== undefined)
+        config.kv_namespaces = readKvBindings(environment.kv_namespaces);
+    if (environment.r2_buckets !== undefined)
+        config.r2_buckets = readR2Buckets(environment.r2_buckets);
+    if (environment.d1_databases !== undefined)
+        config.d1_databases = readD1Bindings(environment.d1_databases);
+    if (environment.services !== undefined)
+        config.services = readServices(environment.services);
+    if (environment.ratelimits !== undefined)
+        config.ratelimits = readRateLimits(environment.ratelimits);
+    if (environment.send_email !== undefined)
+        config.send_email = readRows(environment.send_email);
+    return config;
 }
 /** The staging worker name without its required `-staging` suffix. */
 export function stagingWorkerBaseName(name) {
@@ -124,12 +133,6 @@ export function stagingWorkerBaseName(name) {
     }
     return name.slice(0, -'-staging'.length);
 }
-function stagingWorkerName(staging) {
-    if (typeof staging.name !== 'string' || !staging.name) {
-        throw new Error('[env.staging] must declare a non-empty name.');
-    }
-    return { workerName: staging.name, workerBaseName: stagingWorkerBaseName(staging.name) };
-}
 /**
  * A template whose routes are all pinned (no derivable stage label) cannot serve a
  * pull-request stage: it would deploy unrouted and Wrangler would expose it on workers.dev.
@@ -141,28 +144,10 @@ export function assertPullRequestRoutable(name, routes) {
     const patterns = list.map((route) => route.pattern).join(', ');
     throw new Error(`Every route of ${name} is pinned (no staging label): ${patterns}. A pull-request stage would deploy unrouted and Wrangler would expose it on workers.dev; add a stage-derivable route such as site.staging.<zone>/*.`);
 }
-function stagingStageConfig(toml) {
-    const staging = stagingEnvironment(toml);
-    const { workerName } = stagingWorkerName(staging);
-    return {
-        name: workerName,
-        routes: readStageRoutes(staging.routes),
-        ...(isUnknownRecord(staging.vars) ? { vars: staging.vars } : {}),
-        kv_namespaces: readKvBindings(staging.kv_namespaces),
-        r2_buckets: readRows(staging.r2_buckets).map((row) => {
-            const binding = requiredString(row, 'binding', 'R2 binding');
-            return { binding, bucket_name: requiredString(row, 'bucket_name', `R2 binding ${binding}`) };
-        }),
-        d1_databases: readD1Bindings(staging.d1_databases),
-        services: readServices(staging.services),
-        ratelimits: readRateLimits(staging.ratelimits),
-        send_email: readRows(staging.send_email),
-    };
-}
-export function planPullRequestResources(toml, stage, liveNamespaces) {
-    return planPullRequestBindings(stagingStageConfig(toml), stage, liveNamespaces);
+export function planPullRequestResources(document, stage, liveNamespaces) {
+    return planPullRequestBindings(stageEnvironmentConfig(document, 'staging'), stage, liveNamespaces);
 }
-/** KV/R2/D1 isolation and route checks for a pull-request stage, shared by TOML and JSON. */
+/** KV/R2/D1 isolation and route checks for a pull-request stage, shared by every source format. */
 export function planPullRequestBindings(config, stage, liveNamespaces) {
     parseDeploymentStage(stage);
     assertPullRequestRoutable(config.name, config.routes);
@@ -328,48 +313,17 @@ function requiredDerivedString(value) {
     }
     return value;
 }
-export function derivePullRequestWranglerConfig(toml, options) {
-    const ctx = deriveContext(stagingWorkerName(stagingEnvironment(toml)).workerName, options);
-    const cloned = cloneEnvBlock(toml, 'staging', ctx.stage);
-    const program = parseTOML(cloned);
-    const rootValue = getStaticTOMLValue(program);
-    if (!isWranglerRoot(rootValue)) {
-        throw new Error('Derived Wrangler configuration is not a valid environment document.');
-    }
-    const root = rootValue;
-    const edits = [];
-    for (const table of program.body[0].body) {
-        if (table.type !== 'TOMLTable' || table.resolvedKey[0] !== 'env' || table.resolvedKey[1] !== ctx.stage) {
-            continue;
-        }
-        const tableValue = valueAtPath(root, table.resolvedKey);
-        if (!isUnknownRecord(tableValue)) {
-            continue;
-        }
-        const section = typeof table.resolvedKey[2] === 'string' ? table.resolvedKey[2] : undefined;
-        if (section === 'routes') {
-            const pattern = tableValue.pattern;
-            if (typeof pattern === 'string' && !hasStageLabel(pattern)) {
-                edits.push({ start: table.range[0], end: table.range[1], value: '' });
-                continue;
-            }
-        }
-        const nearbyName = typeof tableValue.name === 'string' ? tableValue.name : undefined;
-        for (const keyValue of table.body) {
-            const key = cloned.slice(keyValue.key.range[0], keyValue.key.range[1]).trim();
-            const current = tableValue[key];
-            const next = deriveStageField(section, key, current, ctx, nearbyName);
-            if (next !== current) {
-                edits.push({ start: keyValue.value.range[0], end: keyValue.value.range[1], value: tomlLiteral(next) });
-            }
-        }
-    }
-    let derived = cloned;
-    for (const edit of edits.sort((left, right) => right.start - left.start)) {
-        derived = derived.slice(0, edit.start) + edit.value + derived.slice(edit.end);
+/**
+ * The whole document with `env.<prN>` added, derived from `env.staging`. Nothing read from disk
+ * is mutated — every level the derivation touches is rebuilt — so the committed source config is
+ * still exactly what the repo wrote once the deploy is done with it.
+ */
+export function derivePullRequestDocument(document, options) {
+    if (document.env?.[options.stage] !== undefined) {
+        throw new Error(`Wrangler configuration already declares [env.${options.stage}]; a pull-request stage is derived from [env.staging] and must not be committed.`);
     }
-    parseTOML(derived);
-    return derived;
+    const derived = derivePullRequestStageConfig(stageEnvironmentConfig(document, 'staging'), options);
+    return { ...document, env: { ...document.env, [options.stage]: derived } };
 }
 export function rateLimitNamespaceId(accountId, workerBaseName, stage, bindingName) {
     const token = parseDeploymentStage(stage);
@@ -377,63 +331,52 @@ export function rateLimitNamespaceId(accountId, workerBaseName, stage, bindingNa
     const value = digest.readUInt32BE(0) & 0x7fff_ffff;
     return String(value === 0 ? 1 : value);
 }
+/**
+ * Wrangler accepts a route as an object or as a bare pattern string. Both become the object form
+ * here, so one derivation rewrites the hostname label either way — a string route used to be
+ * carried into the pull-request stage verbatim, pointing it at staging's own hostname.
+ */
+function readStageRoutes(value) {
+    if (!isRouteRows(value))
+        return [];
+    return value.map((row) => typeof row === 'string' ? { pattern: row } : { ...row, pattern: requiredString(row, 'pattern', 'route') });
+}
 function readKvBindings(value) {
     return readRows(value).map((row) => ({
+        ...row,
         binding: requiredString(row, 'binding', 'KV namespace'),
         id: requiredString(row, 'id', 'KV namespace'),
     }));
 }
-function readR2Bindings(value) {
+function readR2Buckets(value) {
     return readRows(value).map((row) => {
         const binding = requiredString(row, 'binding', 'R2 binding');
-        return { binding, bucketName: requiredString(row, 'bucket_name', `R2 binding ${binding}`) };
+        return { ...row, binding, bucket_name: requiredString(row, 'bucket_name', `R2 binding ${binding}`) };
     });
 }
 function readD1Bindings(value) {
     return readRows(value).map((row) => {
         const binding = requiredString(row, 'binding', 'D1 database');
-        const database = {
+        return {
+            ...row,
             binding,
             database_name: requiredString(row, 'database_name', `D1 binding ${binding}`),
             database_id: requiredString(row, 'database_id', `D1 binding ${binding}`),
         };
-        return typeof row.migrations_dir === 'string' ? { ...database, migrations_dir: row.migrations_dir } : database;
     });
 }
 function readServices(value) {
     return readRows(value).map((row) => {
         const binding = requiredString(row, 'binding', 'Service binding');
-        const service = {
-            binding,
-            service: requiredString(row, 'service', `Service binding ${binding}`),
-        };
-        return typeof row.environment === 'string' ? { ...service, environment: row.environment } : service;
+        return { ...row, binding, service: requiredString(row, 'service', `Service binding ${binding}`) };
     });
 }
 function readRateLimits(value) {
     return readRows(value).map((row) => {
         const name = requiredString(row, 'name', 'Rate-limit binding');
-        const limit = {
-            name,
-            namespace_id: requiredString(row, 'namespace_id', `Rate-limit binding ${name}`),
-        };
-        return row.simple === undefined ? limit : { ...limit, simple: row.simple };
+        return { ...row, name, namespace_id: requiredString(row, 'namespace_id', `Rate-limit binding ${name}`) };
     });
 }
-function readStageRoutes(value) {
-    return readRows(value).map((row) => ({
-        pattern: requiredString(row, 'pattern', 'route'),
-        ...(typeof row.zone_name === 'string' ? { zone_name: row.zone_name } : {}),
-        ...(row.custom_domain === true ? { custom_domain: true } : {}),
-    }));
-}
-function readRoutes(value) {
-    return readRows(value).map((row) => ({
-        pattern: requiredString(row, 'pattern', 'route'),
-        ...(typeof row.zone_name === 'string' ? { zoneName: row.zone_name } : {}),
-        customDomain: row.custom_domain === true,
-    }));
-}
 function readRows(value) {
     return isUnknownRows(value) ? value : [];
 }
@@ -444,27 +387,3 @@ function requiredString(row, key, context) {
     }
     return value;
 }
-function valueAtPath(root, path) {
-    let value = root;
-    for (const segment of path) {
-        if (typeof segment === 'number') {
-            if (!Array.isArray(value))
-                return undefined;
-            value = value[segment];
-        }
-        else {
-            if (!isUnknownRecord(value))
-                return undefined;
-            value = value[segment];
-        }
-    }
-    return value;
-}
-function tomlLiteral(value) {
-    if (typeof value === 'string' || typeof value === 'number' || typeof value === 'boolean' || Array.isArray(value)) {
-        const literal = JSON.stringify(value);
-        if (literal !== undefined)
-            return literal;
-    }
-    throw new Error(`Cannot materialize Wrangler TOML value of type ${typeof value}.`);
-}

package/managed/raw/tooling/direnv/devenv.smoo.nix

@@ -274,16 +274,32 @@
     # 5. The shared setup-environment.ts bootstraps repository dependencies; a
     #    failure aborts shell entry instead of yielding a half-working shell.
     #    Repo-owned enterShell bodies merge after this prologue.
-    # 6. The declared Nx remote cache (`smoo.remoteCache`) is NOT resolved
-    #    here. Shell entry happens on every direnv reload and every
+    # 6. Shell entry resolves the `shell` group of `smoo.secrets` and nothing
+    #    else. Shell entry happens on every direnv reload and every
     #    `devenv shell -- <command>`, and a provider command that runs then is a
     #    credential prompt on every one of them (1Password authorises per
-    #    requesting process lineage, and this one is new each time). Nx reads
+    #    requesting process lineage, and this one is new each time). A
+    #    credential only one deliberate command needs belongs to that command:
+    #    `smoo secrets run <group> <command...>`. The full statement, and the
+    #    derivation below, live in tooling/direnv/secret-references.ts.
+    #
+    #    A group is derived from what the repository already declares, so
+    #    nothing restates it:
+    #
+    #    The variable `smoo.remoteCache.tokenSecret` names is group
+    #    `nx-cache`, and shell entry never resolves it. Nx reads
     #    NX_SELF_HOSTED_REMOTE_CACHE_SERVER and _ACCESS_TOKEN from the
     #    environment when it runs: CI injects them into the job, a developer
     #    exports the token once in the terminal that wants the cache (for
     #    example `op signin`, then the declared command), and every nested
     #    shell inherits it. Absent, Nx runs with the local cache only.
+    #
+    #    A variable `.npmrc` interpolates as `${VAR}` is group `registry`,
+    #    deferred rather than resolved, so setup-environment.ts installs
+    #    without it. An installed checkout contacts no registry, which is why
+    #    that costs nothing in the common case; an install that genuinely
+    #    needs one fails naming the variable, and `smoo secrets run registry
+    #    bun install` supplies it for that one command.
     # 7. GOROOT is unset rather than set. With devenv's Go pinned to the patch
     #    release ttsc vendors, a GOROOT crossing cannot misfire on version at all,
     #    so this is belt-and-braces rather than the fix — it keeps the isolation