@smoothbricks/cli 0.6.0 → 0.8.0

package/dist/monorepo/managed-files.d.ts

@@ -1,3 +1,47 @@
+/**
+ * Repos may append their own content to a managed file below this marker —
+ * e.g. extra merge drivers in .gitattributes. Everything from the marker
+ * line onward is preserved verbatim across updates and ignored by the
+ * drift check; the managed section above it stays byte-exact.
+ */
+export declare const LOCAL_SECTION_MARKER = "# smoo-local: everything below this line is repo-owned and preserved";
+/** Split a managed target's content into the managed part and the repo-owned tail. */
+declare function splitLocalSection(current: string): {
+    managed: string;
+    localTail: string;
+};
+/** Test seam for the pure splitter. */
+export declare const splitLocalSectionForTest: typeof splitLocalSection;
+/**
+ * A repo-owned block INSIDE the managed section — e.g. one extra pattern
+ * spliced into a formatter's list, where a trailing marker (LOCAL_SECTION_MARKER)
+ * can't express it because it isn't at the end of the file. Wrap it in
+ * `# smoo-local-begin` / `# smoo-local-end`; the block is anchored to the line
+ * immediately before `# smoo-local-begin`. On update, the block is re-spliced
+ * right after that same anchor line in the freshly rendered template — if the
+ * anchor no longer appears there (the template reworked that section), the
+ * update refuses rather than silently dropping the repo's customization.
+ */
+export declare const INLINE_LOCAL_BEGIN = "# smoo-local-begin";
+export declare const INLINE_LOCAL_END = "# smoo-local-end";
+interface InlineLocalBlock {
+    anchor: string;
+    lines: string;
+}
+/** Pull inline local blocks out of a managed section, returning the section
+ * with each block (and its markers) removed, plus the extracted blocks in
+ * the order they appeared. */
+declare function extractInlineLocalBlocks(managed: string): {
+    withoutInline: string;
+    blocks: InlineLocalBlock[];
+};
+/** Test seam for the pure extractor. */
+export declare const extractInlineLocalBlocksForTest: typeof extractInlineLocalBlocks;
+/** Re-splice extracted inline blocks into freshly rendered managed content,
+ * each immediately after its anchor line. A no-op when there are no blocks. */
+declare function reinsertInlineLocalBlocks(content: string, blocks: InlineLocalBlock[]): string;
+/** Test seam for the pure re-splicer. */
+export declare const reinsertInlineLocalBlocksForTest: typeof reinsertInlineLocalBlocks;
 export interface FileResult {
     target: string;
     action: 'created' | 'updated' | 'unchanged' | 'skipped' | 'skipped-symlink' | 'drifted' | 'ok-symlink';
@@ -5,4 +49,5 @@ export interface FileResult {
 export declare function applyManagedFiles(root: string, mode: 'update' | 'check' | 'diff'): FileResult[];
 export declare function printResults(results: FileResult[]): void;
 export declare function validateManagedFiles(root: string): number;
+export {};
 //# sourceMappingURL=managed-files.d.ts.map

package/dist/monorepo/managed-files.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"managed-files.d.ts","sourceRoot":"","sources":["../../src/monorepo/managed-files.ts"],"names":[],"mappings":"AAkBA,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,GAAG,iBAAiB,GAAG,SAAS,GAAG,YAAY,CAAC;CACxG;AA8GD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,GAAG,OAAO,GAAG,MAAM,GAAG,UAAU,EAAE,CAG/F;AA4KD,wBAAgB,YAAY,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,IAAI,CAIxD;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAQzD"}
+{"version":3,"file":"managed-files.d.ts","sourceRoot":"","sources":["../../src/monorepo/managed-files.ts"],"names":[],"mappings":"AAUA;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,yEAAyE,CAAC;AAU3G,sFAAsF;AACtF,iBAAS,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAIlF;AAED,uCAAuC;AACvC,eAAO,MAAM,wBAAwB,0BAAoB,CAAC;AAE1D;;;;;;;;;GASG;AACH,eAAO,MAAM,kBAAkB,uBAAuB,CAAC;AACvD,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AAEnD,UAAU,gBAAgB;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;8BAE8B;AAC9B,iBAAS,wBAAwB,CAAC,OAAO,EAAE,MAAM,GAAG;IAAE,aAAa,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,gBAAgB,EAAE,CAAA;CAAE,CA6BxG;AAED,wCAAwC;AACxC,eAAO,MAAM,+BAA+B,iCAA2B,CAAC;AAExE;+EAC+E;AAC/E,iBAAS,yBAAyB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,CActF;AAED,yCAAyC;AACzC,eAAO,MAAM,gCAAgC,kCAA4B,CAAC;AAE1E,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,GAAG,iBAAiB,GAAG,SAAS,GAAG,YAAY,CAAC;CACxG;AA8GD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,GAAG,OAAO,GAAG,MAAM,GAAG,UAAU,EAAE,CAG/F;AAgLD,wBAAgB,YAAY,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,IAAI,CAIxD;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAQzD"}

package/dist/monorepo/managed-files.js

@@ -5,6 +5,87 @@ import { fileURLToPath } from 'node:url';
 import { listReleasePackages, readPackageJson } from '../lib/workspace.js';
 import { renderCiWorkflowYaml } from './ci-workflow.js';
 import { renderPublishWorkflowYaml } from './publish-workflow.js';
+/**
+ * Repos may append their own content to a managed file below this marker —
+ * e.g. extra merge drivers in .gitattributes. Everything from the marker
+ * line onward is preserved verbatim across updates and ignored by the
+ * drift check; the managed section above it stays byte-exact.
+ */
+export const LOCAL_SECTION_MARKER = '# smoo-local: everything below this line is repo-owned and preserved';
+/** Split a managed target's content into the managed part and the repo-owned tail. */
+function splitLocalSection(current) {
+    const index = current.indexOf(LOCAL_SECTION_MARKER);
+    if (index === -1)
+        return { managed: current, localTail: '' };
+    return { managed: current.slice(0, index), localTail: current.slice(index) };
+}
+/** Test seam for the pure splitter. */
+export const splitLocalSectionForTest = splitLocalSection;
+/**
+ * A repo-owned block INSIDE the managed section — e.g. one extra pattern
+ * spliced into a formatter's list, where a trailing marker (LOCAL_SECTION_MARKER)
+ * can't express it because it isn't at the end of the file. Wrap it in
+ * `# smoo-local-begin` / `# smoo-local-end`; the block is anchored to the line
+ * immediately before `# smoo-local-begin`. On update, the block is re-spliced
+ * right after that same anchor line in the freshly rendered template — if the
+ * anchor no longer appears there (the template reworked that section), the
+ * update refuses rather than silently dropping the repo's customization.
+ */
+export const INLINE_LOCAL_BEGIN = '# smoo-local-begin';
+export const INLINE_LOCAL_END = '# smoo-local-end';
+/** Pull inline local blocks out of a managed section, returning the section
+ * with each block (and its markers) removed, plus the extracted blocks in
+ * the order they appeared. */
+function extractInlineLocalBlocks(managed) {
+    const lines = managed.split('\n');
+    const kept = [];
+    const blocks = [];
+    let i = 0;
+    while (i < lines.length) {
+        const line = lines[i];
+        if (line !== undefined && line.trim() === INLINE_LOCAL_BEGIN) {
+            const anchor = kept.at(-1);
+            if (anchor === undefined) {
+                throw new Error(`${INLINE_LOCAL_BEGIN} on line ${i + 1} has no preceding anchor line`);
+            }
+            const blockLines = [];
+            i += 1;
+            while (i < lines.length && lines[i]?.trim() !== INLINE_LOCAL_END) {
+                blockLines.push(lines[i]);
+                i += 1;
+            }
+            if (i >= lines.length) {
+                throw new Error(`${INLINE_LOCAL_BEGIN} anchored on "${anchor}" has no matching ${INLINE_LOCAL_END}`);
+            }
+            blocks.push({ anchor, lines: blockLines.join('\n') });
+            i += 1; // skip the END marker line itself
+            continue;
+        }
+        kept.push(line);
+        i += 1;
+    }
+    return { withoutInline: kept.join('\n'), blocks };
+}
+/** Test seam for the pure extractor. */
+export const extractInlineLocalBlocksForTest = extractInlineLocalBlocks;
+/** Re-splice extracted inline blocks into freshly rendered managed content,
+ * each immediately after its anchor line. A no-op when there are no blocks. */
+function reinsertInlineLocalBlocks(content, blocks) {
+    if (blocks.length === 0)
+        return content;
+    const lines = content.split('\n');
+    for (const block of blocks) {
+        const index = lines.indexOf(block.anchor);
+        if (index === -1) {
+            throw new Error(`${INLINE_LOCAL_BEGIN} block anchored on "${block.anchor}" no longer matches any line in the updated ` +
+                'template — reconcile the repo-owned block manually');
+        }
+        lines.splice(index + 1, 0, INLINE_LOCAL_BEGIN, ...block.lines.split('\n'), INLINE_LOCAL_END);
+    }
+    return lines.join('\n');
+}
+/** Test seam for the pure re-splicer. */
+export const reinsertInlineLocalBlocksForTest = reinsertInlineLocalBlocks;
 const managedFiles = [
     {
         kind: 'raw',
@@ -114,13 +195,17 @@ function applyManagedFile(root, file, mode, context) {
             throw new Error(`${file.target} exists but is not a regular file or symlink`);
         }
         const current = readFileSync(target, 'utf8');
-        if (current === content) {
+        const { managed, localTail } = splitLocalSection(current);
+        const { withoutInline, blocks } = extractInlineLocalBlocks(managed);
+        if (withoutInline === content || (localTail !== '' && withoutInline === `${content}\n`)) {
             return { target: file.target, action: 'unchanged' };
         }
         if (mode === 'check' || mode === 'diff') {
             return { target: file.target, action: 'drifted' };
         }
-        writeManagedFile(target, content, file.executable === true);
+        const rendered = reinsertInlineLocalBlocks(content, blocks);
+        const next = localTail === '' ? rendered : `${rendered}\n${localTail}`;
+        writeManagedFile(target, next, file.executable === true);
         return { target: file.target, action: 'updated' };
     }
     if (mode === 'check' || mode === 'diff') {

package/dist/monorepo/packed-package.js

@@ -69,7 +69,7 @@ async function validatePackedManifest(root, pkg, packed) {
 async function validateAttw(root, pkg, packed) {
     const attw = await loadAttwCore();
     const analysis = await attw.checkPackage(await createAttwPackageFromTarball(attw, root, packed.path), {
-        excludeEntrypoints: wasmExportEntrypoints(pkg.json.exports),
+        excludeEntrypoints: nonJsExportEntrypoints(pkg.json.exports),
     });
     if (!isRecord(analysis) || analysis.types === false) {
         return 0;
@@ -205,19 +205,21 @@ function formatResolutionKind(kind) {
     }
     return kind;
 }
-function wasmExportEntrypoints(exports) {
+function nonJsExportEntrypoints(exports) {
     if (!isRecord(exports)) {
         return [];
     }
     return Object.entries(exports)
-        .filter(([key, value]) => key.startsWith('.') && exportPointsToWasm(value))
+        .filter(([key, value]) => key.startsWith('.') && exportPointsToNonJs(value))
         .map(([key]) => key);
 }
-function exportPointsToWasm(value) {
+function exportPointsToNonJs(value) {
     if (typeof value === 'string') {
-        return value.endsWith('.wasm');
+        // attw resolves every entrypoint as a module; assets can never have types.
+        // Existence of the target files is still validated by publint.
+        return value.endsWith('.wasm') || value.endsWith('.css');
     }
-    return isRecord(value) && Object.values(value).some(exportPointsToWasm);
+    return isRecord(value) && Object.values(value).some(exportPointsToNonJs);
 }
 async function packPackage(root, pkg) {
     const packageDir = join(root, pkg.path);

package/dist/monorepo/packs/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/monorepo/packs/index.ts"],"names":[],"mappings":"AA6BA,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,OAAO,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAClD,WAAW,CAAC,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACzD,YAAY,CAAC,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC1D,gBAAgB,CAAC,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;IAClE,iBAAiB,CAAC,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;CACpE;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;IAChC,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,eAAe,EAAE,OAAO,CAAC,EAAE,mBAAmB,KAAK,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;CAC9F;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;CACtB;AAgGD,wBAAsB,YAAY,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAItE;AAED,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,eAAe,EACpB,OAAO,GAAE,mBAAwB,EACjC,KAAK,GAAE,oBAAyB,GAC/B,OAAO,CAAC,kBAAkB,CAAC,CA0B7B"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/monorepo/packs/index.ts"],"names":[],"mappings":"AA8BA,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,OAAO,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAClD,WAAW,CAAC,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACzD,YAAY,CAAC,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC1D,gBAAgB,CAAC,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;IAClE,iBAAiB,CAAC,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;CACpE;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;IAChC,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,eAAe,EAAE,OAAO,CAAC,EAAE,mBAAmB,KAAK,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;CAC9F;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;CACtB;AA4GD,wBAAsB,YAAY,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAItE;AAED,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,eAAe,EACpB,OAAO,GAAE,mBAAwB,EACjC,KAAK,GAAE,oBAAyB,GAC/B,OAAO,CAAC,kBAAkB,CAAC,CA0B7B"}

package/dist/monorepo/packs/index.js

@@ -10,6 +10,7 @@ import { applyFixableMonorepoDefaults, applyNxReleaseDefaults, applyPublicPackag
 import { validatePackedPublicPackageManifest, validatePackedPublicPackagePublint, validatePackedPublicPackageTypes, } from '../packed-package.js';
 import { syncRootRuntimeVersions } from '../runtime.js';
 import { applyToolConfigDefaults, validateToolConfig } from '../tool-validation.js';
+import { applyWranglerDefaults, validateWrangler } from '../wrangler.js';
 const packs = [
     {
         name: 'core',
@@ -96,6 +97,18 @@ const packs = [
             return validatePackedPublicPackageTypes(ctx.root);
         },
     },
+    {
+        name: 'wrangler',
+        init(ctx) {
+            applyWranglerDefaults(ctx.root);
+        },
+        fixPreBuild(ctx) {
+            applyWranglerDefaults(ctx.root);
+        },
+        validatePreBuild(ctx) {
+            return validateWrangler(ctx.root);
+        },
+    },
 ];
 export async function runInitPacks(ctx) {
     for (const pack of packs) {

package/dist/monorepo/wrangler.d.ts

@@ -0,0 +1,5 @@
+/** First `[env.<name>]` header in a wrangler.toml, or `null` when the config declares no envs (top-level bindings only). */
+export declare function firstWranglerEnv(tomlText: string): string | null;
+export declare function applyWranglerDefaults(root: string): void;
+export declare function validateWrangler(root: string): number;
+//# sourceMappingURL=wrangler.d.ts.map

package/dist/monorepo/wrangler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wrangler.d.ts","sourceRoot":"","sources":["../../src/monorepo/wrangler.ts"],"names":[],"mappings":"AAaA,4HAA4H;AAC5H,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAGhE;AAkCD,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAiDxD;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAgCrD"}

package/dist/monorepo/wrangler.js

@@ -0,0 +1,122 @@
+import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { join, relative } from 'node:path';
+import { getOrCreateRecord, recordProperty, writeJsonObject } from '../lib/json.js';
+import { getWorkspacePackageManifests } from '../lib/workspace.js';
+/** First `[env.<name>]` header in a wrangler.toml, or `null` when the config declares no envs (top-level bindings only). */
+export function firstWranglerEnv(tomlText) {
+    const match = tomlText.match(/^\s*\[env\.([A-Za-z0-9_-]+)/m);
+    return match ? match[1] : null;
+}
+function wranglerProjects(root) {
+    const projects = [];
+    for (const pkg of getWorkspacePackageManifests(root)) {
+        const tomlPath = join(pkg.path, 'wrangler.toml');
+        if (!existsSync(tomlPath)) {
+            continue;
+        }
+        projects.push({
+            label: relative(root, pkg.path) || '.',
+            dir: pkg.path,
+            packageJsonPath: pkg.packageJsonPath,
+            json: pkg.json,
+            tomlPath,
+        });
+    }
+    return projects;
+}
+/** Ensure the root .gitignore ignores the local secret file + generated types (once). */
+function ensureGitignore(root) {
+    const path = join(root, '.gitignore');
+    const text = existsSync(path) ? readFileSync(path, 'utf8') : '';
+    const lines = text.split('\n').map((line) => line.trim());
+    const missing = ['.dev.vars', 'worker-configuration.d.ts'].filter((entry) => !lines.includes(entry));
+    if (missing.length === 0) {
+        return;
+    }
+    const block = `${text.replace(/\s*$/, '')}\n\n# wrangler: local secret values + generated types (names live in .dev.vars.example)\n${missing.join('\n')}\n`;
+    writeFileSync(path, block);
+    console.log(`updated        .gitignore (${missing.join(', ')})`);
+}
+export function applyWranglerDefaults(root) {
+    const projects = wranglerProjects(root);
+    if (projects.length > 0) {
+        ensureGitignore(root);
+    }
+    for (const project of projects) {
+        const env = firstWranglerEnv(readFileSync(project.tomlPath, 'utf8'));
+        const nx = getOrCreateRecord(project.json, 'nx');
+        const targets = getOrCreateRecord(nx, 'targets');
+        const desired = {
+            executor: 'nx:run-commands',
+            cache: true,
+            inputs: ['{projectRoot}/wrangler.toml', '{projectRoot}/.dev.vars.example'],
+            outputs: ['{projectRoot}/worker-configuration.d.ts'],
+            options: {
+                command: `wrangler types${env ? ` --env ${env}` : ''} --env-file .dev.vars.example --include-runtime false`,
+                cwd: '{projectRoot}',
+            },
+        };
+        let changed = false;
+        const existing = recordProperty(targets, 'wrangler-types');
+        if (!existing || JSON.stringify(existing) !== JSON.stringify(desired)) {
+            targets['wrangler-types'] = desired;
+            changed = true;
+        }
+        const typecheck = recordProperty(targets, 'typecheck');
+        if (typecheck) {
+            const dependsOn = Array.isArray(typecheck.dependsOn) ? typecheck.dependsOn : [];
+            if (!dependsOn.includes('wrangler-types')) {
+                dependsOn.push('wrangler-types');
+                typecheck.dependsOn = dependsOn;
+                changed = true;
+            }
+        }
+        if (changed) {
+            writeJsonObject(project.packageJsonPath, project.json);
+            console.log(`updated        ${project.label}/package.json wrangler-types target`);
+        }
+        else {
+            console.log(`unchanged      ${project.label}/package.json wrangler-types target`);
+        }
+        // Empty .dev.vars.example = "this worker declares no secrets". Bootstrap it
+        // when missing; humans add SECRET_NAME= lines if the worker reads any (the
+        // wrangler-types + tsc gate fails on an undeclared secret until they do).
+        const examplePath = join(project.dir, '.dev.vars.example');
+        if (!existsSync(examplePath)) {
+            writeFileSync(examplePath, '');
+            console.log(`created        ${project.label}/.dev.vars.example (no secrets)`);
+        }
+    }
+}
+export function validateWrangler(root) {
+    const gitignorePath = join(root, '.gitignore');
+    const gitignoreLines = existsSync(gitignorePath)
+        ? readFileSync(gitignorePath, 'utf8')
+            .split('\n')
+            .map((line) => line.trim())
+        : [];
+    const gitignoreCoversSecrets = gitignoreLines.includes('.dev.vars') && gitignoreLines.includes('worker-configuration.d.ts');
+    let problems = 0;
+    for (const project of wranglerProjects(root)) {
+        let projectProblems = 0;
+        if (!existsSync(join(project.dir, '.dev.vars.example'))) {
+            console.log(`⨯ ${project.label}: missing .dev.vars.example`);
+            projectProblems++;
+        }
+        const nx = recordProperty(project.json, 'nx');
+        const targets = nx ? recordProperty(nx, 'targets') : null;
+        if (!targets || !recordProperty(targets, 'wrangler-types')) {
+            console.log(`⨯ ${project.label}: missing wrangler-types nx target`);
+            projectProblems++;
+        }
+        if (!gitignoreCoversSecrets) {
+            console.log(`⨯ ${project.label}: root .gitignore must ignore .dev.vars and worker-configuration.d.ts`);
+            projectProblems++;
+        }
+        if (projectProblems === 0) {
+            console.log(`✓ ${project.label}: wrangler config`);
+        }
+        problems += projectProblems;
+    }
+    return problems;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@smoothbricks/cli",
-  "version": "0.6.0",
+  "version": "0.8.0",
   "type": "module",
   "description": "SmoothBricks monorepo automation CLI",
   "bin": {

package/src/monorepo/managed-files.test.ts

@@ -0,0 +1,128 @@
+import { describe, expect, it } from 'bun:test';
+import fc from 'fast-check';
+import {
+  extractInlineLocalBlocksForTest,
+  INLINE_LOCAL_BEGIN,
+  INLINE_LOCAL_END,
+  LOCAL_SECTION_MARKER,
+  reinsertInlineLocalBlocksForTest,
+  splitLocalSectionForTest,
+} from './managed-files.js';
+
+const MANAGED = '# managed content\npath merge=driver\n';
+
+describe('managed-file local sections', () => {
+  it('content without a marker is entirely managed', () => {
+    const { managed, localTail } = splitLocalSectionForTest(MANAGED);
+    expect(managed).toBe(MANAGED);
+    expect(localTail).toBe('');
+  });
+
+  it('everything from the marker onward is the repo-owned tail', () => {
+    const tail = `${LOCAL_SECTION_MARKER}\ncustom/*.jsonl merge=custom-log\n`;
+    const { managed, localTail } = splitLocalSectionForTest(`${MANAGED}\n${tail}`);
+    expect(managed).toBe(`${MANAGED}\n`);
+    expect(localTail).toBe(tail);
+  });
+
+  it('a tail directly after the managed content tolerates the separating newline', () => {
+    // The compare rule accepts `managed === content + '\n'` when a tail exists,
+    // so update → check round-trips as unchanged.
+    const written = `${MANAGED}\n${LOCAL_SECTION_MARKER}\nextra\n`;
+    const { managed, localTail } = splitLocalSectionForTest(written);
+    expect(managed).toBe(`${MANAGED}\n`);
+    expect(localTail.startsWith(LOCAL_SECTION_MARKER)).toBe(true);
+  });
+});
+
+describe('managed-file inline local blocks', () => {
+  it('content with no inline markers extracts as fully managed, no blocks', () => {
+    const { withoutInline, blocks } = extractInlineLocalBlocksForTest(MANAGED);
+    expect(withoutInline).toBe(MANAGED);
+    expect(blocks).toEqual([]);
+  });
+
+  it('a wrapped block is extracted and removed, anchored on the preceding line', () => {
+    const current = ['a:', '  - one', '  - two', INLINE_LOCAL_BEGIN, '  - repo-owned', INLINE_LOCAL_END, 'b:'].join(
+      '\n',
+    );
+    const { withoutInline, blocks } = extractInlineLocalBlocksForTest(current);
+    expect(withoutInline).toBe(['a:', '  - one', '  - two', 'b:'].join('\n'));
+    expect(blocks).toEqual([{ anchor: '  - two', lines: '  - repo-owned' }]);
+  });
+
+  it('multiple blocks each anchor to their own preceding line', () => {
+    const current = [
+      'x',
+      INLINE_LOCAL_BEGIN,
+      'first',
+      INLINE_LOCAL_END,
+      'y',
+      INLINE_LOCAL_BEGIN,
+      'second',
+      INLINE_LOCAL_END,
+      'z',
+    ].join('\n');
+    const { withoutInline, blocks } = extractInlineLocalBlocksForTest(current);
+    expect(withoutInline).toBe(['x', 'y', 'z'].join('\n'));
+    expect(blocks).toEqual([
+      { anchor: 'x', lines: 'first' },
+      { anchor: 'y', lines: 'second' },
+    ]);
+  });
+
+  it('a begin marker with no preceding line throws rather than silently dropping content', () => {
+    const current = [INLINE_LOCAL_BEGIN, 'orphan', INLINE_LOCAL_END].join('\n');
+    expect(() => extractInlineLocalBlocksForTest(current)).toThrow(/no preceding anchor/);
+  });
+
+  it('an unterminated begin marker throws rather than silently dropping content', () => {
+    const current = ['a', INLINE_LOCAL_BEGIN, 'unterminated'].join('\n');
+    expect(() => extractInlineLocalBlocksForTest(current)).toThrow(/no matching/);
+  });
+
+  it('reinserting into fresh content with no blocks is a no-op', () => {
+    expect(reinsertInlineLocalBlocksForTest(MANAGED, [])).toBe(MANAGED);
+  });
+
+  it('reinserting splices the block back after its anchor in freshly rendered content', () => {
+    const fresh = ['a:', '  - one', '  - two', 'b:'].join('\n');
+    const result = reinsertInlineLocalBlocksForTest(fresh, [{ anchor: '  - two', lines: '  - repo-owned' }]);
+    expect(result).toBe(
+      ['a:', '  - one', '  - two', INLINE_LOCAL_BEGIN, '  - repo-owned', INLINE_LOCAL_END, 'b:'].join('\n'),
+    );
+  });
+
+  it("reinserting refuses when the anchor no longer appears — never silently drops the repo's customization", () => {
+    const fresh = ['a:', '  - one', 'b:'].join('\n'); // '  - two' is gone
+    expect(() => reinsertInlineLocalBlocksForTest(fresh, [{ anchor: '  - two', lines: '  - repo-owned' }])).toThrow(
+      /no longer matches/,
+    );
+  });
+
+  it('property: extract then reinsert round-trips to the original for unique, single-occurrence anchors', () => {
+    // Lines that can serve as anchors: non-empty, not a marker, and each drawn
+    // from a small alphabet so uniqueness is checkable — the round-trip only
+    // holds when an anchor line occurs exactly once in the managed section
+    // (reinsert finds the FIRST occurrence by design, same as the real file
+    // shape: comments/patterns are unique in practice).
+    const linePool = fc.constantFrom('alpha', 'beta', 'gamma', 'delta', 'epsilon', 'zeta');
+    fc.assert(
+      fc.property(
+        fc.uniqueArray(linePool, { minLength: 1, maxLength: 6 }),
+        fc.array(fc.string(), { maxLength: 3 }),
+        (anchors, blockLinesFlat) => {
+          const blockLines = blockLinesFlat.length > 0 ? [blockLinesFlat.join('|') || 'x'] : ['x'];
+          const fresh = anchors.join('\n');
+          const withBlocks = anchors
+            .map((anchor) => [anchor, INLINE_LOCAL_BEGIN, ...blockLines, INLINE_LOCAL_END].join('\n'))
+            .join('\n');
+          const { withoutInline, blocks } = extractInlineLocalBlocksForTest(withBlocks);
+          expect(withoutInline).toBe(fresh);
+          const reinserted = reinsertInlineLocalBlocksForTest(fresh, blocks);
+          expect(reinserted).toBe(withBlocks);
+        },
+      ),
+    );
+  });
+});

package/src/monorepo/managed-files.ts

@@ -8,6 +8,14 @@ import { renderPublishWorkflowYaml } from './publish-workflow.js';
 
 type ManagedKind = 'raw' | 'template' | 'generated';
 
+/**
+ * Repos may append their own content to a managed file below this marker —
+ * e.g. extra merge drivers in .gitattributes. Everything from the marker
+ * line onward is preserved verbatim across updates and ignored by the
+ * drift check; the managed section above it stays byte-exact.
+ */
+export const LOCAL_SECTION_MARKER = '# smoo-local: everything below this line is repo-owned and preserved';
+
 interface ManagedFile {
   kind: ManagedKind;
   source: string;
@@ -16,6 +24,92 @@ interface ManagedFile {
   releasePackagesOnly?: boolean;
 }
 
+/** Split a managed target's content into the managed part and the repo-owned tail. */
+function splitLocalSection(current: string): { managed: string; localTail: string } {
+  const index = current.indexOf(LOCAL_SECTION_MARKER);
+  if (index === -1) return { managed: current, localTail: '' };
+  return { managed: current.slice(0, index), localTail: current.slice(index) };
+}
+
+/** Test seam for the pure splitter. */
+export const splitLocalSectionForTest = splitLocalSection;
+
+/**
+ * A repo-owned block INSIDE the managed section — e.g. one extra pattern
+ * spliced into a formatter's list, where a trailing marker (LOCAL_SECTION_MARKER)
+ * can't express it because it isn't at the end of the file. Wrap it in
+ * `# smoo-local-begin` / `# smoo-local-end`; the block is anchored to the line
+ * immediately before `# smoo-local-begin`. On update, the block is re-spliced
+ * right after that same anchor line in the freshly rendered template — if the
+ * anchor no longer appears there (the template reworked that section), the
+ * update refuses rather than silently dropping the repo's customization.
+ */
+export const INLINE_LOCAL_BEGIN = '# smoo-local-begin';
+export const INLINE_LOCAL_END = '# smoo-local-end';
+
+interface InlineLocalBlock {
+  anchor: string;
+  lines: string;
+}
+
+/** Pull inline local blocks out of a managed section, returning the section
+ * with each block (and its markers) removed, plus the extracted blocks in
+ * the order they appeared. */
+function extractInlineLocalBlocks(managed: string): { withoutInline: string; blocks: InlineLocalBlock[] } {
+  const lines = managed.split('\n');
+  const kept: string[] = [];
+  const blocks: InlineLocalBlock[] = [];
+  let i = 0;
+  while (i < lines.length) {
+    const line = lines[i];
+    if (line !== undefined && line.trim() === INLINE_LOCAL_BEGIN) {
+      const anchor = kept.at(-1);
+      if (anchor === undefined) {
+        throw new Error(`${INLINE_LOCAL_BEGIN} on line ${i + 1} has no preceding anchor line`);
+      }
+      const blockLines: string[] = [];
+      i += 1;
+      while (i < lines.length && lines[i]?.trim() !== INLINE_LOCAL_END) {
+        blockLines.push(lines[i] as string);
+        i += 1;
+      }
+      if (i >= lines.length) {
+        throw new Error(`${INLINE_LOCAL_BEGIN} anchored on "${anchor}" has no matching ${INLINE_LOCAL_END}`);
+      }
+      blocks.push({ anchor, lines: blockLines.join('\n') });
+      i += 1; // skip the END marker line itself
+      continue;
+    }
+    kept.push(line);
+    i += 1;
+  }
+  return { withoutInline: kept.join('\n'), blocks };
+}
+
+/** Test seam for the pure extractor. */
+export const extractInlineLocalBlocksForTest = extractInlineLocalBlocks;
+
+/** Re-splice extracted inline blocks into freshly rendered managed content,
+ * each immediately after its anchor line. A no-op when there are no blocks. */
+function reinsertInlineLocalBlocks(content: string, blocks: InlineLocalBlock[]): string {
+  if (blocks.length === 0) return content;
+  const lines = content.split('\n');
+  for (const block of blocks) {
+    const index = lines.indexOf(block.anchor);
+    if (index === -1) {
+      throw new Error(
+        `${INLINE_LOCAL_BEGIN} block anchored on "${block.anchor}" no longer matches any line in the updated ` +
+          'template — reconcile the repo-owned block manually',
+      );
+    }
+    lines.splice(index + 1, 0, INLINE_LOCAL_BEGIN, ...block.lines.split('\n'), INLINE_LOCAL_END);
+  }
+  return lines.join('\n');
+}
+
+/** Test seam for the pure re-splicer. */
+export const reinsertInlineLocalBlocksForTest = reinsertInlineLocalBlocks;
+
 export interface FileResult {
   target: string;
   action: 'created' | 'updated' | 'unchanged' | 'skipped' | 'skipped-symlink' | 'drifted' | 'ok-symlink';
@@ -154,13 +248,17 @@ function applyManagedFile(
       throw new Error(`${file.target} exists but is not a regular file or symlink`);
     }
     const current = readFileSync(target, 'utf8');
-    if (current === content) {
+    const { managed, localTail } = splitLocalSection(current);
+    const { withoutInline, blocks } = extractInlineLocalBlocks(managed);
+    if (withoutInline === content || (localTail !== '' && withoutInline === `${content}\n`)) {
       return { target: file.target, action: 'unchanged' };
     }
     if (mode === 'check' || mode === 'diff') {
       return { target: file.target, action: 'drifted' };
     }
-    writeManagedFile(target, content, file.executable === true);
+    const rendered = reinsertInlineLocalBlocks(content, blocks);
+    const next = localTail === '' ? rendered : `${rendered}\n${localTail}`;
+    writeManagedFile(target, next, file.executable === true);
     return { target: file.target, action: 'updated' };
   }
   if (mode === 'check' || mode === 'diff') {

package/src/monorepo/packed-package.ts

@@ -90,7 +90,7 @@ async function validatePackedManifest(
 async function validateAttw(root: string, pkg: PackageInfo, packed: { path: string }): Promise<number> {
   const attw = await loadAttwCore();
   const analysis = await attw.checkPackage(await createAttwPackageFromTarball(attw, root, packed.path), {
-    excludeEntrypoints: wasmExportEntrypoints(pkg.json.exports),
+    excludeEntrypoints: nonJsExportEntrypoints(pkg.json.exports),
   });
   if (!isRecord(analysis) || analysis.types === false) {
     return 0;
@@ -242,20 +242,22 @@ function formatResolutionKind(kind: string): string {
   return kind;
 }
 
-function wasmExportEntrypoints(exports: unknown): string[] {
+function nonJsExportEntrypoints(exports: unknown): string[] {
   if (!isRecord(exports)) {
     return [];
   }
   return Object.entries(exports)
-    .filter(([key, value]) => key.startsWith('.') && exportPointsToWasm(value))
+    .filter(([key, value]) => key.startsWith('.') && exportPointsToNonJs(value))
     .map(([key]) => key);
 }
 
-function exportPointsToWasm(value: unknown): boolean {
+function exportPointsToNonJs(value: unknown): boolean {
   if (typeof value === 'string') {
-    return value.endsWith('.wasm');
+    // attw resolves every entrypoint as a module; assets can never have types.
+    // Existence of the target files is still validated by publint.
+    return value.endsWith('.wasm') || value.endsWith('.css');
   }
-  return isRecord(value) && Object.values(value).some(exportPointsToWasm);
+  return isRecord(value) && Object.values(value).some(exportPointsToNonJs);
 }
 
 async function packPackage(root: string, pkg: PackageInfo): Promise<{ path: string; arrayBuffer: ArrayBuffer }> {

package/src/monorepo/packs/index.ts

@@ -26,6 +26,7 @@ import {
 } from '../packed-package.js';
 import { syncRootRuntimeVersions } from '../runtime.js';
 import { applyToolConfigDefaults, validateToolConfig } from '../tool-validation.js';
+import { applyWranglerDefaults, validateWrangler } from '../wrangler.js';
 
 export interface MonorepoContext {
   root: string;
@@ -150,6 +151,18 @@ const packs: MonorepoPack[] = [
       return validatePackedPublicPackageTypes(ctx.root);
     },
   },
+  {
+    name: 'wrangler',
+    init(ctx) {
+      applyWranglerDefaults(ctx.root);
+    },
+    fixPreBuild(ctx) {
+      applyWranglerDefaults(ctx.root);
+    },
+    validatePreBuild(ctx) {
+      return validateWrangler(ctx.root);
+    },
+  },
 ];
 
 export async function runInitPacks(ctx: MonorepoContext): Promise<void> {

package/src/monorepo/wrangler.test.ts

@@ -0,0 +1,216 @@
+import { describe, expect, it, spyOn } from 'bun:test';
+import { mkdir, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { applyWranglerDefaults, firstWranglerEnv, validateWrangler } from './wrangler.js';
+
+describe('firstWranglerEnv', () => {
+  it('extracts the first [env.<name>] header', () => {
+    expect(firstWranglerEnv('name = "svc"\n\n[env.staging]\nvars = {}\n\n[env.production]\n')).toBe('staging');
+  });
+
+  it('handles nested env sub-tables', () => {
+    expect(firstWranglerEnv('[env.production.vars]\nFOO = "bar"\n')).toBe('production');
+  });
+
+  it('returns null when the toml declares no env block', () => {
+    expect(firstWranglerEnv('name = "svc"\nmain = "src/index.ts"\n')).toBeNull();
+  });
+});
+
+describe('applyWranglerDefaults', () => {
+  it('injects the wrangler-types target and wires typecheck, idempotently', async () => {
+    const root = await createWorkspace([
+      { dir: 'api', name: '@acme/api', toml: '[env.production]\n', nx: { targets: { typecheck: { dependsOn: ['^build'] } } } },
+    ]);
+    try {
+      applyWranglerDefaults(root);
+      const pkg = await readJson(join(root, 'packages/api/package.json'));
+      expect(nxTargets(pkg)['wrangler-types']).toEqual({
+        executor: 'nx:run-commands',
+        cache: true,
+        inputs: ['{projectRoot}/wrangler.toml', '{projectRoot}/.dev.vars.example'],
+        outputs: ['{projectRoot}/worker-configuration.d.ts'],
+        options: {
+          command: 'wrangler types --env production --env-file .dev.vars.example --include-runtime false',
+          cwd: '{projectRoot}',
+        },
+      });
+      const typecheck = nxTargets(pkg).typecheck;
+      expect(isRecord(typecheck) ? typecheck.dependsOn : null).toEqual(['^build', 'wrangler-types']);
+
+      const logs = captureConsoleLogs();
+      applyWranglerDefaults(root);
+      expect(logs.some((line) => line.startsWith('updated'))).toBe(false);
+      expect(logs.some((line) => line.startsWith('unchanged'))).toBe(true);
+      expect(await readJson(join(root, 'packages/api/package.json'))).toEqual(pkg);
+    } finally {
+      console.log = originalConsoleLog;
+      await rm(root, { recursive: true, force: true });
+    }
+  });
+
+  it('omits --env from the command when the wrangler.toml declares no env block', async () => {
+    const root = await createWorkspace([{ dir: 'api', name: '@acme/api', toml: 'name = "svc"\nmain = "src/index.ts"\n' }]);
+    captureConsoleLogs();
+    try {
+      applyWranglerDefaults(root);
+      const target = nxTargets(await readJson(join(root, 'packages/api/package.json')))['wrangler-types'];
+      const options = isRecord(target) ? target.options : null;
+      expect(isRecord(options) ? options.command : null).toBe(
+        'wrangler types --env-file .dev.vars.example --include-runtime false',
+      );
+    } finally {
+      console.log = originalConsoleLog;
+      await rm(root, { recursive: true, force: true });
+    }
+  });
+
+  it('creates an empty .dev.vars.example and logs it when the project has none', async () => {
+    const root = await createWorkspace([{ dir: 'api', name: '@acme/api', toml: 'name = "svc"\n' }]);
+    const logs = captureConsoleLogs();
+    try {
+      applyWranglerDefaults(root);
+      expect(await readFile(join(root, 'packages/api/.dev.vars.example'), 'utf8')).toBe('');
+      expect(logs.some((line) => line.startsWith('created') && line.includes('api/.dev.vars.example'))).toBe(true);
+    } finally {
+      console.log = originalConsoleLog;
+      await rm(root, { recursive: true, force: true });
+    }
+  });
+
+  it('preserves a human-authored .dev.vars.example and does not log a creation', async () => {
+    const root = await createWorkspace([{ dir: 'api', name: '@acme/api', toml: 'name = "svc"\n' }]);
+    const examplePath = join(root, 'packages/api/.dev.vars.example');
+    await writeFile(examplePath, 'GITHUB_CLIENT_SECRET=\n');
+    const logs = captureConsoleLogs();
+    try {
+      applyWranglerDefaults(root);
+      expect(await readFile(examplePath, 'utf8')).toBe('GITHUB_CLIENT_SECRET=\n');
+      expect(logs.some((line) => line.startsWith('created') && line.includes('.dev.vars.example'))).toBe(false);
+    } finally {
+      console.log = originalConsoleLog;
+      await rm(root, { recursive: true, force: true });
+    }
+  });
+
+  it('adds the missing entries to an incomplete root .gitignore', async () => {
+    const root = await createWorkspace([{ dir: 'api', name: '@acme/api', toml: 'name = "svc"\n' }]);
+    const logs = captureConsoleLogs();
+    try {
+      await writeFile(join(root, '.gitignore'), 'node_modules\n');
+      applyWranglerDefaults(root);
+      const lines = (await readFile(join(root, '.gitignore'), 'utf8')).split('\n').map((line) => line.trim());
+      expect(lines).toContain('.dev.vars');
+      expect(lines).toContain('worker-configuration.d.ts');
+      expect(logs.some((line) => line.startsWith('updated') && line.includes('.gitignore'))).toBe(true);
+    } finally {
+      console.log = originalConsoleLog;
+      await rm(root, { recursive: true, force: true });
+    }
+  });
+
+  it('leaves the root .gitignore untouched when both entries are already present', async () => {
+    const root = await createWorkspace([{ dir: 'api', name: '@acme/api', toml: 'name = "svc"\n' }]);
+    const gitignorePath = join(root, '.gitignore');
+    const logs = captureConsoleLogs();
+    try {
+      await writeFile(gitignorePath, 'node_modules\n.dev.vars\nworker-configuration.d.ts\n');
+      const before = await readFile(gitignorePath, 'utf8');
+      applyWranglerDefaults(root);
+      expect(await readFile(gitignorePath, 'utf8')).toBe(before);
+      expect(logs.some((line) => line.startsWith('updated') && line.includes('.gitignore'))).toBe(false);
+    } finally {
+      console.log = originalConsoleLog;
+      await rm(root, { recursive: true, force: true });
+    }
+  });
+});
+
+describe('validateWrangler', () => {
+  it('flags a project whose .dev.vars.example is missing while target and .gitignore are wired', async () => {
+    const root = await createWorkspace([
+      {
+        dir: 'api',
+        name: '@acme/api',
+        toml: '[env.staging]\n',
+        nx: { targets: { 'wrangler-types': { executor: 'nx:run-commands' } } },
+      },
+    ]);
+    try {
+      await writeFile(join(root, '.gitignore'), '.dev.vars\nworker-configuration.d.ts\n');
+      expect(validateWrangler(root)).toBe(1);
+    } finally {
+      await rm(root, { recursive: true, force: true });
+    }
+  });
+
+  it('passes a fully wired project', async () => {
+    const root = await createWorkspace([{ dir: 'api', name: '@acme/api', toml: '[env.staging]\n' }]);
+    try {
+      applyWranglerDefaults(root);
+      await writeFile(join(root, 'packages/api/.dev.vars.example'), 'SECRET=\n');
+      await writeFile(join(root, '.gitignore'), '.dev.vars\n!.dev.vars.example\nworker-configuration.d.ts\n');
+      expect(validateWrangler(root)).toBe(0);
+    } finally {
+      await rm(root, { recursive: true, force: true });
+    }
+  });
+});
+
+async function createWorkspace(
+  packages: Array<{ dir: string; name: string; toml: string; nx?: Record<string, unknown> }>,
+): Promise<string> {
+  const root = await mkdtemp(join(tmpdir(), 'smoo-wrangler-'));
+  await writeJson(join(root, 'package.json'), {
+    name: '@acme/codebase',
+    version: '0.0.0',
+    private: true,
+    workspaces: ['packages/*'],
+  });
+  for (const pkg of packages) {
+    await writeJson(join(root, `packages/${pkg.dir}/package.json`), {
+      name: pkg.name,
+      version: '0.0.0',
+      private: true,
+      ...(pkg.nx ? { nx: pkg.nx } : {}),
+    });
+    await writeFile(join(root, `packages/${pkg.dir}/wrangler.toml`), pkg.toml);
+  }
+  return root;
+}
+
+function nxTargets(pkg: Record<string, unknown>): Record<string, unknown> {
+  const nx = pkg.nx;
+  if (!isRecord(nx) || !isRecord(nx.targets)) {
+    throw new Error('nx.targets not found');
+  }
+  return nx.targets;
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+
+async function readJson(path: string): Promise<Record<string, unknown>> {
+  const parsed: unknown = JSON.parse(await readFile(path, 'utf8'));
+  if (!isRecord(parsed)) {
+    throw new Error('expected JSON object');
+  }
+  return parsed;
+}
+
+async function writeJson(path: string, value: Record<string, unknown>): Promise<void> {
+  await mkdir(join(path, '..'), { recursive: true });
+  await writeFile(path, `${JSON.stringify(value, null, 2)}\n`);
+}
+
+const originalConsoleLog = console.log;
+
+function captureConsoleLogs(): string[] {
+  const logs: string[] = [];
+  spyOn(console, 'log').mockImplementation((...args: unknown[]) => {
+    logs.push(args.join(' '));
+  });
+  return logs;
+}

package/src/monorepo/wrangler.ts

@@ -0,0 +1,135 @@
+import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { join, relative } from 'node:path';
+import { getOrCreateRecord, recordProperty, writeJsonObject } from '../lib/json.js';
+import { getWorkspacePackageManifests } from '../lib/workspace.js';
+
+interface WranglerProject {
+  label: string;
+  dir: string;
+  packageJsonPath: string;
+  json: Record<string, unknown>;
+  tomlPath: string;
+}
+
+/** First `[env.<name>]` header in a wrangler.toml, or `null` when the config declares no envs (top-level bindings only). */
+export function firstWranglerEnv(tomlText: string): string | null {
+  const match = tomlText.match(/^\s*\[env\.([A-Za-z0-9_-]+)/m);
+  return match ? match[1] : null;
+}
+
+function wranglerProjects(root: string): WranglerProject[] {
+  const projects: WranglerProject[] = [];
+  for (const pkg of getWorkspacePackageManifests(root)) {
+    const tomlPath = join(pkg.path, 'wrangler.toml');
+    if (!existsSync(tomlPath)) {
+      continue;
+    }
+    projects.push({
+      label: relative(root, pkg.path) || '.',
+      dir: pkg.path,
+      packageJsonPath: pkg.packageJsonPath,
+      json: pkg.json,
+      tomlPath,
+    });
+  }
+  return projects;
+}
+
+/** Ensure the root .gitignore ignores the local secret file + generated types (once). */
+function ensureGitignore(root: string): void {
+  const path = join(root, '.gitignore');
+  const text = existsSync(path) ? readFileSync(path, 'utf8') : '';
+  const lines = text.split('\n').map((line) => line.trim());
+  const missing = ['.dev.vars', 'worker-configuration.d.ts'].filter((entry) => !lines.includes(entry));
+  if (missing.length === 0) {
+    return;
+  }
+  const block = `${text.replace(/\s*$/, '')}\n\n# wrangler: local secret values + generated types (names live in .dev.vars.example)\n${missing.join('\n')}\n`;
+  writeFileSync(path, block);
+  console.log(`updated        .gitignore (${missing.join(', ')})`);
+}
+
+export function applyWranglerDefaults(root: string): void {
+  const projects = wranglerProjects(root);
+  if (projects.length > 0) {
+    ensureGitignore(root);
+  }
+  for (const project of projects) {
+    const env = firstWranglerEnv(readFileSync(project.tomlPath, 'utf8'));
+    const nx = getOrCreateRecord(project.json, 'nx');
+    const targets = getOrCreateRecord(nx, 'targets');
+    const desired: Record<string, unknown> = {
+      executor: 'nx:run-commands',
+      cache: true,
+      inputs: ['{projectRoot}/wrangler.toml', '{projectRoot}/.dev.vars.example'],
+      outputs: ['{projectRoot}/worker-configuration.d.ts'],
+      options: {
+        command: `wrangler types${env ? ` --env ${env}` : ''} --env-file .dev.vars.example --include-runtime false`,
+        cwd: '{projectRoot}',
+      },
+    };
+    let changed = false;
+    const existing = recordProperty(targets, 'wrangler-types');
+    if (!existing || JSON.stringify(existing) !== JSON.stringify(desired)) {
+      targets['wrangler-types'] = desired;
+      changed = true;
+    }
+    const typecheck = recordProperty(targets, 'typecheck');
+    if (typecheck) {
+      const dependsOn: unknown[] = Array.isArray(typecheck.dependsOn) ? typecheck.dependsOn : [];
+      if (!dependsOn.includes('wrangler-types')) {
+        dependsOn.push('wrangler-types');
+        typecheck.dependsOn = dependsOn;
+        changed = true;
+      }
+    }
+    if (changed) {
+      writeJsonObject(project.packageJsonPath, project.json);
+      console.log(`updated        ${project.label}/package.json wrangler-types target`);
+    } else {
+      console.log(`unchanged      ${project.label}/package.json wrangler-types target`);
+    }
+    // Empty .dev.vars.example = "this worker declares no secrets". Bootstrap it
+    // when missing; humans add SECRET_NAME= lines if the worker reads any (the
+    // wrangler-types + tsc gate fails on an undeclared secret until they do).
+    const examplePath = join(project.dir, '.dev.vars.example');
+    if (!existsSync(examplePath)) {
+      writeFileSync(examplePath, '');
+      console.log(`created        ${project.label}/.dev.vars.example (no secrets)`);
+    }
+  }
+}
+
+export function validateWrangler(root: string): number {
+  const gitignorePath = join(root, '.gitignore');
+  const gitignoreLines = existsSync(gitignorePath)
+    ? readFileSync(gitignorePath, 'utf8')
+        .split('\n')
+        .map((line) => line.trim())
+    : [];
+  const gitignoreCoversSecrets =
+    gitignoreLines.includes('.dev.vars') && gitignoreLines.includes('worker-configuration.d.ts');
+  let problems = 0;
+  for (const project of wranglerProjects(root)) {
+    let projectProblems = 0;
+    if (!existsSync(join(project.dir, '.dev.vars.example'))) {
+      console.log(`⨯ ${project.label}: missing .dev.vars.example`);
+      projectProblems++;
+    }
+    const nx = recordProperty(project.json, 'nx');
+    const targets = nx ? recordProperty(nx, 'targets') : null;
+    if (!targets || !recordProperty(targets, 'wrangler-types')) {
+      console.log(`⨯ ${project.label}: missing wrangler-types nx target`);
+      projectProblems++;
+    }
+    if (!gitignoreCoversSecrets) {
+      console.log(`⨯ ${project.label}: root .gitignore must ignore .dev.vars and worker-configuration.d.ts`);
+      projectProblems++;
+    }
+    if (projectProblems === 0) {
+      console.log(`✓ ${project.label}: wrangler config`);
+    }
+    problems += projectProblems;
+  }
+  return problems;
+}

package/src/pr/index.test.ts

@@ -18,7 +18,7 @@ afterEach(() => {
 
 const PR_JSON = JSON.stringify({
   number: 40,
-  url: 'https://github.com/conloca/private/pull/40',
+  url: 'https://github.com/acme/private/pull/40',
   headRefName: 'gar-sync/private-to-public',
   baseRefName: 'public-mirror',
   isCrossRepository: false,
@@ -145,7 +145,7 @@ function writeState(overrides: Record<string, unknown>): void {
   mkdirSync(join(gitDir, 'smoo'), { recursive: true });
   const state = {
     pr: 40,
-    url: 'https://github.com/conloca/private/pull/40',
+    url: 'https://github.com/acme/private/pull/40',
     headBranch: 'gar-sync/private-to-public',
     baseBranch: 'public-mirror',
     remote: 'origin',