@smoothbricks/cli 0.7.0 → 0.9.0

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAMA,wBAAsB,MAAM,CAAC,IAAI,WAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAexE"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAOA,wBAAsB,MAAM,CAAC,IAAI,WAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAexE"}

package/dist/cli.js

@@ -3,6 +3,7 @@ import { variants } from './generate/index.js';
 import { cliPackageVersion } from './lib/cli-package.js';
 import { findRepoRoot } from './lib/run.js';
 import { resolvePrConflicts } from './pr/index.js';
+import { scaffold } from './wrangler/scaffold.js';
 export async function runCli(argv = process.argv.slice(2)) {
     const program = buildProgram();
     try {
@@ -290,6 +291,14 @@ function buildProgram() {
             process.exitCode = exitCode;
         }
     });
+    const wrangler = program.command('wrangler').description('Cloudflare wrangler project helpers');
+    wrangler
+        .command('scaffold <project>')
+        .description('Write a starter scripts/prepare-env.ts (manifest-driven) and wire its nx target')
+        .option('--force', 'overwrite an existing scripts/prepare-env.ts')
+        .action(async (project, options) => {
+        scaffold(await findRepoRoot(), project, { force: options.force });
+    });
     return program;
 }
 function booleanOption(value) {

package/dist/monorepo/managed-files.d.ts

@@ -12,6 +12,36 @@ declare function splitLocalSection(current: string): {
 };
 /** Test seam for the pure splitter. */
 export declare const splitLocalSectionForTest: typeof splitLocalSection;
+/**
+ * A repo-owned block INSIDE the managed section — e.g. one extra pattern
+ * spliced into a formatter's list, where a trailing marker (LOCAL_SECTION_MARKER)
+ * can't express it because it isn't at the end of the file. Wrap it in
+ * `# smoo-local-begin` / `# smoo-local-end`; the block is anchored to the line
+ * immediately before `# smoo-local-begin`. On update, the block is re-spliced
+ * right after that same anchor line in the freshly rendered template — if the
+ * anchor no longer appears there (the template reworked that section), the
+ * update refuses rather than silently dropping the repo's customization.
+ */
+export declare const INLINE_LOCAL_BEGIN = "# smoo-local-begin";
+export declare const INLINE_LOCAL_END = "# smoo-local-end";
+interface InlineLocalBlock {
+    anchor: string;
+    lines: string;
+}
+/** Pull inline local blocks out of a managed section, returning the section
+ * with each block (and its markers) removed, plus the extracted blocks in
+ * the order they appeared. */
+declare function extractInlineLocalBlocks(managed: string): {
+    withoutInline: string;
+    blocks: InlineLocalBlock[];
+};
+/** Test seam for the pure extractor. */
+export declare const extractInlineLocalBlocksForTest: typeof extractInlineLocalBlocks;
+/** Re-splice extracted inline blocks into freshly rendered managed content,
+ * each immediately after its anchor line. A no-op when there are no blocks. */
+declare function reinsertInlineLocalBlocks(content: string, blocks: InlineLocalBlock[]): string;
+/** Test seam for the pure re-splicer. */
+export declare const reinsertInlineLocalBlocksForTest: typeof reinsertInlineLocalBlocks;
 export interface FileResult {
     target: string;
     action: 'created' | 'updated' | 'unchanged' | 'skipped' | 'skipped-symlink' | 'drifted' | 'ok-symlink';

package/dist/monorepo/managed-files.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"managed-files.d.ts","sourceRoot":"","sources":["../../src/monorepo/managed-files.ts"],"names":[],"mappings":"AAUA;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,yEAAyE,CAAC;AAU3G,sFAAsF;AACtF,iBAAS,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAIlF;AAED,uCAAuC;AACvC,eAAO,MAAM,wBAAwB,0BAAoB,CAAC;AAE1D,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,GAAG,iBAAiB,GAAG,SAAS,GAAG,YAAY,CAAC;CACxG;AA8GD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,GAAG,OAAO,GAAG,MAAM,GAAG,UAAU,EAAE,CAG/F;AA8KD,wBAAgB,YAAY,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,IAAI,CAIxD;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAQzD"}
+{"version":3,"file":"managed-files.d.ts","sourceRoot":"","sources":["../../src/monorepo/managed-files.ts"],"names":[],"mappings":"AAUA;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,yEAAyE,CAAC;AAU3G,sFAAsF;AACtF,iBAAS,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAIlF;AAED,uCAAuC;AACvC,eAAO,MAAM,wBAAwB,0BAAoB,CAAC;AAE1D;;;;;;;;;GASG;AACH,eAAO,MAAM,kBAAkB,uBAAuB,CAAC;AACvD,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AAEnD,UAAU,gBAAgB;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;8BAE8B;AAC9B,iBAAS,wBAAwB,CAAC,OAAO,EAAE,MAAM,GAAG;IAAE,aAAa,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,gBAAgB,EAAE,CAAA;CAAE,CA6BxG;AAED,wCAAwC;AACxC,eAAO,MAAM,+BAA+B,iCAA2B,CAAC;AAExE;+EAC+E;AAC/E,iBAAS,yBAAyB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,CActF;AAED,yCAAyC;AACzC,eAAO,MAAM,gCAAgC,kCAA4B,CAAC;AAE1E,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,SAAS,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,GAAG,iBAAiB,GAAG,SAAS,GAAG,YAAY,CAAC;CACxG;AA8GD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,GAAG,OAAO,GAAG,MAAM,GAAG,UAAU,EAAE,CAG/F;AAgLD,wBAAgB,YAAY,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,IAAI,CAIxD;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAQzD"}

package/dist/monorepo/managed-files.js

@@ -21,6 +21,71 @@ function splitLocalSection(current) {
 }
 /** Test seam for the pure splitter. */
 export const splitLocalSectionForTest = splitLocalSection;
+/**
+ * A repo-owned block INSIDE the managed section — e.g. one extra pattern
+ * spliced into a formatter's list, where a trailing marker (LOCAL_SECTION_MARKER)
+ * can't express it because it isn't at the end of the file. Wrap it in
+ * `# smoo-local-begin` / `# smoo-local-end`; the block is anchored to the line
+ * immediately before `# smoo-local-begin`. On update, the block is re-spliced
+ * right after that same anchor line in the freshly rendered template — if the
+ * anchor no longer appears there (the template reworked that section), the
+ * update refuses rather than silently dropping the repo's customization.
+ */
+export const INLINE_LOCAL_BEGIN = '# smoo-local-begin';
+export const INLINE_LOCAL_END = '# smoo-local-end';
+/** Pull inline local blocks out of a managed section, returning the section
+ * with each block (and its markers) removed, plus the extracted blocks in
+ * the order they appeared. */
+function extractInlineLocalBlocks(managed) {
+    const lines = managed.split('\n');
+    const kept = [];
+    const blocks = [];
+    let i = 0;
+    while (i < lines.length) {
+        const line = lines[i];
+        if (line !== undefined && line.trim() === INLINE_LOCAL_BEGIN) {
+            const anchor = kept.at(-1);
+            if (anchor === undefined) {
+                throw new Error(`${INLINE_LOCAL_BEGIN} on line ${i + 1} has no preceding anchor line`);
+            }
+            const blockLines = [];
+            i += 1;
+            while (i < lines.length && lines[i]?.trim() !== INLINE_LOCAL_END) {
+                blockLines.push(lines[i]);
+                i += 1;
+            }
+            if (i >= lines.length) {
+                throw new Error(`${INLINE_LOCAL_BEGIN} anchored on "${anchor}" has no matching ${INLINE_LOCAL_END}`);
+            }
+            blocks.push({ anchor, lines: blockLines.join('\n') });
+            i += 1; // skip the END marker line itself
+            continue;
+        }
+        kept.push(line);
+        i += 1;
+    }
+    return { withoutInline: kept.join('\n'), blocks };
+}
+/** Test seam for the pure extractor. */
+export const extractInlineLocalBlocksForTest = extractInlineLocalBlocks;
+/** Re-splice extracted inline blocks into freshly rendered managed content,
+ * each immediately after its anchor line. A no-op when there are no blocks. */
+function reinsertInlineLocalBlocks(content, blocks) {
+    if (blocks.length === 0)
+        return content;
+    const lines = content.split('\n');
+    for (const block of blocks) {
+        const index = lines.indexOf(block.anchor);
+        if (index === -1) {
+            throw new Error(`${INLINE_LOCAL_BEGIN} block anchored on "${block.anchor}" no longer matches any line in the updated ` +
+                'template — reconcile the repo-owned block manually');
+        }
+        lines.splice(index + 1, 0, INLINE_LOCAL_BEGIN, ...block.lines.split('\n'), INLINE_LOCAL_END);
+    }
+    return lines.join('\n');
+}
+/** Test seam for the pure re-splicer. */
+export const reinsertInlineLocalBlocksForTest = reinsertInlineLocalBlocks;
 const managedFiles = [
     {
         kind: 'raw',
@@ -131,13 +196,15 @@ function applyManagedFile(root, file, mode, context) {
         }
         const current = readFileSync(target, 'utf8');
         const { managed, localTail } = splitLocalSection(current);
-        if (managed === content || (localTail !== '' && managed === `${content}\n`)) {
+        const { withoutInline, blocks } = extractInlineLocalBlocks(managed);
+        if (withoutInline === content || (localTail !== '' && withoutInline === `${content}\n`)) {
             return { target: file.target, action: 'unchanged' };
         }
         if (mode === 'check' || mode === 'diff') {
             return { target: file.target, action: 'drifted' };
         }
-        const next = localTail === '' ? content : `${content}\n${localTail}`;
+        const rendered = reinsertInlineLocalBlocks(content, blocks);
+        const next = localTail === '' ? rendered : `${rendered}\n${localTail}`;
         writeManagedFile(target, next, file.executable === true);
         return { target: file.target, action: 'updated' };
     }

package/dist/monorepo/packs/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/monorepo/packs/index.ts"],"names":[],"mappings":"AA6BA,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,OAAO,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAClD,WAAW,CAAC,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACzD,YAAY,CAAC,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC1D,gBAAgB,CAAC,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;IAClE,iBAAiB,CAAC,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;CACpE;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;IAChC,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,eAAe,EAAE,OAAO,CAAC,EAAE,mBAAmB,KAAK,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;CAC9F;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;CACtB;AAgGD,wBAAsB,YAAY,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAItE;AAED,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,eAAe,EACpB,OAAO,GAAE,mBAAwB,EACjC,KAAK,GAAE,oBAAyB,GAC/B,OAAO,CAAC,kBAAkB,CAAC,CA0B7B"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/monorepo/packs/index.ts"],"names":[],"mappings":"AA8BA,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,OAAO,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAClD,WAAW,CAAC,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACzD,YAAY,CAAC,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAC1D,gBAAgB,CAAC,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;IAClE,iBAAiB,CAAC,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;CACpE;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,CAAC,EAAE,SAAS,YAAY,EAAE,CAAC;IAChC,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,eAAe,EAAE,OAAO,CAAC,EAAE,mBAAmB,KAAK,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;CAC9F;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;CACtB;AA4GD,wBAAsB,YAAY,CAAC,GAAG,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAItE;AAED,wBAAsB,gBAAgB,CACpC,GAAG,EAAE,eAAe,EACpB,OAAO,GAAE,mBAAwB,EACjC,KAAK,GAAE,oBAAyB,GAC/B,OAAO,CAAC,kBAAkB,CAAC,CA0B7B"}

package/dist/monorepo/packs/index.js

@@ -10,6 +10,7 @@ import { applyFixableMonorepoDefaults, applyNxReleaseDefaults, applyPublicPackag
 import { validatePackedPublicPackageManifest, validatePackedPublicPackagePublint, validatePackedPublicPackageTypes, } from '../packed-package.js';
 import { syncRootRuntimeVersions } from '../runtime.js';
 import { applyToolConfigDefaults, validateToolConfig } from '../tool-validation.js';
+import { applyWranglerDefaults, validateWrangler } from '../wrangler.js';
 const packs = [
     {
         name: 'core',
@@ -96,6 +97,18 @@ const packs = [
             return validatePackedPublicPackageTypes(ctx.root);
         },
     },
+    {
+        name: 'wrangler',
+        init(ctx) {
+            applyWranglerDefaults(ctx.root);
+        },
+        fixPreBuild(ctx) {
+            applyWranglerDefaults(ctx.root);
+        },
+        validatePreBuild(ctx) {
+            return validateWrangler(ctx.root);
+        },
+    },
 ];
 export async function runInitPacks(ctx) {
     for (const pack of packs) {

package/dist/monorepo/wrangler.d.ts

@@ -0,0 +1,5 @@
+/** First `[env.<name>]` header in a wrangler.toml, or `null` when the config declares no envs (top-level bindings only). */
+export declare function firstWranglerEnv(tomlText: string): string | null;
+export declare function applyWranglerDefaults(root: string): void;
+export declare function validateWrangler(root: string): number;
+//# sourceMappingURL=wrangler.d.ts.map

package/dist/monorepo/wrangler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wrangler.d.ts","sourceRoot":"","sources":["../../src/monorepo/wrangler.ts"],"names":[],"mappings":"AAaA,4HAA4H;AAC5H,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAGhE;AAkCD,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAiDxD;AAED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAgCrD"}

package/dist/monorepo/wrangler.js

@@ -0,0 +1,122 @@
+import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { join, relative } from 'node:path';
+import { getOrCreateRecord, recordProperty, writeJsonObject } from '../lib/json.js';
+import { getWorkspacePackageManifests } from '../lib/workspace.js';
+/** First `[env.<name>]` header in a wrangler.toml, or `null` when the config declares no envs (top-level bindings only). */
+export function firstWranglerEnv(tomlText) {
+    const match = tomlText.match(/^\s*\[env\.([A-Za-z0-9_-]+)/m);
+    return match ? match[1] : null;
+}
+function wranglerProjects(root) {
+    const projects = [];
+    for (const pkg of getWorkspacePackageManifests(root)) {
+        const tomlPath = join(pkg.path, 'wrangler.toml');
+        if (!existsSync(tomlPath)) {
+            continue;
+        }
+        projects.push({
+            label: relative(root, pkg.path) || '.',
+            dir: pkg.path,
+            packageJsonPath: pkg.packageJsonPath,
+            json: pkg.json,
+            tomlPath,
+        });
+    }
+    return projects;
+}
+/** Ensure the root .gitignore ignores the local secret file + generated types (once). */
+function ensureGitignore(root) {
+    const path = join(root, '.gitignore');
+    const text = existsSync(path) ? readFileSync(path, 'utf8') : '';
+    const lines = text.split('\n').map((line) => line.trim());
+    const missing = ['.dev.vars', 'worker-configuration.d.ts'].filter((entry) => !lines.includes(entry));
+    if (missing.length === 0) {
+        return;
+    }
+    const block = `${text.replace(/\s*$/, '')}\n\n# wrangler: local secret values + generated types (names live in .dev.vars.example)\n${missing.join('\n')}\n`;
+    writeFileSync(path, block);
+    console.log(`updated        .gitignore (${missing.join(', ')})`);
+}
+export function applyWranglerDefaults(root) {
+    const projects = wranglerProjects(root);
+    if (projects.length > 0) {
+        ensureGitignore(root);
+    }
+    for (const project of projects) {
+        const env = firstWranglerEnv(readFileSync(project.tomlPath, 'utf8'));
+        const nx = getOrCreateRecord(project.json, 'nx');
+        const targets = getOrCreateRecord(nx, 'targets');
+        const desired = {
+            executor: 'nx:run-commands',
+            cache: true,
+            inputs: ['{projectRoot}/wrangler.toml', '{projectRoot}/.dev.vars.example'],
+            outputs: ['{projectRoot}/worker-configuration.d.ts'],
+            options: {
+                command: `wrangler types${env ? ` --env ${env}` : ''} --env-file .dev.vars.example --include-runtime false`,
+                cwd: '{projectRoot}',
+            },
+        };
+        let changed = false;
+        const existing = recordProperty(targets, 'wrangler-types');
+        if (!existing || JSON.stringify(existing) !== JSON.stringify(desired)) {
+            targets['wrangler-types'] = desired;
+            changed = true;
+        }
+        const typecheck = recordProperty(targets, 'typecheck');
+        if (typecheck) {
+            const dependsOn = Array.isArray(typecheck.dependsOn) ? typecheck.dependsOn : [];
+            if (!dependsOn.includes('wrangler-types')) {
+                dependsOn.push('wrangler-types');
+                typecheck.dependsOn = dependsOn;
+                changed = true;
+            }
+        }
+        if (changed) {
+            writeJsonObject(project.packageJsonPath, project.json);
+            console.log(`updated        ${project.label}/package.json wrangler-types target`);
+        }
+        else {
+            console.log(`unchanged      ${project.label}/package.json wrangler-types target`);
+        }
+        // Empty .dev.vars.example = "this worker declares no secrets". Bootstrap it
+        // when missing; humans add SECRET_NAME= lines if the worker reads any (the
+        // wrangler-types + tsc gate fails on an undeclared secret until they do).
+        const examplePath = join(project.dir, '.dev.vars.example');
+        if (!existsSync(examplePath)) {
+            writeFileSync(examplePath, '');
+            console.log(`created        ${project.label}/.dev.vars.example (no secrets)`);
+        }
+    }
+}
+export function validateWrangler(root) {
+    const gitignorePath = join(root, '.gitignore');
+    const gitignoreLines = existsSync(gitignorePath)
+        ? readFileSync(gitignorePath, 'utf8')
+            .split('\n')
+            .map((line) => line.trim())
+        : [];
+    const gitignoreCoversSecrets = gitignoreLines.includes('.dev.vars') && gitignoreLines.includes('worker-configuration.d.ts');
+    let problems = 0;
+    for (const project of wranglerProjects(root)) {
+        let projectProblems = 0;
+        if (!existsSync(join(project.dir, '.dev.vars.example'))) {
+            console.log(`⨯ ${project.label}: missing .dev.vars.example`);
+            projectProblems++;
+        }
+        const nx = recordProperty(project.json, 'nx');
+        const targets = nx ? recordProperty(nx, 'targets') : null;
+        if (!targets || !recordProperty(targets, 'wrangler-types')) {
+            console.log(`⨯ ${project.label}: missing wrangler-types nx target`);
+            projectProblems++;
+        }
+        if (!gitignoreCoversSecrets) {
+            console.log(`⨯ ${project.label}: root .gitignore must ignore .dev.vars and worker-configuration.d.ts`);
+            projectProblems++;
+        }
+        if (projectProblems === 0) {
+            console.log(`✓ ${project.label}: wrangler config`);
+        }
+        problems += projectProblems;
+    }
+    return problems;
+}

package/dist/wrangler/prepare-env.d.ts

@@ -0,0 +1,68 @@
+export declare function isRecord(v: unknown): v is Record<string, unknown>;
+/** First `[env.<name>]` header, or `null` when the config declares no envs (top-level bindings only). */
+export declare function firstWranglerEnv(toml: string): string | null;
+/** True if the toml declares `[env.<env>]`. */
+export declare function hasEnvBlock(toml: string, env: string): boolean;
+/** A `[env.<env>.vars]` value, or null if unset/empty. Reads committed public config. */
+export declare function getVar(toml: string, env: string, name: string): string | null;
+/** Set a `[env.<env>.vars]` value, preserving any trailing comment. Throws if the key isn't present (scaffold first). */
+export declare function setVar(toml: string, env: string, name: string, value: string): string;
+/** The id written for `[[env.<env>.kv_namespaces]]` binding, or null if absent/empty. */
+export declare function getKvId(toml: string, env: string, binding: string): string | null;
+/** Rewrite the `id = ...` line of the `[[env.<env>.kv_namespaces]]` table whose binding matches. Throws if absent. */
+export declare function setKvId(toml: string, env: string, binding: string, id: string, title: string): string;
+/**
+ * Append a copy of the whole `[env.<from>]` … block-group (every `[env.<from>...]`
+ * table up to the next non-`from` env or EOF) rewritten for `<to>`. Returns the new
+ * toml. Throws if `<from>` is absent or `<to>` already exists (blank/fill instead).
+ */
+export declare function cloneEnvBlock(toml: string, from: string, to: string): string;
+/** Blank every `NAME = "..."` under `[env.<env>.vars]` whose key is in `keys` (env-specific values to re-fill). */
+export declare function blankEnvVars(toml: string, env: string, keys: string[]): string;
+/** Blank every `id = ...` line under the env's `[[env.<env>.kv_namespaces]]` tables (per-env resource ids). */
+export declare function blankKvIds(toml: string, env: string): string;
+/** Parse-guard: throws if `toml` no longer parses, so a bad edit can't be written to disk. */
+export declare function assertToml(toml: string): void;
+/** Persist a toml string after confirming it still parses. */
+export declare function saveToml(path: string, toml: string): void;
+export interface Manifest {
+    /** KV binding names declared under `[[env.<env>.kv_namespaces]]` (resources to provision). */
+    kvBindings: string[];
+    /** Public var names declared in `[env.<env>.vars]` (committed config). */
+    vars: string[];
+    /** Secret names declared in `.dev.vars.example` (values live on the worker, never in the repo). */
+    secrets: string[];
+}
+/** Secret NAMES from a `.dev.vars.example` file (KEY=... / KEY="..."), ignoring comments/blanks. */
+export declare function parseDevVarsExample(text: string): string[];
+/**
+ * Read the vars/secrets split for `env` from `<root>/wrangler.toml` (public var
+ * keys) + `<root>/.dev.vars.example` (secret names). This is the "what to prompt
+ * for" manifest a prepare-env script derives its work from.
+ */
+export declare function readManifest(root: string, env: string): Manifest;
+/** True if `value` looks like a PEM block (any `-----BEGIN ...-----`). */
+export declare function isPem(value: string): boolean;
+/** Read a `.pem` file (expanding a leading `~`) and assert it's a PEM block. Throws otherwise. */
+export declare function readPemFile(path: string): string;
+/** Heuristic: does this secret name suggest file input (PEM/key)? Used to preselect a file prompt — never to change semantics. */
+export declare function looksLikeFileSecret(name: string): boolean;
+export interface KvNamespace {
+    id: string;
+    title: string;
+}
+/** Best-effort ERROR line from a Bun ShellError (thrown on non-zero exit). */
+export declare function errText(err: unknown): string;
+/** Live KV namespaces on the account (`kv namespace list` emits a pure JSON array); `[]` when offline/unauthenticated. */
+export declare function listNamespaces(cwd: string): Promise<KvNamespace[]>;
+/**
+ * Reuse the namespace whose title exactly matches `logical`, else create it. The
+ * id always comes from the structured `list` JSON (create prints freeform text),
+ * so we re-list rather than scrape. Returns the id, or null on failure.
+ */
+export declare function ensureNamespace(logical: string, existing: KvNamespace[], cwd: string): Promise<string | null>;
+/** Current secret names on the worker for `env`; `[]` when none/unreachable (Cloudflare allows setting pre-deploy). */
+export declare function listSecretNames(env: string, cwd: string): Promise<string[]>;
+/** `wrangler secret put <name> --env <env>` piping `value` on stdin (never a CLI arg). Returns success. */
+export declare function putSecret(name: string, value: string, env: string, cwd: string): Promise<boolean>;
+//# sourceMappingURL=prepare-env.d.ts.map

package/dist/wrangler/prepare-env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prepare-env.d.ts","sourceRoot":"","sources":["../../src/wrangler/prepare-env.ts"],"names":[],"mappings":"AAyBA,wBAAgB,QAAQ,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEjE;AAQD,yGAAyG;AACzG,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAG5D;AAED,+CAA+C;AAC/C,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAE9D;AAED,yFAAyF;AACzF,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAK7E;AAED,yHAAyH;AACzH,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAMrF;AAED,yFAAyF;AACzF,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CASjF;AAED,sHAAsH;AACtH,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAQrG;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,CAsB5E;AAED,mHAAmH;AACnH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,CAO9E;AAED,+GAA+G;AAC/G,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAM5D;AAED,8FAA8F;AAC9F,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAE7C;AAED,8DAA8D;AAC9D,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAGzD;AAWD,MAAM,WAAW,QAAQ;IACvB,8FAA8F;IAC9F,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,0EAA0E;IAC1E,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,mGAAmG;IACnG,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,oGAAoG;AACpG,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAS1D;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,QAAQ,CAUhE;AAID,0EAA0E;AAC1E,wBAAgB,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE5C;AAED,kGAAkG;AAClG,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAKhD;AAED,kIAAkI;AAClI,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEzD;AAID,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;CACf;AAkBD,8EAA8E;AAC9E,wBAAgB,OAAO,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAK5C;AAED,0HAA0H;AAC1H,wBAAsB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAMxE;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CASnH;AAMD,uHAAuH;AACvH,wBAAsB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAMjF;AAED,2GAA2G;AAC3G,wBAAsB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAOvG"}