@smoothbricks/cli 0.7.0 → 0.9.0

package/src/monorepo/managed-files.ts

@@ -34,6 +34,82 @@ function splitLocalSection(current: string): { managed: string; localTail: strin
 /** Test seam for the pure splitter. */
 export const splitLocalSectionForTest = splitLocalSection;
 
+/**
+ * A repo-owned block INSIDE the managed section — e.g. one extra pattern
+ * spliced into a formatter's list, where a trailing marker (LOCAL_SECTION_MARKER)
+ * can't express it because it isn't at the end of the file. Wrap it in
+ * `# smoo-local-begin` / `# smoo-local-end`; the block is anchored to the line
+ * immediately before `# smoo-local-begin`. On update, the block is re-spliced
+ * right after that same anchor line in the freshly rendered template — if the
+ * anchor no longer appears there (the template reworked that section), the
+ * update refuses rather than silently dropping the repo's customization.
+ */
+export const INLINE_LOCAL_BEGIN = '# smoo-local-begin';
+export const INLINE_LOCAL_END = '# smoo-local-end';
+
+interface InlineLocalBlock {
+  anchor: string;
+  lines: string;
+}
+
+/** Pull inline local blocks out of a managed section, returning the section
+ * with each block (and its markers) removed, plus the extracted blocks in
+ * the order they appeared. */
+function extractInlineLocalBlocks(managed: string): { withoutInline: string; blocks: InlineLocalBlock[] } {
+  const lines = managed.split('\n');
+  const kept: string[] = [];
+  const blocks: InlineLocalBlock[] = [];
+  let i = 0;
+  while (i < lines.length) {
+    const line = lines[i];
+    if (line !== undefined && line.trim() === INLINE_LOCAL_BEGIN) {
+      const anchor = kept.at(-1);
+      if (anchor === undefined) {
+        throw new Error(`${INLINE_LOCAL_BEGIN} on line ${i + 1} has no preceding anchor line`);
+      }
+      const blockLines: string[] = [];
+      i += 1;
+      while (i < lines.length && lines[i]?.trim() !== INLINE_LOCAL_END) {
+        blockLines.push(lines[i] as string);
+        i += 1;
+      }
+      if (i >= lines.length) {
+        throw new Error(`${INLINE_LOCAL_BEGIN} anchored on "${anchor}" has no matching ${INLINE_LOCAL_END}`);
+      }
+      blocks.push({ anchor, lines: blockLines.join('\n') });
+      i += 1; // skip the END marker line itself
+      continue;
+    }
+    kept.push(line);
+    i += 1;
+  }
+  return { withoutInline: kept.join('\n'), blocks };
+}
+
+/** Test seam for the pure extractor. */
+export const extractInlineLocalBlocksForTest = extractInlineLocalBlocks;
+
+/** Re-splice extracted inline blocks into freshly rendered managed content,
+ * each immediately after its anchor line. A no-op when there are no blocks. */
+function reinsertInlineLocalBlocks(content: string, blocks: InlineLocalBlock[]): string {
+  if (blocks.length === 0) return content;
+  const lines = content.split('\n');
+  for (const block of blocks) {
+    const index = lines.indexOf(block.anchor);
+    if (index === -1) {
+      throw new Error(
+        `${INLINE_LOCAL_BEGIN} block anchored on "${block.anchor}" no longer matches any line in the updated ` +
+          'template — reconcile the repo-owned block manually',
+      );
+    }
+    lines.splice(index + 1, 0, INLINE_LOCAL_BEGIN, ...block.lines.split('\n'), INLINE_LOCAL_END);
+  }
+  return lines.join('\n');
+}
+
+/** Test seam for the pure re-splicer. */
+export const reinsertInlineLocalBlocksForTest = reinsertInlineLocalBlocks;
+
 export interface FileResult {
   target: string;
   action: 'created' | 'updated' | 'unchanged' | 'skipped' | 'skipped-symlink' | 'drifted' | 'ok-symlink';
@@ -173,13 +249,15 @@ function applyManagedFile(
     }
     const current = readFileSync(target, 'utf8');
     const { managed, localTail } = splitLocalSection(current);
-    if (managed === content || (localTail !== '' && managed === `${content}\n`)) {
+    const { withoutInline, blocks } = extractInlineLocalBlocks(managed);
+    if (withoutInline === content || (localTail !== '' && withoutInline === `${content}\n`)) {
       return { target: file.target, action: 'unchanged' };
     }
     if (mode === 'check' || mode === 'diff') {
       return { target: file.target, action: 'drifted' };
     }
-    const next = localTail === '' ? content : `${content}\n${localTail}`;
+    const rendered = reinsertInlineLocalBlocks(content, blocks);
+    const next = localTail === '' ? rendered : `${rendered}\n${localTail}`;
     writeManagedFile(target, next, file.executable === true);
     return { target: file.target, action: 'updated' };
   }

package/src/monorepo/packs/index.ts

@@ -26,6 +26,7 @@ import {
 } from '../packed-package.js';
 import { syncRootRuntimeVersions } from '../runtime.js';
 import { applyToolConfigDefaults, validateToolConfig } from '../tool-validation.js';
+import { applyWranglerDefaults, validateWrangler } from '../wrangler.js';
 
 export interface MonorepoContext {
   root: string;
@@ -150,6 +151,18 @@ const packs: MonorepoPack[] = [
       return validatePackedPublicPackageTypes(ctx.root);
     },
   },
+  {
+    name: 'wrangler',
+    init(ctx) {
+      applyWranglerDefaults(ctx.root);
+    },
+    fixPreBuild(ctx) {
+      applyWranglerDefaults(ctx.root);
+    },
+    validatePreBuild(ctx) {
+      return validateWrangler(ctx.root);
+    },
+  },
 ];
 
 export async function runInitPacks(ctx: MonorepoContext): Promise<void> {

package/src/monorepo/wrangler.test.ts

@@ -0,0 +1,216 @@
+import { describe, expect, it, spyOn } from 'bun:test';
+import { mkdir, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { applyWranglerDefaults, firstWranglerEnv, validateWrangler } from './wrangler.js';
+
+describe('firstWranglerEnv', () => {
+  it('extracts the first [env.<name>] header', () => {
+    expect(firstWranglerEnv('name = "svc"\n\n[env.staging]\nvars = {}\n\n[env.production]\n')).toBe('staging');
+  });
+
+  it('handles nested env sub-tables', () => {
+    expect(firstWranglerEnv('[env.production.vars]\nFOO = "bar"\n')).toBe('production');
+  });
+
+  it('returns null when the toml declares no env block', () => {
+    expect(firstWranglerEnv('name = "svc"\nmain = "src/index.ts"\n')).toBeNull();
+  });
+});
+
+describe('applyWranglerDefaults', () => {
+  it('injects the wrangler-types target and wires typecheck, idempotently', async () => {
+    const root = await createWorkspace([
+      { dir: 'api', name: '@acme/api', toml: '[env.production]\n', nx: { targets: { typecheck: { dependsOn: ['^build'] } } } },
+    ]);
+    try {
+      applyWranglerDefaults(root);
+      const pkg = await readJson(join(root, 'packages/api/package.json'));
+      expect(nxTargets(pkg)['wrangler-types']).toEqual({
+        executor: 'nx:run-commands',
+        cache: true,
+        inputs: ['{projectRoot}/wrangler.toml', '{projectRoot}/.dev.vars.example'],
+        outputs: ['{projectRoot}/worker-configuration.d.ts'],
+        options: {
+          command: 'wrangler types --env production --env-file .dev.vars.example --include-runtime false',
+          cwd: '{projectRoot}',
+        },
+      });
+      const typecheck = nxTargets(pkg).typecheck;
+      expect(isRecord(typecheck) ? typecheck.dependsOn : null).toEqual(['^build', 'wrangler-types']);
+
+      const logs = captureConsoleLogs();
+      applyWranglerDefaults(root);
+      expect(logs.some((line) => line.startsWith('updated'))).toBe(false);
+      expect(logs.some((line) => line.startsWith('unchanged'))).toBe(true);
+      expect(await readJson(join(root, 'packages/api/package.json'))).toEqual(pkg);
+    } finally {
+      console.log = originalConsoleLog;
+      await rm(root, { recursive: true, force: true });
+    }
+  });
+
+  it('omits --env from the command when the wrangler.toml declares no env block', async () => {
+    const root = await createWorkspace([{ dir: 'api', name: '@acme/api', toml: 'name = "svc"\nmain = "src/index.ts"\n' }]);
+    captureConsoleLogs();
+    try {
+      applyWranglerDefaults(root);
+      const target = nxTargets(await readJson(join(root, 'packages/api/package.json')))['wrangler-types'];
+      const options = isRecord(target) ? target.options : null;
+      expect(isRecord(options) ? options.command : null).toBe(
+        'wrangler types --env-file .dev.vars.example --include-runtime false',
+      );
+    } finally {
+      console.log = originalConsoleLog;
+      await rm(root, { recursive: true, force: true });
+    }
+  });
+
+  it('creates an empty .dev.vars.example and logs it when the project has none', async () => {
+    const root = await createWorkspace([{ dir: 'api', name: '@acme/api', toml: 'name = "svc"\n' }]);
+    const logs = captureConsoleLogs();
+    try {
+      applyWranglerDefaults(root);
+      expect(await readFile(join(root, 'packages/api/.dev.vars.example'), 'utf8')).toBe('');
+      expect(logs.some((line) => line.startsWith('created') && line.includes('api/.dev.vars.example'))).toBe(true);
+    } finally {
+      console.log = originalConsoleLog;
+      await rm(root, { recursive: true, force: true });
+    }
+  });
+
+  it('preserves a human-authored .dev.vars.example and does not log a creation', async () => {
+    const root = await createWorkspace([{ dir: 'api', name: '@acme/api', toml: 'name = "svc"\n' }]);
+    const examplePath = join(root, 'packages/api/.dev.vars.example');
+    await writeFile(examplePath, 'GITHUB_CLIENT_SECRET=\n');
+    const logs = captureConsoleLogs();
+    try {
+      applyWranglerDefaults(root);
+      expect(await readFile(examplePath, 'utf8')).toBe('GITHUB_CLIENT_SECRET=\n');
+      expect(logs.some((line) => line.startsWith('created') && line.includes('.dev.vars.example'))).toBe(false);
+    } finally {
+      console.log = originalConsoleLog;
+      await rm(root, { recursive: true, force: true });
+    }
+  });
+
+  it('adds the missing entries to an incomplete root .gitignore', async () => {
+    const root = await createWorkspace([{ dir: 'api', name: '@acme/api', toml: 'name = "svc"\n' }]);
+    const logs = captureConsoleLogs();
+    try {
+      await writeFile(join(root, '.gitignore'), 'node_modules\n');
+      applyWranglerDefaults(root);
+      const lines = (await readFile(join(root, '.gitignore'), 'utf8')).split('\n').map((line) => line.trim());
+      expect(lines).toContain('.dev.vars');
+      expect(lines).toContain('worker-configuration.d.ts');
+      expect(logs.some((line) => line.startsWith('updated') && line.includes('.gitignore'))).toBe(true);
+    } finally {
+      console.log = originalConsoleLog;
+      await rm(root, { recursive: true, force: true });
+    }
+  });
+
+  it('leaves the root .gitignore untouched when both entries are already present', async () => {
+    const root = await createWorkspace([{ dir: 'api', name: '@acme/api', toml: 'name = "svc"\n' }]);
+    const gitignorePath = join(root, '.gitignore');
+    const logs = captureConsoleLogs();
+    try {
+      await writeFile(gitignorePath, 'node_modules\n.dev.vars\nworker-configuration.d.ts\n');
+      const before = await readFile(gitignorePath, 'utf8');
+      applyWranglerDefaults(root);
+      expect(await readFile(gitignorePath, 'utf8')).toBe(before);
+      expect(logs.some((line) => line.startsWith('updated') && line.includes('.gitignore'))).toBe(false);
+    } finally {
+      console.log = originalConsoleLog;
+      await rm(root, { recursive: true, force: true });
+    }
+  });
+});
+
+describe('validateWrangler', () => {
+  it('flags a project whose .dev.vars.example is missing while target and .gitignore are wired', async () => {
+    const root = await createWorkspace([
+      {
+        dir: 'api',
+        name: '@acme/api',
+        toml: '[env.staging]\n',
+        nx: { targets: { 'wrangler-types': { executor: 'nx:run-commands' } } },
+      },
+    ]);
+    try {
+      await writeFile(join(root, '.gitignore'), '.dev.vars\nworker-configuration.d.ts\n');
+      expect(validateWrangler(root)).toBe(1);
+    } finally {
+      await rm(root, { recursive: true, force: true });
+    }
+  });
+
+  it('passes a fully wired project', async () => {
+    const root = await createWorkspace([{ dir: 'api', name: '@acme/api', toml: '[env.staging]\n' }]);
+    try {
+      applyWranglerDefaults(root);
+      await writeFile(join(root, 'packages/api/.dev.vars.example'), 'SECRET=\n');
+      await writeFile(join(root, '.gitignore'), '.dev.vars\n!.dev.vars.example\nworker-configuration.d.ts\n');
+      expect(validateWrangler(root)).toBe(0);
+    } finally {
+      await rm(root, { recursive: true, force: true });
+    }
+  });
+});
+
+async function createWorkspace(
+  packages: Array<{ dir: string; name: string; toml: string; nx?: Record<string, unknown> }>,
+): Promise<string> {
+  const root = await mkdtemp(join(tmpdir(), 'smoo-wrangler-'));
+  await writeJson(join(root, 'package.json'), {
+    name: '@acme/codebase',
+    version: '0.0.0',
+    private: true,
+    workspaces: ['packages/*'],
+  });
+  for (const pkg of packages) {
+    await writeJson(join(root, `packages/${pkg.dir}/package.json`), {
+      name: pkg.name,
+      version: '0.0.0',
+      private: true,
+      ...(pkg.nx ? { nx: pkg.nx } : {}),
+    });
+    await writeFile(join(root, `packages/${pkg.dir}/wrangler.toml`), pkg.toml);
+  }
+  return root;
+}
+
+function nxTargets(pkg: Record<string, unknown>): Record<string, unknown> {
+  const nx = pkg.nx;
+  if (!isRecord(nx) || !isRecord(nx.targets)) {
+    throw new Error('nx.targets not found');
+  }
+  return nx.targets;
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+
+async function readJson(path: string): Promise<Record<string, unknown>> {
+  const parsed: unknown = JSON.parse(await readFile(path, 'utf8'));
+  if (!isRecord(parsed)) {
+    throw new Error('expected JSON object');
+  }
+  return parsed;
+}
+
+async function writeJson(path: string, value: Record<string, unknown>): Promise<void> {
+  await mkdir(join(path, '..'), { recursive: true });
+  await writeFile(path, `${JSON.stringify(value, null, 2)}\n`);
+}
+
+const originalConsoleLog = console.log;
+
+function captureConsoleLogs(): string[] {
+  const logs: string[] = [];
+  spyOn(console, 'log').mockImplementation((...args: unknown[]) => {
+    logs.push(args.join(' '));
+  });
+  return logs;
+}

package/src/monorepo/wrangler.ts

@@ -0,0 +1,135 @@
+import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { join, relative } from 'node:path';
+import { getOrCreateRecord, recordProperty, writeJsonObject } from '../lib/json.js';
+import { getWorkspacePackageManifests } from '../lib/workspace.js';
+
+interface WranglerProject {
+  label: string;
+  dir: string;
+  packageJsonPath: string;
+  json: Record<string, unknown>;
+  tomlPath: string;
+}
+
+/** First `[env.<name>]` header in a wrangler.toml, or `null` when the config declares no envs (top-level bindings only). */
+export function firstWranglerEnv(tomlText: string): string | null {
+  const match = tomlText.match(/^\s*\[env\.([A-Za-z0-9_-]+)/m);
+  return match ? match[1] : null;
+}
+
+function wranglerProjects(root: string): WranglerProject[] {
+  const projects: WranglerProject[] = [];
+  for (const pkg of getWorkspacePackageManifests(root)) {
+    const tomlPath = join(pkg.path, 'wrangler.toml');
+    if (!existsSync(tomlPath)) {
+      continue;
+    }
+    projects.push({
+      label: relative(root, pkg.path) || '.',
+      dir: pkg.path,
+      packageJsonPath: pkg.packageJsonPath,
+      json: pkg.json,
+      tomlPath,
+    });
+  }
+  return projects;
+}
+
+/** Ensure the root .gitignore ignores the local secret file + generated types (once). */
+function ensureGitignore(root: string): void {
+  const path = join(root, '.gitignore');
+  const text = existsSync(path) ? readFileSync(path, 'utf8') : '';
+  const lines = text.split('\n').map((line) => line.trim());
+  const missing = ['.dev.vars', 'worker-configuration.d.ts'].filter((entry) => !lines.includes(entry));
+  if (missing.length === 0) {
+    return;
+  }
+  const block = `${text.replace(/\s*$/, '')}\n\n# wrangler: local secret values + generated types (names live in .dev.vars.example)\n${missing.join('\n')}\n`;
+  writeFileSync(path, block);
+  console.log(`updated        .gitignore (${missing.join(', ')})`);
+}
+
+export function applyWranglerDefaults(root: string): void {
+  const projects = wranglerProjects(root);
+  if (projects.length > 0) {
+    ensureGitignore(root);
+  }
+  for (const project of projects) {
+    const env = firstWranglerEnv(readFileSync(project.tomlPath, 'utf8'));
+    const nx = getOrCreateRecord(project.json, 'nx');
+    const targets = getOrCreateRecord(nx, 'targets');
+    const desired: Record<string, unknown> = {
+      executor: 'nx:run-commands',
+      cache: true,
+      inputs: ['{projectRoot}/wrangler.toml', '{projectRoot}/.dev.vars.example'],
+      outputs: ['{projectRoot}/worker-configuration.d.ts'],
+      options: {
+        command: `wrangler types${env ? ` --env ${env}` : ''} --env-file .dev.vars.example --include-runtime false`,
+        cwd: '{projectRoot}',
+      },
+    };
+    let changed = false;
+    const existing = recordProperty(targets, 'wrangler-types');
+    if (!existing || JSON.stringify(existing) !== JSON.stringify(desired)) {
+      targets['wrangler-types'] = desired;
+      changed = true;
+    }
+    const typecheck = recordProperty(targets, 'typecheck');
+    if (typecheck) {
+      const dependsOn: unknown[] = Array.isArray(typecheck.dependsOn) ? typecheck.dependsOn : [];
+      if (!dependsOn.includes('wrangler-types')) {
+        dependsOn.push('wrangler-types');
+        typecheck.dependsOn = dependsOn;
+        changed = true;
+      }
+    }
+    if (changed) {
+      writeJsonObject(project.packageJsonPath, project.json);
+      console.log(`updated        ${project.label}/package.json wrangler-types target`);
+    } else {
+      console.log(`unchanged      ${project.label}/package.json wrangler-types target`);
+    }
+    // Empty .dev.vars.example = "this worker declares no secrets". Bootstrap it
+    // when missing; humans add SECRET_NAME= lines if the worker reads any (the
+    // wrangler-types + tsc gate fails on an undeclared secret until they do).
+    const examplePath = join(project.dir, '.dev.vars.example');
+    if (!existsSync(examplePath)) {
+      writeFileSync(examplePath, '');
+      console.log(`created        ${project.label}/.dev.vars.example (no secrets)`);
+    }
+  }
+}
+
+export function validateWrangler(root: string): number {
+  const gitignorePath = join(root, '.gitignore');
+  const gitignoreLines = existsSync(gitignorePath)
+    ? readFileSync(gitignorePath, 'utf8')
+        .split('\n')
+        .map((line) => line.trim())
+    : [];
+  const gitignoreCoversSecrets =
+    gitignoreLines.includes('.dev.vars') && gitignoreLines.includes('worker-configuration.d.ts');
+  let problems = 0;
+  for (const project of wranglerProjects(root)) {
+    let projectProblems = 0;
+    if (!existsSync(join(project.dir, '.dev.vars.example'))) {
+      console.log(`⨯ ${project.label}: missing .dev.vars.example`);
+      projectProblems++;
+    }
+    const nx = recordProperty(project.json, 'nx');
+    const targets = nx ? recordProperty(nx, 'targets') : null;
+    if (!targets || !recordProperty(targets, 'wrangler-types')) {
+      console.log(`⨯ ${project.label}: missing wrangler-types nx target`);
+      projectProblems++;
+    }
+    if (!gitignoreCoversSecrets) {
+      console.log(`⨯ ${project.label}: root .gitignore must ignore .dev.vars and worker-configuration.d.ts`);
+      projectProblems++;
+    }
+    if (projectProblems === 0) {
+      console.log(`✓ ${project.label}: wrangler config`);
+    }
+    problems += projectProblems;
+  }
+  return problems;
+}

package/src/release/__tests__/helpers/fixture-repo.ts

@@ -6,6 +6,24 @@ import type { GitReleaseTagInfo } from '../../core.js';
 
 const GIT_TIMEOUT_MS = 10_000;
 
+// Isolate fixture git from the runner environment and skip fsync. These are
+// throwaway temp repos (deleted in withFixtureRepo's finally) so durability is
+// irrelevant — fsync is pure cost. On GitHub Actions the ~20 sequential git
+// spawns in a push test otherwise sum past the 30s cap: fsync on the runner's
+// disk is the dominant cost, and inheriting the runner's global/system config
+// (credential helpers, url.*.insteadOf rewrites, fsmonitor) slows every spawn
+// and risks a credential-prompt hang. Unknown core.* keys are ignored by older
+// git, so this is a harmless speedup locally and the real fix on CI.
+const GIT_FIXTURE_ENV: Record<string, string> = {
+  GIT_CONFIG_GLOBAL: '/dev/null',
+  GIT_CONFIG_SYSTEM: '/dev/null',
+  GIT_TERMINAL_PROMPT: '0',
+  GIT_OPTIONAL_LOCKS: '0',
+  GIT_CONFIG_COUNT: '1',
+  GIT_CONFIG_KEY_0: 'core.fsync',
+  GIT_CONFIG_VALUE_0: 'none',
+};
+
 export async function withFixtureRepo(fn: (root: string) => Promise<void>): Promise<void> {
   const root = await mkdtemp(join(tmpdir(), 'smoo-release-test-'));
   try {
@@ -86,7 +104,7 @@ export async function gitSucceeds(root: string, args: string[]): Promise<boolean
 async function gitResult(root: string, args: string[], env?: Record<string, string>): Promise<GitResult> {
   const proc = Bun.spawn(['git', ...args], {
     cwd: root,
-    env: { ...process.env, ...env },
+    env: { ...process.env, ...GIT_FIXTURE_ENV, ...env },
     stdout: 'pipe',
     stderr: 'pipe',
   });