@smoothbricks/cli 0.8.0 → 0.10.0

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAMA,wBAAsB,MAAM,CAAC,IAAI,WAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAexE"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AAOA,wBAAsB,MAAM,CAAC,IAAI,WAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAexE"}

package/dist/cli.js

@@ -3,6 +3,7 @@ import { variants } from './generate/index.js';
 import { cliPackageVersion } from './lib/cli-package.js';
 import { findRepoRoot } from './lib/run.js';
 import { resolvePrConflicts } from './pr/index.js';
+import { scaffold } from './wrangler/scaffold.js';
 export async function runCli(argv = process.argv.slice(2)) {
     const program = buildProgram();
     try {
@@ -290,6 +291,14 @@ function buildProgram() {
             process.exitCode = exitCode;
         }
     });
+    const wrangler = program.command('wrangler').description('Cloudflare wrangler project helpers');
+    wrangler
+        .command('scaffold <project>')
+        .description('Write a starter scripts/prepare-env.ts (manifest-driven) and wire its nx target')
+        .option('--force', 'overwrite an existing scripts/prepare-env.ts')
+        .action(async (project, options) => {
+        scaffold(await findRepoRoot(), project, { force: options.force });
+    });
     return program;
 }
 function booleanOption(value) {

package/dist/wrangler/prepare-env.d.ts

@@ -0,0 +1,89 @@
+export declare function isRecord(v: unknown): v is Record<string, unknown>;
+/** First `[env.<name>]` (source order; also derived from a nested `[env.<name>.*]`), or null when no env declared. */
+export declare function firstWranglerEnv(toml: string): string | null;
+/** True if the toml declares `[env.<env>]` (or any `[env.<env>.*]` sub-table). */
+export declare function hasEnvBlock(toml: string, env: string): boolean;
+/** A `[env.<env>.vars]` value, or null if unset/empty. Reads committed public config. */
+export declare function getVar(toml: string, env: string, name: string): string | null;
+/** Set a `[env.<env>.vars]` value (JSON-encoded), preserving any trailing comment. Throws if the key is absent (scaffold first). */
+export declare function setVar(toml: string, env: string, name: string, value: string): string;
+/** The id written for `[[env.<env>.kv_namespaces]]` binding, or null if absent/empty. */
+export declare function getKvId(toml: string, env: string, binding: string): string | null;
+/** Rewrite the `id = ...` line (value + trailing comment) of the kv_namespaces table whose binding matches. Throws if absent. */
+export declare function setKvId(toml: string, env: string, binding: string, id: string, title: string): string;
+/**
+ * Append a copy of every `[env.<from>...]` table rewritten for `<to>` (headers
+ * only — values copied verbatim). Throws if `<from>` is absent or `<to>` exists.
+ */
+export declare function cloneEnvBlock(toml: string, from: string, to: string): string;
+/** Blank the named `[env.<env>.vars]` values to `""` (preserving comments), skipping absent keys. */
+export declare function blankEnvVars(toml: string, env: string, keys: string[]): string;
+/** Blank every kv_namespaces `id` under the env to `""` (drops trailing comment; binding/name survive). */
+export declare function blankKvIds(toml: string, env: string): string;
+/** The database_id written for `[[env.<env>.d1_databases]]` binding, or null if absent/empty. */
+export declare function getD1Id(toml: string, env: string, binding: string): string | null;
+/** The `database_name` for `[[env.<env>.d1_databases]]` binding, or null. Source of truth for which DB to create/reuse. */
+export declare function getD1Name(toml: string, env: string, binding: string): string | null;
+/** Rewrite the `database_id = ...` line (value + trailing comment) of the d1 table whose binding matches; the name line is untouched. Throws if absent. */
+export declare function setD1Id(toml: string, env: string, binding: string, id: string, name: string): string;
+/** Blank every d1 `database_id` under the env to `""` (drops trailing comment; binding/name survive). */
+export declare function blankD1Ids(toml: string, env: string): string;
+/** Parse-guard: throws if `toml` no longer parses, so a bad edit can't be written to disk. */
+export declare function assertToml(toml: string): void;
+/** Persist a toml string after confirming it still parses. */
+export declare function saveToml(path: string, toml: string): void;
+export interface Manifest {
+    /** KV binding names declared under `[[env.<env>.kv_namespaces]]` (resources to provision). */
+    kvBindings: string[];
+    /** D1 binding names declared under `[[env.<env>.d1_databases]]` (resources to provision). */
+    d1Bindings: string[];
+    /** Public var names declared in `[env.<env>.vars]` (committed config). */
+    vars: string[];
+    /** Secret names declared in `.dev.vars.example` (values live on the worker, never in the repo). */
+    secrets: string[];
+}
+/** Secret NAMES from a `.dev.vars.example` file (KEY=... / KEY="..."), ignoring comments/blanks. */
+export declare function parseDevVarsExample(text: string): string[];
+/**
+ * Read the vars/secrets split for `env` from `<root>/wrangler.toml` (public var
+ * keys) + `<root>/.dev.vars.example` (secret names). This is the "what to prompt
+ * for" manifest a prepare-env script derives its work from.
+ */
+export declare function readManifest(root: string, env: string): Manifest;
+/** True if `value` looks like a PEM block (any `-----BEGIN ...-----`). */
+export declare function isPem(value: string): boolean;
+/** Read a `.pem` file (expanding a leading `~`) and assert it's a PEM block. Throws otherwise. */
+export declare function readPemFile(path: string): string;
+/** Heuristic: does this secret name suggest file input (PEM/key)? Used to preselect a file prompt — never to change semantics. */
+export declare function looksLikeFileSecret(name: string): boolean;
+export interface KvNamespace {
+    id: string;
+    title: string;
+}
+/** Best-effort ERROR line from a Bun ShellError (thrown on non-zero exit). */
+export declare function errText(err: unknown): string;
+/** Live KV namespaces on the account (`kv namespace list` emits a pure JSON array); `[]` when offline/unauthenticated. */
+export declare function listNamespaces(cwd: string): Promise<KvNamespace[]>;
+/**
+ * Reuse the namespace whose title exactly matches `logical`, else create it. The
+ * id always comes from the structured `list` JSON (create prints freeform text),
+ * so we re-list rather than scrape. Returns the id, or null on failure.
+ */
+export declare function ensureNamespace(logical: string, existing: KvNamespace[], cwd: string): Promise<string | null>;
+export interface D1Database {
+    uuid: string;
+    name: string;
+}
+/** Live D1 databases on the account (`d1 list --json`); `[]` when offline/unauthenticated. */
+export declare function listD1Databases(cwd: string): Promise<D1Database[]>;
+/**
+ * Reuse the D1 database whose name matches, else create it. The uuid comes from
+ * the structured `list` JSON (create prints freeform text), so we re-list rather
+ * than scrape. Returns the uuid, or null on failure.
+ */
+export declare function ensureD1Database(name: string, existing: D1Database[], cwd: string): Promise<string | null>;
+/** Current secret names on the worker for `env`; `[]` when none/unreachable (Cloudflare allows setting pre-deploy). */
+export declare function listSecretNames(env: string, cwd: string): Promise<string[]>;
+/** `wrangler secret put <name> --env <env>` piping `value` on stdin (never a CLI arg). Returns success. */
+export declare function putSecret(name: string, value: string, env: string, cwd: string): Promise<boolean>;
+//# sourceMappingURL=prepare-env.d.ts.map

package/dist/wrangler/prepare-env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"prepare-env.d.ts","sourceRoot":"","sources":["../../src/wrangler/prepare-env.ts"],"names":[],"mappings":"AAyBA,wBAAgB,QAAQ,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEjE;AAsDD,sHAAsH;AACtH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAK5D;AAED,kFAAkF;AAClF,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAG9D;AAED,yFAAyF;AACzF,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAK7E;AAED,oIAAoI;AACpI,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAKrF;AAED,yFAAyF;AACzF,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAOjF;AAED,iIAAiI;AACjI,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAIrG;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,CAW5E;AAED,qGAAqG;AACrG,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,CAO9E;AAED,2GAA2G;AAC3G,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED,iGAAiG;AACjG,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAOjF;AAED,2HAA2H;AAC3H,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAOnF;AAED,2JAA2J;AAC3J,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAIpG;AAED,yGAAyG;AACzG,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAE5D;AAkBD,8FAA8F;AAC9F,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAE7C;AAED,8DAA8D;AAC9D,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAGzD;AAID,MAAM,WAAW,QAAQ;IACvB,8FAA8F;IAC9F,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,6FAA6F;IAC7F,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,0EAA0E;IAC1E,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,mGAAmG;IACnG,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,oGAAoG;AACpG,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAS1D;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,QAAQ,CAYhE;AAID,0EAA0E;AAC1E,wBAAgB,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE5C;AAED,kGAAkG;AAClG,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAKhD;AAED,kIAAkI;AAClI,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEzD;AAID,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;CACf;AAkBD,8EAA8E;AAC9E,wBAAgB,OAAO,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAK5C;AAED,0HAA0H;AAC1H,wBAAsB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAMxE;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CASnH;AAMD,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAaD,8FAA8F;AAC9F,wBAAsB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAMxE;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAShH;AAMD,uHAAuH;AACvH,wBAAsB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAMjF;AAED,2GAA2G;AAC3G,wBAAsB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAOvG"}

package/dist/wrangler/prepare-env.js

@@ -0,0 +1,363 @@
+/**
+ * Composable primitives for writing a project's own `prepare-env` script — the
+ * provisioning half of the wrangler setup flow (the `wrangler` monorepo pack owns
+ * the build-time half: the `wrangler-types` target + `.dev.vars.example`).
+ *
+ * `wrangler types --env-file .dev.vars.example` emits a machine-readable manifest
+ * that distinguishes committed public **vars** (literal-typed in `[env.<env>.vars]`)
+ * from **secrets** (string-typed, names in `.dev.vars.example`, values never in the
+ * repo). `readManifest` reads that split back so a script knows what to prompt for;
+ * the toml editors clone/blank/fill env blocks; the wrangler shell-outs provision.
+ *
+ * Import from a target's `scripts/prepare-env.ts`:
+ *   import * as pe from '@smoothbricks/cli/wrangler/prepare-env';
+ * Scaffold a starter with:  smoo wrangler scaffold <project>
+ *
+ * Prompt-agnostic by design: the module does the toml + wrangler work; the script
+ * brings its own prompts (e.g. @clack/prompts). Bun-only (uses `bun`'s `$`).
+ */
+import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { $ } from 'bun';
+import { getStaticTOMLValue, parseTOML } from 'toml-eslint-parser';
+// ── runtime narrowing (wrangler JSON is external data — no casts) ─────────────
+export function isRecord(v) {
+    return typeof v === 'object' && v !== null && !Array.isArray(v);
+}
+// ── wrangler.toml editors (CST: read via getStaticTOMLValue, write via
+// node-range splice — comment/format-preserving by construction, no regex) ─────
+/** All top-level tables (`[env.x]`, `[env.x.vars]`, `[[env.x.d1_databases]]`, …) — each carries `resolvedKey` (incl. array index). */
+function tables(toml) {
+    return parseTOML(toml).body[0].body.filter((n) => n.type === 'TOMLTable');
+}
+/** Whole doc as a JS object (comments/format dropped — reads only). */
+function tomlValue(toml) {
+    const value = getStaticTOMLValue(parseTOML(toml));
+    return isRecord(value) ? value : {};
+}
+function envRecord(toml, env) {
+    const envs = tomlValue(toml).env;
+    const block = isRecord(envs) ? envs[env] : undefined;
+    return isRecord(block) ? block : null;
+}
+function sameKey(a, b) {
+    return a.length === b.length && a.every((x, i) => x === b[i]);
+}
+/** The `key = value` node named `key` in a table (single-segment keys; matched by source text). */
+function kvIn(toml, table, key) {
+    for (const kv of table.body) {
+        if (toml.slice(kv.key.range[0], kv.key.range[1]).trim() === key)
+            return kv;
+    }
+    return null;
+}
+/** The `<field>` KV of the `[[env.<env>.<arrayKey>]]` table whose `binding` matches, or null. */
+function arrayTableKv(toml, env, arrayKey, binding, field) {
+    const block = envRecord(toml, env);
+    const rows = isRecord(block) && Array.isArray(block[arrayKey]) ? block[arrayKey] : [];
+    const index = rows.findIndex((r) => isRecord(r) && r.binding === binding);
+    if (index < 0)
+        return null;
+    const table = tables(toml).find((t) => t.kind === 'array' && sameKey(t.resolvedKey, ['env', env, arrayKey, index]));
+    return table ? kvIn(toml, table, field) : null;
+}
+function splice(toml, start, end, text) {
+    return toml.slice(0, start) + text + toml.slice(end);
+}
+/** End of the physical line containing `offset` (exclusive of the newline). */
+function endOfLine(toml, offset) {
+    const nl = toml.indexOf('\n', offset);
+    return nl === -1 ? toml.length : nl;
+}
+/** First `[env.<name>]` (source order; also derived from a nested `[env.<name>.*]`), or null when no env declared. */
+export function firstWranglerEnv(toml) {
+    const envs = tomlValue(toml).env;
+    if (!isRecord(envs))
+        return null;
+    const [first] = Object.keys(envs);
+    return first ?? null;
+}
+/** True if the toml declares `[env.<env>]` (or any `[env.<env>.*]` sub-table). */
+export function hasEnvBlock(toml, env) {
+    const envs = tomlValue(toml).env;
+    return isRecord(envs) && env in envs;
+}
+/** A `[env.<env>.vars]` value, or null if unset/empty. Reads committed public config. */
+export function getVar(toml, env, name) {
+    const block = envRecord(toml, env);
+    const vars = isRecord(block?.vars) ? block.vars : {};
+    const value = vars[name];
+    return typeof value === 'string' && value ? value : null;
+}
+/** Set a `[env.<env>.vars]` value (JSON-encoded), preserving any trailing comment. Throws if the key is absent (scaffold first). */
+export function setVar(toml, env, name, value) {
+    const table = tables(toml).find((t) => sameKey(t.resolvedKey, ['env', env, 'vars']));
+    const kv = table ? kvIn(toml, table, name) : null;
+    if (!kv)
+        throw new Error(`vars key "${name}" not found under [env.${env}.vars]`);
+    return splice(toml, kv.value.range[0], kv.value.range[1], JSON.stringify(value));
+}
+/** The id written for `[[env.<env>.kv_namespaces]]` binding, or null if absent/empty. */
+export function getKvId(toml, env, binding) {
+    const block = envRecord(toml, env);
+    const rows = isRecord(block) && Array.isArray(block.kv_namespaces) ? block.kv_namespaces : [];
+    for (const row of rows) {
+        if (isRecord(row) && row.binding === binding && typeof row.id === 'string')
+            return row.id || null;
+    }
+    return null;
+}
+/** Rewrite the `id = ...` line (value + trailing comment) of the kv_namespaces table whose binding matches. Throws if absent. */
+export function setKvId(toml, env, binding, id, title) {
+    const kv = arrayTableKv(toml, env, 'kv_namespaces', binding, 'id');
+    if (!kv)
+        throw new Error(`kv_namespaces binding "${binding}" not found under [env.${env}]`);
+    return splice(toml, kv.value.range[0], endOfLine(toml, kv.value.range[1]), `${JSON.stringify(id)} # ${title}`);
+}
+/**
+ * Append a copy of every `[env.<from>...]` table rewritten for `<to>` (headers
+ * only — values copied verbatim). Throws if `<from>` is absent or `<to>` exists.
+ */
+export function cloneEnvBlock(toml, from, to) {
+    if (!hasEnvBlock(toml, from))
+        throw new Error(`source [env.${from}] not found`);
+    if (hasEnvBlock(toml, to))
+        throw new Error(`target [env.${to}] already exists — blank/fill it instead`);
+    const cloned = tables(toml)
+        .filter((t) => t.resolvedKey[0] === 'env' && t.resolvedKey[1] === from)
+        .map((t) => {
+        const seg = t.key.keys[1].range; // the `<from>` segment of this table's header
+        const text = toml.slice(t.range[0], t.range[1]);
+        return text.slice(0, seg[0] - t.range[0]) + to + text.slice(seg[1] - t.range[0]);
+    });
+    return `${toml.replace(/\s*$/, '')}\n\n${cloned.join('\n\n')}\n`;
+}
+/** Blank the named `[env.<env>.vars]` values to `""` (preserving comments), skipping absent keys. */
+export function blankEnvVars(toml, env, keys) {
+    const table = tables(toml).find((t) => sameKey(t.resolvedKey, ['env', env, 'vars']));
+    if (!table)
+        return toml;
+    const edits = keys
+        .map((key) => kvIn(toml, table, key))
+        .flatMap((kv) => (kv ? [{ start: kv.value.range[0], end: kv.value.range[1] }] : []));
+    return applyBlanks(toml, edits);
+}
+/** Blank every kv_namespaces `id` under the env to `""` (drops trailing comment; binding/name survive). */
+export function blankKvIds(toml, env) {
+    return blankArrayField(toml, env, 'kv_namespaces', 'id');
+}
+/** The database_id written for `[[env.<env>.d1_databases]]` binding, or null if absent/empty. */
+export function getD1Id(toml, env, binding) {
+    const block = envRecord(toml, env);
+    const rows = isRecord(block) && Array.isArray(block.d1_databases) ? block.d1_databases : [];
+    for (const row of rows) {
+        if (isRecord(row) && row.binding === binding && typeof row.database_id === 'string')
+            return row.database_id || null;
+    }
+    return null;
+}
+/** The `database_name` for `[[env.<env>.d1_databases]]` binding, or null. Source of truth for which DB to create/reuse. */
+export function getD1Name(toml, env, binding) {
+    const block = envRecord(toml, env);
+    const rows = isRecord(block) && Array.isArray(block.d1_databases) ? block.d1_databases : [];
+    for (const row of rows) {
+        if (isRecord(row) && row.binding === binding && typeof row.database_name === 'string')
+            return row.database_name || null;
+    }
+    return null;
+}
+/** Rewrite the `database_id = ...` line (value + trailing comment) of the d1 table whose binding matches; the name line is untouched. Throws if absent. */
+export function setD1Id(toml, env, binding, id, name) {
+    const kv = arrayTableKv(toml, env, 'd1_databases', binding, 'database_id');
+    if (!kv)
+        throw new Error(`d1_databases binding "${binding}" not found under [env.${env}]`);
+    return splice(toml, kv.value.range[0], endOfLine(toml, kv.value.range[1]), `${JSON.stringify(id)} # ${name}`);
+}
+/** Blank every d1 `database_id` under the env to `""` (drops trailing comment; binding/name survive). */
+export function blankD1Ids(toml, env) {
+    return blankArrayField(toml, env, 'd1_databases', 'database_id');
+}
+/** Blank one field across every `[[env.<env>.<arrayKey>]]` table (value..EOL -> `""`). */
+function blankArrayField(toml, env, arrayKey, field) {
+    const edits = tables(toml)
+        .filter((t) => t.kind === 'array' && t.resolvedKey[0] === 'env' && t.resolvedKey[1] === env && t.resolvedKey[2] === arrayKey)
+        .map((t) => kvIn(toml, t, field))
+        .flatMap((kv) => (kv ? [{ start: kv.value.range[0], end: endOfLine(toml, kv.value.range[1]) }] : []));
+    return applyBlanks(toml, edits);
+}
+/** Apply `""` at each range, descending so earlier offsets stay valid. */
+function applyBlanks(toml, edits) {
+    let out = toml;
+    for (const e of [...edits].sort((a, b) => b.start - a.start))
+        out = splice(out, e.start, e.end, '""');
+    return out;
+}
+/** Parse-guard: throws if `toml` no longer parses, so a bad edit can't be written to disk. */
+export function assertToml(toml) {
+    parseTOML(toml);
+}
+/** Persist a toml string after confirming it still parses. */
+export function saveToml(path, toml) {
+    assertToml(toml);
+    writeFileSync(path, toml);
+}
+/** Secret NAMES from a `.dev.vars.example` file (KEY=... / KEY="..."), ignoring comments/blanks. */
+export function parseDevVarsExample(text) {
+    const names = [];
+    for (const raw of text.split('\n')) {
+        const line = raw.trim();
+        if (!line || line.startsWith('#'))
+            continue;
+        const m = line.match(/^([A-Za-z_][A-Za-z0-9_]*)\s*=/);
+        if (m)
+            names.push(m[1]);
+    }
+    return names;
+}
+/**
+ * Read the vars/secrets split for `env` from `<root>/wrangler.toml` (public var
+ * keys) + `<root>/.dev.vars.example` (secret names). This is the "what to prompt
+ * for" manifest a prepare-env script derives its work from.
+ */
+export function readManifest(root, env) {
+    const toml = readFileSync(join(root, 'wrangler.toml'), 'utf8');
+    const block = envRecord(toml, env);
+    const varsRec = isRecord(block?.vars) ? block.vars : {};
+    const vars = Object.keys(varsRec);
+    const kvRows = isRecord(block) && Array.isArray(block.kv_namespaces) ? block.kv_namespaces : [];
+    const kvBindings = kvRows.flatMap((row) => (isRecord(row) && typeof row.binding === 'string' ? [row.binding] : []));
+    const d1Rows = isRecord(block) && Array.isArray(block.d1_databases) ? block.d1_databases : [];
+    const d1Bindings = d1Rows.flatMap((row) => (isRecord(row) && typeof row.binding === 'string' ? [row.binding] : []));
+    const examplePath = join(root, '.dev.vars.example');
+    const secrets = existsSync(examplePath) ? parseDevVarsExample(readFileSync(examplePath, 'utf8')) : [];
+    return { kvBindings, d1Bindings, vars, secrets };
+}
+// ── PEM (a standard, reusable) ───────────────────────────────────────────────
+/** True if `value` looks like a PEM block (any `-----BEGIN ...-----`). */
+export function isPem(value) {
+    return /-----BEGIN [A-Z ]+-----/.test(value);
+}
+/** Read a `.pem` file (expanding a leading `~`) and assert it's a PEM block. Throws otherwise. */
+export function readPemFile(path) {
+    const resolved = path.replace(/^~/, process.env.HOME ?? '~');
+    const content = readFileSync(resolved, 'utf8');
+    if (!isPem(content))
+        throw new Error(`${path} is not a PEM (no -----BEGIN block)`);
+    return content;
+}
+/** Heuristic: does this secret name suggest file input (PEM/key)? Used to preselect a file prompt — never to change semantics. */
+export function looksLikeFileSecret(name) {
+    return /_PEM$|_KEY$|_CERT$/.test(name);
+}
+function asKvNamespaces(json) {
+    if (!Array.isArray(json))
+        return [];
+    const out = [];
+    for (const row of json) {
+        if (isRecord(row) && typeof row.id === 'string' && typeof row.title === 'string') {
+            out.push({ id: row.id, title: row.title });
+        }
+    }
+    return out;
+}
+function asSecretNames(json) {
+    if (!Array.isArray(json))
+        return [];
+    return json.flatMap((row) => (isRecord(row) && typeof row.name === 'string' ? [row.name] : []));
+}
+/** Best-effort ERROR line from a Bun ShellError (thrown on non-zero exit). */
+export function errText(err) {
+    if (!isRecord(err))
+        return 'unknown error';
+    const stderr = 'stderr' in err && err.stderr != null ? String(err.stderr) : '';
+    const exit = 'exitCode' in err ? String(err.exitCode) : '?';
+    return stderr.split('\n').find((l) => l.includes('ERROR')) ?? `exit ${exit}`;
+}
+/** Live KV namespaces on the account (`kv namespace list` emits a pure JSON array); `[]` when offline/unauthenticated. */
+export async function listNamespaces(cwd) {
+    try {
+        return asKvNamespaces(await $ `bunx wrangler kv namespace list`.cwd(cwd).quiet().json());
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * Reuse the namespace whose title exactly matches `logical`, else create it. The
+ * id always comes from the structured `list` JSON (create prints freeform text),
+ * so we re-list rather than scrape. Returns the id, or null on failure.
+ */
+export async function ensureNamespace(logical, existing, cwd) {
+    const match = existing.find((n) => n.title === logical);
+    if (match)
+        return match.id;
+    try {
+        await $ `bunx wrangler kv namespace create ${logical}`.cwd(cwd).quiet();
+    }
+    catch (err) {
+        return errText(err).includes('already') ? (await reList(logical, cwd)) : null;
+    }
+    return reList(logical, cwd);
+}
+async function reList(logical, cwd) {
+    return (await listNamespaces(cwd)).find((n) => n.title === logical)?.id ?? null;
+}
+function asD1Databases(json) {
+    if (!Array.isArray(json))
+        return [];
+    const out = [];
+    for (const row of json) {
+        if (isRecord(row) && typeof row.uuid === 'string' && typeof row.name === 'string') {
+            out.push({ uuid: row.uuid, name: row.name });
+        }
+    }
+    return out;
+}
+/** Live D1 databases on the account (`d1 list --json`); `[]` when offline/unauthenticated. */
+export async function listD1Databases(cwd) {
+    try {
+        return asD1Databases(await $ `bunx wrangler d1 list --json`.cwd(cwd).quiet().json());
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * Reuse the D1 database whose name matches, else create it. The uuid comes from
+ * the structured `list` JSON (create prints freeform text), so we re-list rather
+ * than scrape. Returns the uuid, or null on failure.
+ */
+export async function ensureD1Database(name, existing, cwd) {
+    const match = existing.find((d) => d.name === name);
+    if (match)
+        return match.uuid;
+    try {
+        await $ `bunx wrangler d1 create ${name}`.cwd(cwd).quiet();
+    }
+    catch (err) {
+        return errText(err).includes('already') ? reListD1(name, cwd) : null;
+    }
+    return reListD1(name, cwd);
+}
+async function reListD1(name, cwd) {
+    return (await listD1Databases(cwd)).find((d) => d.name === name)?.uuid ?? null;
+}
+/** Current secret names on the worker for `env`; `[]` when none/unreachable (Cloudflare allows setting pre-deploy). */
+export async function listSecretNames(env, cwd) {
+    try {
+        return asSecretNames(await $ `bunx wrangler secret list --format json --env ${env}`.cwd(cwd).quiet().json());
+    }
+    catch {
+        return [];
+    }
+}
+/** `wrangler secret put <name> --env <env>` piping `value` on stdin (never a CLI arg). Returns success. */
+export async function putSecret(name, value, env, cwd) {
+    try {
+        await $ `bunx wrangler secret put ${name} --env ${env} < ${Buffer.from(value)}`.cwd(cwd).quiet();
+        return true;
+    }
+    catch {
+        return false;
+    }
+}

package/dist/wrangler/scaffold.d.ts

@@ -0,0 +1,7 @@
+export interface ScaffoldOptions {
+    /** Overwrite an existing scripts/prepare-env.ts. */
+    force?: boolean;
+}
+/** Write the starter script + wire the `prepare-env` nx target. Returns the script path. */
+export declare function scaffold(root: string, project: string, options?: ScaffoldOptions): string;
+//# sourceMappingURL=scaffold.d.ts.map

package/dist/wrangler/scaffold.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scaffold.d.ts","sourceRoot":"","sources":["../../src/wrangler/scaffold.ts"],"names":[],"mappings":"AAYA,MAAM,WAAW,eAAe;IAC9B,oDAAoD;IACpD,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAmMD,4FAA4F;AAC5F,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,eAAoB,GAAG,MAAM,CA2B7F"}