@smoothbricks/cli 0.8.0 → 0.10.0

package/dist/wrangler/scaffold.js

@@ -0,0 +1,228 @@
+/**
+ * `smoo wrangler scaffold <project>` — write a starter `scripts/prepare-env.ts`
+ * into a wrangler project and wire its `prepare-env` nx target. The generated
+ * script imports the `@smoothbricks/cli/wrangler/prepare-env` primitives and
+ * derives its work at runtime from the project's manifest (wrangler.toml [vars] +
+ * .dev.vars.example), so it never drifts from what the worker declares.
+ */
+import { existsSync, mkdirSync, writeFileSync } from 'node:fs';
+import { join, relative } from 'node:path';
+import { getOrCreateRecord, recordProperty, writeJsonObject } from '../lib/json.js';
+import { getWorkspacePackageManifests } from '../lib/workspace.js';
+/** Locate a workspace package by nx name, package name, or relative path; must have a wrangler.toml. */
+function resolveProject(root, project) {
+    const manifests = getWorkspacePackageManifests(root);
+    const match = manifests.find((m) => {
+        const nx = recordProperty(m.json, 'nx');
+        const nxName = nx && typeof nx.name === 'string' ? nx.name : null;
+        return nxName === project || m.name === project || relative(root, m.path) === project;
+    });
+    if (!match) {
+        const known = manifests.map((m) => recordProperty(m.json, 'nx')?.name ?? m.name).join(', ');
+        throw new Error(`project "${project}" not found. Known: ${known}`);
+    }
+    const dir = match.path; // WorkspacePackageManifest.path is absolute
+    if (!existsSync(join(dir, 'wrangler.toml'))) {
+        throw new Error(`"${project}" has no wrangler.toml — not a wrangler project`);
+    }
+    return { dir, label: relative(root, dir), packageJsonPath: match.packageJsonPath, json: match.json };
+}
+/** The generated starter script — generic, manifest-driven, prompt-batteries included. */
+function renderScript(projectName) {
+    return `#!/usr/bin/env bun
+/**
+ * Prepare a deploy environment for ${projectName}. Generated by \`smoo wrangler scaffold\`.
+ *
+ * Provisions what \`wrangler deploy\` assumes already exists, idempotently:
+ *   - KV namespaces the worker binds (ids written into wrangler.toml)
+ *   - public [env.<env>.vars] (committed config the deploy applies)
+ *   - secrets (wrangler secret put; values never touch the repo)
+ *
+ * Work is derived from the manifest (wrangler.toml [vars] + .dev.vars.example),
+ * so it stays in sync with what the worker declares. Customize the app-specific
+ * bits below (KV title convention; any secret that feeds >1 binding).
+ *
+ * Usage:
+ *   bun scripts/prepare-env.ts <env>            # provision (staging | production | …)
+ *   bun scripts/prepare-env.ts <env> --check    # report state, no writes
+ */
+import { readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+import * as p from '@clack/prompts';
+import * as pe from '@smoothbricks/cli/wrangler/prepare-env';
+
+const ROOT = resolve(import.meta.dir, '..');
+const WRANGLER = resolve(ROOT, 'wrangler.toml');
+const readToml = () => readFileSync(WRANGLER, 'utf8');
+
+// App-specific: the account-level logical title for a KV binding. Default is
+// lowercase + underscores→dashes; edit if your namespaces are named differently.
+function kvTitle(binding: string, env: string): string {
+  return \`\${binding.toLowerCase().replace(/_/g, '-')}-\${env}\`;
+}
+
+function bail<T>(v: T | symbol): asserts v is T {
+  if (p.isCancel(v)) {
+    p.cancel('Aborted — anything already provisioned stays; re-run to continue (idempotent).');
+    process.exit(1);
+  }
+}
+
+async function checkMode(env: string): Promise<void> {
+  const toml = readToml();
+  const { kvBindings, vars, secrets } = pe.readManifest(ROOT, env);
+  p.log.info(\`env block [env.\${env}]: \${pe.hasEnvBlock(toml, env) ? '✓ present' : '✗ missing'}\`);
+  const live = await pe.listNamespaces(ROOT);
+  for (const binding of kvBindings) {
+    const inToml = pe.getKvId(toml, env, binding);
+    const liveId = live.find((n) => n.title === kvTitle(binding, env))?.id ?? null;
+    p.log.message(\`  KV \${binding}: \${!liveId ? '✗ not created' : inToml === liveId ? \`✓ \${liveId}\` : \`⚠ drift (live \${liveId}, toml \${inToml ?? 'unset'})\`}\`);
+  }
+  for (const name of vars) {
+    p.log.message(\`  var \${name}: \${pe.getVar(toml, env, name) ? '✓ set' : '✗ empty'}\`);
+  }
+  const set = await pe.listSecretNames(env, ROOT);
+  for (const name of secrets) {
+    p.log.message(\`  secret \${name}: \${set.includes(name) ? '✓ set' : '✗ missing'}\`);
+  }
+}
+
+async function main(): Promise<void> {
+  const env = process.argv.slice(2).find((a) => !a.startsWith('-'));
+  if (!env) {
+    console.error('usage: bun scripts/prepare-env.ts <env> [--check]');
+    process.exit(1);
+  }
+  const check = process.argv.includes('--check');
+  p.intro(\`${projectName} · prepare \${env}\${check ? ' (check)' : ''}\`);
+
+  if (check) {
+    await checkMode(env);
+    p.outro(\`check complete for "\${env}" — nothing changed\`);
+    return;
+  }
+
+  let toml = readToml();
+
+  // 0. Env block. If missing, offer to clone an existing env and blank its
+  //    per-env values (KV ids), then fill below.
+  if (!pe.hasEnvBlock(toml, env)) {
+    const from = pe.firstWranglerEnv(toml);
+    if (from && (await p.confirm({ message: \`No [env.\${env}] — clone from [env.\${from}]?\` })) === true) {
+      toml = pe.blankKvIds(pe.cloneEnvBlock(toml, from, env), env);
+      pe.saveToml(WRANGLER, toml);
+      p.log.success(\`cloned [env.\${from}] → [env.\${env}] (KV ids blanked; edit domain-specific vars below)\`);
+    } else {
+      p.log.warn(\`Add an [env.\${env}] block to wrangler.toml first, then re-run.\`);
+      return;
+    }
+  }
+
+  const { kvBindings, vars, secrets } = pe.readManifest(ROOT, env);
+
+  // 1. KV namespaces → ids into the toml.
+  const live = await pe.listNamespaces(ROOT);
+  for (const binding of kvBindings) {
+    const s = p.spinner();
+    s.start(\`KV \${binding}\`);
+    const id = await pe.ensureNamespace(kvTitle(binding, env), live, ROOT);
+    if (!id) { s.stop(\`✗ \${binding}\`); continue; }
+    toml = pe.setKvId(toml, env, binding, id, kvTitle(binding, env));
+    pe.saveToml(WRANGLER, toml);
+    s.stop(\`✓ \${binding} → \${id}\`);
+  }
+
+  // 2. Public vars → [env.<env>.vars] (committed, applied by deploy). Enter keeps
+  //    current; a same-named env var overrides (CI).
+  if ((await p.confirm({ message: \`Set public vars for "\${env}"?\` })) === true) {
+    for (const name of vars) {
+      const current = pe.getVar(toml, env, name);
+      const preset = process.env[name]?.trim();
+      let value: string;
+      if (preset) {
+        value = preset;
+        p.log.info(\`\${name}: from environment\`);
+      } else {
+        const raw = await p.text({ message: \`\${name}:\`, placeholder: current ? 'Enter to keep current' : 'Enter to skip', initialValue: current ?? '' });
+        bail(raw);
+        value = raw.trim();
+      }
+      if (!value || value === current) continue;
+      toml = pe.setVar(toml, env, name, value);
+      pe.saveToml(WRANGLER, toml);
+    }
+  }
+
+  // 3. Secrets → wrangler secret put (values never in the repo). File-or-paste;
+  //    PEM validated by content. Skip-if-set unless you choose to replace.
+  const alreadySet = await pe.listSecretNames(env, ROOT);
+  if ((await p.confirm({ message: \`Set secrets for "\${env}"?\` })) === true) {
+    for (const name of secrets) {
+      const preset = process.env[name]?.trim();
+      if (alreadySet.includes(name) && !preset) {
+        const replace = await p.confirm({ message: \`\${name} already set — replace?\`, initialValue: false });
+        bail(replace);
+        if (!replace) { p.log.info(\`kept \${name}\`); continue; }
+      }
+      let value: string;
+      if (preset) {
+        value = preset;
+      } else if (pe.looksLikeFileSecret(name)) {
+        const path = await p.text({ message: \`\${name} — path to file:\`, placeholder: 'Enter to skip' });
+        bail(path);
+        if (!path.trim()) continue;
+        value = pe.readPemFile(path.trim());
+      } else {
+        const raw = await p.password({ message: \`\${name}:\` });
+        bail(raw);
+        value = raw.trim();
+        if (!value) continue;
+        if (pe.isPem(value) === false && /KEY|PEM|CERT/.test(name) && value.startsWith('~')) {
+          value = pe.readPemFile(value);
+        }
+      }
+      const s = p.spinner();
+      s.start(\`secret \${name}\`);
+      const ok = await pe.putSecret(name, value, env, ROOT);
+      s.stop(\`\${ok ? '✓' : '✗'} \${name}\`);
+    }
+    // Verify: re-list and flag any we set that didn't land.
+    const after = await pe.listSecretNames(env, ROOT);
+    const missing = secrets.filter((n) => !after.includes(n));
+    if (missing.length) p.log.warn(\`not listed afterwards — verify manually: \${missing.join(', ')}\`);
+  }
+
+  p.outro(\`"\${env}" prepared — re-run anytime (idempotent) · inspect with --check · then deploy\`);
+}
+
+if (import.meta.main) {
+  await main();
+}
+`;
+}
+/** Write the starter script + wire the `prepare-env` nx target. Returns the script path. */
+export function scaffold(root, project, options = {}) {
+    const { dir, label, packageJsonPath, json } = resolveProject(root, project);
+    const scriptsDir = join(dir, 'scripts');
+    const scriptPath = join(scriptsDir, 'prepare-env.ts');
+    const existed = existsSync(scriptPath);
+    if (existed && !options.force) {
+        throw new Error(`${label}/scripts/prepare-env.ts already exists — pass --force to overwrite`);
+    }
+    mkdirSync(scriptsDir, { recursive: true });
+    writeFileSync(scriptPath, renderScript(project));
+    console.log(`${existed ? 'overwrote' : 'created'}      ${label}/scripts/prepare-env.ts`);
+    // Wire the nx target (idempotent).
+    const nx = getOrCreateRecord(json, 'nx');
+    const targets = getOrCreateRecord(nx, 'targets');
+    if (!recordProperty(targets, 'prepare-env')) {
+        targets['prepare-env'] = {
+            executor: 'nx:run-commands',
+            options: { command: 'bun scripts/prepare-env.ts', cwd: '{projectRoot}' },
+        };
+        writeJsonObject(packageJsonPath, json);
+        console.log(`updated       ${label}/package.json prepare-env target`);
+    }
+    console.log(`\nnext: fill secret NAMES in ${label}/.dev.vars.example, then\n  bunx nx run ${project}:prepare-env -- <env>`);
+    return scriptPath;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@smoothbricks/cli",
-  "version": "0.8.0",
+  "version": "0.10.0",
   "type": "module",
   "description": "SmoothBricks monorepo automation CLI",
   "bin": {
@@ -33,6 +33,13 @@
       "development": "./src/monorepo/git-config.ts",
       "import": "./dist/monorepo/git-config.js",
       "default": "./dist/monorepo/git-config.js"
+    },
+    "./wrangler/prepare-env": {
+      "types": "./dist/wrangler/prepare-env.d.ts",
+      "bun": "./src/wrangler/prepare-env.ts",
+      "development": "./src/wrangler/prepare-env.ts",
+      "import": "./dist/wrangler/prepare-env.js",
+      "default": "./dist/wrangler/prepare-env.js"
     }
   },
   "files": [
@@ -51,6 +58,7 @@
     "publint": "^0.3.18",
     "semver": "^7.7.4",
     "sherif": "^1.11.1",
+    "toml-eslint-parser": "^1.0.3",
     "tslib": "^2.8.1"
   },
   "devDependencies": {

package/src/cli.ts

@@ -3,6 +3,7 @@ import { variants } from './generate/index.js';
 import { cliPackageVersion } from './lib/cli-package.js';
 import { findRepoRoot } from './lib/run.js';
 import { resolvePrConflicts } from './pr/index.js';
+import { scaffold } from './wrangler/scaffold.js';
 
 export async function runCli(argv = process.argv.slice(2)): Promise<void> {
   const program = buildProgram();
@@ -354,6 +355,15 @@ function buildProgram(): Command {
       }
     });
 
+  const wrangler = program.command('wrangler').description('Cloudflare wrangler project helpers');
+  wrangler
+    .command('scaffold <project>')
+    .description('Write a starter scripts/prepare-env.ts (manifest-driven) and wire its nx target')
+    .option('--force', 'overwrite an existing scripts/prepare-env.ts')
+    .action(async (project: string, options: { force?: boolean }) => {
+      scaffold(await findRepoRoot(), project, { force: options.force });
+    });
+
   return program;
 }
 

package/src/release/__tests__/helpers/fixture-repo.ts

@@ -6,6 +6,24 @@ import type { GitReleaseTagInfo } from '../../core.js';
 
 const GIT_TIMEOUT_MS = 10_000;
 
+// Isolate fixture git from the runner environment and skip fsync. These are
+// throwaway temp repos (deleted in withFixtureRepo's finally) so durability is
+// irrelevant — fsync is pure cost. On GitHub Actions the ~20 sequential git
+// spawns in a push test otherwise sum past the 30s cap: fsync on the runner's
+// disk is the dominant cost, and inheriting the runner's global/system config
+// (credential helpers, url.*.insteadOf rewrites, fsmonitor) slows every spawn
+// and risks a credential-prompt hang. Unknown core.* keys are ignored by older
+// git, so this is a harmless speedup locally and the real fix on CI.
+const GIT_FIXTURE_ENV: Record<string, string> = {
+  GIT_CONFIG_GLOBAL: '/dev/null',
+  GIT_CONFIG_SYSTEM: '/dev/null',
+  GIT_TERMINAL_PROMPT: '0',
+  GIT_OPTIONAL_LOCKS: '0',
+  GIT_CONFIG_COUNT: '1',
+  GIT_CONFIG_KEY_0: 'core.fsync',
+  GIT_CONFIG_VALUE_0: 'none',
+};
+
 export async function withFixtureRepo(fn: (root: string) => Promise<void>): Promise<void> {
   const root = await mkdtemp(join(tmpdir(), 'smoo-release-test-'));
   try {
@@ -86,7 +104,7 @@ export async function gitSucceeds(root: string, args: string[]): Promise<boolean
 async function gitResult(root: string, args: string[], env?: Record<string, string>): Promise<GitResult> {
   const proc = Bun.spawn(['git', ...args], {
     cwd: root,
-    env: { ...process.env, ...env },
+    env: { ...process.env, ...GIT_FIXTURE_ENV, ...env },
     stdout: 'pipe',
     stderr: 'pipe',
   });

package/src/wrangler/prepare-env.test.ts

@@ -0,0 +1,347 @@
+import { describe, expect, it } from 'bun:test';
+import { mkdtemp, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import {
+  assertToml,
+  blankD1Ids,
+  blankEnvVars,
+  blankKvIds,
+  cloneEnvBlock,
+  firstWranglerEnv,
+  getD1Id,
+  getD1Name,
+  getKvId,
+  getVar,
+  hasEnvBlock,
+  isPem,
+  looksLikeFileSecret,
+  parseDevVarsExample,
+  readManifest,
+  readPemFile,
+  setD1Id,
+  setKvId,
+  setVar,
+} from './prepare-env.js';
+
+// The wrangler shell-outs (listNamespaces / ensureNamespace / listSecretNames /
+// putSecret) invoke `bunx wrangler` against a live account and are integration-
+// only — deliberately not exercised here. Everything below is a pure primitive.
+
+describe('firstWranglerEnv', () => {
+  it('returns the name of the first [env.<name>] header', () => {
+    expect(firstWranglerEnv('name = "svc"\n\n[env.staging]\n\n[env.production]\n')).toBe('staging');
+  });
+
+  it('derives the env from a nested [env.<name>.vars] sub-table', () => {
+    expect(firstWranglerEnv('[env.prod.vars]\nFOO = "bar"\n')).toBe('prod');
+  });
+
+  it('returns null when the toml declares no env block', () => {
+    expect(firstWranglerEnv('name = "svc"\nmain = "src/index.ts"\n')).toBeNull();
+  });
+});
+
+describe('hasEnvBlock', () => {
+  const toml = 'name = "svc"\n\n[env.production]\nroute = "x"\n';
+
+  it('is true for a declared [env.<env>] block', () => {
+    expect(hasEnvBlock(toml, 'production')).toBe(true);
+  });
+
+  it('is false for an env the toml never declares', () => {
+    expect(hasEnvBlock(toml, 'staging')).toBe(false);
+  });
+});
+
+describe('getVar / setVar', () => {
+  const toml =
+    'name = "svc"\n\n[env.staging.vars]\nTOKEN = "staging-token"\n\n[env.production.vars]\nTOKEN = "production-token"\nEMPTY = ""\n';
+
+  it('reads a set value and returns null for empty or absent keys', () => {
+    expect(getVar(toml, 'production', 'TOKEN')).toBe('production-token');
+    expect(getVar(toml, 'production', 'EMPTY')).toBeNull();
+    expect(getVar(toml, 'production', 'MISSING')).toBeNull();
+  });
+
+  it('rewrites the target value while preserving a trailing comment', () => {
+    const src = '[env.production.vars]\nAPI_URL = "https://old.example.com" # keep this comment\n';
+    const out = setVar(src, 'production', 'API_URL', 'https://new.example.com');
+    expect(out).toContain('# keep this comment');
+    expect(getVar(out, 'production', 'API_URL')).toBe('https://new.example.com');
+  });
+
+  it('edits only the target env block, leaving a same-named key under another env untouched', () => {
+    const out = setVar(toml, 'production', 'TOKEN', 'rotated-prod');
+    expect(getVar(out, 'production', 'TOKEN')).toBe('rotated-prod');
+    expect(getVar(out, 'staging', 'TOKEN')).toBe('staging-token');
+  });
+
+  it('JSON-encodes a value with $ and quotes so the result still parses', () => {
+    const src = '[env.production.vars]\nSECRET_HINT = "placeholder"\n';
+    const value = 'a$b"c';
+    const out = setVar(src, 'production', 'SECRET_HINT', value);
+    expect(() => assertToml(out)).not.toThrow();
+    expect(getVar(out, 'production', 'SECRET_HINT')).toBe(value);
+  });
+
+  it('throws when the vars key is absent (scaffold-first contract)', () => {
+    expect(() => setVar(toml, 'production', 'NOT_THERE', 'x')).toThrow();
+  });
+});
+
+describe('getKvId / setKvId', () => {
+  const toml =
+    'name = "svc"\n\n' +
+    '[[env.production.kv_namespaces]]\nbinding = "CACHE"\nid = "cache-id-123"\n\n' +
+    '[[env.production.kv_namespaces]]\nbinding = "SESSIONS"\nid = ""\n';
+
+  it('reads the id for a matching binding and null for empty/absent bindings', () => {
+    expect(getKvId(toml, 'production', 'CACHE')).toBe('cache-id-123');
+    expect(getKvId(toml, 'production', 'SESSIONS')).toBeNull();
+    expect(getKvId(toml, 'production', 'MISSING')).toBeNull();
+  });
+
+  it('writes "<id>" # <title> against the right binding, leaving siblings intact', () => {
+    const out = setKvId(toml, 'production', 'SESSIONS', 'sess-id-456', 'svc-sessions-production');
+    expect(out).toContain('# svc-sessions-production');
+    expect(getKvId(out, 'production', 'SESSIONS')).toBe('sess-id-456');
+    expect(getKvId(out, 'production', 'CACHE')).toBe('cache-id-123');
+  });
+
+  it('throws when the binding block is absent', () => {
+    expect(() => setKvId(toml, 'production', 'MISSING', 'x', 't')).toThrow();
+  });
+});
+
+describe('cloneEnvBlock', () => {
+  const staging =
+    'name = "svc"\n\n' +
+    '[env.staging]\nroute = "staging.example.com"\n\n' +
+    '[env.staging.vars]\nLEVEL = "debug"\n\n' +
+    '[[env.staging.kv_namespaces]]\nbinding = "CACHE"\nid = "staging-cache"\n';
+
+  it('appends a rewritten copy while leaving the source block intact', () => {
+    const out = cloneEnvBlock(staging, 'staging', 'production');
+    expect(() => assertToml(out)).not.toThrow();
+    expect(hasEnvBlock(out, 'production')).toBe(true);
+    // source untouched
+    expect(getVar(out, 'staging', 'LEVEL')).toBe('debug');
+    expect(getKvId(out, 'staging', 'CACHE')).toBe('staging-cache');
+    // cloned vars + kv tables present under the new env
+    expect(getVar(out, 'production', 'LEVEL')).toBe('debug');
+    expect(getKvId(out, 'production', 'CACHE')).toBe('staging-cache');
+  });
+
+  it('throws when the source env is missing', () => {
+    expect(() => cloneEnvBlock(staging, 'qa', 'production')).toThrow();
+  });
+
+  it('throws when the target env already exists', () => {
+    const withBoth = `${staging}\n[env.production]\nroute = "prod.example.com"\n`;
+    expect(() => cloneEnvBlock(withBoth, 'staging', 'production')).toThrow();
+  });
+});
+
+describe('blankEnvVars / blankKvIds', () => {
+  it('blanks the named vars and leaves the others untouched', () => {
+    const toml = '[env.production.vars]\nKEEP = "keep-value"\nDROP_A = "a"\nDROP_B = "b"\n';
+    const out = blankEnvVars(toml, 'production', ['DROP_A', 'DROP_B']);
+    expect(getVar(out, 'production', 'DROP_A')).toBeNull();
+    expect(getVar(out, 'production', 'DROP_B')).toBeNull();
+    expect(getVar(out, 'production', 'KEEP')).toBe('keep-value');
+  });
+
+  it('blanks every kv id under the env while preserving the bindings', () => {
+    const toml =
+      '[[env.production.kv_namespaces]]\nbinding = "CACHE"\nid = "cache-id"\n\n' +
+      '[[env.production.kv_namespaces]]\nbinding = "SESSIONS"\nid = "sess-id"\n';
+    const out = blankKvIds(toml, 'production');
+    expect(getKvId(out, 'production', 'CACHE')).toBeNull();
+    expect(getKvId(out, 'production', 'SESSIONS')).toBeNull();
+    // bindings survived: setKvId still resolves them and re-fills an id
+    const refilled = setKvId(out, 'production', 'CACHE', 'new-cache', 'title');
+    expect(getKvId(refilled, 'production', 'CACHE')).toBe('new-cache');
+  });
+});
+
+// D1 shell-outs (listD1Databases / ensureD1Database) invoke `bunx wrangler d1`
+// against a live account and are integration-only — deliberately not exercised.
+
+describe('getD1Id / getD1Name', () => {
+  const toml =
+    '[env.staging]\n\n' +
+    '[[env.staging.d1_databases]]\nbinding = "DB"\ndatabase_id = "abc123"\ndatabase_name = "app-staging-db"\n\n' +
+    '[env.production]\n\n' +
+    '[[env.production.d1_databases]]\nbinding = "DB"\ndatabase_id = ""\ndatabase_name = "app-db"\n';
+
+  it('reads the id for a matching binding and null for empty id, absent binding, and absent env', () => {
+    expect(getD1Id(toml, 'staging', 'DB')).toBe('abc123');
+    expect(getD1Id(toml, 'production', 'DB')).toBeNull(); // production id is ""
+    expect(getD1Id(toml, 'staging', 'MISSING')).toBeNull(); // absent binding
+    expect(getD1Id(toml, 'qa', 'DB')).toBeNull(); // absent env
+  });
+
+  it('reads the database_name for a matching binding and null when the binding or env is absent', () => {
+    expect(getD1Name(toml, 'staging', 'DB')).toBe('app-staging-db');
+    expect(getD1Name(toml, 'production', 'DB')).toBe('app-db'); // present even though its id is blank
+    expect(getD1Name(toml, 'staging', 'MISSING')).toBeNull();
+    expect(getD1Name(toml, 'qa', 'DB')).toBeNull();
+  });
+});
+
+describe('setD1Id', () => {
+  const toml =
+    '[[env.staging.d1_databases]]\nbinding = "DB"\ndatabase_id = ""\ndatabase_name = "app-staging-db"\n\n' +
+    '[[env.staging.d1_databases]]\nbinding = "ANALYTICS"\ndatabase_id = ""\ndatabase_name = "app-staging-analytics"\n\n' +
+    '[[env.production.d1_databases]]\nbinding = "DB"\ndatabase_id = "prod-existing"\ndatabase_name = "app-db"\n';
+
+  it('writes "<id>" # <name> against the matching env+binding, leaving siblings and other envs intact', () => {
+    const out = setD1Id(toml, 'staging', 'DB', 'new-staging-id', 'app-staging-db');
+    expect(out).toContain('"new-staging-id" # app-staging-db');
+    expect(getD1Id(out, 'staging', 'DB')).toBe('new-staging-id'); // round-trip
+    expect(getD1Id(out, 'staging', 'ANALYTICS')).toBeNull(); // sibling binding untouched
+    expect(getD1Id(out, 'production', 'DB')).toBe('prod-existing'); // other env untouched
+  });
+
+  it('tolerates database_name preceding database_id and preserves the name', () => {
+    const nameFirst =
+      '[[env.staging.d1_databases]]\nbinding = "DB"\ndatabase_name = "app-staging-db"\ndatabase_id = "old"\n';
+    const out = setD1Id(nameFirst, 'staging', 'DB', 'fresh', 'app-staging-db');
+    expect(getD1Id(out, 'staging', 'DB')).toBe('fresh');
+    expect(getD1Name(out, 'staging', 'DB')).toBe('app-staging-db'); // name line not clobbered
+    expect(() => assertToml(out)).not.toThrow();
+  });
+
+  it('throws when the binding or the env is absent', () => {
+    expect(() => setD1Id(toml, 'staging', 'MISSING', 'x', 'n')).toThrow();
+    expect(() => setD1Id(toml, 'qa', 'DB', 'x', 'n')).toThrow();
+  });
+});
+
+describe('blankD1Ids', () => {
+  const toml =
+    '[[env.staging.d1_databases]]\nbinding = "DB"\ndatabase_id = "staging-db-id"\ndatabase_name = "app-staging-db"\n\n' +
+    '[[env.staging.d1_databases]]\nbinding = "ANALYTICS"\ndatabase_id = "staging-an-id"\ndatabase_name = "app-staging-analytics"\n\n' +
+    '[[env.production.d1_databases]]\nbinding = "DB"\ndatabase_id = "prod-db-id"\ndatabase_name = "app-db"\n';
+
+  it('blanks every d1 id under the env while names, bindings, and the other env survive', () => {
+    const out = blankD1Ids(toml, 'staging');
+    expect(getD1Id(out, 'staging', 'DB')).toBeNull();
+    expect(getD1Id(out, 'staging', 'ANALYTICS')).toBeNull();
+    // names survive the blanking
+    expect(getD1Name(out, 'staging', 'DB')).toBe('app-staging-db');
+    expect(getD1Name(out, 'staging', 'ANALYTICS')).toBe('app-staging-analytics');
+    // other env's id is untouched
+    expect(getD1Id(out, 'production', 'DB')).toBe('prod-db-id');
+    // bindings survived: setD1Id still resolves them and re-fills an id
+    const refilled = setD1Id(out, 'staging', 'DB', 're-provisioned', 'app-staging-db');
+    expect(getD1Id(refilled, 'staging', 'DB')).toBe('re-provisioned');
+  });
+});
+
+describe('assertToml', () => {
+  it('returns for valid toml', () => {
+    expect(() => assertToml('name = "svc"\n[env.production]\n')).not.toThrow();
+  });
+
+  it('throws for malformed toml', () => {
+    expect(() => assertToml('[env.\nbad')).toThrow();
+  });
+});
+
+describe('parseDevVarsExample', () => {
+  it('extracts KEY names from KEY= and KEY="" lines, ignoring comments and blanks', () => {
+    const text = '# secrets\nAPI_KEY=\n\nJWT_SECRET=""\n# trailing note\n';
+    expect(parseDevVarsExample(text)).toEqual(['API_KEY', 'JWT_SECRET']);
+  });
+});
+
+describe('readManifest', () => {
+  const toml =
+    'name = "svc"\n\n' +
+    '[env.staging.vars]\nPUBLIC_URL = "https://staging"\nFEATURE_FLAG = "on"\n\n' +
+    '[[env.staging.kv_namespaces]]\nbinding = "CACHE"\nid = "abc"\n\n' +
+    '[[env.staging.kv_namespaces]]\nbinding = "SESSIONS"\nid = "def"\n';
+
+  it('splits vars, kv bindings, and secrets for the requested env', async () => {
+    const root = await mkdtemp(join(tmpdir(), 'smoo-prepare-env-'));
+    try {
+      await writeFile(join(root, 'wrangler.toml'), toml);
+      await writeFile(join(root, '.dev.vars.example'), '# secrets\nAPI_KEY=\nJWT_SECRET=""\n');
+      expect(readManifest(root, 'staging')).toEqual({
+        kvBindings: ['CACHE', 'SESSIONS'],
+        d1Bindings: [],
+        vars: ['PUBLIC_URL', 'FEATURE_FLAG'],
+        secrets: ['API_KEY', 'JWT_SECRET'],
+      });
+    } finally {
+      await rm(root, { recursive: true, force: true });
+    }
+  });
+
+  it('returns an empty secrets list when .dev.vars.example is absent', async () => {
+    const root = await mkdtemp(join(tmpdir(), 'smoo-prepare-env-'));
+    try {
+      await writeFile(join(root, 'wrangler.toml'), toml);
+      const manifest = readManifest(root, 'staging');
+      expect(manifest.secrets).toEqual([]);
+      expect(manifest.vars).toEqual(['PUBLIC_URL', 'FEATURE_FLAG']);
+      expect(manifest.kvBindings).toEqual(['CACHE', 'SESSIONS']);
+    } finally {
+      await rm(root, { recursive: true, force: true });
+    }
+  });
+
+  it('reports d1 bindings alongside kv bindings and vars without dropping the existing fields', async () => {
+    const withD1 =
+      'name = "svc"\n\n' +
+      '[env.staging.vars]\nPUBLIC_URL = "https://staging"\n\n' +
+      '[[env.staging.kv_namespaces]]\nbinding = "CACHE"\nid = "abc"\n\n' +
+      '[[env.staging.d1_databases]]\nbinding = "DB"\ndatabase_id = "id-1"\ndatabase_name = "app-staging-db"\n\n' +
+      '[[env.staging.d1_databases]]\nbinding = "ANALYTICS"\ndatabase_id = ""\ndatabase_name = "app-analytics-db"\n';
+    const root = await mkdtemp(join(tmpdir(), 'smoo-prepare-env-'));
+    try {
+      await writeFile(join(root, 'wrangler.toml'), withD1);
+      expect(readManifest(root, 'staging')).toEqual({
+        kvBindings: ['CACHE'],
+        d1Bindings: ['DB', 'ANALYTICS'],
+        vars: ['PUBLIC_URL'],
+        secrets: [],
+      });
+    } finally {
+      await rm(root, { recursive: true, force: true });
+    }
+  });
+});
+
+describe('isPem / readPemFile / looksLikeFileSecret', () => {
+  it('recognizes a -----BEGIN block and rejects arbitrary text', () => {
+    expect(isPem('-----BEGIN CERTIFICATE-----\nMIIB\n-----END CERTIFICATE-----\n')).toBe(true);
+    expect(isPem('-----BEGIN RSA PRIVATE KEY-----\n')).toBe(true);
+    expect(isPem('just a plain secret')).toBe(false);
+  });
+
+  it('reads a PEM file and throws on a non-PEM file', async () => {
+    const root = await mkdtemp(join(tmpdir(), 'smoo-prepare-env-'));
+    try {
+      const pem = '-----BEGIN CERTIFICATE-----\nMIIBcontent\n-----END CERTIFICATE-----\n';
+      const pemPath = join(root, 'cert.pem');
+      const plainPath = join(root, 'plain.txt');
+      await writeFile(pemPath, pem);
+      await writeFile(plainPath, 'not a pem at all\n');
+      expect(readPemFile(pemPath)).toBe(pem);
+      expect(() => readPemFile(plainPath)).toThrow();
+    } finally {
+      await rm(root, { recursive: true, force: true });
+    }
+  });
+
+  it('flags _PEM/_KEY/_CERT suffixes as file secrets and nothing else', () => {
+    expect(looksLikeFileSecret('SIGNING_PEM')).toBe(true);
+    expect(looksLikeFileSecret('SIGNING_KEY')).toBe(true);
+    expect(looksLikeFileSecret('SIGNING_CERT')).toBe(true);
+    expect(looksLikeFileSecret('API_TOKEN')).toBe(false);
+    expect(looksLikeFileSecret('PEM_HEADER')).toBe(false);
+  });
+});