@smoothbricks/cli 0.8.0 → 0.9.0

package/src/wrangler/scaffold.test.ts

@@ -0,0 +1,200 @@
+import { describe, expect, it, spyOn } from 'bun:test';
+import { mkdir, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { scaffold } from './scaffold.js';
+
+describe('scaffold', () => {
+  it('writes the manifest-driven starter script and wires the prepare-env nx target', async () => {
+    const root = await createWorkspace([{ dir: 'worker', name: '@acme/worker', toml: '[env.production]\n' }]);
+    captureConsoleLogs();
+    try {
+      const scriptPath = scaffold(root, '@acme/worker');
+
+      // Returns the absolute path it wrote.
+      expect(scriptPath).toBe(join(root, 'packages/worker/scripts/prepare-env.ts'));
+
+      // The generated script imports the primitives module and derives work from the manifest.
+      const script = await readFile(scriptPath, 'utf8');
+      expect(script).toContain('@smoothbricks/cli/wrangler/prepare-env');
+      expect(script).toContain('readManifest');
+
+      // The nx target is wired to run the script from the project root.
+      const pkg = await readJson(join(root, 'packages/worker/package.json'));
+      expect(nxTargets(pkg)['prepare-env']).toEqual({
+        executor: 'nx:run-commands',
+        options: { command: 'bun scripts/prepare-env.ts', cwd: '{projectRoot}' },
+      });
+    } finally {
+      console.log = originalConsoleLog;
+      await rm(root, { recursive: true, force: true });
+    }
+  });
+
+  it('resolves the same project by nx name, package name, and relative path', async () => {
+    const root = await createWorkspace([
+      { dir: 'worker', name: '@acme/worker', toml: '[env.production]\n', nx: { name: 'my-worker' } },
+    ]);
+    captureConsoleLogs();
+    try {
+      const expected = join(root, 'packages/worker/scripts/prepare-env.ts');
+      const byNxName = scaffold(root, 'my-worker');
+      const byPackageName = scaffold(root, '@acme/worker', { force: true });
+      const byRelativePath = scaffold(root, 'packages/worker', { force: true });
+
+      expect(byNxName).toBe(expected);
+      expect(byPackageName).toBe(expected);
+      expect(byRelativePath).toBe(expected);
+    } finally {
+      console.log = originalConsoleLog;
+      await rm(root, { recursive: true, force: true });
+    }
+  });
+
+  it('throws when the project is unknown, naming the known projects', async () => {
+    const root = await createWorkspace([
+      { dir: 'worker', name: '@acme/worker', toml: '[env.production]\n', nx: { name: 'my-worker' } },
+    ]);
+    try {
+      let message = '';
+      try {
+        scaffold(root, 'ghost');
+      } catch (error) {
+        message = error instanceof Error ? error.message : String(error);
+      }
+      expect(message).toContain('not found');
+      expect(message).toContain('my-worker');
+    } finally {
+      await rm(root, { recursive: true, force: true });
+    }
+  });
+
+  it('throws when the resolved package has no wrangler.toml', async () => {
+    const root = await createWorkspace([{ dir: 'plain', name: '@acme/plain' }]);
+    try {
+      expect(() => scaffold(root, '@acme/plain')).toThrow('has no wrangler.toml');
+    } finally {
+      await rm(root, { recursive: true, force: true });
+    }
+  });
+
+  it('throws on a second scaffold without force, pointing at --force', async () => {
+    const root = await createWorkspace([{ dir: 'worker', name: '@acme/worker', toml: '[env.production]\n' }]);
+    captureConsoleLogs();
+    try {
+      scaffold(root, '@acme/worker');
+      expect(() => scaffold(root, '@acme/worker')).toThrow('--force');
+    } finally {
+      console.log = originalConsoleLog;
+      await rm(root, { recursive: true, force: true });
+    }
+  });
+
+  it('overwrites an existing script when force is set', async () => {
+    const root = await createWorkspace([{ dir: 'worker', name: '@acme/worker', toml: '[env.production]\n' }]);
+    const logs = captureConsoleLogs();
+    try {
+      const scriptPath = scaffold(root, '@acme/worker');
+      await writeFile(scriptPath, 'stale hand-edited content\n');
+
+      const again = scaffold(root, '@acme/worker', { force: true });
+      expect(again).toBe(scriptPath);
+
+      // The stale content is replaced by a freshly rendered script.
+      const script = await readFile(scriptPath, 'utf8');
+      expect(script).not.toContain('stale hand-edited content');
+      expect(script).toContain('@smoothbricks/cli/wrangler/prepare-env');
+      expect(logs.some((line) => line.startsWith('overwrote'))).toBe(true);
+    } finally {
+      console.log = originalConsoleLog;
+      await rm(root, { recursive: true, force: true });
+    }
+  });
+
+  it('preserves a hand-customized prepare-env target and never duplicates it', async () => {
+    const custom = {
+      executor: 'nx:run-commands',
+      options: { command: 'bun scripts/prepare-env.ts --custom', cwd: '{projectRoot}' },
+    };
+    const root = await createWorkspace([
+      {
+        dir: 'worker',
+        name: '@acme/worker',
+        toml: '[env.production]\n',
+        nx: { targets: { 'prepare-env': { ...custom } } },
+      },
+    ]);
+    captureConsoleLogs();
+    try {
+      scaffold(root, '@acme/worker', { force: true });
+
+      // The idempotent guard leaves an already-wired target exactly as authored.
+      const target = nxTargets(await readJson(join(root, 'packages/worker/package.json')))['prepare-env'];
+      expect(target).toEqual(custom);
+      // Still a single target object, not wrapped into an array or duplicated.
+      expect(Array.isArray(target)).toBe(false);
+    } finally {
+      console.log = originalConsoleLog;
+      await rm(root, { recursive: true, force: true });
+    }
+  });
+});
+
+async function createWorkspace(
+  packages: Array<{ dir: string; name: string; toml?: string; nx?: Record<string, unknown> }>,
+): Promise<string> {
+  const root = await mkdtemp(join(tmpdir(), 'smoo-scaffold-'));
+  await writeJson(join(root, 'package.json'), {
+    name: '@acme/codebase',
+    version: '0.0.0',
+    private: true,
+    workspaces: ['packages/*'],
+  });
+  for (const pkg of packages) {
+    await writeJson(join(root, `packages/${pkg.dir}/package.json`), {
+      name: pkg.name,
+      version: '0.0.0',
+      private: true,
+      ...(pkg.nx ? { nx: pkg.nx } : {}),
+    });
+    if (pkg.toml !== undefined) {
+      await writeFile(join(root, `packages/${pkg.dir}/wrangler.toml`), pkg.toml);
+    }
+  }
+  return root;
+}
+
+function nxTargets(pkg: Record<string, unknown>): Record<string, unknown> {
+  const nx = pkg.nx;
+  if (!isRecord(nx) || !isRecord(nx.targets)) {
+    throw new Error('nx.targets not found');
+  }
+  return nx.targets;
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+
+async function readJson(path: string): Promise<Record<string, unknown>> {
+  const parsed: unknown = JSON.parse(await readFile(path, 'utf8'));
+  if (!isRecord(parsed)) {
+    throw new Error('expected JSON object');
+  }
+  return parsed;
+}
+
+async function writeJson(path: string, value: Record<string, unknown>): Promise<void> {
+  await mkdir(join(path, '..'), { recursive: true });
+  await writeFile(path, `${JSON.stringify(value, null, 2)}\n`);
+}
+
+const originalConsoleLog = console.log;
+
+function captureConsoleLogs(): string[] {
+  const logs: string[] = [];
+  spyOn(console, 'log').mockImplementation((...args: unknown[]) => {
+    logs.push(args.join(' '));
+  });
+  return logs;
+}

package/src/wrangler/scaffold.ts

@@ -0,0 +1,239 @@
+/**
+ * `smoo wrangler scaffold <project>` — write a starter `scripts/prepare-env.ts`
+ * into a wrangler project and wire its `prepare-env` nx target. The generated
+ * script imports the `@smoothbricks/cli/wrangler/prepare-env` primitives and
+ * derives its work at runtime from the project's manifest (wrangler.toml [vars] +
+ * .dev.vars.example), so it never drifts from what the worker declares.
+ */
+import { existsSync, mkdirSync, writeFileSync } from 'node:fs';
+import { join, relative } from 'node:path';
+import { getOrCreateRecord, recordProperty, writeJsonObject } from '../lib/json.js';
+import { getWorkspacePackageManifests } from '../lib/workspace.js';
+
+export interface ScaffoldOptions {
+  /** Overwrite an existing scripts/prepare-env.ts. */
+  force?: boolean;
+}
+
+/** Locate a workspace package by nx name, package name, or relative path; must have a wrangler.toml. */
+function resolveProject(root: string, project: string): { dir: string; label: string; packageJsonPath: string; json: Record<string, unknown> } {
+  const manifests = getWorkspacePackageManifests(root);
+  const match = manifests.find((m) => {
+    const nx = recordProperty(m.json, 'nx');
+    const nxName = nx && typeof nx.name === 'string' ? nx.name : null;
+    return nxName === project || m.name === project || relative(root, m.path) === project;
+  });
+  if (!match) {
+    const known = manifests.map((m) => recordProperty(m.json, 'nx')?.name ?? m.name).join(', ');
+    throw new Error(`project "${project}" not found. Known: ${known}`);
+  }
+  const dir = match.path; // WorkspacePackageManifest.path is absolute
+  if (!existsSync(join(dir, 'wrangler.toml'))) {
+    throw new Error(`"${project}" has no wrangler.toml — not a wrangler project`);
+  }
+  return { dir, label: relative(root, dir), packageJsonPath: match.packageJsonPath, json: match.json };
+}
+
+/** The generated starter script — generic, manifest-driven, prompt-batteries included. */
+function renderScript(projectName: string): string {
+  return `#!/usr/bin/env bun
+/**
+ * Prepare a deploy environment for ${projectName}. Generated by \`smoo wrangler scaffold\`.
+ *
+ * Provisions what \`wrangler deploy\` assumes already exists, idempotently:
+ *   - KV namespaces the worker binds (ids written into wrangler.toml)
+ *   - public [env.<env>.vars] (committed config the deploy applies)
+ *   - secrets (wrangler secret put; values never touch the repo)
+ *
+ * Work is derived from the manifest (wrangler.toml [vars] + .dev.vars.example),
+ * so it stays in sync with what the worker declares. Customize the app-specific
+ * bits below (KV title convention; any secret that feeds >1 binding).
+ *
+ * Usage:
+ *   bun scripts/prepare-env.ts <env>            # provision (staging | production | …)
+ *   bun scripts/prepare-env.ts <env> --check    # report state, no writes
+ */
+import { readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+import * as p from '@clack/prompts';
+import * as pe from '@smoothbricks/cli/wrangler/prepare-env';
+
+const ROOT = resolve(import.meta.dir, '..');
+const WRANGLER = resolve(ROOT, 'wrangler.toml');
+const readToml = () => readFileSync(WRANGLER, 'utf8');
+
+// App-specific: the account-level logical title for a KV binding. Default is
+// lowercase + underscores→dashes; edit if your namespaces are named differently.
+function kvTitle(binding: string, env: string): string {
+  return \`\${binding.toLowerCase().replace(/_/g, '-')}-\${env}\`;
+}
+
+function bail<T>(v: T | symbol): asserts v is T {
+  if (p.isCancel(v)) {
+    p.cancel('Aborted — anything already provisioned stays; re-run to continue (idempotent).');
+    process.exit(1);
+  }
+}
+
+async function checkMode(env: string): Promise<void> {
+  const toml = readToml();
+  const { kvBindings, vars, secrets } = pe.readManifest(ROOT, env);
+  p.log.info(\`env block [env.\${env}]: \${pe.hasEnvBlock(toml, env) ? '✓ present' : '✗ missing'}\`);
+  const live = await pe.listNamespaces(ROOT);
+  for (const binding of kvBindings) {
+    const inToml = pe.getKvId(toml, env, binding);
+    const liveId = live.find((n) => n.title === kvTitle(binding, env))?.id ?? null;
+    p.log.message(\`  KV \${binding}: \${!liveId ? '✗ not created' : inToml === liveId ? \`✓ \${liveId}\` : \`⚠ drift (live \${liveId}, toml \${inToml ?? 'unset'})\`}\`);
+  }
+  for (const name of vars) {
+    p.log.message(\`  var \${name}: \${pe.getVar(toml, env, name) ? '✓ set' : '✗ empty'}\`);
+  }
+  const set = await pe.listSecretNames(env, ROOT);
+  for (const name of secrets) {
+    p.log.message(\`  secret \${name}: \${set.includes(name) ? '✓ set' : '✗ missing'}\`);
+  }
+}
+
+async function main(): Promise<void> {
+  const env = process.argv.slice(2).find((a) => !a.startsWith('-'));
+  if (!env) {
+    console.error('usage: bun scripts/prepare-env.ts <env> [--check]');
+    process.exit(1);
+  }
+  const check = process.argv.includes('--check');
+  p.intro(\`${projectName} · prepare \${env}\${check ? ' (check)' : ''}\`);
+
+  if (check) {
+    await checkMode(env);
+    p.outro(\`check complete for "\${env}" — nothing changed\`);
+    return;
+  }
+
+  let toml = readToml();
+
+  // 0. Env block. If missing, offer to clone an existing env and blank its
+  //    per-env values (KV ids), then fill below.
+  if (!pe.hasEnvBlock(toml, env)) {
+    const from = pe.firstWranglerEnv(toml);
+    if (from && (await p.confirm({ message: \`No [env.\${env}] — clone from [env.\${from}]?\` })) === true) {
+      toml = pe.blankKvIds(pe.cloneEnvBlock(toml, from, env), env);
+      pe.saveToml(WRANGLER, toml);
+      p.log.success(\`cloned [env.\${from}] → [env.\${env}] (KV ids blanked; edit domain-specific vars below)\`);
+    } else {
+      p.log.warn(\`Add an [env.\${env}] block to wrangler.toml first, then re-run.\`);
+      return;
+    }
+  }
+
+  const { kvBindings, vars, secrets } = pe.readManifest(ROOT, env);
+
+  // 1. KV namespaces → ids into the toml.
+  const live = await pe.listNamespaces(ROOT);
+  for (const binding of kvBindings) {
+    const s = p.spinner();
+    s.start(\`KV \${binding}\`);
+    const id = await pe.ensureNamespace(kvTitle(binding, env), live, ROOT);
+    if (!id) { s.stop(\`✗ \${binding}\`); continue; }
+    toml = pe.setKvId(toml, env, binding, id, kvTitle(binding, env));
+    pe.saveToml(WRANGLER, toml);
+    s.stop(\`✓ \${binding} → \${id}\`);
+  }
+
+  // 2. Public vars → [env.<env>.vars] (committed, applied by deploy). Enter keeps
+  //    current; a same-named env var overrides (CI).
+  if ((await p.confirm({ message: \`Set public vars for "\${env}"?\` })) === true) {
+    for (const name of vars) {
+      const current = pe.getVar(toml, env, name);
+      const preset = process.env[name]?.trim();
+      let value: string;
+      if (preset) {
+        value = preset;
+        p.log.info(\`\${name}: from environment\`);
+      } else {
+        const raw = await p.text({ message: \`\${name}:\`, placeholder: current ? 'Enter to keep current' : 'Enter to skip', initialValue: current ?? '' });
+        bail(raw);
+        value = raw.trim();
+      }
+      if (!value || value === current) continue;
+      toml = pe.setVar(toml, env, name, value);
+      pe.saveToml(WRANGLER, toml);
+    }
+  }
+
+  // 3. Secrets → wrangler secret put (values never in the repo). File-or-paste;
+  //    PEM validated by content. Skip-if-set unless you choose to replace.
+  const alreadySet = await pe.listSecretNames(env, ROOT);
+  if ((await p.confirm({ message: \`Set secrets for "\${env}"?\` })) === true) {
+    for (const name of secrets) {
+      const preset = process.env[name]?.trim();
+      if (alreadySet.includes(name) && !preset) {
+        const replace = await p.confirm({ message: \`\${name} already set — replace?\`, initialValue: false });
+        bail(replace);
+        if (!replace) { p.log.info(\`kept \${name}\`); continue; }
+      }
+      let value: string;
+      if (preset) {
+        value = preset;
+      } else if (pe.looksLikeFileSecret(name)) {
+        const path = await p.text({ message: \`\${name} — path to file:\`, placeholder: 'Enter to skip' });
+        bail(path);
+        if (!path.trim()) continue;
+        value = pe.readPemFile(path.trim());
+      } else {
+        const raw = await p.password({ message: \`\${name}:\` });
+        bail(raw);
+        value = raw.trim();
+        if (!value) continue;
+        if (pe.isPem(value) === false && /KEY|PEM|CERT/.test(name) && value.startsWith('~')) {
+          value = pe.readPemFile(value);
+        }
+      }
+      const s = p.spinner();
+      s.start(\`secret \${name}\`);
+      const ok = await pe.putSecret(name, value, env, ROOT);
+      s.stop(\`\${ok ? '✓' : '✗'} \${name}\`);
+    }
+    // Verify: re-list and flag any we set that didn't land.
+    const after = await pe.listSecretNames(env, ROOT);
+    const missing = secrets.filter((n) => !after.includes(n));
+    if (missing.length) p.log.warn(\`not listed afterwards — verify manually: \${missing.join(', ')}\`);
+  }
+
+  p.outro(\`"\${env}" prepared — re-run anytime (idempotent) · inspect with --check · then deploy\`);
+}
+
+if (import.meta.main) {
+  await main();
+}
+`;
+}
+
+/** Write the starter script + wire the `prepare-env` nx target. Returns the script path. */
+export function scaffold(root: string, project: string, options: ScaffoldOptions = {}): string {
+  const { dir, label, packageJsonPath, json } = resolveProject(root, project);
+  const scriptsDir = join(dir, 'scripts');
+  const scriptPath = join(scriptsDir, 'prepare-env.ts');
+
+  const existed = existsSync(scriptPath);
+  if (existed && !options.force) {
+    throw new Error(`${label}/scripts/prepare-env.ts already exists — pass --force to overwrite`);
+  }
+  mkdirSync(scriptsDir, { recursive: true });
+  writeFileSync(scriptPath, renderScript(project));
+  console.log(`${existed ? 'overwrote' : 'created'}      ${label}/scripts/prepare-env.ts`);
+
+  // Wire the nx target (idempotent).
+  const nx = getOrCreateRecord(json, 'nx');
+  const targets = getOrCreateRecord(nx, 'targets');
+  if (!recordProperty(targets, 'prepare-env')) {
+    targets['prepare-env'] = {
+      executor: 'nx:run-commands',
+      options: { command: 'bun scripts/prepare-env.ts', cwd: '{projectRoot}' },
+    };
+    writeJsonObject(packageJsonPath, json);
+    console.log(`updated       ${label}/package.json prepare-env target`);
+  }
+
+  console.log(`\nnext: fill secret NAMES in ${label}/.dev.vars.example, then\n  bunx nx run ${project}:prepare-env -- <env>`);
+  return scriptPath;
+}