@smoothbricks/cli 0.9.0 → 0.10.1

package/dist/cli.js

@@ -67,9 +67,12 @@ function buildProgram() {
         const { validateCommitMessageFile } = await import('./monorepo/index.js');
         validateCommitMessageFile(commitMsgFile, options, await findRepoRoot());
     });
-    monorepo.command('sync-bun-lockfile-versions').action(async () => {
+    monorepo
+        .command('sync-bun-lockfile-versions')
+        .option('--stage', 'stage bun.lock when versions were resynced (pre-commit self-heal); quiet when clean')
+        .action(async (options) => {
         const { syncBunLockfileVersions } = await import('./monorepo/index.js');
-        syncBunLockfileVersions(await findRepoRoot());
+        syncBunLockfileVersions(await findRepoRoot(), options.stage ? { log: false, stage: true } : {});
     });
     monorepo
         .command('list-release-packages')

package/dist/monorepo/lockfile.d.ts

@@ -1,5 +1,7 @@
 export interface SyncBunLockfileVersionsOptions {
     log?: boolean;
+    /** `git add` bun.lock after rewriting it, for the pre-commit self-heal path. */
+    stage?: boolean;
 }
 export declare function syncBunLockfileVersions(root: string, options?: SyncBunLockfileVersionsOptions): number;
 export declare function validateBunLockfileVersions(root: string): number;

package/dist/monorepo/lockfile.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"lockfile.d.ts","sourceRoot":"","sources":["../../src/monorepo/lockfile.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,8BAA8B;IAC7C,GAAG,CAAC,EAAE,OAAO,CAAC;CACf;AAWD,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,8BAAmC,GAAG,MAAM,CAkD1G;AAED,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAiChE"}
+{"version":3,"file":"lockfile.d.ts","sourceRoot":"","sources":["../../src/monorepo/lockfile.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,8BAA8B;IAC7C,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,gFAAgF;IAChF,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAiBD,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,8BAAmC,GAAG,MAAM,CAuD1G;AAED,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAiChE"}

package/dist/monorepo/lockfile.js

@@ -11,6 +11,12 @@ import { escapeRegex, getWorkspacePackages } from '../lib/workspace.js';
 // - https://github.com/oven-sh/bun/issues/18906
 // - https://github.com/oven-sh/bun/issues/20477
 // - https://github.com/oven-sh/bun/issues/20829
+//
+// Any `bun install` rewrites the workspace versions from package.json, reverting
+// this sync between releases. The pre-commit hook therefore runs
+// `smoo monorepo sync-bun-lockfile-versions --stage` on every commit so drift is
+// healed at the commit that would otherwise carry it — validation must never
+// fail a committer for drift a routine `bun install` introduced.
 export function syncBunLockfileVersions(root, options = {}) {
     const log = options.log ?? true;
     const lockfilePath = join(root, 'bun.lock');
@@ -53,9 +59,14 @@ export function syncBunLockfileVersions(root, options = {}) {
     }
     if (updated > 0) {
         writeFileSync(lockfilePath, lockfile);
+        if (options.stage) {
+            execSync('git add bun.lock', { cwd: root, stdio: ['pipe', 'pipe', 'pipe'] });
+        }
     }
-    if (log) {
-        console.log(updated > 0 ? `Updated ${updated} workspace version(s) in bun.lock` : 'All workspace versions already in sync.');
+    if (log || updated > 0) {
+        console.log(updated > 0
+            ? `Updated ${updated} workspace version(s) in bun.lock${options.stage ? ' (staged)' : ''}`
+            : 'All workspace versions already in sync.');
     }
     return updated;
 }

package/dist/wrangler/prepare-env.d.ts

@@ -1,26 +1,33 @@
 export declare function isRecord(v: unknown): v is Record<string, unknown>;
-/** First `[env.<name>]` header, or `null` when the config declares no envs (top-level bindings only). */
+/** First `[env.<name>]` (source order; also derived from a nested `[env.<name>.*]`), or null when no env declared. */
 export declare function firstWranglerEnv(toml: string): string | null;
-/** True if the toml declares `[env.<env>]`. */
+/** True if the toml declares `[env.<env>]` (or any `[env.<env>.*]` sub-table). */
 export declare function hasEnvBlock(toml: string, env: string): boolean;
 /** A `[env.<env>.vars]` value, or null if unset/empty. Reads committed public config. */
 export declare function getVar(toml: string, env: string, name: string): string | null;
-/** Set a `[env.<env>.vars]` value, preserving any trailing comment. Throws if the key isn't present (scaffold first). */
+/** Set a `[env.<env>.vars]` value (JSON-encoded), preserving any trailing comment. Throws if the key is absent (scaffold first). */
 export declare function setVar(toml: string, env: string, name: string, value: string): string;
 /** The id written for `[[env.<env>.kv_namespaces]]` binding, or null if absent/empty. */
 export declare function getKvId(toml: string, env: string, binding: string): string | null;
-/** Rewrite the `id = ...` line of the `[[env.<env>.kv_namespaces]]` table whose binding matches. Throws if absent. */
+/** Rewrite the `id = ...` line (value + trailing comment) of the kv_namespaces table whose binding matches. Throws if absent. */
 export declare function setKvId(toml: string, env: string, binding: string, id: string, title: string): string;
 /**
- * Append a copy of the whole `[env.<from>]` … block-group (every `[env.<from>...]`
- * table up to the next non-`from` env or EOF) rewritten for `<to>`. Returns the new
- * toml. Throws if `<from>` is absent or `<to>` already exists (blank/fill instead).
+ * Append a copy of every `[env.<from>...]` table rewritten for `<to>` (headers
+ * only — values copied verbatim). Throws if `<from>` is absent or `<to>` exists.
  */
 export declare function cloneEnvBlock(toml: string, from: string, to: string): string;
-/** Blank every `NAME = "..."` under `[env.<env>.vars]` whose key is in `keys` (env-specific values to re-fill). */
+/** Blank the named `[env.<env>.vars]` values to `""` (preserving comments), skipping absent keys. */
 export declare function blankEnvVars(toml: string, env: string, keys: string[]): string;
-/** Blank every `id = ...` line under the env's `[[env.<env>.kv_namespaces]]` tables (per-env resource ids). */
+/** Blank every kv_namespaces `id` under the env to `""` (drops trailing comment; binding/name survive). */
 export declare function blankKvIds(toml: string, env: string): string;
+/** The database_id written for `[[env.<env>.d1_databases]]` binding, or null if absent/empty. */
+export declare function getD1Id(toml: string, env: string, binding: string): string | null;
+/** The `database_name` for `[[env.<env>.d1_databases]]` binding, or null. Source of truth for which DB to create/reuse. */
+export declare function getD1Name(toml: string, env: string, binding: string): string | null;
+/** Rewrite the `database_id = ...` line (value + trailing comment) of the d1 table whose binding matches; the name line is untouched. Throws if absent. */
+export declare function setD1Id(toml: string, env: string, binding: string, id: string, name: string): string;
+/** Blank every d1 `database_id` under the env to `""` (drops trailing comment; binding/name survive). */
+export declare function blankD1Ids(toml: string, env: string): string;
 /** Parse-guard: throws if `toml` no longer parses, so a bad edit can't be written to disk. */
 export declare function assertToml(toml: string): void;
 /** Persist a toml string after confirming it still parses. */
@@ -28,6 +35,8 @@ export declare function saveToml(path: string, toml: string): void;
 export interface Manifest {
     /** KV binding names declared under `[[env.<env>.kv_namespaces]]` (resources to provision). */
     kvBindings: string[];
+    /** D1 binding names declared under `[[env.<env>.d1_databases]]` (resources to provision). */
+    d1Bindings: string[];
     /** Public var names declared in `[env.<env>.vars]` (committed config). */
     vars: string[];
     /** Secret names declared in `.dev.vars.example` (values live on the worker, never in the repo). */
@@ -61,6 +70,18 @@ export declare function listNamespaces(cwd: string): Promise<KvNamespace[]>;
  * so we re-list rather than scrape. Returns the id, or null on failure.
  */
 export declare function ensureNamespace(logical: string, existing: KvNamespace[], cwd: string): Promise<string | null>;
+export interface D1Database {
+    uuid: string;
+    name: string;
+}
+/** Live D1 databases on the account (`d1 list --json`); `[]` when offline/unauthenticated. */
+export declare function listD1Databases(cwd: string): Promise<D1Database[]>;
+/**
+ * Reuse the D1 database whose name matches, else create it. The uuid comes from
+ * the structured `list` JSON (create prints freeform text), so we re-list rather
+ * than scrape. Returns the uuid, or null on failure.
+ */
+export declare function ensureD1Database(name: string, existing: D1Database[], cwd: string): Promise<string | null>;
 /** Current secret names on the worker for `env`; `[]` when none/unreachable (Cloudflare allows setting pre-deploy). */
 export declare function listSecretNames(env: string, cwd: string): Promise<string[]>;
 /** `wrangler secret put <name> --env <env>` piping `value` on stdin (never a CLI arg). Returns success. */

package/dist/wrangler/prepare-env.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"prepare-env.d.ts","sourceRoot":"","sources":["../../src/wrangler/prepare-env.ts"],"names":[],"mappings":"AAyBA,wBAAgB,QAAQ,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEjE;AAQD,yGAAyG;AACzG,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAG5D;AAED,+CAA+C;AAC/C,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAE9D;AAED,yFAAyF;AACzF,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAK7E;AAED,yHAAyH;AACzH,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAMrF;AAED,yFAAyF;AACzF,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CASjF;AAED,sHAAsH;AACtH,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAQrG;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,CAsB5E;AAED,mHAAmH;AACnH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,CAO9E;AAED,+GAA+G;AAC/G,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAM5D;AAED,8FAA8F;AAC9F,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAE7C;AAED,8DAA8D;AAC9D,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAGzD;AAWD,MAAM,WAAW,QAAQ;IACvB,8FAA8F;IAC9F,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,0EAA0E;IAC1E,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,mGAAmG;IACnG,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,oGAAoG;AACpG,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAS1D;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,QAAQ,CAUhE;AAID,0EAA0E;AAC1E,wBAAgB,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE5C;AAED,kGAAkG;AAClG,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAKhD;AAED,kIAAkI;AAClI,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEzD;AAID,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;CACf;AAkBD,8EAA8E;AAC9E,wBAAgB,OAAO,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAK5C;AAED,0HAA0H;AAC1H,wBAAsB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAMxE;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CASnH;AAMD,uHAAuH;AACvH,wBAAsB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAMjF;AAED,2GAA2G;AAC3G,wBAAsB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAOvG"}
+{"version":3,"file":"prepare-env.d.ts","sourceRoot":"","sources":["../../src/wrangler/prepare-env.ts"],"names":[],"mappings":"AAyBA,wBAAgB,QAAQ,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEjE;AAsDD,sHAAsH;AACtH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAK5D;AAED,kFAAkF;AAClF,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAG9D;AAED,yFAAyF;AACzF,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAK7E;AAED,oIAAoI;AACpI,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAKrF;AAED,yFAAyF;AACzF,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAOjF;AAED,iIAAiI;AACjI,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAIrG;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,MAAM,CAW5E;AAED,qGAAqG;AACrG,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,CAO9E;AAED,2GAA2G;AAC3G,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED,iGAAiG;AACjG,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAOjF;AAED,2HAA2H;AAC3H,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAOnF;AAED,2JAA2J;AAC3J,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAIpG;AAED,yGAAyG;AACzG,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAE5D;AAkBD,8FAA8F;AAC9F,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAE7C;AAED,8DAA8D;AAC9D,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAGzD;AAID,MAAM,WAAW,QAAQ;IACvB,8FAA8F;IAC9F,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,6FAA6F;IAC7F,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,0EAA0E;IAC1E,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,mGAAmG;IACnG,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,oGAAoG;AACpG,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAS1D;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,QAAQ,CAYhE;AAID,0EAA0E;AAC1E,wBAAgB,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE5C;AAED,kGAAkG;AAClG,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAKhD;AAED,kIAAkI;AAClI,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEzD;AAID,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;CACf;AAkBD,8EAA8E;AAC9E,wBAAgB,OAAO,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAK5C;AAED,0HAA0H;AAC1H,wBAAsB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAMxE;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CASnH;AAMD,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;CACd;AAaD,8FAA8F;AAC9F,wBAAsB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAMxE;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAShH;AAMD,uHAAuH;AACvH,wBAAsB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAMjF;AAED,2GAA2G;AAC3G,wBAAsB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAOvG"}

package/dist/wrangler/prepare-env.js

@@ -19,23 +19,68 @@
 import { existsSync, readFileSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { $ } from 'bun';
-import { parse } from 'smol-toml';
-// ── runtime narrowing (wrangler JSON + parsed toml are external data — no casts) ─
+import { getStaticTOMLValue, parseTOML } from 'toml-eslint-parser';
+// ── runtime narrowing (wrangler JSON is external data — no casts) ─────────────
 export function isRecord(v) {
     return typeof v === 'object' && v !== null && !Array.isArray(v);
 }
-function escapeRe(s) {
-    return s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+// ── wrangler.toml editors (CST: read via getStaticTOMLValue, write via
+// node-range splice — comment/format-preserving by construction, no regex) ─────
+/** All top-level tables (`[env.x]`, `[env.x.vars]`, `[[env.x.d1_databases]]`, …) — each carries `resolvedKey` (incl. array index). */
+function tables(toml) {
+    return parseTOML(toml).body[0].body.filter((n) => n.type === 'TOMLTable');
 }
-// ── pure wrangler.toml editors (no I/O — unit-testable) ──────────────────────
-/** First `[env.<name>]` header, or `null` when the config declares no envs (top-level bindings only). */
+/** Whole doc as a JS object (comments/format dropped — reads only). */
+function tomlValue(toml) {
+    const value = getStaticTOMLValue(parseTOML(toml));
+    return isRecord(value) ? value : {};
+}
+function envRecord(toml, env) {
+    const envs = tomlValue(toml).env;
+    const block = isRecord(envs) ? envs[env] : undefined;
+    return isRecord(block) ? block : null;
+}
+function sameKey(a, b) {
+    return a.length === b.length && a.every((x, i) => x === b[i]);
+}
+/** The `key = value` node named `key` in a table (single-segment keys; matched by source text). */
+function kvIn(toml, table, key) {
+    for (const kv of table.body) {
+        if (toml.slice(kv.key.range[0], kv.key.range[1]).trim() === key)
+            return kv;
+    }
+    return null;
+}
+/** The `<field>` KV of the `[[env.<env>.<arrayKey>]]` table whose `binding` matches, or null. */
+function arrayTableKv(toml, env, arrayKey, binding, field) {
+    const block = envRecord(toml, env);
+    const rows = isRecord(block) && Array.isArray(block[arrayKey]) ? block[arrayKey] : [];
+    const index = rows.findIndex((r) => isRecord(r) && r.binding === binding);
+    if (index < 0)
+        return null;
+    const table = tables(toml).find((t) => t.kind === 'array' && sameKey(t.resolvedKey, ['env', env, arrayKey, index]));
+    return table ? kvIn(toml, table, field) : null;
+}
+function splice(toml, start, end, text) {
+    return toml.slice(0, start) + text + toml.slice(end);
+}
+/** End of the physical line containing `offset` (exclusive of the newline). */
+function endOfLine(toml, offset) {
+    const nl = toml.indexOf('\n', offset);
+    return nl === -1 ? toml.length : nl;
+}
+/** First `[env.<name>]` (source order; also derived from a nested `[env.<name>.*]`), or null when no env declared. */
 export function firstWranglerEnv(toml) {
-    const match = toml.match(/^\s*\[env\.([A-Za-z0-9_-]+)/m);
-    return match ? match[1] : null;
+    const envs = tomlValue(toml).env;
+    if (!isRecord(envs))
+        return null;
+    const [first] = Object.keys(envs);
+    return first ?? null;
 }
-/** True if the toml declares `[env.<env>]`. */
+/** True if the toml declares `[env.<env>]` (or any `[env.<env>.*]` sub-table). */
 export function hasEnvBlock(toml, env) {
-    return new RegExp(`^\\[env\\.${escapeRe(env)}\\]`, 'm').test(toml);
+    const envs = tomlValue(toml).env;
+    return isRecord(envs) && env in envs;
 }
 /** A `[env.<env>.vars]` value, or null if unset/empty. Reads committed public config. */
 export function getVar(toml, env, name) {
@@ -44,95 +89,118 @@ export function getVar(toml, env, name) {
     const value = vars[name];
     return typeof value === 'string' && value ? value : null;
 }
-/** Set a `[env.<env>.vars]` value, preserving any trailing comment. Throws if the key isn't present (scaffold first). */
+/** Set a `[env.<env>.vars]` value (JSON-encoded), preserving any trailing comment. Throws if the key is absent (scaffold first). */
 export function setVar(toml, env, name, value) {
-    const re = new RegExp(`(\\[env\\.${escapeRe(env)}\\.vars\\][\\s\\S]*?\\n${escapeRe(name)} = )"[^"]*"`);
-    if (!re.test(toml)) {
+    const table = tables(toml).find((t) => sameKey(t.resolvedKey, ['env', env, 'vars']));
+    const kv = table ? kvIn(toml, table, name) : null;
+    if (!kv)
         throw new Error(`vars key "${name}" not found under [env.${env}.vars]`);
-    }
-    return toml.replace(re, (_m, prefix) => `${prefix}${JSON.stringify(value)}`);
+    return splice(toml, kv.value.range[0], kv.value.range[1], JSON.stringify(value));
 }
 /** The id written for `[[env.<env>.kv_namespaces]]` binding, or null if absent/empty. */
 export function getKvId(toml, env, binding) {
     const block = envRecord(toml, env);
     const rows = isRecord(block) && Array.isArray(block.kv_namespaces) ? block.kv_namespaces : [];
     for (const row of rows) {
-        if (isRecord(row) && row.binding === binding && typeof row.id === 'string') {
+        if (isRecord(row) && row.binding === binding && typeof row.id === 'string')
             return row.id || null;
-        }
     }
     return null;
 }
-/** Rewrite the `id = ...` line of the `[[env.<env>.kv_namespaces]]` table whose binding matches. Throws if absent. */
+/** Rewrite the `id = ...` line (value + trailing comment) of the kv_namespaces table whose binding matches. Throws if absent. */
 export function setKvId(toml, env, binding, id, title) {
-    const re = new RegExp(`(\\[\\[env\\.${escapeRe(env)}\\.kv_namespaces\\]\\]\\s*\\n\\s*binding = "${escapeRe(binding)}"\\s*\\n\\s*id = )[^\\n]*`);
-    if (!re.test(toml)) {
+    const kv = arrayTableKv(toml, env, 'kv_namespaces', binding, 'id');
+    if (!kv)
         throw new Error(`kv_namespaces binding "${binding}" not found under [env.${env}]`);
-    }
-    return toml.replace(re, `$1"${id}" # ${title}`);
+    return splice(toml, kv.value.range[0], endOfLine(toml, kv.value.range[1]), `${JSON.stringify(id)} # ${title}`);
 }
 /**
- * Append a copy of the whole `[env.<from>]` … block-group (every `[env.<from>...]`
- * table up to the next non-`from` env or EOF) rewritten for `<to>`. Returns the new
- * toml. Throws if `<from>` is absent or `<to>` already exists (blank/fill instead).
+ * Append a copy of every `[env.<from>...]` table rewritten for `<to>` (headers
+ * only — values copied verbatim). Throws if `<from>` is absent or `<to>` exists.
  */
 export function cloneEnvBlock(toml, from, to) {
     if (!hasEnvBlock(toml, from))
         throw new Error(`source [env.${from}] not found`);
     if (hasEnvBlock(toml, to))
         throw new Error(`target [env.${to}] already exists — blank/fill it instead`);
-    const lines = toml.split('\n');
-    const isFromHeader = (l) => new RegExp(`^\\[+env\\.${escapeRe(from)}(\\.|\\])`).test(l);
-    const isAnyEnvHeader = (l) => /^\[+env\.[A-Za-z0-9_-]+(\.|\])/.test(l);
-    const out = [];
-    let capturing = false;
-    for (const line of lines) {
-        if (isFromHeader(line)) {
-            capturing = true;
-            out.push(line);
-        }
-        else if (capturing && isAnyEnvHeader(line) && !isFromHeader(line)) {
-            capturing = false; // a different env began — stop
-        }
-        else if (capturing) {
-            out.push(line);
-        }
-    }
-    const cloned = out
-        .map((l) => l.replace(new RegExp(`(\\[+env\\.)${escapeRe(from)}(\\.|\\])`, 'g'), `$1${to}$2`))
-        .join('\n');
-    return `${toml.replace(/\s*$/, '')}\n\n${cloned}\n`;
+    const cloned = tables(toml)
+        .filter((t) => t.resolvedKey[0] === 'env' && t.resolvedKey[1] === from)
+        .map((t) => {
+        const seg = t.key.keys[1].range; // the `<from>` segment of this table's header
+        const text = toml.slice(t.range[0], t.range[1]);
+        return text.slice(0, seg[0] - t.range[0]) + to + text.slice(seg[1] - t.range[0]);
+    });
+    return `${toml.replace(/\s*$/, '')}\n\n${cloned.join('\n\n')}\n`;
 }
-/** Blank every `NAME = "..."` under `[env.<env>.vars]` whose key is in `keys` (env-specific values to re-fill). */
+/** Blank the named `[env.<env>.vars]` values to `""` (preserving comments), skipping absent keys. */
 export function blankEnvVars(toml, env, keys) {
-    let out = toml;
-    for (const key of keys) {
-        const re = new RegExp(`(\\[env\\.${escapeRe(env)}\\.vars\\][\\s\\S]*?\\n${escapeRe(key)} = )"[^"]*"`);
-        if (re.test(out))
-            out = out.replace(re, '$1""');
-    }
-    return out;
+    const table = tables(toml).find((t) => sameKey(t.resolvedKey, ['env', env, 'vars']));
+    if (!table)
+        return toml;
+    const edits = keys
+        .map((key) => kvIn(toml, table, key))
+        .flatMap((kv) => (kv ? [{ start: kv.value.range[0], end: kv.value.range[1] }] : []));
+    return applyBlanks(toml, edits);
 }
-/** Blank every `id = ...` line under the env's `[[env.<env>.kv_namespaces]]` tables (per-env resource ids). */
+/** Blank every kv_namespaces `id` under the env to `""` (drops trailing comment; binding/name survive). */
 export function blankKvIds(toml, env) {
-    const re = new RegExp(`(\\[\\[env\\.${escapeRe(env)}\\.kv_namespaces\\]\\]\\s*\\n\\s*binding = "[^"]*"\\s*\\n\\s*id = )[^\\n]*`, 'g');
-    return toml.replace(re, '$1""');
+    return blankArrayField(toml, env, 'kv_namespaces', 'id');
+}
+/** The database_id written for `[[env.<env>.d1_databases]]` binding, or null if absent/empty. */
+export function getD1Id(toml, env, binding) {
+    const block = envRecord(toml, env);
+    const rows = isRecord(block) && Array.isArray(block.d1_databases) ? block.d1_databases : [];
+    for (const row of rows) {
+        if (isRecord(row) && row.binding === binding && typeof row.database_id === 'string')
+            return row.database_id || null;
+    }
+    return null;
+}
+/** The `database_name` for `[[env.<env>.d1_databases]]` binding, or null. Source of truth for which DB to create/reuse. */
+export function getD1Name(toml, env, binding) {
+    const block = envRecord(toml, env);
+    const rows = isRecord(block) && Array.isArray(block.d1_databases) ? block.d1_databases : [];
+    for (const row of rows) {
+        if (isRecord(row) && row.binding === binding && typeof row.database_name === 'string')
+            return row.database_name || null;
+    }
+    return null;
+}
+/** Rewrite the `database_id = ...` line (value + trailing comment) of the d1 table whose binding matches; the name line is untouched. Throws if absent. */
+export function setD1Id(toml, env, binding, id, name) {
+    const kv = arrayTableKv(toml, env, 'd1_databases', binding, 'database_id');
+    if (!kv)
+        throw new Error(`d1_databases binding "${binding}" not found under [env.${env}]`);
+    return splice(toml, kv.value.range[0], endOfLine(toml, kv.value.range[1]), `${JSON.stringify(id)} # ${name}`);
+}
+/** Blank every d1 `database_id` under the env to `""` (drops trailing comment; binding/name survive). */
+export function blankD1Ids(toml, env) {
+    return blankArrayField(toml, env, 'd1_databases', 'database_id');
+}
+/** Blank one field across every `[[env.<env>.<arrayKey>]]` table (value..EOL -> `""`). */
+function blankArrayField(toml, env, arrayKey, field) {
+    const edits = tables(toml)
+        .filter((t) => t.kind === 'array' && t.resolvedKey[0] === 'env' && t.resolvedKey[1] === env && t.resolvedKey[2] === arrayKey)
+        .map((t) => kvIn(toml, t, field))
+        .flatMap((kv) => (kv ? [{ start: kv.value.range[0], end: endOfLine(toml, kv.value.range[1]) }] : []));
+    return applyBlanks(toml, edits);
+}
+/** Apply `""` at each range, descending so earlier offsets stay valid. */
+function applyBlanks(toml, edits) {
+    let out = toml;
+    for (const e of [...edits].sort((a, b) => b.start - a.start))
+        out = splice(out, e.start, e.end, '""');
+    return out;
 }
 /** Parse-guard: throws if `toml` no longer parses, so a bad edit can't be written to disk. */
 export function assertToml(toml) {
-    parse(toml);
+    parseTOML(toml);
 }
 /** Persist a toml string after confirming it still parses. */
 export function saveToml(path, toml) {
     assertToml(toml);
     writeFileSync(path, toml);
 }
-function envRecord(toml, env) {
-    const parsed = parse(toml);
-    const envs = isRecord(parsed) && isRecord(parsed.env) ? parsed.env : {};
-    const block = envs[env];
-    return isRecord(block) ? block : null;
-}
 /** Secret NAMES from a `.dev.vars.example` file (KEY=... / KEY="..."), ignoring comments/blanks. */
 export function parseDevVarsExample(text) {
     const names = [];
@@ -158,9 +226,11 @@ export function readManifest(root, env) {
     const vars = Object.keys(varsRec);
     const kvRows = isRecord(block) && Array.isArray(block.kv_namespaces) ? block.kv_namespaces : [];
     const kvBindings = kvRows.flatMap((row) => (isRecord(row) && typeof row.binding === 'string' ? [row.binding] : []));
+    const d1Rows = isRecord(block) && Array.isArray(block.d1_databases) ? block.d1_databases : [];
+    const d1Bindings = d1Rows.flatMap((row) => (isRecord(row) && typeof row.binding === 'string' ? [row.binding] : []));
     const examplePath = join(root, '.dev.vars.example');
     const secrets = existsSync(examplePath) ? parseDevVarsExample(readFileSync(examplePath, 'utf8')) : [];
-    return { kvBindings, vars, secrets };
+    return { kvBindings, d1Bindings, vars, secrets };
 }
 // ── PEM (a standard, reusable) ───────────────────────────────────────────────
 /** True if `value` looks like a PEM block (any `-----BEGIN ...-----`). */
@@ -232,6 +302,46 @@ export async function ensureNamespace(logical, existing, cwd) {
 async function reList(logical, cwd) {
     return (await listNamespaces(cwd)).find((n) => n.title === logical)?.id ?? null;
 }
+function asD1Databases(json) {
+    if (!Array.isArray(json))
+        return [];
+    const out = [];
+    for (const row of json) {
+        if (isRecord(row) && typeof row.uuid === 'string' && typeof row.name === 'string') {
+            out.push({ uuid: row.uuid, name: row.name });
+        }
+    }
+    return out;
+}
+/** Live D1 databases on the account (`d1 list --json`); `[]` when offline/unauthenticated. */
+export async function listD1Databases(cwd) {
+    try {
+        return asD1Databases(await $ `bunx wrangler d1 list --json`.cwd(cwd).quiet().json());
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * Reuse the D1 database whose name matches, else create it. The uuid comes from
+ * the structured `list` JSON (create prints freeform text), so we re-list rather
+ * than scrape. Returns the uuid, or null on failure.
+ */
+export async function ensureD1Database(name, existing, cwd) {
+    const match = existing.find((d) => d.name === name);
+    if (match)
+        return match.uuid;
+    try {
+        await $ `bunx wrangler d1 create ${name}`.cwd(cwd).quiet();
+    }
+    catch (err) {
+        return errText(err).includes('already') ? reListD1(name, cwd) : null;
+    }
+    return reListD1(name, cwd);
+}
+async function reListD1(name, cwd) {
+    return (await listD1Databases(cwd)).find((d) => d.name === name)?.uuid ?? null;
+}
 /** Current secret names on the worker for `env`; `[]` when none/unreachable (Cloudflare allows setting pre-deploy). */
 export async function listSecretNames(env, cwd) {
     try {

package/managed/raw/tooling/git-hooks/pre-commit.sh

@@ -9,6 +9,12 @@ set -e -o pipefail
 # Format exactly what is staged so the commit includes the formatter output.
 git-format-staged
 
+# Any `bun install` rewrites bun.lock workspace versions from package.json,
+# reverting the stable-tag versions the release flow syncs (see
+# packages/cli/src/monorepo/lockfile.ts). Self-heal here instead of failing a
+# later commit on drift it didn't cause.
+smoo monorepo sync-bun-lockfile-versions --stage
+
 # Adding a workspace package is rare and easy to leave half-wired. Run the
 # full monorepo validator only for newly staged package manifests.
 smoo monorepo validate --fail-fast --only-if-new-workspace-package

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@smoothbricks/cli",
-  "version": "0.9.0",
+  "version": "0.10.1",
   "type": "module",
   "description": "SmoothBricks monorepo automation CLI",
   "bin": {
@@ -52,13 +52,13 @@
   ],
   "dependencies": {
     "@arethetypeswrong/core": "^0.18.2",
-    "@smoothbricks/nx-plugin": "0.2.5",
+    "@smoothbricks/nx-plugin": "0.3.0",
     "@smoothbricks/validation": "0.1.1",
     "commander": "^14.0.3",
     "publint": "^0.3.18",
     "semver": "^7.7.4",
     "sherif": "^1.11.1",
-    "smol-toml": "^1.6.1",
+    "toml-eslint-parser": "^1.0.3",
     "tslib": "^2.8.1"
   },
   "devDependencies": {

package/src/cli.ts

@@ -76,10 +76,13 @@ function buildProgram(): Command {
       const { validateCommitMessageFile } = await import('./monorepo/index.js');
       validateCommitMessageFile(commitMsgFile, options, await findRepoRoot());
     });
-  monorepo.command('sync-bun-lockfile-versions').action(async () => {
-    const { syncBunLockfileVersions } = await import('./monorepo/index.js');
-    syncBunLockfileVersions(await findRepoRoot());
-  });
+  monorepo
+    .command('sync-bun-lockfile-versions')
+    .option('--stage', 'stage bun.lock when versions were resynced (pre-commit self-heal); quiet when clean')
+    .action(async (options: { stage?: boolean }) => {
+      const { syncBunLockfileVersions } = await import('./monorepo/index.js');
+      syncBunLockfileVersions(await findRepoRoot(), options.stage ? { log: false, stage: true } : {});
+    });
   monorepo
     .command('list-release-packages')
     .option('--fail-empty', 'fail when no owned release packages are found')