@smoothbricks/cli 0.9.0 → 0.10.1

package/src/monorepo/lockfile.test.ts

@@ -0,0 +1,157 @@
+import { afterAll, describe, expect, it } from 'bun:test';
+import { execSync } from 'node:child_process';
+import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import fc from 'fast-check';
+import { syncBunLockfileVersions, validateBunLockfileVersions } from './lockfile.js';
+
+const cleanupRoots: string[] = [];
+afterAll(() => {
+  for (const root of cleanupRoots) {
+    rmSync(root, { recursive: true, force: true });
+  }
+});
+
+function git(root: string, args: string): string {
+  return execSync(`git ${args}`, {
+    cwd: root,
+    encoding: 'utf8',
+    env: {
+      ...process.env,
+      GIT_CONFIG_GLOBAL: '/dev/null',
+      GIT_CONFIG_SYSTEM: '/dev/null',
+      GIT_AUTHOR_NAME: 'fixture',
+      GIT_AUTHOR_EMAIL: 'fixture@invalid',
+      GIT_COMMITTER_NAME: 'fixture',
+      GIT_COMMITTER_EMAIL: 'fixture@invalid',
+    },
+    stdio: ['pipe', 'pipe', 'pipe'],
+  });
+}
+
+interface FixtureOptions {
+  packageVersion: string;
+  lockVersion: string;
+  stableTag?: string;
+}
+
+function makeFixtureRepo(options: FixtureOptions): string {
+  const root = mkdtempSync(join(tmpdir(), 'smoo-lockfile-'));
+  cleanupRoots.push(root);
+  git(root, 'init -q');
+  git(root, 'commit -q --allow-empty -m init');
+  writeFileSync(
+    join(root, 'package.json'),
+    JSON.stringify({ name: 'fixture-root', version: '0.0.0', private: true, workspaces: ['packages/*'] }),
+  );
+  mkdirSync(join(root, 'packages', 'foo'), { recursive: true });
+  writeFixturePackage(root, options.packageVersion);
+  writeFixtureLock(root, options.lockVersion);
+  if (options.stableTag) {
+    git(root, `tag ${options.stableTag}`);
+  }
+  return root;
+}
+
+function writeFixturePackage(root: string, version: string): void {
+  writeFileSync(
+    join(root, 'packages', 'foo', 'package.json'),
+    JSON.stringify({ name: '@fixture/foo', version, nx: { name: 'foo' } }),
+  );
+}
+
+function writeFixtureLock(root: string, version: string): void {
+  writeFileSync(
+    join(root, 'bun.lock'),
+    [
+      '{',
+      '  "lockfileVersion": 1,',
+      '  "workspaces": {',
+      '    "": { "name": "fixture-root" },',
+      '    "packages/foo": {',
+      '      "name": "@fixture/foo",',
+      `      "version": "${version}",`,
+      '    },',
+      '  },',
+      '}',
+      '',
+    ].join('\n'),
+  );
+}
+
+function lockVersionIn(root: string): string {
+  const match = readFileSync(join(root, 'bun.lock'), 'utf8').match(/"packages\/foo":\s*\{[^}]*"version":\s*"([^"]+)"/);
+  if (!match) throw new Error('fixture lockfile lost its workspace entry');
+  return match[1] as string;
+}
+
+describe('bun.lock workspace version sync', () => {
+  it('a bun-install revert of the release-synced version fails validation', () => {
+    // The b3298fc4c shape: package.json holds the next prerelease, a stable tag
+    // exists, and `bun install` rewrote the lockfile back to the prerelease.
+    const root = makeFixtureRepo({
+      packageVersion: '0.1.3-next.0',
+      lockVersion: '0.1.3-next.0',
+      stableTag: 'foo@0.1.2',
+    });
+    expect(validateBunLockfileVersions(root)).toBe(1);
+  });
+
+  it('sync restores the latest stable tag version and validation passes', () => {
+    const root = makeFixtureRepo({
+      packageVersion: '0.1.3-next.0',
+      lockVersion: '0.1.3-next.0',
+      stableTag: 'foo@0.1.2',
+    });
+    expect(syncBunLockfileVersions(root, { log: false })).toBe(1);
+    expect(lockVersionIn(root)).toBe('0.1.2');
+    expect(validateBunLockfileVersions(root)).toBe(0);
+  });
+
+  it('a never-published prerelease package falls back to its manifest version', () => {
+    // The new-workspace-package shape (e.g. cowshed): no stable tag exists yet.
+    const root = makeFixtureRepo({ packageVersion: '0.2.0-next.0', lockVersion: '0.2.0-next.0' });
+    expect(validateBunLockfileVersions(root)).toBe(0);
+    expect(syncBunLockfileVersions(root, { log: false })).toBe(0);
+  });
+
+  it('a stable manifest version is required verbatim in the lockfile', () => {
+    const root = makeFixtureRepo({ packageVersion: '0.1.0', lockVersion: '0.0.9' });
+    expect(validateBunLockfileVersions(root)).toBe(1);
+    expect(syncBunLockfileVersions(root, { log: false })).toBe(1);
+    expect(lockVersionIn(root)).toBe('0.1.0');
+  });
+
+  it('stage: true stages the healed bun.lock', () => {
+    const root = makeFixtureRepo({
+      packageVersion: '0.1.3-next.0',
+      lockVersion: '0.1.3-next.0',
+      stableTag: 'foo@0.1.2',
+    });
+    expect(syncBunLockfileVersions(root, { log: false, stage: true })).toBe(1);
+    expect(git(root, 'diff --cached --name-only')).toContain('bun.lock');
+  });
+
+  it('stage: true leaves a clean lockfile unstaged', () => {
+    const root = makeFixtureRepo({ packageVersion: '0.1.2', lockVersion: '0.1.2', stableTag: 'foo@0.1.2' });
+    expect(syncBunLockfileVersions(root, { log: false, stage: true })).toBe(0);
+    expect(git(root, 'diff --cached --name-only').trim()).toBe('');
+  });
+
+  it('property: after sync, validation always passes', () => {
+    const version = fc
+      .tuple(fc.nat({ max: 20 }), fc.nat({ max: 20 }), fc.nat({ max: 20 }), fc.option(fc.nat({ max: 5 })))
+      .map(([major, minor, patch, next]) => `${major}.${minor}.${patch}${next === null ? '' : `-next.${next}`}`);
+    const root = makeFixtureRepo({ packageVersion: '0.1.2', lockVersion: '0.1.2', stableTag: 'foo@0.1.2' });
+    fc.assert(
+      fc.property(version, version, (packageVersion, lockVersion) => {
+        writeFixturePackage(root, packageVersion);
+        writeFixtureLock(root, lockVersion);
+        syncBunLockfileVersions(root, { log: false });
+        return validateBunLockfileVersions(root) === 0;
+      }),
+      { numRuns: 25 },
+    );
+  });
+});

package/src/monorepo/lockfile.ts

@@ -5,6 +5,8 @@ import { escapeRegex, getWorkspacePackages } from '../lib/workspace.js';
 
 export interface SyncBunLockfileVersionsOptions {
   log?: boolean;
+  /** `git add` bun.lock after rewriting it, for the pre-commit self-heal path. */
+  stage?: boolean;
 }
 
 // Temporary Bun workaround. Delete this sync function, validateBunLockfileVersions,
@@ -16,6 +18,12 @@ export interface SyncBunLockfileVersionsOptions {
 // - https://github.com/oven-sh/bun/issues/18906
 // - https://github.com/oven-sh/bun/issues/20477
 // - https://github.com/oven-sh/bun/issues/20829
+//
+// Any `bun install` rewrites the workspace versions from package.json, reverting
+// this sync between releases. The pre-commit hook therefore runs
+// `smoo monorepo sync-bun-lockfile-versions --stage` on every commit so drift is
+// healed at the commit that would otherwise carry it — validation must never
+// fail a committer for drift a routine `bun install` introduced.
 export function syncBunLockfileVersions(root: string, options: SyncBunLockfileVersionsOptions = {}): number {
   const log = options.log ?? true;
   const lockfilePath = join(root, 'bun.lock');
@@ -59,10 +67,15 @@ export function syncBunLockfileVersions(root: string, options: SyncBunLockfileVe
   }
   if (updated > 0) {
     writeFileSync(lockfilePath, lockfile);
+    if (options.stage) {
+      execSync('git add bun.lock', { cwd: root, stdio: ['pipe', 'pipe', 'pipe'] });
+    }
   }
-  if (log) {
+  if (log || updated > 0) {
     console.log(
-      updated > 0 ? `Updated ${updated} workspace version(s) in bun.lock` : 'All workspace versions already in sync.',
+      updated > 0
+        ? `Updated ${updated} workspace version(s) in bun.lock${options.stage ? ' (staged)' : ''}`
+        : 'All workspace versions already in sync.',
     );
   }
   return updated;

package/src/release/__tests__/fixture-repo.test.ts

@@ -226,6 +226,14 @@ describe('release planning with fixture git repositories', () => {
     });
   });
 
+  it('kills timed-out fixture Git process groups so descendants cannot hold output pipes open', async () => {
+    await withFixtureRepo(async (root) => {
+      await expect(
+        git(root, ['-c', "alias.hold-pipes=!sh -c 'sleep 30 & exit 0'", 'hold-pipes'], undefined, 100),
+      ).rejects.toThrow('timed out after 100ms');
+    });
+  }, 5_000);
+
   it('repairs a scoped package from its project-name release tag without creating a package-name tag', async () => {
     await withFixtureRepo(async (author) => {
       await writeWorkspace(author);

package/src/release/__tests__/helpers/fixture-repo.ts

@@ -82,9 +82,14 @@ export async function writeBuildablePackage(
   );
 }
 
-export async function git(root: string, args: string[], env?: Record<string, string>): Promise<void> {
-  const result = await gitResult(root, args, env);
-  if (result.exitCode !== 0) {
+export async function git(
+  root: string,
+  args: string[],
+  env?: Record<string, string>,
+  timeoutMs = GIT_TIMEOUT_MS,
+): Promise<void> {
+  const result = await gitResult(root, args, env, timeoutMs);
+  if (result.timedOut || result.exitCode !== 0) {
     throw new Error(gitErrorMessage(root, args, result));
   }
 }
@@ -101,9 +106,15 @@ export async function gitSucceeds(root: string, args: string[]): Promise<boolean
   return (await gitResult(root, args)).exitCode === 0;
 }
 
-async function gitResult(root: string, args: string[], env?: Record<string, string>): Promise<GitResult> {
+async function gitResult(
+  root: string,
+  args: string[],
+  env?: Record<string, string>,
+  timeoutMs = GIT_TIMEOUT_MS,
+): Promise<GitResult> {
   const proc = Bun.spawn(['git', ...args], {
     cwd: root,
+    detached: true,
     env: { ...process.env, ...GIT_FIXTURE_ENV, ...env },
     stdout: 'pipe',
     stderr: 'pipe',
@@ -111,15 +122,23 @@ async function gitResult(root: string, args: string[], env?: Record<string, stri
   let timedOut = false;
   const timeout = setTimeout(() => {
     timedOut = true;
-    proc.kill();
-  }, GIT_TIMEOUT_MS);
+    try {
+      // `git` may exit after spawning a transport or hook which still owns its
+      // pipes. Killing the detached process group closes every inherited pipe.
+      process.kill(-proc.pid, 'SIGKILL');
+    } catch (error) {
+      if (!(error instanceof Error && 'code' in error && error.code === 'ESRCH')) {
+        proc.kill('SIGKILL');
+      }
+    }
+  }, timeoutMs);
   try {
     const [exitCode, stdout, stderr] = await Promise.all([
       proc.exited,
       streamBytes(proc.stdout),
       streamBytes(proc.stderr),
     ]);
-    return { exitCode, stdout, stderr, timedOut };
+    return { exitCode, stdout, stderr, timedOut, timeoutMs };
   } finally {
     clearTimeout(timeout);
   }
@@ -151,12 +170,13 @@ interface GitResult {
   stdout: Uint8Array;
   stderr: Uint8Array;
   timedOut: boolean;
+  timeoutMs: number;
 }
 
 function gitErrorMessage(root: string, args: string[], result: GitResult): string {
   const stderr = new TextDecoder().decode(result.stderr).trim();
   const timeoutText = result.timedOut
-    ? ` timed out after ${GIT_TIMEOUT_MS}ms`
+    ? ` timed out after ${result.timeoutMs}ms`
     : ` failed with exit code ${result.exitCode}`;
   return [`git ${args.join(' ')}${timeoutText}`, `cwd: ${root}`, stderr].filter(Boolean).join('\n');
 }

package/src/wrangler/prepare-env.test.ts

@@ -4,10 +4,13 @@ import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import {
   assertToml,
+  blankD1Ids,
   blankEnvVars,
   blankKvIds,
   cloneEnvBlock,
   firstWranglerEnv,
+  getD1Id,
+  getD1Name,
   getKvId,
   getVar,
   hasEnvBlock,
@@ -16,6 +19,7 @@ import {
   parseDevVarsExample,
   readManifest,
   readPemFile,
+  setD1Id,
   setKvId,
   setVar,
 } from './prepare-env.js';
@@ -161,6 +165,81 @@ describe('blankEnvVars / blankKvIds', () => {
   });
 });
 
+// D1 shell-outs (listD1Databases / ensureD1Database) invoke `bunx wrangler d1`
+// against a live account and are integration-only — deliberately not exercised.
+
+describe('getD1Id / getD1Name', () => {
+  const toml =
+    '[env.staging]\n\n' +
+    '[[env.staging.d1_databases]]\nbinding = "DB"\ndatabase_id = "abc123"\ndatabase_name = "app-staging-db"\n\n' +
+    '[env.production]\n\n' +
+    '[[env.production.d1_databases]]\nbinding = "DB"\ndatabase_id = ""\ndatabase_name = "app-db"\n';
+
+  it('reads the id for a matching binding and null for empty id, absent binding, and absent env', () => {
+    expect(getD1Id(toml, 'staging', 'DB')).toBe('abc123');
+    expect(getD1Id(toml, 'production', 'DB')).toBeNull(); // production id is ""
+    expect(getD1Id(toml, 'staging', 'MISSING')).toBeNull(); // absent binding
+    expect(getD1Id(toml, 'qa', 'DB')).toBeNull(); // absent env
+  });
+
+  it('reads the database_name for a matching binding and null when the binding or env is absent', () => {
+    expect(getD1Name(toml, 'staging', 'DB')).toBe('app-staging-db');
+    expect(getD1Name(toml, 'production', 'DB')).toBe('app-db'); // present even though its id is blank
+    expect(getD1Name(toml, 'staging', 'MISSING')).toBeNull();
+    expect(getD1Name(toml, 'qa', 'DB')).toBeNull();
+  });
+});
+
+describe('setD1Id', () => {
+  const toml =
+    '[[env.staging.d1_databases]]\nbinding = "DB"\ndatabase_id = ""\ndatabase_name = "app-staging-db"\n\n' +
+    '[[env.staging.d1_databases]]\nbinding = "ANALYTICS"\ndatabase_id = ""\ndatabase_name = "app-staging-analytics"\n\n' +
+    '[[env.production.d1_databases]]\nbinding = "DB"\ndatabase_id = "prod-existing"\ndatabase_name = "app-db"\n';
+
+  it('writes "<id>" # <name> against the matching env+binding, leaving siblings and other envs intact', () => {
+    const out = setD1Id(toml, 'staging', 'DB', 'new-staging-id', 'app-staging-db');
+    expect(out).toContain('"new-staging-id" # app-staging-db');
+    expect(getD1Id(out, 'staging', 'DB')).toBe('new-staging-id'); // round-trip
+    expect(getD1Id(out, 'staging', 'ANALYTICS')).toBeNull(); // sibling binding untouched
+    expect(getD1Id(out, 'production', 'DB')).toBe('prod-existing'); // other env untouched
+  });
+
+  it('tolerates database_name preceding database_id and preserves the name', () => {
+    const nameFirst =
+      '[[env.staging.d1_databases]]\nbinding = "DB"\ndatabase_name = "app-staging-db"\ndatabase_id = "old"\n';
+    const out = setD1Id(nameFirst, 'staging', 'DB', 'fresh', 'app-staging-db');
+    expect(getD1Id(out, 'staging', 'DB')).toBe('fresh');
+    expect(getD1Name(out, 'staging', 'DB')).toBe('app-staging-db'); // name line not clobbered
+    expect(() => assertToml(out)).not.toThrow();
+  });
+
+  it('throws when the binding or the env is absent', () => {
+    expect(() => setD1Id(toml, 'staging', 'MISSING', 'x', 'n')).toThrow();
+    expect(() => setD1Id(toml, 'qa', 'DB', 'x', 'n')).toThrow();
+  });
+});
+
+describe('blankD1Ids', () => {
+  const toml =
+    '[[env.staging.d1_databases]]\nbinding = "DB"\ndatabase_id = "staging-db-id"\ndatabase_name = "app-staging-db"\n\n' +
+    '[[env.staging.d1_databases]]\nbinding = "ANALYTICS"\ndatabase_id = "staging-an-id"\ndatabase_name = "app-staging-analytics"\n\n' +
+    '[[env.production.d1_databases]]\nbinding = "DB"\ndatabase_id = "prod-db-id"\ndatabase_name = "app-db"\n';
+
+  it('blanks every d1 id under the env while names, bindings, and the other env survive', () => {
+    const out = blankD1Ids(toml, 'staging');
+    expect(getD1Id(out, 'staging', 'DB')).toBeNull();
+    expect(getD1Id(out, 'staging', 'ANALYTICS')).toBeNull();
+    // names survive the blanking
+    expect(getD1Name(out, 'staging', 'DB')).toBe('app-staging-db');
+    expect(getD1Name(out, 'staging', 'ANALYTICS')).toBe('app-staging-analytics');
+    // other env's id is untouched
+    expect(getD1Id(out, 'production', 'DB')).toBe('prod-db-id');
+    // bindings survived: setD1Id still resolves them and re-fills an id
+    const refilled = setD1Id(out, 'staging', 'DB', 're-provisioned', 'app-staging-db');
+    expect(getD1Id(refilled, 'staging', 'DB')).toBe('re-provisioned');
+  });
+});
+
 describe('assertToml', () => {
   it('returns for valid toml', () => {
     expect(() => assertToml('name = "svc"\n[env.production]\n')).not.toThrow();
@@ -192,6 +271,7 @@ describe('readManifest', () => {
       await writeFile(join(root, '.dev.vars.example'), '# secrets\nAPI_KEY=\nJWT_SECRET=""\n');
       expect(readManifest(root, 'staging')).toEqual({
         kvBindings: ['CACHE', 'SESSIONS'],
+        d1Bindings: [],
         vars: ['PUBLIC_URL', 'FEATURE_FLAG'],
         secrets: ['API_KEY', 'JWT_SECRET'],
       });
@@ -212,6 +292,27 @@ describe('readManifest', () => {
       await rm(root, { recursive: true, force: true });
     }
   });
+
+  it('reports d1 bindings alongside kv bindings and vars without dropping the existing fields', async () => {
+    const withD1 =
+      'name = "svc"\n\n' +
+      '[env.staging.vars]\nPUBLIC_URL = "https://staging"\n\n' +
+      '[[env.staging.kv_namespaces]]\nbinding = "CACHE"\nid = "abc"\n\n' +
+      '[[env.staging.d1_databases]]\nbinding = "DB"\ndatabase_id = "id-1"\ndatabase_name = "app-staging-db"\n\n' +
+      '[[env.staging.d1_databases]]\nbinding = "ANALYTICS"\ndatabase_id = ""\ndatabase_name = "app-analytics-db"\n';
+    const root = await mkdtemp(join(tmpdir(), 'smoo-prepare-env-'));
+    try {
+      await writeFile(join(root, 'wrangler.toml'), withD1);
+      expect(readManifest(root, 'staging')).toEqual({
+        kvBindings: ['CACHE'],
+        d1Bindings: ['DB', 'ANALYTICS'],
+        vars: ['PUBLIC_URL'],
+        secrets: [],
+      });
+    } finally {
+      await rm(root, { recursive: true, force: true });
+    }
+  });
 });
 
 describe('isPem / readPemFile / looksLikeFileSecret', () => {