@breadstone-infrastructure/nx-tasks 0.0.256 → 0.0.258

package/src/executors/secrets-vercel-sync/executor.ts

@@ -0,0 +1,44 @@
+// #region Imports
+
+import type { ExecutorContext } from '@nx/devkit';
+import { getProjectRoot } from '../../utils/getProjectRoot';
+import type { SecretsVercelSyncExecutorOptions } from './executor.options';
+
+// #endregion
+
+/**
+ * Nx executor that synchronizes secrets from a configurable provider to Vercel.
+ *
+ * @public
+ */
+export default async function runExecutor(options: SecretsVercelSyncExecutorOptions, context: ExecutorContext): Promise<{ success: boolean }> {
+    try {
+        const task = (await import('./executor.task')).SecretsVercelSyncTask;
+
+        await task.run({
+            cwd: getProjectRoot(context),
+            provider: options.provider,
+            secretsProject: options.secretsProject,
+            secretsConfig: options.secretsConfig,
+            vaultUrl: options.vaultUrl,
+            apiKey: options.apiKey,
+            vercelTeam: options.vercelTeam,
+            vercelProject: options.vercelProject,
+            vercelEnvironment: options.vercelEnvironment,
+            vercelVariableType: options.vercelVariableType,
+            conflictStrategy: options.conflictStrategy,
+            dryRun: options.dryRun,
+            deleteMissing: options.deleteMissing,
+            includeKeys: options.includeKeys,
+            excludeKeys: options.excludeKeys,
+            redeploy: options.redeploy,
+            interactive: options.interactive
+        });
+
+        return { success: true };
+    } catch (error) {
+        console.error(error);
+
+        return { success: false };
+    }
+}

package/src/executors/secrets-vercel-sync/providers/azure-keyvault.provider.ts

@@ -0,0 +1,173 @@
+// #region Imports
+
+import type { ILogger } from '@breadstone-infrastructure/utilities';
+import { prompt } from 'enquirer';
+import type { ISecretsProvider } from './secrets-provider.interface';
+
+// #endregion
+
+// #region Interfaces
+
+interface IAzureKeyVaultSecretItem {
+    id: string;
+    attributes: {
+        enabled: boolean;
+        created: number;
+        updated: number;
+    };
+}
+
+interface IAzureKeyVaultSecretListResponse {
+    value: Array<IAzureKeyVaultSecretItem>;
+    nextLink?: string;
+}
+
+interface IAzureKeyVaultSecretValueResponse {
+    value: string;
+    id: string;
+    attributes: {
+        enabled: boolean;
+    };
+}
+
+// #endregion
+
+/**
+ * Secrets provider implementation for Azure Key Vault.
+ *
+ * Uses the Key Vault REST API with a Bearer token (e.g. from `az account get-access-token`
+ * or a service principal client credential flow). The token must be provided via `apiKey`
+ * or entered interactively.
+ *
+ * @public
+ */
+export class AzureKeyVaultSecretsProvider implements ISecretsProvider {
+
+    // #region Methods
+
+    /**
+     * @inheritdoc
+     */
+    public async authenticate(apiKey?: string, interactive?: boolean): Promise<string> {
+        if (apiKey) {
+            return apiKey;
+        }
+
+        const envToken = process.env['AZURE_KEYVAULT_TOKEN'];
+        if (envToken) {
+            return envToken;
+        }
+
+        if (interactive) {
+            const credentials = await prompt<{ token: string }>([
+                {
+                    type: 'input',
+                    name: 'token',
+                    message: 'Enter your Azure Key Vault access token:\nYou can obtain one via `az account get-access-token --resource https://vault.azure.net --query accessToken -o tsv`.'
+                }
+            ]);
+
+            if (!credentials.token) {
+                throw new Error('No Azure Key Vault access token provided. Aborting.');
+            }
+
+            return credentials.token;
+        }
+
+        throw new Error('AZURE_KEYVAULT_TOKEN environment variable is not set. Set it to an Azure Key Vault access token, or enable interactive mode.');
+    }
+
+    /**
+     * Fetches all secrets from an Azure Key Vault.
+     *
+     * The `project` and `config` parameters are ignored. The vault is identified
+     * solely by `vaultUrl`.
+     *
+     * @inheritdoc
+     */
+    public async fetchSecrets(token: string, _project: string, _config: string, logger: ILogger, vaultUrl?: string): Promise<Record<string, string>> {
+        if (!vaultUrl) {
+            throw new Error('vaultUrl is required for the azure-keyvault provider.');
+        }
+
+        const normalizedVaultUrl = vaultUrl.endsWith('/') ? vaultUrl.slice(0, -1) : vaultUrl;
+        const secrets: Record<string, string> = {};
+
+        // Step 1: List all secrets (paged)
+        const secretItems = await this.listSecrets(token, normalizedVaultUrl);
+        logger.log(`  Found ${secretItems.length} secrets in Key Vault.`);
+
+        // Step 2: Fetch each secret value
+        for (const item of secretItems) {
+            const secretName = this.extractSecretName(item.id);
+            const value = await this.getSecretValue(token, normalizedVaultUrl, secretName);
+            secrets[secretName] = value;
+        }
+
+        logger.log(`  Fetched ${Object.keys(secrets).length} secrets from Azure Key Vault [${normalizedVaultUrl}].`);
+
+        return secrets;
+    }
+
+    // #endregion
+
+    // #region Private Methods
+
+    /**
+     * Lists all secrets in the vault (handles pagination).
+     */
+    private async listSecrets(token: string, vaultUrl: string): Promise<Array<IAzureKeyVaultSecretItem>> {
+        const allItems: Array<IAzureKeyVaultSecretItem> = [];
+        let nextLink: string | undefined = `${vaultUrl}/secrets?api-version=7.4`;
+
+        while (nextLink) {
+            const response = await fetch(nextLink, {
+                headers: { Authorization: `Bearer ${token}` }
+            });
+
+            if (!response.ok) {
+                throw new Error(`Failed to list Azure Key Vault secrets (HTTP ${response.status}): ${response.statusText}`);
+            }
+
+            const data = await response.json() as IAzureKeyVaultSecretListResponse;
+            const enabledItems = data.value.filter(item => item.attributes.enabled);
+            allItems.push(...enabledItems);
+            nextLink = data.nextLink;
+        }
+
+        return allItems;
+    }
+
+    /**
+     * Fetches the current value of a single secret.
+     */
+    private async getSecretValue(token: string, vaultUrl: string, secretName: string): Promise<string> {
+        const url = `${vaultUrl}/secrets/${encodeURIComponent(secretName)}?api-version=7.4`;
+
+        const response = await fetch(url, {
+            headers: { Authorization: `Bearer ${token}` }
+        });
+
+        if (!response.ok) {
+            throw new Error(`Failed to fetch Azure Key Vault secret "${secretName}" (HTTP ${response.status}): ${response.statusText}`);
+        }
+
+        const data = await response.json() as IAzureKeyVaultSecretValueResponse;
+
+        return data.value;
+    }
+
+    /**
+     * Extracts the secret name from a Key Vault secret ID URL.
+     *
+     * @example
+     * `https://my-vault.vault.azure.net/secrets/MY_SECRET` → `MY_SECRET`
+     */
+    private extractSecretName(secretId: string): string {
+        const parts = secretId.split('/');
+
+        return parts[parts.length - 1];
+    }
+
+    // #endregion
+}

package/src/executors/secrets-vercel-sync/providers/doppler.provider.ts

@@ -0,0 +1,93 @@
+// #region Imports
+
+import type { ILogger } from '@breadstone-infrastructure/utilities';
+import { prompt } from 'enquirer';
+import type { ISecretsProvider } from './secrets-provider.interface';
+
+// #endregion
+
+// #region Interfaces
+
+interface IDopplerSecretsResponse {
+    success: boolean;
+    secrets: Record<string, {
+        raw: string;
+        computed: string;
+        note: string;
+    }>;
+}
+
+// #endregion
+
+/**
+ * Secrets provider implementation for Doppler.
+ *
+ * @public
+ */
+export class DopplerSecretsProvider implements ISecretsProvider {
+
+    // #region Methods
+
+    /**
+     * @inheritdoc
+     */
+    public async authenticate(apiKey?: string, interactive?: boolean): Promise<string> {
+        if (apiKey) {
+            return apiKey;
+        }
+
+        const envToken = process.env['DOPPLER_TOKEN'];
+        if (envToken) {
+            return envToken;
+        }
+
+        if (interactive) {
+            const credentials = await prompt<{ token: string }>([
+                {
+                    type: 'input',
+                    name: 'token',
+                    message: 'Enter your Doppler API token:\nYou can find it in your Doppler account under Service Tokens or Personal Tokens.'
+                }
+            ]);
+
+            if (!credentials.token) {
+                throw new Error('No Doppler API token provided. Aborting.');
+            }
+
+            return credentials.token;
+        }
+
+        throw new Error('DOPPLER_TOKEN environment variable is not set. Set it to a Doppler Service Token or Personal Token, or enable interactive mode.');
+    }
+
+    /**
+     * @inheritdoc
+     */
+    public async fetchSecrets(token: string, project: string, config: string, logger: ILogger): Promise<Record<string, string>> {
+        const apiUrl = `https://api.doppler.com/v3/configs/config/secrets?project=${encodeURIComponent(project)}&config=${encodeURIComponent(config)}&include_dynamic_secrets=false&include_managed_secrets=true`;
+
+        const response = await fetch(apiUrl, {
+            headers: { Authorization: `Bearer ${token}` }
+        });
+
+        if (!response.ok) {
+            throw new Error(`Failed to fetch Doppler secrets (HTTP ${response.status}): ${response.statusText}`);
+        }
+
+        const data = await response.json() as IDopplerSecretsResponse;
+
+        if (!data.success) {
+            throw new Error('Doppler API returned success=false.');
+        }
+
+        const secrets = Object.fromEntries(
+            Object.entries(data.secrets).map(([key, value]) => [key, value.computed])
+        );
+
+        logger.log(`  Fetched ${Object.keys(secrets).length} secrets from Doppler [${project}/${config}].`);
+
+        return secrets;
+    }
+
+    // #endregion
+}

package/src/executors/secrets-vercel-sync/providers/secrets-provider.factory.ts

@@ -0,0 +1,33 @@
+// #region Imports
+
+import { AzureKeyVaultSecretsProvider } from './azure-keyvault.provider';
+import { DopplerSecretsProvider } from './doppler.provider';
+import type { ISecretsProvider } from './secrets-provider.interface';
+
+// #endregion
+
+/**
+ * The supported secrets provider types.
+ *
+ * @public
+ */
+export type SecretsProviderType = 'doppler' | 'azure-keyvault';
+
+/**
+ * Creates an {@link ISecretsProvider} instance for the given provider type.
+ *
+ * @param type - The provider type to instantiate.
+ * @returns The corresponding secrets provider.
+ *
+ * @public
+ */
+export function createSecretsProvider(type: SecretsProviderType): ISecretsProvider {
+    switch (type) {
+        case 'doppler':
+            return new DopplerSecretsProvider();
+        case 'azure-keyvault':
+            return new AzureKeyVaultSecretsProvider();
+        default:
+            throw new Error(`Unknown secrets provider type: "${type}". Supported: doppler, azure-keyvault.`);
+    }
+}

package/src/executors/secrets-vercel-sync/providers/secrets-provider.interface.ts

@@ -0,0 +1,34 @@
+// #region Imports
+
+import type { ILogger } from '@breadstone-infrastructure/utilities';
+
+// #endregion
+
+/**
+ * Abstraction for a secrets provider that can authenticate and fetch secrets.
+ *
+ * @public
+ */
+export interface ISecretsProvider {
+
+    /**
+     * Authenticates with the provider and returns an access token.
+     *
+     * @param apiKey - An optional API key or access token. If provided, it is used directly.
+     * @param interactive - Whether to prompt the user for credentials if none are provided.
+     * @returns The resolved access token.
+     */
+    authenticate(apiKey?: string, interactive?: boolean): Promise<string>;
+
+    /**
+     * Fetches all secrets from the provider.
+     *
+     * @param token - The access token obtained from {@link authenticate}.
+     * @param project - The project identifier (Doppler project name, or ignored for Azure Key Vault).
+     * @param config - The config identifier (Doppler config name, or ignored for Azure Key Vault).
+     * @param logger - Logger instance for status output.
+     * @param vaultUrl - The Azure Key Vault URL (only used by the azure-keyvault provider).
+     * @returns A flat record of secret key-value pairs.
+     */
+    fetchSecrets(token: string, project: string, config: string, logger: ILogger, vaultUrl?: string): Promise<Record<string, string>>;
+}

package/src/executors/secrets-vercel-sync/schema.json

@@ -0,0 +1,112 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema",
+  "cli": "nx",
+  "title": "Secrets Vercel Sync",
+  "description": "Synchronizes secrets from a configurable provider (Doppler, Azure Key Vault) to a Vercel project/environment.",
+  "type": "object",
+  "properties": {
+    "provider": {
+      "type": "string",
+      "description": "The secrets provider to use.",
+      "enum": [
+        "doppler",
+        "azure-keyvault"
+      ],
+      "default": "doppler"
+    },
+    "secretsProject": {
+      "type": "string",
+      "description": "The secrets provider project identifier (e.g. Doppler project name)."
+    },
+    "secretsConfig": {
+      "type": "string",
+      "description": "The secrets provider configuration identifier (e.g. Doppler config name: dev, prev, prod)."
+    },
+    "vaultUrl": {
+      "type": "string",
+      "description": "The Azure Key Vault URL (e.g. https://my-vault.vault.azure.net). Required when provider is azure-keyvault."
+    },
+    "apiKey": {
+      "type": "string",
+      "description": "The API key or access token for the secrets provider. If omitted, resolved from environment or prompted interactively."
+    },
+    "vercelTeam": {
+      "type": "string",
+      "description": "The Vercel team slug or scope."
+    },
+    "vercelProject": {
+      "type": "string",
+      "description": "The Vercel project name or ID."
+    },
+    "vercelEnvironment": {
+      "type": "string",
+      "description": "The target Vercel environment.",
+      "enum": [
+        "development",
+        "preview",
+        "production"
+      ]
+    },
+    "vercelVariableType": {
+      "type": "string",
+      "description": "The Vercel variable type (encrypted or sensitive).",
+      "enum": [
+        "encrypted",
+        "sensitive"
+      ],
+      "default": "encrypted"
+    },
+    "conflictStrategy": {
+      "type": "string",
+      "description": "How to handle conflicts between the secrets provider and existing Vercel values.",
+      "enum": [
+        "none",
+        "prefer-source",
+        "prefer-vercel"
+      ],
+      "default": "prefer-source"
+    },
+    "dryRun": {
+      "type": "boolean",
+      "description": "If true, no changes are written to Vercel. Only a diff report is shown.",
+      "default": false
+    },
+    "deleteMissing": {
+      "type": "boolean",
+      "description": "If true, keys present in Vercel but not in the secrets provider are deleted. Must be explicitly enabled.",
+      "default": false
+    },
+    "includeKeys": {
+      "type": "array",
+      "items": {
+        "type": "string"
+      },
+      "description": "If set, only these keys are synchronized."
+    },
+    "excludeKeys": {
+      "type": "array",
+      "items": {
+        "type": "string"
+      },
+      "description": "If set, these keys are excluded from synchronization."
+    },
+    "redeploy": {
+      "type": "boolean",
+      "description": "If true, triggers a redeployment of the Vercel project after sync.",
+      "default": false
+    },
+    "interactive": {
+      "type": "boolean",
+      "description": "If true, prompts the user for missing tokens instead of failing.",
+      "default": false
+    }
+  },
+  "required": [
+    "secretsProject",
+    "secretsConfig",
+    "vercelTeam",
+    "vercelProject",
+    "vercelEnvironment"
+  ],
+  "additionalProperties": false
+}

package/src/executors/svelte-proxy-transform/executor.task.ts

@@ -0,0 +1,187 @@
+/* eslint-disable @typescript-eslint/no-unnecessary-condition */
+/* eslint-disable max-depth */
+
+// #region Imports
+
+import { blue, ConsoleLogger, CustomElementManifest, File, gray, green, type IFileCacheOptions, logSeparator, Path } from '@breadstone-infrastructure/utilities';
+import prettier from 'prettier';
+import type { PackageJson, TsConfigJson } from 'type-fest';
+import { withCaching } from '../../utils/withCaching';
+
+// #endregion
+
+export namespace SvelteProxyTransformTask {
+
+    export const DEFAULT_OPTIONS = {
+        verbose: false,
+        cleanOut: false,
+        aliases: {},
+        ignore: [],
+        prettier: {
+            parser: 'html',
+            arrowParens: 'always',
+            bracketSameLine: false,
+            bracketSpacing: true,
+            semi: true,
+            singleQuote: true,
+            trailingComma: 'none',
+            tabWidth: 4,
+            useTabs: false,
+            printWidth: 1200
+        } satisfies prettier.Options
+    };
+
+    export interface ISvelteProxyTransformOptions {
+        cwd: string;
+        path: string;
+        out: string;
+        cleanOut?: boolean;
+        packageJson: PackageJson;
+        tsConfigJson: TsConfigJson;
+        verbose?: boolean;
+        aliases?: Record<string, string>;
+        ignore?: Array<string>;
+        cache?: IFileCacheOptions;
+    }
+
+    export async function run(options: ISvelteProxyTransformOptions): Promise<void> {
+        const logger = new ConsoleLogger();
+        logSeparator(logger, 'Svelte Proxy Transform');
+
+        const fileCache = withCaching(options.cache);
+
+        // TODO: remove this when wca is not longer used.
+        // this happen when json2 is used as format; afterwards text files will be created.
+        // we have to change the extension to again to json
+        const textFiles = File.glob(Path.combine(options.cwd, options.path, '**/*.txt'));
+        textFiles.forEach((file) => {
+            const content = File.readAllText(file);
+            File.writeAllText(file.replace('.txt', '.json'), content);
+            File.delete(file);
+        });
+
+        const filesPath = Path.combine(options.cwd, options.path, '**/*.json');
+        const files = File.glob(filesPath);
+        const createdFiles: Array<string> = [];
+
+        if (options.verbose) {
+            logger.log(gray(`    Search for: ${filesPath}`));
+        }
+
+        if (files.length) {
+            if (options.verbose) {
+                logger.log(gray(`    ${files.length} files to transform`));
+            }
+
+            for (const file of files) {
+                // eslint-disable-next-line no-await-in-loop
+                if (!await fileCache.isFileCached(file)) {
+                    try {
+                        const doc = File.readAllJson(file) as unknown as CustomElementManifest.PackageDoc;
+                        const def = CustomElementManifest.readDefinition(doc);
+                        const properties = CustomElementManifest.readProperties(doc);
+                        const events = CustomElementManifest.readEvents(doc);
+                        const slots = CustomElementManifest.readSlots(doc);
+                        const out = getOutPathAndFile(def.declaration.module ?? '');
+
+                        if (options.ignore?.includes(def.name)) {
+                            if (options.verbose) {
+                                logger.log(gray(`    [IGNORE] ${Path.relative(options.cwd, file)}`));
+                            }
+                            continue;
+                        }
+
+                        const rootDir = options.tsConfigJson.compilerOptions?.rootDir ?? '';
+                        const outPath = Path.combine(options.cwd, options.out, out ?? '').replace(/Component\.ts$/, 'Component.svelte');
+                        // eslint-disable-next-line no-await-in-loop
+                        const code = await formatSvelteComponent(generateSvelteComponent(def.name, properties, events, slots, options.aliases ?? {}));
+
+                        const outFileExists = File.exists(outPath);
+                        File.writeAllText(outPath, code);
+                        createdFiles.push(Path.relative(options.cwd, outPath));
+
+                        if (outFileExists) {
+                            logger.log(blue(`    [UPDATE] ${Path.relative(options.cwd, outPath)}`));
+                        } else {
+                            logger.log(green(`    [CREATE] ${Path.relative(options.cwd, outPath)}`));
+                        }
+                    } catch (error) {
+                        logger.error('    Error while transforming.');
+                        logger.error(`    ${error}`);
+                    }
+                } else if (options.verbose) {
+                    logger.log(gray(`    File ${Path.relative(options.cwd, file)} is up to date.`));
+                }
+            }
+        } else {
+            logger.log(gray('\tFile or Folder is up to date.'));
+        }
+
+        logSeparator(logger);
+    }
+
+    function formatSvelteComponent(code: string): Promise<string> {
+        return prettier.format(code, DEFAULT_OPTIONS.prettier);
+    }
+
+    function generateSvelteComponent(tagName: string, props: Array<CustomElementManifest.FieldDoc>, events: Array<CustomElementManifest.EventDoc>, slots: Array<CustomElementManifest.SlotDoc>, aliases: Record<string, string>): string {
+        const lookupName = aliases[tagName] ?? null;
+        const pascalName = dashToPascalCase(tagName);
+        const controlName = lookupName ?? pascalName.replace('Mosaik', '');
+        const elementClassName = `${controlName}Element`;
+
+        // Generate typed prop declarations with explicit types from the element
+        const propDeclarations = props
+            .map((p) => `    export let ${p.name}: ${elementClassName}['${p.name}'] = undefined!;`)
+            .join('\n');
+
+        // Generate event subscriptions that properly store and dispose subscriptions
+        const eventSubscriptions = events
+            .map((e) => `        subscriptions.push(el.on('${e.name}', (e) => dispatch('${e.name}', e)));`)
+            .join('\n');
+
+        // Generate prop bindings for the template (one per line for readability)
+        const propBindings = props.map((p) => `{${p.name}}`).join(' ');
+
+        // Slot handling
+        const slotContent = slots.length > 0 ? '<slot />' : '';
+
+        return `<script lang="ts">
+    import { onMount, onDestroy, createEventDispatcher } from 'svelte';
+    import { ${elementClassName} } from '@breadstone/mosaik-elements-foundation';
+    import type { IEventListenerSubscription } from '@breadstone/mosaik-elements';
+
+    let el: ${elementClassName};
+    const subscriptions: Array<IEventListenerSubscription> = [];
+
+${propDeclarations}
+
+    const dispatch = createEventDispatcher();
+
+    onMount(() => {
+${eventSubscriptions}
+    });
+
+    onDestroy(() => {
+        subscriptions.forEach((s) => s.dispose());
+    });
+</script>
+
+<${tagName} bind:this={el} ${propBindings}>
+    ${slotContent}
+</${tagName}>
+`;
+    }
+
+    function getOutPathAndFile(original: string): string | undefined {
+        return original.split('/src').pop()
+            ?.replace('Element.ts', 'Component.ts');
+    }
+
+    function dashToPascalCase(str: string): string {
+        return str.toLowerCase()
+            .split('-')
+            .map((segment) => segment.charAt(0).toUpperCase() + segment.slice(1))
+            .join('');
+    }
+}