@davidvornholt/standards 0.13.0 → 0.14.1

package/src/poller-units.ts

@@ -8,7 +8,11 @@ import { fileURLToPath } from 'node:url';
 import type { PollerConfig } from './poller-config';
 
 const SERVICE_NAME = 'standards-poller';
-const TICK_INTERVAL_MINUTES = 10;
+// Bounds idle pickup latency while preserving a full cooldown after each tick:
+// OnUnitInactiveSec starts counting when the oneshot service finishes.
+// AccuracySec matters at this scale: systemd's default 1min accuracy would
+// stretch a 1min interval into a 1-2min window.
+const TICK_INTERVAL_MINUTES = 1;
 // Non-agent tick work: stale sweeps, clone/fetch, GitHub reads and writes.
 const TICK_OVERHEAD_MINUTES = 30;
 const MAX_ASCII_CONTROL_CODE = 31;
@@ -62,7 +66,8 @@ Description=Run the standards fix poller on an interval
 
 [Timer]
 OnBootSec=2min
-OnUnitActiveSec=${TICK_INTERVAL_MINUTES}min
+OnUnitInactiveSec=${TICK_INTERVAL_MINUTES}min
+AccuracySec=15s
 Persistent=true
 
 [Install]

package/src/sops-exec.ts

@@ -0,0 +1,47 @@
+// Shared sops process runner: prefer a local sops binary and fall back to
+// `nix run nixpkgs#sops`, mirroring the canonical secrets.just tool
+// resolution. Used by dev-env decryption and the creds SOPS writers.
+
+import { spawnSync } from 'node:child_process';
+import process from 'node:process';
+
+export type SopsRunResult = {
+  readonly status: number | null;
+  readonly stdout: string;
+  readonly stderr: string;
+  readonly errorMessage: string | null;
+};
+
+export const runSops = (
+  args: ReadonlyArray<string>,
+  cwd: string,
+  env?: Readonly<Record<string, string>>,
+): SopsRunResult => {
+  const options = {
+    cwd,
+    encoding: 'utf8' as const,
+    env: { ...process.env, ...(env ?? {}) },
+  };
+  const localSops = spawnSync('sops', [...args], options);
+  const result =
+    localSops.error === undefined && localSops.status !== null
+      ? localSops
+      : spawnSync(
+          'nix',
+          [
+            '--extra-experimental-features',
+            'nix-command flakes',
+            'run',
+            'nixpkgs#sops',
+            '--',
+            ...args,
+          ],
+          options,
+        );
+  return {
+    status: result.status,
+    stdout: result.stdout ?? '',
+    stderr: result.stderr ?? '',
+    errorMessage: result.error?.message ?? null,
+  };
+};