@davidvornholt/standards 0.20.0 → 0.22.0

package/src/dev-env.ts

@@ -1,127 +1,172 @@
-import { spawnSync } from 'node:child_process';
 import { existsSync } from 'node:fs';
 import { join } from 'node:path';
 import {
+  type DevEnvRunOptions,
+  renderDevEnvPreservingUnsafeReferences,
+} from './dev-env-brokered-preserve';
+import { resolveBrokeredReferences } from './dev-env-brokered-resolve';
+import { composeDevEnv } from './dev-env-compose';
+import {
+  type DevEnvRemoval,
   type DevEnvWrite,
   devEnvDestinationProblems,
 } from './dev-env-destination';
+import { devEnvGitIgnoreProblem } from './dev-env-destination-gitignore';
 import { parseDevEnvDocument } from './dev-env-document';
-import { renderDotenv } from './dev-env-dotenv';
-import { writeDevEnvFiles } from './dev-env-transaction';
-import { runSops } from './sops-exec';
-
-export const DEV_SECRETS_FILE = 'secrets/dev.yaml';
-
-const SOPS_ARGS = ['--decrypt', '--output-type', 'json', DEV_SECRETS_FILE];
+import type { DevEnvPlainInput } from './dev-env-plain-layer';
+import { readPlainLayer } from './dev-env-plain-layer';
+import { planDevEnvRemovals } from './dev-env-reconciliation';
+import { DEV_SECRETS_FILE, readDevSecrets } from './dev-env-secrets';
+import { applyDevEnvChanges } from './dev-env-transaction';
 
-type DecryptResult =
-  | { readonly ok: true; readonly value: unknown }
-  | { readonly ok: false; readonly problem: string };
+export const DEV_CONFIG_FILE = 'config/dev.yaml';
+export const DEV_LOCAL_FILE = 'config/dev.local.yaml';
 
-// sops emits JSON here so the CLI never parses the encrypted YAML itself.
-const decryptDevSecrets = (consumer: string): DecryptResult => {
-  const result = runSops(SOPS_ARGS, consumer);
-  if (result.status !== 0) {
-    const detail = result.errorMessage ?? result.stderr.trim();
-    return {
-      ok: false,
-      problem: detail
-        ? `could not decrypt ${DEV_SECRETS_FILE}: ${detail}`
-        : `could not decrypt ${DEV_SECRETS_FILE}`,
-    };
-  }
-  try {
-    return { ok: true, value: JSON.parse(result.stdout) as unknown };
-  } catch (error) {
-    return {
-      ok: false,
-      problem: `could not parse decrypted ${DEV_SECRETS_FILE} as JSON: ${
-        error instanceof Error ? error.message : String(error)
-      }`,
-    };
-  }
+export type DevEnvInputs = {
+  readonly config: DevEnvPlainInput;
+  readonly secrets: unknown;
+  readonly local: DevEnvPlainInput;
 };
 
-// Writing decrypted values into the tree is only safe when git will never
-// track them. `git check-ignore` is authoritative; anything but a clear
-// "ignored" answer fails closed, including running outside a git checkout.
-const gitIgnoreProblem = (consumer: string, rel: string): string | null => {
-  const result = spawnSync('git', ['check-ignore', '-q', '--', rel], {
-    cwd: consumer,
-  });
-  if (result.error !== undefined || result.status === null) {
-    return `cannot run git to verify ${rel} is gitignored`;
-  }
-  if (result.status === 0) {
-    return null;
-  }
-  if (result.status === 1) {
-    return `${rel} is not gitignored; ignore it before generating dev env files`;
-  }
-  return `cannot verify ${rel} is gitignored (git check-ignore exited ${result.status})`;
-};
+const documentProblems = (
+  source: string,
+  input: DevEnvPlainInput,
+): ReadonlyArray<string> =>
+  input === null
+    ? []
+    : parseDevEnvDocument(input.raw, source, 'configuration').problems;
 
 export type DevEnvPlan = {
   readonly writes: ReadonlyArray<DevEnvWrite>;
+  readonly removals: ReadonlyArray<DevEnvRemoval>;
   readonly problems: ReadonlyArray<string>;
 };
 
-export const planDevEnvWrites = (
+export const planDevEnvChanges = (
   consumer: string,
-  raw: unknown,
+  inputs: DevEnvInputs,
+  options: DevEnvRunOptions = { preservedBrokeredReferences: new Set() },
 ): DevEnvPlan => {
-  const document = parseDevEnvDocument(raw, DEV_SECRETS_FILE);
-  const problems: Array<string> = [...document.problems];
+  const layer = (source: string, input: DevEnvPlainInput) =>
+    input === null
+      ? null
+      : {
+          source,
+          document: parseDevEnvDocument(input.raw, source, 'configuration'),
+        };
+  const composed = composeDevEnv(
+    layer(DEV_CONFIG_FILE, inputs.config),
+    {
+      source: DEV_SECRETS_FILE,
+      document: parseDevEnvDocument(
+        inputs.secrets,
+        DEV_SECRETS_FILE,
+        'secrets',
+      ),
+    },
+    layer(DEV_LOCAL_FILE, inputs.local),
+  );
+  const resolved = resolveBrokeredReferences(
+    consumer,
+    composed.targets,
+    composed.brokeredReferences,
+    options.preservedBrokeredReferences,
+  );
+  const problems: Array<string> = [...composed.problems, ...resolved.problems];
   const writes: Array<DevEnvWrite> = [];
-  for (const target of document.targets) {
+  for (const target of resolved.targets) {
     const workspaceDir = `${target.group}/${target.workspace}`;
     const rel = `${workspaceDir}/.env.local`;
     if (existsSync(join(consumer, workspaceDir, 'package.json'))) {
-      const ignoreProblem = gitIgnoreProblem(consumer, rel);
+      const ignoreProblem = devEnvGitIgnoreProblem(consumer, rel);
       if (ignoreProblem === null) {
-        writes.push({
+        const composedTarget = composed.targets.find(
+          (candidate) =>
+            candidate.group === target.group &&
+            candidate.workspace === target.workspace,
+        );
+        const rendered = renderDevEnvPreservingUnsafeReferences({
+          consumer,
           rel,
-          content: renderDotenv(
-            `${target.group}.${target.workspace}`,
-            DEV_SECRETS_FILE,
-            target.env,
-          ),
+          sourcePath: `${target.group}.${target.workspace}`,
+          sources: target.sources,
+          resolvedEnv: target.env,
+          composedEnv: composedTarget?.env ?? {},
+          preservedReferences: options.preservedBrokeredReferences,
         });
+        if (rendered.ok) {
+          writes.push({ rel, content: rendered.content });
+        } else {
+          problems.push(rendered.problem);
+        }
       } else {
         problems.push(ignoreProblem);
       }
     } else {
       problems.push(
-        `${DEV_SECRETS_FILE} defines ${target.group}.${target.workspace}, but ${workspaceDir}/package.json does not exist`,
+        `${target.sources.join(' + ')} defines ${target.group}.${target.workspace}, but ${workspaceDir}/package.json does not exist`,
       );
     }
   }
-  return { writes, problems };
+  const removalPlan = planDevEnvRemovals(consumer, writes);
+  return {
+    writes,
+    removals: removalPlan.removals,
+    problems: [...problems, ...removalPlan.problems],
+  };
 };
 
-export const runDevEnv = async (consumer: string): Promise<boolean> => {
-  if (!existsSync(join(consumer, DEV_SECRETS_FILE))) {
-    console.error(
-      `standards dev-env: ${DEV_SECRETS_FILE} not found; create it with \`just secrets edit dev\``,
-    );
-    return false;
-  }
-  const decrypted = decryptDevSecrets(consumer);
-  if (!decrypted.ok) {
-    console.error(`standards dev-env: ${decrypted.problem}`);
+export const runDevEnv = async (
+  consumer: string,
+  options: DevEnvRunOptions = { preservedBrokeredReferences: new Set() },
+): Promise<boolean> => {
+  const config = readPlainLayer(consumer, DEV_CONFIG_FILE);
+  const secrets = readDevSecrets(consumer);
+  const local = readPlainLayer(consumer, DEV_LOCAL_FILE);
+  const localIgnoreProblem = local.present
+    ? devEnvGitIgnoreProblem(consumer, DEV_LOCAL_FILE)
+    : null;
+  const inputProblems = [
+    ...config.problems,
+    ...(secrets.ok ? [] : [secrets.problem]),
+    ...local.problems,
+    ...(localIgnoreProblem === null ? [] : [localIgnoreProblem]),
+    ...documentProblems(DEV_CONFIG_FILE, config.input),
+    ...(secrets.ok
+      ? parseDevEnvDocument(secrets.value, DEV_SECRETS_FILE, 'secrets').problems
+      : []),
+    ...documentProblems(DEV_LOCAL_FILE, local.input),
+  ];
+  if (inputProblems.length > 0 || !secrets.ok) {
+    console.error(`standards dev-env: ${inputProblems.length} problem(s):`);
+    console.error(inputProblems.map((problem) => `  - ${problem}`).join('\n'));
     return false;
   }
-  const plan = planDevEnvWrites(consumer, decrypted.value);
+  const plan = planDevEnvChanges(
+    consumer,
+    {
+      config: config.input,
+      secrets: secrets.value,
+      local: local.input,
+    },
+    options,
+  );
   const problems = [
     ...plan.problems,
-    ...(await devEnvDestinationProblems(consumer, plan.writes)),
+    ...(await devEnvDestinationProblems(consumer, [
+      ...plan.writes,
+      ...plan.removals,
+    ])),
   ];
   if (problems.length > 0) {
     console.error(`standards dev-env: ${problems.length} problem(s):`);
     console.error(problems.map((problem) => `  - ${problem}`).join('\n'));
     return false;
   }
-  const generated = await writeDevEnvFiles(consumer, plan.writes);
+  const generated = await applyDevEnvChanges(consumer, [
+    ...plan.writes,
+    ...plan.removals,
+  ]);
   if (!generated.ok) {
     console.error('standards dev-env: generation failed:');
     console.error(
@@ -140,8 +185,16 @@ export const runDevEnv = async (consumer: string): Promise<boolean> => {
   for (const write of plan.writes) {
     console.log(`  wrote ${write.rel}`);
   }
+  for (const removal of plan.removals) {
+    console.log(`  removed ${removal.rel}`);
+  }
+  const inputFiles = [
+    ...(config.input === null ? [] : [DEV_CONFIG_FILE]),
+    DEV_SECRETS_FILE,
+    ...(local.input === null ? [] : [DEV_LOCAL_FILE]),
+  ];
   console.log(
-    `standards dev-env: generated ${plan.writes.length} env file(s) from ${DEV_SECRETS_FILE}`,
+    `standards dev-env: generated ${plan.writes.length} and removed ${plan.removals.length} env file(s) from ${inputFiles.join(' + ')}`,
   );
   return true;
 };