@kedge/cli 0.0.0-stage → 0.10.0

package/src/d1-batch.ts

@@ -0,0 +1,66 @@
+// The CLI's own audited batches against a store's D1 (p0.5 §3.4, D-054):
+// `staff`, direct `keys create`, and a CLI session's row (p0.10 §6.2), each
+// one file through `wrangler d1 execute`, locally or on Cloudflare.
+import { spawnSync } from "node:child_process";
+import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import type { CliBatch } from "@kedge/db";
+import { wranglerBin } from "./cf";
+import { childStdio } from "./output";
+
+/** Runs one CLI batch against the store's D1; tests replace it. */
+export type Executor = (
+  b: CliBatch,
+  opts: { database: string; remote: boolean; cwd: string; config?: string; env?: Record<string, string> },
+) => number;
+
+/** The bootstrap Wrangler's whole environment: PATH, an empty HOME, and what Kedge resolved. */
+export function bootstrapEnv(
+  env: NodeJS.ProcessEnv,
+  home: string,
+  resolved: Record<string, string> = {},
+): Record<string, string> {
+  return { PATH: env.PATH ?? "", HOME: home, WRANGLER_SEND_METRICS: "false", CI: "1", ...resolved };
+}
+
+export const wranglerExecute: Executor = (b, opts) => {
+  const dir = mkdtempSync(join(tmpdir(), "kedge-"));
+  const file = join(dir, "batch.sql");
+  // An empty dotenv file of our own: Wrangler then loads none of the store's, whose stale
+  // CLOUDFLARE_* values could redirect the resolved credentials (codex code r4).
+  const envFile = join(dir, "empty.env");
+  try {
+    writeFileSync(file, b.sql, { mode: 0o600 });
+    writeFileSync(envFile, "");
+    // The CLI's own Wrangler with only what Kedge resolved: an inherited environment could carry a
+    // global API key, which Wrangler prefers to a token and would send instead (codex code r5),
+    // and an empty HOME holds no one's login. The store directory stays the working one, for its
+    // config and its local state.
+    const r = spawnSync(
+      process.execPath,
+      [
+        wranglerBin(),
+        "d1",
+        "execute",
+        opts.database,
+        "--file",
+        file,
+        opts.remote ? "--remote" : "--local",
+        "--yes",
+        "--env-file",
+        envFile,
+        ...(opts.config ? ["-c", opts.config] : []),
+      ],
+      {
+        cwd: opts.cwd,
+        stdio: childStdio(),
+        env: bootstrapEnv(process.env, dir, opts.env),
+      },
+    );
+    return r.status ?? 1;
+  } finally {
+    // The file holds no secret (only digests), but it needn't outlive the run.
+    rmSync(dir, { recursive: true, force: true });
+  }
+};