@m6d/cortex-cli 0.12.1 → 0.14.0

package/src/commands/apply.ts

@@ -0,0 +1,186 @@
+import { existsSync } from "node:fs";
+import { relative, resolve } from "node:path";
+
+import type { Command } from "@commander-js/extra-typings";
+import { appliedManifestSchema, manifestChangesSchema } from "@cortex/contracts/manifest";
+import { loadManifestFile } from "@cortex/contracts/manifest-file";
+import { z } from "zod";
+
+import { callManagement } from "@/management/client";
+import { callOrFail, requireProfile } from "@/commands/management";
+import * as report from "@/ui/report";
+
+// Discovery is this exact name in the cwd, with no upward walk, so the
+// argument's default is the discovery rule.
+export const DEFAULT_MANIFEST = "./cortex.manifest.ts";
+
+const CHANGES = ["create", "update", "delete"] as const;
+const MARKS = { create: "+", update: "~", delete: "-" } satisfies Record<
+    (typeof CHANGES)[number],
+    string
+>;
+
+/**
+ * `cortex apply [path]`: makes Cortex match a manifest in one
+ * transaction, through the management API with the profile's key.
+ * `--dry-run` answers what would change and changes nothing.
+ */
+export function registerApply(program: Command<[], { verbose?: true; profile?: string }>) {
+    const command = program
+        .command("apply")
+        .helpGroup("Cortex:")
+        .description("Make Cortex match a manifest")
+        .argument("[path]", "The manifest, TypeScript or JSON", DEFAULT_MANIFEST)
+        .option("--dry-run", "Show what would change, and change nothing");
+
+    command.action(async function (path, options) {
+        const { verbose = false, profile: profileName } = program.opts();
+        const dryRun = options.dryRun === true;
+        const file = findManifest(path);
+        const profile = requireProfile(profileName);
+
+        report.header(dryRun ? "cortex apply --dry-run" : "cortex apply");
+        report.input("Manifest", label(file));
+        report.input("Cortex", profile.url);
+
+        const { changes, triggerSecrets } = await applyManifest({ profile, file, dryRun, verbose });
+        const created = countNames(changes.create);
+        const updated = countNames(changes.update);
+        const deleted = countNames(changes.delete);
+        report.footer(
+            created + updated + deleted === 0
+                ? "no changes"
+                : dryRun
+                  ? `would create ${created}, update ${updated}, delete ${deleted}`
+                  : `created ${created}, updated ${updated}, deleted ${deleted}`,
+        );
+        printTriggerSecrets(triggerSecrets);
+    });
+}
+
+/**
+ * Loads the manifest at `file` and sends it, a preview under `dryRun`, then
+ * prints its changes one row per entry. Ends the run on an invalid file, a
+ * refusal, or a summary this CLI cannot read. `cortex apply` and `cortex
+ * setup` both apply through it; each prints the trigger secrets it returns.
+ */
+export async function applyManifest(options: {
+    profile: ReturnType<typeof requireProfile>;
+    file: string;
+    dryRun: boolean;
+    verbose: boolean;
+}) {
+    const { profile, file, dryRun, verbose } = options;
+    const manifest = await loadManifest(file, verbose);
+    const answer = await callOrFail(profile, () =>
+        callManagement(
+            profile,
+            "post",
+            dryRun ? "/manifests/preview" : "/manifests/sync",
+            manifest,
+        ),
+    );
+    // The secrets are read apart from the changes: a sync has committed by
+    // now, and a summary this CLI is too old to read must not lose them.
+    const { triggerSecrets = {} } = appliedManifestSchema
+        .pick({ triggerSecrets: true })
+        .partial()
+        .parse(answer);
+    const applied = manifestChangesSchema.safeParse(answer);
+    if (!applied.success) {
+        printTriggerSecrets(triggerSecrets);
+        report.fail({
+            what: `${profile.url} answered with a summary this CLI cannot read`,
+            blocks: [
+                `The ${dryRun ? "preview" : "apply"} went through. Update the CLI to read its summary:`,
+                "  bun add -d @m6d/cortex-cli@latest",
+            ],
+        });
+    }
+    printChanges(applied.data);
+    return { changes: applied.data, triggerSecrets };
+}
+
+/** How a manifest path prints: relative to the cwd, `./`-prefixed. */
+function label(path: string) {
+    const relativePath = relative(process.cwd(), path);
+    return relativePath.startsWith(".") ? relativePath : `./${relativePath}`;
+}
+
+/** The manifest's absolute path; a missing file ends the run before anything prints. */
+export function findManifest(path: string) {
+    const absolute = resolve(process.cwd(), path);
+    if (existsSync(absolute)) return absolute;
+    return report.fail({
+        what: `No manifest at ${path}`,
+        blocks:
+            path === DEFAULT_MANIFEST
+                ? [
+                      "cortex apply reads exactly ./cortex.manifest.ts in the directory you run in.\nIt does not search parent directories.",
+                      "Run it from the project root, or point at the file:",
+                      "  cortex apply ./deploy/cortex.manifest.ts",
+                  ]
+                : ["The path is resolved from the directory you run in."],
+    });
+}
+
+/**
+ * The file's default export, checked against the manifest contract here so
+ * a mistake is named before anything is sent, then sent as written: Cortex
+ * fills its own defaults, which may be newer than this CLI's.
+ */
+async function loadManifest(path: string, verbose: boolean) {
+    const { written, parsed } = await loadManifestFile(path).catch((error: unknown) =>
+        report.fail({
+            what: `Could not load ${label(path)}`,
+            error,
+            blocks: [
+                "Importing the file has to run cleanly on its own: it default-exports the\nmanifest, and every package it imports has to be installed (`bun add -d\n@m6d/cortex` for `defineManifest`).",
+            ],
+            verbose,
+        }),
+    );
+    if (!parsed.success) {
+        report.fail({
+            what: `${label(path)} is not a valid manifest`,
+            blocks: [z.prettifyError(parsed.error)],
+        });
+    }
+    return written;
+}
+
+/** One row per changed entry under its kind: `+` created, `~` updated, `-` deleted. */
+function printChanges(changes: Record<(typeof CHANGES)[number], Record<string, string[]>>) {
+    const rows = new Map<string, string[]>();
+    for (const change of CHANGES) {
+        for (const [kind, names] of Object.entries(changes[change])) {
+            const marked = names.map((name) => `${MARKS[change]} ${name}`);
+            rows.set(kind, [...(rows.get(kind) ?? []), ...marked]);
+        }
+    }
+    for (const [kind, lines] of rows) {
+        for (const [index, line] of lines.entries()) {
+            report.row(index === 0 ? kind : "", line, 14);
+        }
+    }
+}
+
+function countNames(byKind: Record<string, string[]>) {
+    return Object.values(byKind).flat().length;
+}
+
+/**
+ * The fire secrets this apply minted, for each trigger it created or whose
+ * `fireCredential` it dropped; nothing shows them again.
+ */
+export function printTriggerSecrets(secrets: Record<string, string>) {
+    const entries = Object.entries(secrets);
+    if (entries.length === 0) return;
+    report.note(
+        [
+            "Trigger fire secrets, shown this once. Store them now: nothing shows them again,",
+            "and only rotating a trigger's secret gives it a new one.",
+            ...entries.map(([name, secret]) => `  ${name}  ${secret}`),
+        ].join("\n"),
+    );
+}