@mp-lb/arcnet 0.0.0-stage → 0.2.0

package/src/secrets/writeSecretsWorkflow.ts

@@ -0,0 +1,83 @@
+import { mkdirSync, existsSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname } from "node:path";
+import { stringify } from "yaml";
+import { safeTargetPath } from "../safeTargetPath.js";
+import type { SecretsConfig } from "./config.js";
+import { wireSecretsWorkflows } from "./wireSecretsWorkflows.js";
+
+export const writeSecretsWorkflow = (
+  config: SecretsConfig,
+  root: string,
+  configFile: string,
+) => {
+  const path = safeTargetPath(
+    root,
+    ".github/workflows/validate-arcnet-secrets.yaml",
+  );
+
+  const marker =
+    "# Generated by arcnet secrets; configure sources in .arcnet/secrets.json.\n";
+
+  if (existsSync(path) && !readFileSync(path, "utf8").startsWith(marker))
+    throw new Error(
+      "Existing validate-arcnet-secrets.yaml is not ArcNet-managed; move it before continuing.",
+    );
+  if (configFile !== ".arcnet/secrets.json")
+    throw new Error(
+      "Generated CI requires the standard .arcnet/secrets.json location.",
+    );
+  mkdirSync(dirname(path), { recursive: true });
+
+  const env = Object.fromEntries(
+    config.sources
+      .flatMap((source) => [
+        source.keyEnv,
+        ...(!source.snapshot && source.tokenEnv ? [source.tokenEnv] : []),
+      ])
+      .map((key) => [key, `\u0024{{ secrets.${key} }}`]),
+  );
+
+  writeFileSync(
+    path,
+    marker +
+      stringify({
+        name: "Validate ArcNet secrets",
+        on: {
+          workflow_dispatch: {},
+          push: {
+            branches: ["main"],
+            paths: [
+              ".arcnet/**",
+              ".github/workflows/validate-arcnet-secrets.yaml",
+              "package.json",
+              "pnpm-lock.yaml",
+            ],
+          },
+        },
+        permissions: { contents: "read" },
+        jobs: {
+          validate: {
+            if: `github.repository == '${config.repository}' && github.ref == 'refs/heads/main'`,
+            "runs-on": "ubuntu-latest",
+            "timeout-minutes": 10,
+            steps: [
+              {
+                uses: "actions/checkout@v4",
+                with: { "persist-credentials": false },
+              },
+              { uses: "pnpm/action-setup@v4" },
+              { uses: "actions/setup-node@v4", with: { "node-version": 22 } },
+              { run: "pnpm install --frozen-lockfile --ignore-scripts" },
+              {
+                name: "Decrypt, merge and validate selected keys",
+                run: "pnpm exec arcnet env check",
+                env,
+              },
+            ],
+          },
+        },
+      }),
+  );
+
+  wireSecretsWorkflows(dirname(path), env);
+};

package/src/selectNetwork.ts

@@ -0,0 +1,73 @@
+import {
+  networkConfigSchema,
+  type ServiceDeploy,
+} from "@mp-lb/zapper/dist/arc/schemas.js";
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { parse } from "yaml";
+import { z } from "zod";
+import { fail } from "./fail.js";
+import { packageRoot } from "./packageInfo.js";
+const networkSchema = networkConfigSchema.extend({ "gcp-project": z.string() });
+const read = (path: string) => readFileSync(path, "utf8");
+
+export const selectNetwork = (
+  slug: string,
+  selection: Record<string, ServiceDeploy> | undefined,
+  safe: (name: string) => string,
+) => {
+  const network = networkSchema.parse(
+    parse(
+      read(
+        existsSync(safe("arcnet.network.yaml"))
+          ? safe("arcnet.network.yaml")
+          : join(packageRoot, "templates/network.yaml"),
+      ),
+    ),
+  );
+
+  const selectedModules = selection
+    ? Object.values(selection).map((s) => s.module)
+    : ["cloud-run-web"];
+
+  const providerMap: Record<string, string[]> = {
+    "cloud-run-web": ["google", "cloudflare"],
+    "gce-worker": ["google"],
+    "vercel-static": ["vercel", "cloudflare"],
+    "shared-mongo-atlas": ["mongodbatlas"],
+    "upstash-redis": ["upstash"],
+    "aws-s3": ["aws"],
+  };
+
+  const providers = new Set([
+    "google",
+    ...selectedModules.flatMap((m) => providerMap[m] ?? []),
+  ]);
+
+  network.providers = Object.fromEntries(
+    [...providers].map((k) => {
+      const provider = network.providers[k];
+      if (!provider) fail(`Network is missing provider ${k}.`);
+      return [k, provider];
+    }),
+  );
+
+  const defaults = new Set([
+    "github-ci",
+    "gcp-project",
+    "project-base",
+    ...selectedModules,
+  ]);
+
+  network["module-defaults"] = Object.fromEntries(
+    Object.entries(network["module-defaults"]).filter(([k]) => defaults.has(k)),
+  );
+
+  network.env = { resolver: "false", "public-file": ".arcnet/unused.env" };
+  const gcpProject = network["gcp-project"]?.replaceAll("{slug}", slug);
+  if (!/^[a-z][a-z0-9-]{4,28}[a-z0-9]$/.test(gcpProject ?? ""))
+    fail(
+      "Network gcp-project must resolve to a valid 6–30 character project ID using {slug}.",
+    );
+  return { network, gcpProject };
+};

package/src/setup.ts

@@ -0,0 +1,277 @@
+import { setupReport } from "./setupReport.js";
+import {
+  existsSync,
+  lstatSync,
+  mkdirSync,
+  readFileSync,
+  realpathSync,
+  writeFileSync,
+} from "node:fs";
+import { dirname, join } from "node:path";
+import { parseDocument, stringify } from "yaml";
+import { z } from "zod";
+import { addDependency, hasDependency } from "./addDependency.js";
+import { fail } from "./fail.js";
+import { packageRoot } from "./packageInfo.js";
+import { parseSetupInput } from "./parseSetupInput.js";
+import { readSelection } from "./readSelection.js";
+import { resolveRepository } from "./resolveRepository.js";
+import { safeTargetPath } from "./safeTargetPath.js";
+import { selectNetwork } from "./selectNetwork.js";
+import { setupVercel } from "./setupVercel.js";
+
+const home = packageRoot;
+
+const read = (p: string) => readFileSync(p, "utf8");
+const json = (value: unknown) => JSON.stringify(value, null, 2) + "\n";
+
+export const setup = (args: string[], root = process.cwd()) => {
+  const { slug, options, dry } = parseSetupInput(args);
+  root = realpathSync(root);
+  const safe = (name: string) => safeTargetPath(root, name);
+
+  if (!options.services) {
+    const inputs = [".arcnet/services.json", "arcnet.services.json"].filter(
+      (name) => existsSync(safe(name)),
+    );
+
+    if (inputs.length > 1)
+      fail(
+        "Both .arcnet/services.json and arcnet.services.json exist. Select one with --services.",
+      );
+    options.services = inputs[0];
+  }
+
+  if (
+    !options["seen-dockerfile"] &&
+    !existsSync(safe(options.dockerfile)) &&
+    existsSync(safe("Dockerfile"))
+  )
+    options.dockerfile = "Dockerfile";
+  const zapPath = safe("zap.yaml");
+  if (!existsSync(zapPath))
+    fail("Run setup from a target repository containing zap.yaml.");
+  const doc = parseDocument(read(zapPath));
+  if (doc.errors.length) fail("zap.yaml is invalid YAML; fix it before setup.");
+
+  const project = z
+    .object({
+      project: z.string(),
+      native: z.record(z.string(), z.unknown()).optional(),
+      docker: z.record(z.string(), z.unknown()).optional(),
+      containers: z.record(z.string(), z.unknown()).optional(),
+      deploy: z.unknown().optional(),
+    })
+    .parse(doc.toJS());
+
+  if (project.project !== slug)
+    fail(
+      `Slug must equal zap.yaml project (${project.project}). No files changed.`,
+    );
+
+  if (!options.vercel) {
+    const inputs = [".arcnet/vercel.json", "arcnet.vercel.json"].filter(
+      (name) => existsSync(safe(name)),
+    );
+
+    if (inputs.length > 1)
+      fail(
+        "Both .arcnet/vercel.json and arcnet.vercel.json exist. Select one with --vercel.",
+      );
+    options.vercel = inputs[0];
+  }
+
+  if (options.vercel) {
+    if (
+      options.services ||
+      options["seen-service"] ||
+      options["seen-dockerfile"] ||
+      options["seen-repository"]
+    )
+      fail(
+        "Vercel-only input cannot be combined with Terraform/service flags or a services.json input.",
+      );
+    if (
+      !existsSync(safe("pnpm-lock.yaml")) ||
+      !existsSync(safe("package.json"))
+    )
+      fail("A target pnpm package.json and lockfile are required.");
+    const pm = JSON.parse(read(safe("package.json"))).packageManager;
+    if (!/^pnpm@\d+\.\d+\.\d+(?:\+sha\d+\.[a-f0-9]+)?$/.test(pm ?? ""))
+      fail("Pin packageManager to an exact pnpm version.");
+    return setupVercel({
+      root,
+      slug,
+      safe,
+      file: options.vercel,
+      dry,
+      hasDeploy: Boolean(project.deploy),
+    });
+  }
+
+  if (
+    !/^[a-z][a-z0-9-]*$/.test(options.service) ||
+    ["gcp", "registry", "ci"].includes(options.service) ||
+    /myshop/i.test(`${options.service} ${options.dockerfile}`)
+  )
+    fail("Invalid or reserved service name; MyShop must remain local-only.");
+  if (
+    !options.services &&
+    !Object.hasOwn(project.native ?? {}, options.service) &&
+    !Object.hasOwn(project.docker ?? {}, options.service) &&
+    !Object.hasOwn(project.containers ?? {}, options.service)
+  )
+    fail(`No local service named ${options.service} in zap.yaml.`);
+  if (
+    !options.services &&
+    (!existsSync(safe(options.dockerfile)) ||
+      !lstatSync(safe(options.dockerfile)).isFile())
+  )
+    fail(
+      `Missing ${options.dockerfile}. Add and test a backend-only Dockerfile listening on PORT=8080 with GET /health; use --dockerfile for another path.`,
+    );
+  if (!existsSync(safe("pnpm-lock.yaml")) || !existsSync(safe("package.json")))
+    fail(
+      "A pnpm project with committed package.json and pnpm-lock.yaml is required.",
+    );
+  const packageManager = JSON.parse(read(safe("package.json"))).packageManager;
+  if (
+    !/^pnpm@\d+\.\d+\.\d+(?:\+sha\d+\.[a-f0-9]+)?$/.test(packageManager ?? "")
+  )
+    fail(
+      "package.json must pin an exact pnpm packageManager version for reproducible CI.",
+    );
+  const repository = resolveRepository(root, options.repository);
+  if (
+    options.services &&
+    (options["seen-service"] || options["seen-dockerfile"])
+  )
+    fail("--services cannot be combined with --service or --dockerfile.");
+
+  const selection = options.services
+    ? readSelection(options.services, safe)
+    : undefined;
+
+  const configPath = safe(".arcnet/project.json");
+
+  if (existsSync(configPath)) {
+    const old = JSON.parse(read(configPath));
+    if (
+      old.slug !== slug ||
+      old.repository !== repository ||
+      old.service !== options.service ||
+      old.dockerfile !== options.dockerfile ||
+      JSON.stringify(old.selection) !== JSON.stringify(selection)
+    )
+      fail(
+        "Existing ArcNet setup differs. Edit/review its committed config; setup never overwrites it.",
+      );
+
+    const required = [
+      ".arcnet/network.yaml",
+      ".arcnet/.gitignore",
+      ".github/workflows/deploy-arc.yaml",
+    ];
+
+    if (
+      !project.deploy ||
+      !hasDependency(root) ||
+      required.some((p) => !existsSync(safe(p)))
+    )
+      fail(
+        "Incomplete ArcNet installation. Restore missing files from Git before rerunning.",
+      );
+    return setupReport(
+      "already-configured",
+      [],
+      "Already configured; preserved all existing files and edits.",
+    );
+  }
+
+  if (project.deploy)
+    fail(
+      "Existing deploy block detected. Migrate it explicitly; no files changed.",
+    );
+  const { network, gcpProject } = selectNetwork(slug, selection, safe);
+
+  const config = {
+    version: 1,
+    slug,
+    repository,
+    service: options.service,
+    dockerfile: options.dockerfile,
+    selection,
+    services: selection ? Object.keys(selection) : [options.service],
+    approved: false,
+    workloadIdentityProvider: "",
+    serviceAccount: `arc-deploy@${gcpProject}.iam.gserviceaccount.com`,
+  };
+
+  const deployedSelection = selection && structuredClone(selection);
+  for (const block of Object.values(deployedSelection ?? {}))
+    if (block.module === "vercel-static")
+      block.module = "./node_modules/@mp-lb/arcnet/templates/vercel-static";
+  doc.set("deploy", {
+    project: {
+      gcp: { module: "gcp-project" },
+      registry: { module: "project-base", "depends-on": ["gcp"] },
+      ci: {
+        module: "github-ci",
+        "depends-on": ["gcp"],
+        params: { repository },
+      },
+    },
+    services: deployedSelection ?? {
+      [options.service]: {
+        module: "cloud-run-web",
+        domain: `${slug}-api.${network.dns.zone}`,
+        dockerfile: options.dockerfile,
+        env: [],
+        params: {
+          port: 8080,
+          "health-path": "/health",
+          "min-instances": 0,
+          "max-instances": 2,
+        },
+      },
+    },
+  });
+
+  const files = new Map([
+    [".arcnet/project.json", json(config)],
+    [".arcnet/network.yaml", stringify(network)],
+    [
+      ".arcnet/.gitignore",
+      "node_modules/\n.terraform/\n*.tfstate*\n*.tfplan\ncredentials.env\n",
+    ],
+    [
+      ".github/workflows/deploy-arc.yaml",
+      read(join(home, "templates/deploy-arc.yaml")),
+    ],
+  ]);
+
+  for (const name of files.keys())
+    if (existsSync(safe(name)))
+      fail(`Refusing to overwrite ${name}. No files changed.`);
+  const manifest = addDependency(safe("package.json"));
+  if (dry)
+    return setupReport(
+      "dry-run",
+      [...files.keys(), "package.json", "zap.yaml"],
+      `Dry run: would pin @mp-lb/arcnet in package.json and add deploy.services (${config.services.join(", ")}), ${[...files.keys()].join(", ")}. No files written; no cloud commands run.`,
+    );
+
+  // Validate every destination before writing; preserve unrelated files and YAML comments.
+  for (const [name, content] of files) {
+    mkdirSync(dirname(safe(name)), { recursive: true });
+    writeFileSync(safe(name), content, { flag: "wx" });
+  }
+
+  writeFileSync(zapPath, doc.toString());
+  writeFileSync(safe("package.json"), manifest);
+  return setupReport(
+    "installed",
+    [...files.keys(), "package.json", "zap.yaml"],
+    "ArcNet files generated. Deployment is disabled (approved=false). Review the StackForge ArcNet prerequisites, network REPLACE_ placeholders, Dockerfile, domain, env whitelist and Git diff. Install: pnpm install. Offline check: pnpm exec arcnet check. Only the selected services are included; no existing Vercel project is automatically adopted. MyShop stays local-only.",
+  );
+};

package/src/setupReport.ts

@@ -0,0 +1,11 @@
+export type SetupReport = {
+  operation: "setup";
+  status: "dry-run" | "installed" | "already-configured";
+  files: string[];
+  message: string;
+};
+export const setupReport = (
+  status: SetupReport["status"],
+  files: string[],
+  message: string,
+): SetupReport => ({ operation: "setup", status, files, message });

package/src/setupVercel.ts

@@ -0,0 +1,126 @@
+import { setupReport } from "./setupReport.js";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { isDeepStrictEqual } from "node:util";
+import { addDependency, hasDependency } from "./addDependency.js";
+import { packageRoot } from "./packageInfo.js";
+import { vercelInputSchema } from "./schemas.js";
+import { validateConfig } from "./validateConfig.js";
+const home = packageRoot;
+const json = (value: unknown) => JSON.stringify(value, null, 2) + "\n";
+
+export const setupVercel = ({
+  root,
+  slug,
+  safe,
+  file,
+  dry,
+  hasDeploy,
+}: {
+  root: string;
+  slug: string;
+  safe: (name: string) => string;
+  file: string;
+  dry: boolean;
+  hasDeploy: boolean;
+}) => {
+  if (hasDeploy)
+    throw new Error(
+      "Existing Terraform deploy block found. Vercel-only reference mode cannot silently replace it.",
+    );
+
+  const input = vercelInputSchema.parse(
+    JSON.parse(readFileSync(safe(file), "utf8")),
+  );
+
+  const config = validateConfig(
+    {
+      version: 1,
+      mode: "vercel",
+      slug,
+      repository: input.repository,
+      approved: false,
+      account: input.account,
+      sites: input.sites,
+    },
+    root,
+  );
+
+  if (
+    Object.keys(input).some(
+      (k) => !["repository", "account", "sites"].includes(k),
+    )
+  )
+    throw new Error(
+      "Vercel input supports only repository, account and sites; ownership/import is separate.",
+    );
+  const path = safe(".arcnet/project.json");
+
+  const files = new Map([
+    [".arcnet/project.json", json(config)],
+    [".arcnet/.gitignore", "project.json.new\n"],
+    [
+      ".github/workflows/deploy-arc.yaml",
+      readFileSync(join(home, "templates/deploy-vercel.yaml"), "utf8"),
+    ],
+  ]);
+
+  if (existsSync(path)) {
+    const old = validateConfig(JSON.parse(readFileSync(path, "utf8")), root);
+    const previous = { ...old, approved: false };
+    const expected = { ...config, approved: false };
+
+    // Creation promotes a planned new site to an explicit reference; a setup rerun must preserve that receipt.
+    for (const [name, site] of Object.entries(expected.sites)) {
+      if (site.mode === "new" && previous.sites?.[name]?.mode === "existing") {
+        expected.sites[name] = {
+          ...site,
+          mode: "existing",
+          projectId: previous.sites[name].projectId,
+        };
+
+        delete expected.sites[name]!.creationApproved;
+      }
+    }
+
+    if (!isDeepStrictEqual(previous, expected))
+      throw new Error(
+        "Existing ArcNet configuration differs. Review committed config instead of overwriting it. After explicit creation, update the source input to the returned existing reference.",
+      );
+    if (!hasDependency(root))
+      throw new Error(
+        "Incomplete installation: add the ArcNet package dependency.",
+      );
+    for (const name of files.keys())
+      if (!existsSync(safe(name)))
+        throw new Error(`Incomplete installation: restore ${name} from Git.`);
+    return setupReport(
+      "already-configured",
+      [],
+      "Already configured; preserved all settings and files.",
+    );
+  }
+
+  for (const name of files.keys())
+    if (existsSync(safe(name)))
+      throw new Error(`Refusing to overwrite ${name}. No files changed.`);
+  const manifest = addDependency(safe("package.json"));
+  if (dry)
+    return setupReport(
+      "dry-run",
+      [...files.keys(), "package.json"],
+      `Dry run: Vercel-only references for ${Object.keys(config.sites).join(", ")}. No files or cloud resources changed; no GCP/WIF/Terraform.`,
+    );
+
+  for (const [name, content] of files) {
+    mkdirSync(dirname(safe(name)), { recursive: true });
+    writeFileSync(safe(name), content, { flag: "wx" });
+  }
+
+  writeFileSync(safe("package.json"), manifest);
+  return setupReport(
+    "installed",
+    [...files.keys(), "package.json"],
+    "Generated Vercel-only config and GitHub workflow (approved=false). No zap.yaml changes, GCP, Terraform, DNS or project settings ownership. Offline plan: pnpm install, then pnpm exec arcnet plan",
+  );
+};

package/src/stageSite.ts

@@ -0,0 +1,54 @@
+import {
+  cpSync,
+  existsSync,
+  lstatSync,
+  mkdirSync,
+  mkdtempSync,
+  rmSync,
+  writeFileSync,
+} from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { fail } from "./fail.js";
+import { inspectStaticTree } from "./inspectStaticTree.js";
+import { safePath } from "./safePath.js";
+import type { VercelAccount, VercelSite } from "./schemas.js";
+
+export const stageSite = (
+  root: string,
+  site: VercelSite,
+  account: VercelAccount,
+) => {
+  const output = safePath(root, site.output);
+  if (
+    !existsSync(output) ||
+    !lstatSync(output).isDirectory() ||
+    !existsSync(join(output, "index.html"))
+  )
+    fail(`Static output needs index.html: ${site.output}`);
+  inspectStaticTree(output);
+  const stage = mkdtempSync(join(tmpdir(), "arcnet-static-"));
+
+  try {
+    mkdirSync(join(stage, ".vercel/output"), { recursive: true });
+    cpSync(output, join(stage, ".vercel/output/static"), { recursive: true });
+    writeFileSync(
+      join(stage, ".vercel/output/config.json"),
+      JSON.stringify(site.outputConfig),
+    );
+
+    writeFileSync(
+      join(stage, ".vercel/project.json"),
+      JSON.stringify({
+        projectId: site.projectId,
+        orgId: account.id,
+        projectName: site.projectName,
+      }),
+    );
+
+    return stage;
+  } catch (e) {
+    rmSync(stage, { recursive: true, force: true });
+    throw e;
+  }
+};

package/src/validateConfig.ts

@@ -0,0 +1,22 @@
+import { fail } from "./fail.js";
+import { safePath } from "./safePath.js";
+import type { VercelConfig } from "./schemas.js";
+import { vercelConfigSchema } from "./schemas.js";
+
+export const validateConfig = (input: unknown, root: string): VercelConfig => {
+  const config = vercelConfigSchema.parse(input);
+  const identities = new Set<string>();
+
+  for (const site of Object.values(config.sites)) {
+    for (const id of [site.projectId, site.projectName].filter(
+      (id): id is string => Boolean(id),
+    )) {
+      if (identities.has(id)) fail("Duplicate Vercel project selection.");
+      identities.add(id);
+    }
+
+    safePath(root, site.output);
+  }
+
+  return config;
+};