Function writeOutput

ts/workflow-cli/cli/deploy/write.ts:18–99

(
  spec: DeploymentSpec,
  resourceSecrets: EngineSecrets,
  cfg: DeployConfig,
  req: DeployRequirements,
  componentEnv: Record<string, string> = {},
)

import type { ComponentSecrets } from "./spec";

type DeploymentSpec = DeploymentSchemas["DeploymentSpec"];

// Resolve the operator's output dir, expanding a leading `~`. A shell expands that
// before the CLI sees it, but the interactive prompt and a --values file bypass the
// shell — there `~/bundle` would silently become a dir literally named "~" under the
// cwd. Only a leading segment expands, so `./~` still addresses a real "~" directory.
export function resolveOutputDir(dir: string): string {
  const expanded = dir === "~" || dir.startsWith("~/") ? path.join(os.homedir(), dir.slice(1)) : dir;
  return path.resolve(process.cwd(), expanded);
}

export async function writeOutput(
  spec: DeploymentSpec,
  componentSecrets: Record<string, ComponentSecrets>,
  cfg: DeployConfig,
  req: DeployRequirements,
  componentEnv: Record<string, string> = {},
): Promise<string[]> {
  const dir = resolveOutputDir(cfg.outputDir);

  if (existsSync(dir)) {
    const contents = await fs.readdir(dir);
    if (contents.length > 0) {
      if (!cfg.force) {
        process.stderr.write(`output dir not empty: ${dir} (use --force to overwrite)\n`);
        process.exit(1);
      }
      // force=true: wipe + recreate so stale files (an old engine.tar, a stray
      // .env from a prior run, ...) don't end up in the new bundle.
      await fs.rm(dir, { recursive: true, force: true });
      await fs.mkdir(dir, { recursive: true });
    }
  } else {
    await fs.mkdir(dir, { recursive: true });
  }

  const written: string[] = [];
  // secret=true -> mode 0o600. The secret-bearing files: engine.env carries the
  // provider keys + web-search key, a custom component's <name>.env may carry its
  // own, and <name>-secrets.json is the resource-credential doc. The
  // <name>-config.json files and deployment-spec.json are secret-free by
  // construction — safe to share.
  const emit = async (name: string, content: string, secret = false): Promise<void> => {
    const out = path.join(dir, name);
    const opts = secret ? { encoding: "utf-8" as const, mode: 0o600 } : { encoding: "utf-8" as const };
    await fs.writeFile(out, content, opts);
    written.push(out);
  };
  const json = (v: unknown): string => JSON.stringify(v, null, 2) + "\n";

  // One <name>-config.json per component carrying a config blob (the engine's boot
  // file today) — bind-mounted read-only by the renderer, secret-free. The full
  // resolved spec is the deployment record.
  for (const c of spec.components) {
    if (c.config !== undefined) await emit(configFileName(c.name), json(c.config));
  }
  // One secret doc per component that needs one, keyed by resource id — the
  // resolver already split them so each component holds only its own credentials