Three files with 3 stars each -> selective.
cmd/lib.nu:
utils/init.nu [get-workspace-path get-provisioning-infra-path] (kept)
sops/lib.nu [find-sops-key on_sops]
config/accessor DROPPED (dead)
utils/ui.nu DROPPED (dead)
config/loader/core.nu:
All 3 star-imports (interpolators, context_manager, sops_handler) were
dead — NONE of their exports are used in the file body. All dropped.
config/encryption.nu:
sops/lib.nu [3 symbols — get-sops-age-key-file is_sops_file on_sops]
kms/lib.nu [on_kms]
plugins/kms.nu [3 symbols] (already selective; kept)
config/accessor DROPPED (dead)
Deferred from this batch: cmd/environment.nu.
It calls 7+ functions that are not defined anywhere in the codebase
(list-available-environments, get-current-environment, switch-environment,
init-environment-config, show-config, compare-environments, etc.).
Converting its star-imports to selective would surface those as undefined
symbol errors. Needs the Blocker-1 style treatment (stubs or elimination)
in a dedicated commit. Tracked as follow-up.
Validation: all 3 nu --ide-check 50 -> 0 errors.
Refs: ADR-025
Three unrelated files grouped in one commit because each is a mechanical
3-5 star -> selective conversion with small cleanups.
providers/loader.nu (L2):
registry.nu [4 symbols]
logging.nu [2 symbols]
interface.nu DROPPED (dead)
Note: dynamic `use ($provider_entry.entry_point) *` at line ~173 is
intentional runtime dispatch; not convertible.
extensions/loader_oci.nu (L2):
logging.nu [3 symbols]
oci/client.nu [7 symbols]
loader.nu [4 symbols] — fixed comma-separated list syntax quirk
config/accessor DROPPED (dead)
extensions/cache DROPPED (dead)
plugins/mod.nu (L3 facade):
auth.nu [1 symbol]
kms.nu [8 symbols]
secretumvault.nu [9 symbols]
config/accessor DROPPED (dead)
+ added `use utils/interface.nu [_ansi]` — _ansi was used in body but
previously arrived through implicit star chain; now explicit.
Validation: all three nu --ide-check 50 -> 0 errors.
Refs: ADR-025, .coder/benchmarks/phase2-transitivity.md
Two workspace+services command files converted, batched because they share
the same pattern (4 stars each -> selective).
workspace/commands.nu:
user/config.nu [11 symbols]
utils/hints.nu [show-next-step]
platform/activation.nu [activate-workspace-platform]
workspace/notation.nu [3 symbols]
Pre-existing name collision documented: get-workspace-path and
list-workspaces are exported by BOTH user/config.nu and notation.nu.
Star-import resolved via last-wins (notation.nu). Selective version
attributes both to notation.nu to preserve behaviour.
services/commands.nu:
services/manager.nu [9 symbols]
services/health.nu [2 symbols]
services/preflight.nu [4 symbols]
services/dependencies.nu [5 symbols]
Validation: both files nu --ide-check 50 -> 0 errors.
Refs: ADR-025
setup/mod.nu had 4 star-imports. Resolution per target:
Converted to selective:
config/accessor.nu -> [config-get] 1 symbol
utils.nu (re-export) -> [create_versions_file ...] 4 symbols
config.nu (re-export) -> [env_file_providers ...] 2 symbols
Dropped:
utils/logging.nu -> 0 used symbols in this file DEAD
Also promoted the accessor import to absolute path
(lib_provisioning/config/accessor/core.nu) per ADR-025 rule.
Validation:
nu --ide-check 50 setup/mod.nu -> 0 errors
Refs: ADR-025, .coder/benchmarks/phase2-transitivity.md Layer 3
config/loader/mod.nu had 5 `export use X *`. Each is now explicit.
Symbol counts per target:
core.nu 1
validator.nu 6
environment.nu 4
test.nu 2
dag.nu 1
Total: 14 symbols.
With loader/mod.nu now star-free, the orchestrator loader.nu (1-line
re-export) could be converted from `export use loader.nu *` to selective
in config/mod.nu. Tracked as follow-up — once loader/mod.nu and
accessor/mod.nu are both clean, config/mod.nu's 2 orchestrator exceptions
can be resolved.
Validation:
nu --ide-check 50 config/loader/mod.nu -> 0 errors
Refs: ADR-025, .coder/benchmarks/phase2-transitivity.md Layer 3
config/mod.nu had 6 `export use X *`. Partial conversion:
Converted to selective:
accessor_generated.nu 80 symbols (schema-driven generated accessors)
migration.nu 6 symbols
encryption.nu 12 symbols
commands.nu 11 symbols (multi-word "config X" + main)
Kept as star re-exports (with inline comment explaining why):
loader.nu - 1-line orchestrator → loader/mod.nu (itself has 5 stars)
accessor.nu - 1-line orchestrator → accessor/mod.nu (itself has 3 stars)
Rationale for the 2 exceptions: loader.nu and accessor.nu are thin
orchestrator files that re-export their sub-subsystems. Flattening them
requires a prior pass refactoring loader/ and accessor/ subtrees. Tracked
as follow-up in the transitivity DAG.
Validation:
nu --ide-check 50 config/mod.nu -> 1 error (pre-existing, verified by
stash-and-compare). Zero new errors introduced.
Refs: ADR-025, .coder/benchmarks/phase2-transitivity.md Layer 3
ecosystem/mod.nu had 5 `use ./X.nu *` — NOT `export use`. The comment
claimed "Re-exports all ecosystem integration providers" but no export
actually happened (plain `use` makes symbols visible only inside this
file, not to consumers). Parent `integrations/mod.nu` does
`use ./ecosystem *` expecting propagation that never occurred.
Fixed both issues in one commit:
1. Promote each `use` to `export use` so the facade actually re-exports.
2. Replace each star with an explicit symbol list.
Symbol counts per target:
runtime.nu 5
backup.nu 6
ssh_advanced.nu 6
gitops.nu 7
service.nu 8
Total: 32 symbols re-exported (previously: 0, due to the use-vs-export-use bug).
Behaviour change note: consumers that rely on integrations/ecosystem/* symbols
via `use lib_provisioning/integrations *` may now see symbols that were
silently missing before. This is the documented intent restored.
Validation:
nu --ide-check 50 ecosystem/mod.nu -> 41 errors (all PRE-EXISTING,
verified by stash-and-compare). Zero new errors introduced.
Refs: ADR-025, .coder/benchmarks/phase2-transitivity.md Layer 3
gitea/mod.nu had 6 `export use X *`. Each is now explicit.
Symbol counts per target:
api_client.nu 28
service.nu 10
workspace_git.nu 17
locking.nu 9
extension_publish.nu 6
commands.nu 24 (all multi-word "gitea X")
Total: 94 symbols, 24 quoted multi-word Nu subcommands.
Validation:
nu --ide-check 50 gitea/mod.nu -> 50 errors (all PRE-EXISTING)
Verified by stash-and-compare: the unmodified original mod.nu also
produced 50 errors from the same imported files. Zero errors
introduced by this refactor.
Refs: ADR-025, .coder/benchmarks/phase2-transitivity.md Layer 3
utils/version/mod.nu had 6 `export use X *`. Each is now explicit.
Symbol counts per target:
core.nu 6
formatter.nu 3
loader.nu 6
manager.nu 7
registry.nu 6
taskserv.nu 7
Total: 35 symbols re-exported.
Validation:
nu --ide-check 50 version/mod.nu -> 0 errors
Refs: ADR-025, .coder/benchmarks/phase2-transitivity.md Layer 3
platform/mod.nu had 8 `export use X *`. Each is now explicit symbol list.
Symbol counts per target:
target.nu 12
discovery.nu 5
health.nu 4
credentials.nu 6
connection.nu 9
cli.nu 7
autostart.nu 7
service-manager.nu 15
Total: 65 symbols re-exported.
Pre-existing duplicate symbols surfaced by the explicit listing (not caused
by this commit — the `export use X *` pattern silently shadowed them):
- get-service-status: connection.nu (arg) + autostart.nu (no arg)
- start-required-services: service-manager.nu + autostart.nu
- load-deployment-mode: target.nu + service-manager.nu
Leaving duplicates as-is; resolving the naming collisions is out of scope
for ADR-025 (tracked as pre-existing bug to address in a separate commit).
Validation:
nu --ide-check 50 platform/mod.nu -> 0 errors
Refs: ADR-025, .coder/benchmarks/phase2-transitivity.md Layer 3
utils/mod.nu was the top subsystem facade (10 stars reported in the DAG,
16 on closer inspection). Each `export use X *` is now `export use X [symbols]`
with an explicit list.
Symbol counts per target:
interface.nu 13
init.nu 13
logging.nu 13
settings.nu 19 (file already selective per pilot commit 8de5e63)
imports.nu 16
generate.nu 6
ssh.nu 5
files.nu 4
error.nu 2
undefined.nu 2
format.nu 2
templates.nu 2
clean.nu 1
help.nu 1
on_select.nu 1
qr.nu 1
Total: 101 distinct symbols re-exported by name. Consumers using
`use lib_provisioning/utils *` see an identical symbol set, but every
symbol is now auditable.
Validation:
nu --ide-check 50 utils/mod.nu -> 4 errors, all pre-existing (verified
by stash-and-compare against the pre-refactor version). Zero new
errors introduced.
Refs: ADR-025, .coder/benchmarks/phase2-transitivity.md Layer 3
bootstrap.nu had 5 star-imports. Body scan showed only 2 of the 5 files
contributed any used symbols:
config/accessor.nu -> config-get
services/health.nu -> wait-for-service
The other 3 files were imported with `use X *` but supplied zero used
symbols — dead imports inherited from an earlier architecture:
utils/logging.nu (0 used) dropped
services/lifecycle.nu (0 used) dropped
services/dependencies.nu (0 used) dropped
All imports now use absolute paths from nulib/ root. Existing selective
imports (context_manager, setup/mod, nickel_processor) kept as-is and
promoted to absolute paths for consistency with ADR-025 rule.
Validation:
nu --ide-check 50 platform/bootstrap.nu -> 0 errors
Refs: ADR-025, .coder/benchmarks/phase2-transitivity.md Layer 2
Two changes in this file:
1. Replace 5 star-imports with selective imports (absolute paths):
Before:
use target.nu *
use discovery.nu *
use health.nu *
use autostart.nu *
use connection.nu *
After:
use lib_provisioning/platform/health.nu [check-all-services check-required-services]
use lib_provisioning/platform/discovery.nu [list-services]
use lib_provisioning/platform/autostart.nu [start-required-services]
use lib_provisioning/platform/connection.nu [init-connection-metadata show-connection-status]
platform/target.nu drops from the import list — nothing from target.nu is
actually used in this file once load-platform-target (see #2) is removed.
2. Stub platform-config function.
platform-config called `load-platform-target`, a symbol with zero
definitions in the entire codebase (same class as on_clusters from
blocker 1). The function was dead at runtime. Replaced body with a
user-facing message pointing to `prvng platform list` which works.
Validation:
nu --ide-check 50 platform/cli.nu -> 0 errors
Refs: ADR-025, .coder/benchmarks/phase2-findings.md blockers (extended)
ui.nu is a 5-line facade re-exporting UI primitives from clean.nu, error.nu,
help.nu, interface.nu, undefined.nu. All five used `export use X *` — ADR-025
transitivity rule prohibits these root star-re-exports.
Replaced each star with explicit symbol lists (19 symbols total):
clean.nu [cleanup] (1)
error.nu [throw-error safe-execute] (2)
help.nu [parse_help_command] (1)
interface.nu [13 symbols, one per line] (13)
undefined.nu [option_undefined invalid_task] (2)
The facade keeps the 2 callers (cmd/environment.nu, cmd/lib.nu) working with
their existing `use ../utils/ui.nu *` pattern — the consumers see identical
behaviour, but the symbol set is now explicit and bounded.
Validation:
nu --ide-check 50 ui.nu -> 0 errors
nu --ide-check 50 cmd/environment.nu -> 0 errors (regression check)
nu --ide-check 50 cmd/lib.nu -> 0 errors (regression check)
Refs: ADR-025, .coder/benchmarks/phase2-transitivity.md Layer 2
First real star-import removal. settings.nu is the highest fan-in importer
in the lib_provisioning/ transitivity DAG (8 star-imports, common ancestor
for most symbols consumed by the 16 root fat-import files).
Before:
use ../config/accessor.nu *
use ./logging.nu *
use ./nickel_processor.nu *
use ./error.nu [throw-error]
use ./init.nu [get-provisioning-infra-path get-provisioning-name get-provisioning-resources]
use ../../../../extensions/providers/prov_lib/middleware.nu *
use ../context.nu *
use ../sops/mod.nu *
use ../workspace/detection.nu *
use ../user/config.nu *
After (absolute paths from nulib/ root, named-symbol imports):
use lib_provisioning/config/accessor/core.nu [config-get]
use lib_provisioning/context.nu [setup_user_context]
use lib_provisioning/sops/lib.nu [is_sops_file decode_sops_file on_sops]
use lib_provisioning/user/config.nu [get-workspace-default-infra get-workspace-path]
use lib_provisioning/utils/error.nu [throw-error]
use lib_provisioning/utils/init.nu [get-provisioning-infra-path get-provisioning-name get-provisioning-resources get-work-format]
use lib_provisioning/utils/interface.nu [_ansi _print]
use lib_provisioning/utils/logging.nu [is-debug-enabled]
use lib_provisioning/utils/nickel_processor.nu [ncl-eval ncl-eval-soft process_nickel_export_raw]
use lib_provisioning/workspace/detection.nu [detect-infra-from-pwd get-effective-workspace infer-workspace-from-pwd]
use ../../../../extensions/providers/prov_lib/middleware.nu [mw_create_cache mw_ip_from_cache]
Cross-tree middleware import kept relative — the target is outside nulib/
(public extension API consumed by workspaces). Only two specific middleware
symbols are pulled; the rest of middleware.nu is no longer in settings.nu
scope.
Method: grep bare identifiers in settings.nu body, intersect with each
star-imported target's export set, record origin. Followed pattern from
Phase 3 pilot methodology (ADR-025 section "Fix call sites bottom-up").
Validation:
nu --ide-check 50 lib_provisioning/utils/settings.nu
-> 0 errors, 0 warnings (type hints only)
Transitivity note: several target files (error.nu, logging.nu, init.nu,
sops/lib.nu, detection.nu) still contain star-imports of their own. This
pilot proves the pattern works; subsequent commits will climb the DAG
leaves-first and eventually remove those remaining stars.
Refs: ADR-025, .coder/benchmarks/phase2-transitivity.md (Layer 3 priority)
Two export-env blocks in lib_provisioning/ ran at module load time as side
effects of the lib_provisioning/mod.nu star-import chain. ADR-025 empties
that chain; the side effects were never going to fire again and neither has
a remaining reader that depends on them.
1. lib_provisioning/cmd/env.nu
Former block: called check_env (a pre-flight gate for PROVISIONING_VARS /
PROVISIONING_WORKSPACE_PATH / PROVISIONING_WK_ENV_PATH existence) and set
$env.PROVISIONING_DEBUG = false. Nobody imports cmd/env.nu directly; every
downstream reader of PROVISIONING_DEBUG either sets it explicitly via a
--debug flag branch or reads it with `?` + default fallback.
2. lib_provisioning/providers/registry.nu
Former block: $env.PROVIDER_REGISTRY_INITIALIZED = false. The four read
sites in registry.nu already use `$env.PROVIDER_REGISTRY_INITIALIZED? |
default false`; the unset state is equivalent to false. Zero behaviour
change.
Both files now carry a comment explaining the removal so future contributors
understand the history without reading ADR-025.
Refs: ADR-025, .coder/benchmarks/phase2-findings.md export-env decisions
Six symbols were referenced across the codebase but had no definition anywhere.
Star-imports from lib_provisioning/mod.nu silenced the missing-def errors at
parse time; at runtime the call sites either threw or took dead code paths.
ADR-025 Phase 2 (AST audit) surfaced them as blockers for Phase 3 because
selective imports would expose them as "variable not found" errors.
Resolution: add stub getters in lib_provisioning/config/accessor/functions.nu
following the existing pattern (env -> config -> PROVISIONING-derived -> ""):
- get-providers-path (14 call sites)
- get-prov-lib-path (2 call sites)
- get-core-nulib-path (7 call sites)
- get-provisioning-generate-dirpath (5 call sites)
- get-provisioning-generate-defsfile (1 call site)
- get-provisioning-req-versions (4 call sites)
All existing callers already guard results with is-empty / path exists checks,
so empty-string returns fall back to safe no-op paths.
show_tools_info (main_provisioning/tools.nu) was missing a guard around its
open call; added is-empty / path-exists check matching sibling fns.
The only non-path symbol (on_clusters in clusters/create.nu) had no recoverable
implementation; its closure is replaced with a user-facing message directing
to 'prvng cluster deploy' (the supported workflow).
Refs: ADR-025, .coder/benchmarks/phase2-findings.md blockers section
Six symbols were referenced across the codebase but had no definition anywhere.
Star-imports from lib_provisioning/mod.nu silenced the missing-def errors at
parse time; at runtime the call sites either threw or took dead code paths.
ADR-025 Phase 2 (AST audit) surfaced them as blockers for Phase 3 because
selective imports would expose them as "variable not found" errors.
Resolution: add stub getters in lib_provisioning/config/accessor/functions.nu
following the existing pattern (env -> config -> PROVISIONING-derived -> ""):
- get-providers-path (14 call sites)
- get-prov-lib-path (2 call sites)
- get-core-nulib-path (7 call sites)
- get-provisioning-generate-dirpath (5 call sites)
- get-provisioning-generate-defsfile (1 call site)
- get-provisioning-req-versions (4 call sites)
All existing callers already guard results with is-empty / path exists checks,
so empty-string returns fall back to safe no-op paths.
show_tools_info (main_provisioning/tools.nu) was missing a guard around its
open call; added is-empty / path-exists check matching sibling fns.
The only non-path symbol (on_clusters in clusters/create.nu) had no recoverable
implementation; its closure is replaced with a user-facing message directing
to 'prvng cluster deploy' (the supported workflow).
Refs: ADR-025, .coder/benchmarks/phase2-findings.md blockers section
Six symbols were referenced across the codebase but had no definition anywhere.
Star-imports from lib_provisioning/mod.nu silenced the missing-def errors at
parse time; at runtime the call sites either threw or took dead code paths.
ADR-025 Phase 2 (AST audit) surfaced them as blockers for Phase 3 because
selective imports would expose them as "variable not found" errors.
Resolution: add stub getters in lib_provisioning/config/accessor/functions.nu
following the existing pattern (env -> config -> PROVISIONING-derived -> ""):
- get-providers-path (14 call sites)
- get-prov-lib-path (2 call sites)
- get-core-nulib-path (7 call sites)
- get-provisioning-generate-dirpath (5 call sites)
- get-provisioning-generate-defsfile (1 call site)
- get-provisioning-req-versions (4 call sites)
All existing callers already guard results with is-empty / path exists checks,
so empty-string returns fall back to safe no-op paths.
show_tools_info (main_provisioning/tools.nu) was missing a guard around its
open call; added is-empty / path-exists check matching sibling fns.
The only non-path symbol (on_clusters in clusters/create.nu) had no recoverable
implementation; its closure is replaced with a user-facing message directing
to 'prvng cluster deploy' (the supported workflow).
Refs: ADR-025, .coder/benchmarks/phase2-findings.md blockers section
