npm - @celilo/cli - Versions diffs - 0.1.0 - Mend

@celilo/cli 0.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (267) hide show

package/README.md +1566 -0
package/bin/celilo +16 -0
package/drizzle/0000_complex_puma.sql +179 -0
package/drizzle/0001_dizzy_wolfpack.sql +2 -0
package/drizzle/0002_web_routes.sql +16 -0
package/drizzle/0003_backup_storage.sql +32 -0
package/drizzle/meta/0000_snapshot.json +1151 -0
package/drizzle/meta/0001_snapshot.json +1167 -0
package/drizzle/meta/0002_snapshot.json +1257 -0
package/drizzle/meta/_journal.json +27 -0
package/package.json +64 -0
package/schemas/system_config.json +106 -0
package/src/__integration__/container-services-cli.integration.test.ts +246 -0
package/src/ansible/dependencies.test.ts +309 -0
package/src/ansible/dependencies.ts +896 -0
package/src/ansible/inventory.test.ts +463 -0
package/src/ansible/inventory.ts +445 -0
package/src/ansible/secrets.ts +222 -0
package/src/ansible/validation.test.ts +92 -0
package/src/ansible/validation.ts +272 -0
package/src/api-clients/digitalocean.ts +94 -0
package/src/api-clients/proxmox.ts +655 -0
package/src/capabilities/logging-wrapper.test.ts +217 -0
package/src/capabilities/lookup.test.ts +149 -0
package/src/capabilities/lookup.ts +89 -0
package/src/capabilities/public-web-helpers.test.ts +198 -0
package/src/capabilities/public-web-publish.test.ts +458 -0
package/src/capabilities/registration.test.ts +395 -0
package/src/capabilities/registration.ts +200 -0
package/src/capabilities/route-validation.test.ts +121 -0
package/src/capabilities/route-validation.ts +96 -0
package/src/capabilities/secret-ref.test.ts +313 -0
package/src/capabilities/secret-validation.ts +157 -0
package/src/capabilities/secrets.test.ts +750 -0
package/src/capabilities/secrets.ts +244 -0
package/src/capabilities/validation.test.ts +613 -0
package/src/capabilities/validation.ts +160 -0
package/src/capabilities/well-known.test.ts +238 -0
package/src/capabilities/well-known.ts +222 -0
package/src/cli/cli.test.ts +654 -0
package/src/cli/command-registry.ts +742 -0
package/src/cli/command-tree-parser.test.ts +180 -0
package/src/cli/command-tree-parser.ts +193 -0
package/src/cli/commands/backup-create.ts +137 -0
package/src/cli/commands/backup-delete.ts +74 -0
package/src/cli/commands/backup-import.ts +97 -0
package/src/cli/commands/backup-list.ts +132 -0
package/src/cli/commands/backup-name.ts +73 -0
package/src/cli/commands/backup-prune.ts +98 -0
package/src/cli/commands/backup-restore.ts +122 -0
package/src/cli/commands/capability-info.ts +121 -0
package/src/cli/commands/capability-list.ts +47 -0
package/src/cli/commands/completion.ts +87 -0
package/src/cli/commands/hook-run.ts +176 -0
package/src/cli/commands/ipam.ts +607 -0
package/src/cli/commands/machine-add.ts +235 -0
package/src/cli/commands/machine-earmark.ts +82 -0
package/src/cli/commands/machine-list.ts +77 -0
package/src/cli/commands/machine-remove.ts +90 -0
package/src/cli/commands/machine-status.ts +131 -0
package/src/cli/commands/module-audit.ts +51 -0
package/src/cli/commands/module-build.ts +60 -0
package/src/cli/commands/module-config.ts +170 -0
package/src/cli/commands/module-deploy.ts +71 -0
package/src/cli/commands/module-generate.ts +236 -0
package/src/cli/commands/module-health.ts +108 -0
package/src/cli/commands/module-import.ts +80 -0
package/src/cli/commands/module-list.ts +43 -0
package/src/cli/commands/module-logs.ts +73 -0
package/src/cli/commands/module-remove.ts +162 -0
package/src/cli/commands/module-show.ts +208 -0
package/src/cli/commands/module-status.ts +131 -0
package/src/cli/commands/module-types.ts +189 -0
package/src/cli/commands/module-upgrade.ts +192 -0
package/src/cli/commands/package.ts +68 -0
package/src/cli/commands/secret-list.ts +99 -0
package/src/cli/commands/secret-set.ts +134 -0
package/src/cli/commands/service-add-digitalocean.ts +133 -0
package/src/cli/commands/service-add-proxmox.ts +342 -0
package/src/cli/commands/service-config-get.ts +83 -0
package/src/cli/commands/service-config-set.ts +145 -0
package/src/cli/commands/service-list.ts +74 -0
package/src/cli/commands/service-reconfigure.ts +230 -0
package/src/cli/commands/service-remove.ts +103 -0
package/src/cli/commands/service-verify.ts +240 -0
package/src/cli/commands/status.ts +216 -0
package/src/cli/commands/storage-add-local.ts +106 -0
package/src/cli/commands/storage-add-s3.ts +114 -0
package/src/cli/commands/storage-list.ts +72 -0
package/src/cli/commands/storage-remove.ts +54 -0
package/src/cli/commands/storage-set-default.ts +44 -0
package/src/cli/commands/storage-verify.ts +54 -0
package/src/cli/commands/system-config.ts +168 -0
package/src/cli/commands/system-init.ts +314 -0
package/src/cli/commands/system-secret-get.ts +98 -0
package/src/cli/commands/system-secret-set.ts +76 -0
package/src/cli/commands/system-vault-password.ts +34 -0
package/src/cli/completion.test.ts +37 -0
package/src/cli/completion.ts +482 -0
package/src/cli/fuel-gauge.test.ts +208 -0
package/src/cli/fuel-gauge.ts +405 -0
package/src/cli/generate-zsh-completion.test.ts +95 -0
package/src/cli/generate-zsh-completion.ts +497 -0
package/src/cli/index.ts +1583 -0
package/src/cli/interactive-config.test.ts +201 -0
package/src/cli/interactive-config.ts +62 -0
package/src/cli/parser.test.ts +227 -0
package/src/cli/parser.ts +244 -0
package/src/cli/prompts.test.ts +33 -0
package/src/cli/prompts.ts +121 -0
package/src/cli/types.ts +38 -0
package/src/cli/validators.test.ts +235 -0
package/src/cli/validators.ts +188 -0
package/src/config/env.ts +41 -0
package/src/config/paths.test.ts +172 -0
package/src/config/paths.ts +108 -0
package/src/db/client.ts +190 -0
package/src/db/migrate.ts +30 -0
package/src/db/schema.test.ts +221 -0
package/src/db/schema.ts +434 -0
package/src/hooks/capability-loader-firewall.test.ts +246 -0
package/src/hooks/capability-loader.test.ts +100 -0
package/src/hooks/capability-loader.ts +520 -0
package/src/hooks/define-hook.test.ts +488 -0
package/src/hooks/executor.test.ts +462 -0
package/src/hooks/executor.ts +469 -0
package/src/hooks/logger.test.ts +54 -0
package/src/hooks/logger.ts +95 -0
package/src/hooks/test-fixtures/failing-hook.ts +13 -0
package/src/hooks/test-fixtures/no-default-hook.ts +6 -0
package/src/hooks/test-fixtures/success-hook.ts +20 -0
package/src/hooks/test-fixtures/unbranded-hook.ts +11 -0
package/src/hooks/test-fixtures/void-hook.ts +13 -0
package/src/hooks/types.ts +89 -0
package/src/infrastructure/property-extractor.test.ts +194 -0
package/src/infrastructure/property-extractor.ts +151 -0
package/src/ipam/allocator.test.ts +442 -0
package/src/ipam/allocator.ts +369 -0
package/src/ipam/auto-allocator.test.ts +247 -0
package/src/ipam/auto-allocator.ts +270 -0
package/src/ipam/subnet-parser.test.ts +107 -0
package/src/ipam/subnet-parser.ts +136 -0
package/src/manifest/contracts/index.ts +61 -0
package/src/manifest/contracts/v1.ts +118 -0
package/src/manifest/json-schema-roundtrip.test.ts +99 -0
package/src/manifest/schema.ts +367 -0
package/src/manifest/template-validator.test.ts +231 -0
package/src/manifest/template-validator.ts +322 -0
package/src/manifest/validate.test.ts +1180 -0
package/src/manifest/validate.ts +415 -0
package/src/module/import.test.ts +355 -0
package/src/module/import.ts +676 -0
package/src/module/packaging/audit.ts +169 -0
package/src/module/packaging/build.ts +228 -0
package/src/module/packaging/checksum.ts +41 -0
package/src/module/packaging/extract.ts +234 -0
package/src/module/packaging/signature.ts +47 -0
package/src/secrets/encryption.test.ts +284 -0
package/src/secrets/encryption.ts +162 -0
package/src/secrets/generators.test.ts +112 -0
package/src/secrets/generators.ts +127 -0
package/src/secrets/master-key.test.ts +159 -0
package/src/secrets/master-key.ts +114 -0
package/src/secrets/storage.test.ts +115 -0
package/src/secrets/storage.ts +106 -0
package/src/secrets/vault.test.ts +35 -0
package/src/secrets/vault.ts +42 -0
package/src/services/backup-create.ts +532 -0
package/src/services/backup-metadata.ts +198 -0
package/src/services/backup-restore.ts +229 -0
package/src/services/backup-retention.ts +84 -0
package/src/services/backup-storage.ts +281 -0
package/src/services/build-stream.test.ts +122 -0
package/src/services/build-stream.ts +201 -0
package/src/services/config-interview.ts +694 -0
package/src/services/container-service.test.ts +298 -0
package/src/services/container-service.ts +401 -0
package/src/services/cross-module-data-manager.test.ts +405 -0
package/src/services/cross-module-data-manager.ts +412 -0
package/src/services/deploy-ansible.ts +88 -0
package/src/services/deploy-planner.ts +153 -0
package/src/services/deploy-preflight.ts +274 -0
package/src/services/deploy-ssh.ts +131 -0
package/src/services/deploy-terraform.test.ts +55 -0
package/src/services/deploy-terraform.ts +445 -0
package/src/services/deploy-validation.ts +311 -0
package/src/services/dns-auto-register.ts +211 -0
package/src/services/health-runner.ts +184 -0
package/src/services/infrastructure-selector.test.ts +485 -0
package/src/services/infrastructure-selector.ts +245 -0
package/src/services/infrastructure-variable-resolver.test.ts +751 -0
package/src/services/infrastructure-variable-resolver.ts +234 -0
package/src/services/machine-detector.ts +328 -0
package/src/services/machine-pool.test.ts +405 -0
package/src/services/machine-pool.ts +316 -0
package/src/services/manifest-validation.ts +120 -0
package/src/services/module-build.test.ts +290 -0
package/src/services/module-build.ts +431 -0
package/src/services/module-config.test.ts +237 -0
package/src/services/module-config.ts +298 -0
package/src/services/module-deploy.ts +862 -0
package/src/services/module-types-drift.test.ts +73 -0
package/src/services/module-types-generator.test.ts +288 -0
package/src/services/module-types-generator.ts +189 -0
package/src/services/proxmox-state-recovery.ts +140 -0
package/src/services/schema-validation.ts +155 -0
package/src/services/secret-schema-loader.test.ts +311 -0
package/src/services/secret-schema-loader.ts +239 -0
package/src/services/ssh-key-manager.test.ts +283 -0
package/src/services/ssh-key-manager.ts +193 -0
package/src/services/storage-providers/local.ts +105 -0
package/src/services/storage-providers/s3.ts +182 -0
package/src/services/storage-providers/types.ts +24 -0
package/src/services/system-config-schema-types.ts +25 -0
package/src/services/system-config-validator.test.ts +160 -0
package/src/services/system-config-validator.ts +74 -0
package/src/services/system-init.test.ts +153 -0
package/src/services/system-init.ts +253 -0
package/src/services/terraform-safety.ts +174 -0
package/src/services/zone-detector.test.ts +110 -0
package/src/services/zone-detector.ts +102 -0
package/src/services/zone-policy.test.ts +97 -0
package/src/services/zone-policy.ts +126 -0
package/src/templates/generator.test.ts +645 -0
package/src/templates/generator.ts +1119 -0
package/src/templates/types.ts +62 -0
package/src/test-utils/INTERACTIVE_PROMPTS.md +167 -0
package/src/test-utils/cli-context-interactive.test.ts +152 -0
package/src/test-utils/cli-context-server.test.ts +66 -0
package/src/test-utils/cli-context.test.ts +273 -0
package/src/test-utils/cli-context.ts +677 -0
package/src/test-utils/cli-result.test.ts +282 -0
package/src/test-utils/cli-result.ts +241 -0
package/src/test-utils/cli.ts +55 -0
package/src/test-utils/completion-harness.test.ts +126 -0
package/src/test-utils/completion-harness.ts +82 -0
package/src/test-utils/database.test.ts +182 -0
package/src/test-utils/database.ts +126 -0
package/src/test-utils/filesystem.test.ts +208 -0
package/src/test-utils/filesystem.ts +142 -0
package/src/test-utils/fixtures.test.ts +123 -0
package/src/test-utils/fixtures.ts +160 -0
package/src/test-utils/golden-diff.ts +197 -0
package/src/test-utils/index.ts +77 -0
package/src/test-utils/integration.ts +81 -0
package/src/test-utils/module-fixtures.ts +468 -0
package/src/test-utils/modules.test.ts +144 -0
package/src/test-utils/modules.ts +183 -0
package/src/test-utils/setup-test-db.ts +90 -0
package/src/test-utils/value-extractor.test.ts +231 -0
package/src/test-utils/value-extractor.ts +228 -0
package/src/types/infrastructure.ts +157 -0
package/src/utils/shell.test.ts +365 -0
package/src/utils/shell.ts +159 -0
package/src/validation/schemas.ts +166 -0
package/src/variables/ansible-resolver.test.ts +142 -0
package/src/variables/ansible-resolver.ts +69 -0
package/src/variables/capability-self-ref.test.ts +220 -0
package/src/variables/context.test.ts +1265 -0
package/src/variables/context.ts +624 -0
package/src/variables/declarative-derivation.test.ts +743 -0
package/src/variables/declarative-derivation.ts +200 -0
package/src/variables/parser.test.ts +231 -0
package/src/variables/parser.ts +76 -0
package/src/variables/resolver.test.ts +458 -0
package/src/variables/resolver.ts +282 -0
package/src/variables/types.ts +59 -0

package/src/capabilities/public-web-publish.test.ts ADDED Viewed

@@ -0,0 +1,458 @@
+/**
+ * Integration test for `publishStaticSite`'s clientConfig injection.
+ *
+ * The factory itself opens SSH connections and shells out to tar — we
+ * stub `child_process.execSync` so the test exercises only the parts
+ * that matter for D4: config.js generation, file write into sourceDir,
+ * and the composition order (register_route → write file → upload).
+ *
+ * Why `spyOn` instead of `mock.module`: bun:test's `mock.module()` is
+ * a runtime-global replacement that persists across every test file in
+ * the suite. Mocking `node:child_process` that way breaks unrelated
+ * tests (e.g. CommandTreeParser, deriveSecret) because their own
+ * `execSync` calls hit our stub. `spyOn` is auto-restored after each
+ * test and stays scoped to this file.
+ */
+import { afterEach, beforeEach, describe, expect, spyOn, test } from 'bun:test';
+import * as childProcess from 'node:child_process';
+import { existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { createPublicWeb } from '@celilo/capabilities';
+import type { HookLogger, RouteOps, WebRoute } from '@celilo/capabilities';
+import { createCapturingLogger } from '../hooks/logger';
+let execSyncSpy: ReturnType<typeof spyOn>;
+const noopLogger: HookLogger = {
+  info() {},
+  warn() {},
+  error() {},
+  success() {},
+};
+function makeRouteOps(): { ops: RouteOps; routes: WebRoute[] } {
+  const routes: WebRoute[] = [];
+  let nextId = 1;
+  const ops: RouteOps = {
+    getRoutes(moduleId) {
+      return routes.filter((r) => r.moduleId === moduleId);
+    },
+    getAllRoutes() {
+      return [...routes];
+    },
+    upsertRoute(route) {
+      const existing = routes.findIndex(
+        (r) => r.path === route.path && r.moduleId === route.moduleId,
+      );
+      const now = new Date();
+      const stored: WebRoute = {
+        id: existing >= 0 ? routes[existing].id : nextId++,
+        slug: route.slug,
+        moduleId: route.moduleId,
+        type: route.type,
+        path: route.path,
+        targetHost: route.targetHost ?? null,
+        targetPort: route.targetPort ?? null,
+        subdomain: route.subdomain ?? null,
+        websocket: route.websocket ?? false,
+        contentHash: route.contentHash ?? null,
+        createdAt: existing >= 0 ? routes[existing].createdAt : now,
+        updatedAt: now,
+      };
+      if (existing >= 0) {
+        routes[existing] = stored;
+      } else {
+        routes.push(stored);
+      }
+    },
+    deleteRoute(moduleId, path) {
+      const i = routes.findIndex((r) => r.moduleId === moduleId && r.path === path);
+      if (i >= 0) routes.splice(i, 1);
+    },
+    deleteRoutesBySlug(slug) {
+      for (let i = routes.length - 1; i >= 0; i--) {
+        if (routes[i].slug === slug) routes.splice(i, 1);
+      }
+    },
+    deleteRoutesByModule(moduleId) {
+      for (let i = routes.length - 1; i >= 0; i--) {
+        if (routes[i].moduleId === moduleId) routes.splice(i, 1);
+      }
+    },
+  };
+  return { ops, routes };
+}
+describe('publishStaticSite — clientConfig injection', () => {
+  let sourceDir: string;
+  beforeEach(() => {
+    // Stub execSync to a no-op for the duration of this test only.
+    // spyOn auto-restores when the test finishes, so other test files
+    // in the same suite get the real implementation.
+    execSyncSpy = spyOn(childProcess, 'execSync').mockReturnValue(Buffer.from(''));
+    sourceDir = mkdtempSync(join(tmpdir(), 'publish-static-site-'));
+    // Drop a fake build artifact so the upload "has something to do".
+    writeFileSync(join(sourceDir, 'index.html'), '<html></html>', 'utf-8');
+  });
+  afterEach(() => {
+    execSyncSpy.mockRestore();
+    rmSync(sourceDir, { recursive: true, force: true });
+  });
+  test('writes config.js into sourceDir before upload when clientConfig is provided', async () => {
+    const { ops } = makeRouteOps();
+    const cap = createPublicWeb({
+      moduleId: 'lunacycle',
+      logger: noopLogger,
+      config: {
+        container_ip: '10.0.10.20/24',
+        hostname: 'www',
+        primary_domain: 'example.com',
+        email: 'admin@example.com',
+      },
+      secrets: {},
+      routeOps: ops,
+    });
+    const result = await cap.publishStaticSite({
+      path: '/lunacycle',
+      sourceDir,
+      clientConfig: {
+        AUTHENTIK_URL: 'https://auth.example.com/application/o',
+        CLIENT_ID: 'lunacycle-web',
+        REDIRECT_URI: 'https://www.example.com/lunacycle/auth/callback',
+      },
+    });
+    expect(result.success).toBe(true);
+    expect(result.path).toBe('/lunacycle');
+    const configPath = join(sourceDir, 'config.js');
+    expect(existsSync(configPath)).toBe(true);
+    const configContents = readFileSync(configPath, 'utf-8');
+    expect(configContents).toContain('window.__MODULE_CONFIG__ =');
+    expect(configContents).toContain('"AUTHENTIK_URL":"https://auth.example.com/application/o"');
+    expect(configContents).toContain('"CLIENT_ID":"lunacycle-web"');
+    expect(configContents).toContain(
+      '"REDIRECT_URI":"https://www.example.com/lunacycle/auth/callback"',
+    );
+    expect(configContents.startsWith('// Generated by Celilo')).toBe(true);
+  });
+  test('does not write config.js when clientConfig is omitted', async () => {
+    const { ops } = makeRouteOps();
+    const cap = createPublicWeb({
+      moduleId: 'lunacycle',
+      logger: noopLogger,
+      config: {
+        container_ip: '10.0.10.20/24',
+        hostname: 'www',
+        primary_domain: 'example.com',
+        email: 'admin@example.com',
+      },
+      secrets: {},
+      routeOps: ops,
+    });
+    await cap.publishStaticSite({
+      path: '/lunacycle',
+      sourceDir,
+      // no clientConfig
+    });
+    expect(existsSync(join(sourceDir, 'config.js'))).toBe(false);
+  });
+  test('registers the route as static and records moduleId/path', async () => {
+    const { ops, routes } = makeRouteOps();
+    const cap = createPublicWeb({
+      moduleId: 'lunacycle',
+      logger: noopLogger,
+      config: {
+        container_ip: '10.0.10.20/24',
+        hostname: 'www',
+        primary_domain: 'example.com',
+        email: 'admin@example.com',
+      },
+      secrets: {},
+      routeOps: ops,
+    });
+    await cap.publishStaticSite({
+      path: '/lunacycle',
+      sourceDir,
+    });
+    const stored = routes.find((r) => r.path === '/lunacycle');
+    expect(stored).toBeDefined();
+    expect(stored?.type).toBe('static');
+    expect(stored?.moduleId).toBe('lunacycle');
+    expect(stored?.slug).toBe('lunacycle');
+  });
+  test('fails fast when sourceDir does not exist', async () => {
+    const { ops } = makeRouteOps();
+    const cap = createPublicWeb({
+      moduleId: 'lunacycle',
+      logger: noopLogger,
+      config: {
+        container_ip: '10.0.10.20/24',
+        hostname: 'www',
+        primary_domain: 'example.com',
+        email: 'admin@example.com',
+      },
+      secrets: {},
+      routeOps: ops,
+    });
+    await expect(
+      cap.publishStaticSite({
+        path: '/lunacycle',
+        sourceDir: '/nonexistent/path/that/should/not/exist',
+        clientConfig: { FOO: 'bar' },
+      }),
+    ).rejects.toThrow('sourceDir does not exist');
+  });
+  test('fails validation before touching the filesystem', async () => {
+    const { ops } = makeRouteOps();
+    const cap = createPublicWeb({
+      moduleId: 'lunacycle',
+      logger: noopLogger,
+      config: {
+        container_ip: '10.0.10.20/24',
+        hostname: 'www',
+        primary_domain: 'example.com',
+        email: 'admin@example.com',
+      },
+      secrets: {},
+      routeOps: ops,
+    });
+    await expect(
+      cap.publishStaticSite({
+        path: '', // bad — caught by validator before any side effects
+        sourceDir,
+      }),
+    ).rejects.toThrow('Invalid publishStaticSite request');
+    // The doomed call must not have written config.js or registered a route.
+    expect(existsSync(join(sourceDir, 'config.js'))).toBe(false);
+  });
+});
+describe('registerReverseProxy', () => {
+  beforeEach(() => {
+    execSyncSpy = spyOn(childProcess, 'execSync').mockReturnValue(Buffer.from(''));
+  });
+  afterEach(() => {
+    execSyncSpy.mockRestore();
+  });
+  test('registers a reverse_proxy route and returns the path', async () => {
+    const { ops, routes } = makeRouteOps();
+    const cap = createPublicWeb({
+      moduleId: 'lunacycle',
+      logger: noopLogger,
+      config: {
+        container_ip: '10.0.10.20/24',
+        hostname: 'www',
+        primary_domain: 'example.com',
+        email: 'admin@example.com',
+      },
+      secrets: {},
+      routeOps: ops,
+    });
+    const result = await cap.registerReverseProxy({
+      path: '/lunacycle/api',
+      targetHost: '10.0.20.42',
+      targetPort: 8080,
+      websocket: true,
+    });
+    expect(result.success).toBe(true);
+    expect(result.path).toBe('/lunacycle/api');
+    const stored = routes.find((r) => r.path === '/lunacycle/api');
+    expect(stored).toBeDefined();
+    expect(stored?.type).toBe('reverse_proxy');
+    expect(stored?.targetHost).toBe('10.0.20.42');
+    expect(stored?.targetPort).toBe(8080);
+    expect(stored?.websocket).toBe(true);
+  });
+  test('rejects invalid request before touching routeOps', async () => {
+    const { ops, routes } = makeRouteOps();
+    const cap = createPublicWeb({
+      moduleId: 'lunacycle',
+      logger: noopLogger,
+      config: {
+        container_ip: '10.0.10.20/24',
+        hostname: 'www',
+        primary_domain: 'example.com',
+        email: 'admin@example.com',
+      },
+      secrets: {},
+      routeOps: ops,
+    });
+    await expect(
+      cap.registerReverseProxy({
+        path: '/lunacycle/api',
+        targetHost: '',
+        targetPort: 8080,
+      }),
+    ).rejects.toThrow('Invalid registerReverseProxy request');
+    expect(routes).toHaveLength(0);
+  });
+});
+describe('auto-logging — end-to-end through createPublicWeb', () => {
+  let sourceDir: string;
+  beforeEach(() => {
+    execSyncSpy = spyOn(childProcess, 'execSync').mockReturnValue(Buffer.from(''));
+    sourceDir = mkdtempSync(join(tmpdir(), 'autolog-publish-'));
+    writeFileSync(join(sourceDir, 'index.html'), '<html></html>', 'utf-8');
+  });
+  afterEach(() => {
+    execSyncSpy.mockRestore();
+    rmSync(sourceDir, { recursive: true, force: true });
+  });
+  test('successful primitive call emits → and ✓ markers via the captured logger', async () => {
+    const { logger, messages } = createCapturingLogger();
+    const { ops } = makeRouteOps();
+    const cap = createPublicWeb({
+      moduleId: 'lunacycle',
+      logger,
+      config: {
+        container_ip: '10.0.10.20/24',
+        hostname: 'www',
+        primary_domain: 'example.com',
+        email: 'admin@example.com',
+      },
+      secrets: {},
+      routeOps: ops,
+    });
+    await cap.register_route({
+      type: 'reverse_proxy',
+      path: '/lunacycle/api',
+      targetHost: '10.0.20.42',
+      targetPort: 8080,
+    });
+    const messageTexts = messages.map((m) => m.message);
+    expect(messageTexts).toContain('→ public_web.register_route');
+    expect(messageTexts).toContain('✓ public_web.register_route');
+    // The error marker must NOT appear on a successful call.
+    expect(messageTexts.some((m) => m.startsWith('✗'))).toBe(false);
+  });
+  test('failed primitive call emits ✗ marker and re-throws', async () => {
+    const { logger, messages } = createCapturingLogger();
+    const { ops } = makeRouteOps();
+    const cap = createPublicWeb({
+      moduleId: 'lunacycle',
+      logger,
+      config: {
+        container_ip: '10.0.10.20/24',
+        hostname: 'www',
+        primary_domain: 'example.com',
+        email: 'admin@example.com',
+      },
+      secrets: {},
+      routeOps: ops,
+    });
+    // Bad path triggers the validator inside register_route, which
+    // throws — the wrapper should catch, log, and re-throw.
+    await expect(
+      cap.register_route({
+        type: 'static',
+        path: 'no-leading-slash', // invalid
+      }),
+    ).rejects.toThrow('Invalid route');
+    const errorMessage = messages.find((m) => m.level === 'error');
+    expect(errorMessage).toBeDefined();
+    expect(errorMessage?.message).toContain('✗ public_web.register_route');
+    expect(errorMessage?.message).toContain('Invalid route');
+  });
+  test('high-level call composes its primitives and logs each step', async () => {
+    const { logger, messages } = createCapturingLogger();
+    const { ops } = makeRouteOps();
+    const cap = createPublicWeb({
+      moduleId: 'lunacycle',
+      logger,
+      config: {
+        container_ip: '10.0.10.20/24',
+        hostname: 'www',
+        primary_domain: 'example.com',
+        email: 'admin@example.com',
+      },
+      secrets: {},
+      routeOps: ops,
+    });
+    await cap.publishStaticSite({ path: '/lunacycle', sourceDir });
+    const messageTexts = messages.map((m) => m.message);
+    // The high-level call itself logs.
+    expect(messageTexts).toContain('→ public_web.publishStaticSite');
+    expect(messageTexts).toContain('✓ public_web.publishStaticSite');
+    // It also composes register_route + upload_static_assets internally.
+    // Those run via the unwrapped reference (`capability.<method>` from
+    // inside the factory closure), so they do NOT produce extra arrow
+    // markers — only the outer publishStaticSite call is logged.
+    // This keeps high-level calls a single semantic step in logs.
+    expect(messageTexts.filter((m) => m.startsWith('→'))).toHaveLength(1);
+    expect(messageTexts.filter((m) => m.startsWith('✓'))).toHaveLength(1);
+  });
+  test('does not log payloads or result values', async () => {
+    const { logger, messages } = createCapturingLogger();
+    const { ops } = makeRouteOps();
+    const cap = createPublicWeb({
+      moduleId: 'lunacycle',
+      logger,
+      config: {
+        container_ip: '10.0.10.20/24',
+        hostname: 'www',
+        primary_domain: 'example.com',
+        email: 'admin@example.com',
+      },
+      secrets: {},
+      routeOps: ops,
+    });
+    await cap.register_route({
+      type: 'reverse_proxy',
+      path: '/lunacycle/api',
+      targetHost: '10.0.20.42',
+      targetPort: 8080,
+    });
+    // None of the request fields should appear in the log lines.
+    for (const m of messages) {
+      expect(m.message).not.toContain('10.0.20.42');
+      expect(m.message).not.toContain('8080');
+      expect(m.message).not.toContain('lunacycle/api');
+    }
+  });
+});