@descix/cli 1.0.1 → 1.0.4

package/lib/commands/config.js

@@ -1,47 +1,48 @@
 /**
  * Configuration Commands
- * 
+ *
  * Manage CLI configuration (.descix/workspace.json)
- * Uses PathContext for path resolution - no process.cwd() lookups
+ * Uses WorkspaceConfig for path resolution - no process.cwd() lookups
  */
 
 import chalk from 'chalk';
 import * as path from 'path';
-import { PathContext } from '../core/PathContext.js';
 import { WorkspaceConfig } from '../workspace-config.js';
+import { environmentNameFor } from '../environment-report.js';
 
 /**
  * Show current configuration
  */
 export async function show() {
   try {
-    const ctx = await PathContext.load();
-    const config = ctx.getWorkspaceConfig();
-    const workspaceRoot = ctx.getWorkspaceRoot();
-    
+    const workspaceConfig = await WorkspaceConfig.load();
+    const workspaceRoot = workspaceConfig.getWorkspaceRoot();
+
     console.log(chalk.cyan('\n📋 DeSciX Workspace Configuration:\n'));
     console.log(chalk.white(`   Workspace:     ${workspaceRoot}`));
-    console.log(chalk.white(`   API URL:       ${config.apiUrl || 'https://descix.net (default)'}`));
-    console.log(chalk.white(`   Environment:   ${config.environment || 'production'}`));
-    
-    // Show communities/apps
-    const communities = Object.keys(config.communities || {});
-    if (communities.length > 0) {
-      console.log(chalk.white(`   Communities:   ${communities.join(', ')}`));
-      
-      for (const commId of communities) {
-        const apps = Object.keys(config.communities[commId]?.apps || {});
-        if (apps.length > 0) {
-          console.log(chalk.gray(`     └─ ${commId}: ${apps.join(', ')}`));
-        }
-      }
+    // Under (A', contract rev 2) getApiUrl() ALWAYS yields an origin — a workspace that named
+    // none resolves to the declared default. The "(not configured)" branch is therefore
+    // unreachable and was DELETED, not fenced.
+    const configuredOrigin = workspaceConfig.getApiUrl();
+    console.log(chalk.white(`   API URL:       ${configuredOrigin}`));
+    // The environment NAME comes from the ONE owner that derives it from the origin. It used to
+    // read a separate `env.environment` key and fall back to the literal 'production' — a second
+    // derivation of the same fact, which could disagree with the origin printed one line above.
+    console.log(chalk.white(`   Environment:   ${environmentNameFor(configuredOrigin)}`));
+
+    // Show mapped apps (v2.1 env.products)
+    const platform = workspaceConfig.env?.platform;
+    const products = workspaceConfig.env?.products || [];
+    const allApps = [platform?.appId, ...products.map(p => p.appId)].filter(Boolean);
+    if (allApps.length > 0) {
+      console.log(chalk.white(`   Apps:          ${allApps.join(', ')}`));
     }
-    
+
     console.log('');
     const configPath = path.join(workspaceRoot, '.descix', 'workspace.json');
     console.log(chalk.gray(`   Config file: ${configPath}`));
     console.log('');
-    
+
   } catch (error) {
     console.error(chalk.red('Error loading config:', error.message));
     throw error;
@@ -53,18 +54,17 @@ export async function show() {
  */
 export async function setUrl(url, options = {}) {
   try {
-    const ctx = await PathContext.load();
-    const workspaceRoot = ctx.getWorkspaceRoot();
-    
-    const workspaceConfig = await WorkspaceConfig.load(workspaceRoot);
+    const workspaceConfig = await WorkspaceConfig.load();
+    const workspaceRoot = workspaceConfig.getWorkspaceRoot();
+
     workspaceConfig.apiUrl = url;
     workspaceConfig.environment = url.includes('localhost') ? 'development' : 'production';
     const configPath = await workspaceConfig.save(workspaceRoot);
-    
+
     console.log(chalk.green('\n✅ Configuration updated!\n'));
     console.log(chalk.white(`   API URL: ${url}`));
     console.log(chalk.gray(`   Saved to: ${configPath}\n`));
-    
+
   } catch (error) {
     console.error(chalk.red('Error updating config:', error.message));
     throw error;
@@ -74,29 +74,41 @@ export async function setUrl(url, options = {}) {
 /**
  * Initialize config for environment
  */
-export async function init(env = 'prod', options = {}) {
+export async function init(env, options = {}) {
   try {
-    const ctx = await PathContext.load();
-    const workspaceRoot = ctx.getWorkspaceRoot();
-    
-    const workspaceConfig = await WorkspaceConfig.load(workspaceRoot);
-    
-    // Set API URL based on environment
-    if (env === 'dev') {
-      workspaceConfig.apiUrl = 'https://localhost:4000';
-      workspaceConfig.environment = 'development';
-    } else {
-      workspaceConfig.apiUrl = 'https://descix.net';
-      workspaceConfig.environment = 'production';
+    // NO DEFAULT ENVIRONMENT. This used to be `init(env = 'prod')` with an `if (env === 'dev')
+    // … else <production>` body, which meant a bare `descix config init` — and ANY unrecognised
+    // environment name, including a typo — silently wrote the PRODUCTION origin into the
+    // workspace. That is precisely "an origin the developer did not choose".
+    if (!env) {
+      throw new Error(
+        'descix config init requires an environment: --env dev|demo|prod.\n' +
+        'There is no default — the origin this workspace talks to is a choice, not an omission.'
+      );
     }
-    
-    const configPath = await workspaceConfig.save(workspaceRoot);
-    
+
+    const normalized = String(env).toLowerCase();
+    const known = WorkspaceConfig.ENV_MAP[normalized];
+    if (!known) {
+      throw new Error(
+        `Unknown environment "${env}". Known environments: ` +
+        `${Object.keys(WorkspaceConfig.ENV_MAP).join(', ')}.\n` +
+        'For a self-hosted or port-forwarded gateway use ' +
+        '`descix config set-env <name> --url https://...`.'
+      );
+    }
+
+    // Write through the CANONICAL writer. This function used to assign the LEGACY top-level
+    // `workspaceConfig.apiUrl`, while `config set-env` writes `env.apiUrl` — two writers of one
+    // fact, writing two different keys, one of which `getApiUrl()` only consults as a fallback.
+    const workspaceConfig = await WorkspaceConfig.load();
+    const result = await workspaceConfig.setEnvironment(normalized, options.url || null);
+
     console.log(chalk.green('\n✅ Configuration initialized!\n'));
-    console.log(chalk.white(`   Environment: ${workspaceConfig.environment}`));
-    console.log(chalk.white(`   API URL:     ${workspaceConfig.apiUrl}`));
-    console.log(chalk.gray(`   Saved to:    ${configPath}\n`));
-    
+    console.log(chalk.white(`   Environment: ${result.environment}`));
+    console.log(chalk.white(`   API URL:     ${result.apiUrl}`));
+    console.log(chalk.gray(`   Saved to:    ${result.configPath}\n`));
+
   } catch (error) {
     console.error(chalk.red('Error initializing config:', error.message));
     throw error;
@@ -104,52 +116,160 @@ export async function init(env = 'prod', options = {}) {
 }
 
 /**
- * Set sync_mode for an app
- * @param {string} mode - "git" or "drive"
- * @param {Object} options - { community, app }
+ * Set target environment persistently in workspace.json.
+ * After switching, auto-runs reconnect against the new API URL.
+ *
+ * @param {string} envName - Environment: dev, demo, prod, or custom name
+ * @param {Object} options - { url?: string } optional URL override for custom envs
  */
-export async function setSyncMode(mode, options = {}) {
+export async function setEnv(envName, options = {}) {
   try {
-    const validModes = ['git', 'drive'];
-    if (!validModes.includes(mode)) {
-      throw new Error(`Invalid sync_mode: "${mode}". Must be one of: ${validModes.join(', ')}`);
-    }
-    
-    const ctx = await PathContext.load();
-    const workspaceRoot = ctx.getWorkspaceRoot();
-    
-    // Resolve community and app
-    const { communityId, appId } = ctx.requireContext(options);
-    
-    const workspaceConfig = await WorkspaceConfig.load(workspaceRoot);
-    
-    // Update app config
-    if (!workspaceConfig.communities[communityId]) {
-      throw new Error(`Community "${communityId}" not found in workspace.json`);
-    }
-    if (!workspaceConfig.communities[communityId].apps?.[appId]) {
-      throw new Error(`App "${appId}" not found in community "${communityId}"`);
-    }
-    
-    workspaceConfig.communities[communityId].apps[appId].sync_mode = mode;
-    
-    const configPath = await workspaceConfig.save(workspaceRoot);
-    
-    console.log(chalk.green('\n✅ Sync mode updated!\n'));
-    console.log(chalk.white(`   Community:  ${communityId}`));
-    console.log(chalk.white(`   App:        ${appId}`));
-    console.log(chalk.white(`   Sync Mode:  ${mode}`));
-    console.log(chalk.gray(`   Saved to:   ${configPath}\n`));
-    
-    if (mode === 'git') {
-      console.log(chalk.cyan('   Tip: Use "descix kb build" to process KB locally.'));
+    const workspaceConfig = await WorkspaceConfig.load();
+
+    const result = await workspaceConfig.setEnvironment(envName, options.url || null);
+
+    console.log(chalk.green('\n✅ Environment switched!\n'));
+    console.log(chalk.white(`   Environment:   ${result.environment}`));
+    // The `|| https://localhost:<microservice.port>` branch that stood here DERIVED AN ORIGIN
+    // FROM A PLATFORM PORT and printed it as the API URL — the exact construction CEO-D
+    // 2026-08-18 forbids ("an environment NAME never derives localhost from a platform port")
+    // and a misreport of an origin the developer never chose. setEnvironment() always returns a
+    // real apiUrl, so the branch was unreachable as well as wrong. DELETED.
+    console.log(chalk.white(`   API URL:       ${result.apiUrl}`));
+    console.log(chalk.white(`   Secret Label:  ${result.secretLabel}`));
+    console.log(chalk.gray(`   Saved to:      ${result.configPath}\n`));
+
+    // Auto-reconnect against the new environment
+    if (result.apiUrl) {
+      process.env.DESCIX_API_URL = result.apiUrl;
     } else {
-      console.log(chalk.cyan('   Tip: Use the PWA to upload KB files to Drive.'));
+      delete process.env.DESCIX_API_URL;
     }
-    console.log('');
-    
+
+    console.log(chalk.cyan('   Reconnecting to new environment...\n'));
+    try {
+      const { reconnect } = await import('./auth.js');
+      await reconnect();
+    } catch (err) {
+      console.log(chalk.yellow(`\n   ⚠️  Auto-reconnect failed: ${err.message}`));
+      console.log(chalk.gray('   Run "descix reconnect" or "descix login" manually.\n'));
+    }
+
   } catch (error) {
-    console.error(chalk.red('Error updating sync mode:', error.message));
+    console.error(chalk.red(`\n❌ ${error.message}\n`));
     throw error;
   }
 }
+
+// ─── Workspace-level env keys (redteam G-6) ──────────────────────────────────
+// env.gateway.port, env.devCerts, env.powchUrl and env.siteUrl are read by the
+// gateway and the shell build, but had NO verb — the only way to set them was to
+// hand-edit .descix/workspace.json. The target UX is that a developer never
+// hand-crafts that file, so each of these now has a command.
+
+/**
+ * Shared writer: set one key, report it, and say where it landed.
+ *
+ * `produceValue` is a THUNK, not a value, so validation runs INSIDE this
+ * try/catch. Passing an already-validated value meant a rejection threw at the
+ * call site, propagated to the CLI action's `catch { process.exit(1) }`, and the
+ * developer got a bare exit code with no message — a fail-loud that fails
+ * silently, which is worse than no validation because it looks like a crash.
+ */
+async function setWorkspaceEnvKey(dottedKey, produceValue, label) {
+  try {
+    const value = typeof produceValue === 'function' ? produceValue() : produceValue;
+    const workspaceConfig = await WorkspaceConfig.load();
+    const configPath = await workspaceConfig.setEnvKey(dottedKey, value);
+    console.log(chalk.green(`\n✅ ${label}\n`));
+    console.log(chalk.white(`   env.${dottedKey}: ${value === null ? chalk.gray('(removed)') : value}`));
+    console.log(chalk.gray(`   Saved to: ${configPath}\n`));
+    return configPath;
+  } catch (error) {
+    console.error(chalk.red(`\n❌ ${error.message}\n`));
+    throw error;
+  }
+}
+
+/** Reject anything that is not a usable port BEFORE it reaches the file. */
+function assertPort(value) {
+  const port = Number(value);
+  if (!Number.isInteger(port) || port < 1 || port > 65535) {
+    throw new Error(`Port must be an integer 1-65535, got "${value}".`);
+  }
+  return port;
+}
+
+/** Reject anything that is not an absolute http(s) URL BEFORE it reaches the file. */
+function assertUrl(value, what) {
+  let parsed;
+  try {
+    parsed = new URL(value);
+  } catch {
+    throw new Error(`${what} must be an absolute URL (e.g. https://powch.dev.descix.net), got "${value}".`);
+  }
+  if (parsed.protocol !== 'https:' && parsed.protocol !== 'http:') {
+    throw new Error(`${what} must be http(s), got "${parsed.protocol}//".`);
+  }
+  return value;
+}
+
+/**
+ * Set the port `descix serve` listens on (env.gateway.port).
+ */
+export async function setGatewayPort(port) {
+  return setWorkspaceEnvKey(
+    'gateway.port',
+    () => (port === null ? null : assertPort(port)),
+    'Gateway port set — `descix serve` will listen here and the shell product map will match it.',
+  );
+}
+
+/**
+ * Point the local dev servers at a specific TLS cert pair (env.devCerts.*).
+ * One owner: the gateway AND every app dev server behind it read this.
+ */
+export async function setDevCerts(options = {}) {
+  const { dir, cert, key, clear } = options;
+  if (clear) {
+    await setWorkspaceEnvKey('devCerts.dir', null, 'Dev certs cleared — falling back to the SDK-tracked SAN pair.');
+    await setWorkspaceEnvKey('devCerts.cert', null, 'Dev cert file cleared.');
+    return setWorkspaceEnvKey('devCerts.key', null, 'Dev key file cleared.');
+  }
+  if (!dir && !cert && !key) {
+    const message =
+      'Nothing to set. Pass --dir <path> (a directory holding cert.pem + key.pem), ' +
+      'or --cert <path> and --key <path>, or --clear to remove.';
+    console.error(chalk.red(`\n❌ ${message}\n`));
+    throw new Error(message);
+  }
+  let last;
+  if (dir) last = await setWorkspaceEnvKey('devCerts.dir', path.resolve(dir), 'Dev cert directory set.');
+  if (cert) last = await setWorkspaceEnvKey('devCerts.cert', path.resolve(cert), 'Dev certificate set.');
+  if (key) last = await setWorkspaceEnvKey('devCerts.key', path.resolve(key), 'Dev private key set.');
+  return last;
+}
+
+/**
+ * Set where Powch lives (env.powchUrl).
+ * Powch is CROSS-ORIGIN from the shell by design — it holds passkeys and the
+ * wallet — so this is its own origin, never a path on the gateway.
+ */
+export async function setPowchUrl(url) {
+  return setWorkspaceEnvKey(
+    'powchUrl',
+    () => (url === null ? null : assertUrl(url, 'Powch URL')),
+    'Powch URL set — the gateway and the shell build now agree on it.',
+  );
+}
+
+/**
+ * Set the App Shell origin `descix serve` proxies `/` to (env.siteUrl).
+ */
+export async function setSiteUrl(url) {
+  return setWorkspaceEnvKey(
+    'siteUrl',
+    () => (url === null ? null : assertUrl(url, 'Site URL')),
+    'App Shell URL set — `descix serve` will proxy / here.',
+  );
+}