@monster-orange/den 0.0.0 → 0.1.0

package/src/shared/smoke/repo-cloner.ts

@@ -0,0 +1,151 @@
+/**
+ * Smoke test repo cloner
+ *
+ * Manages .smoke-clones/{repoName}/{environment}/ — shallow clones of
+ * registered repos checked out at the exact SHA deployed to each environment.
+ *
+ * Directory layout:
+ *   .smoke-clones/
+ *     api/
+ *       staging/          ← shallow clone at deployed SHA
+ *         .deployed-sha   ← cached SHA (avoids redundant re-clones)
+ *
+ * Freshness strategy:
+ *   - Read .deployed-sha from disk
+ *   - If it matches the target SHA → already up to date, return path immediately
+ *   - If it differs (or file absent) → fetch + checkout + update stamp
+ *
+ * Git authentication:
+ *   Uses `gh auth git-credential` as the git credential helper so the
+ *   existing `gh` session covers private repos without separate SSH setup.
+ */
+
+import { execSync } from "child_process";
+import * as fs from "fs";
+import * as path from "path";
+import type { DeployedRef } from "./branch-resolver.js";
+import { getDistRoot } from "../paths.js";
+import { assertSafeCloneDestination } from "../environment-manager/clone-guard.js";
+
+// Anchored to the den root, NOT process.cwd() — this module CLONES repos,
+// and a cwd-derived destination once bulk-cloned into an unrelated checkout.
+const CLONES_DIR = path.resolve(getDistRoot(), ".smoke-clones");
+const DEPLOYED_SHA_FILE = ".deployed-sha";
+
+/** Absolute path to the clone directory for a repo+environment pair. */
+export function cloneDirFor(repoName: string, environment: string): string {
+  return path.join(CLONES_DIR, repoName, environment);
+}
+
+function run(cmd: string, cwd?: string): void {
+  execSync(cmd, {
+    cwd,
+    stdio: "inherit",
+    env: {
+      ...process.env,
+      // Route git credentials through `gh` so private repos work without SSH
+      GIT_CREDENTIAL_HELPER: "!gh auth git-credential",
+    },
+  });
+}
+
+function runCapture(cmd: string, cwd?: string): string {
+  return execSync(cmd, {
+    cwd,
+    stdio: ["ignore", "pipe", "pipe"],
+    encoding: "utf-8",
+    env: {
+      ...process.env,
+      GIT_CREDENTIAL_HELPER: "!gh auth git-credential",
+    },
+  }).trim();
+}
+
+/**
+ * Ensure the repo is cloned at the given SHA.
+ * Returns the absolute path to the clone root.
+ *
+ * @param repoName   Short name (matches .den.yml `name` field, e.g. "api")
+ * @param environment  Den environment key (e.g. "staging") — used for path only
+ * @param originUrl  Git remote URL to clone from
+ * @param ref        Deployed ref from branch-resolver
+ */
+export function ensureRepoAtSha(
+  repoName: string,
+  environment: string,
+  originUrl: string,
+  ref: DeployedRef,
+): string {
+  const cloneDir = cloneDirFor(repoName, environment);
+  const shaFile = path.join(cloneDir, DEPLOYED_SHA_FILE);
+
+  // Fast path: already at the right SHA
+  if (fs.existsSync(shaFile)) {
+    const cached = fs.readFileSync(shaFile, "utf-8").trim();
+    if (cached === ref.sha) {
+      console.log(
+        `  ✓ ${repoName}@${environment}: already at ${ref.sha.slice(0, 8)} (${ref.ref})`,
+      );
+      return cloneDir;
+    }
+    console.log(
+      `  ↻ ${repoName}@${environment}: updating ${cached.slice(0, 8)} → ${ref.sha.slice(0, 8)} (${ref.ref})`,
+    );
+  } else {
+    console.log(
+      `  ⬇ ${repoName}@${environment}: cloning at ${ref.sha.slice(0, 8)} (${ref.ref})`,
+    );
+  }
+
+  if (!fs.existsSync(cloneDir)) {
+    assertSafeCloneDestination(cloneDir, repoName);
+    // Initial clone — shallow, blobless (history not needed, just the tree)
+    fs.mkdirSync(cloneDir, { recursive: true });
+    try {
+      run(
+        `git clone --filter=blob:none --depth=1 --branch "${ref.ref}" ` +
+          `-c credential.helper="!gh auth git-credential" ` +
+          `"${originUrl}" "${cloneDir}"`,
+      );
+    } catch {
+      // Branch may not exist by that name (e.g. detached SHA) — try bare clone
+      fs.rmSync(cloneDir, { recursive: true, force: true });
+      fs.mkdirSync(cloneDir, { recursive: true });
+      run(
+        `git clone --filter=blob:none --depth=1 ` +
+          `-c credential.helper="!gh auth git-credential" ` +
+          `"${originUrl}" "${cloneDir}"`,
+      );
+    }
+  }
+
+  // Fetch the exact SHA (in case shallow clone landed on a different commit)
+  const currentSha = runCapture("git rev-parse HEAD", cloneDir);
+  if (currentSha !== ref.sha) {
+    try {
+      run(
+        `git -c credential.helper="!gh auth git-credential" ` +
+          `fetch --depth=1 origin "${ref.sha}"`,
+        cloneDir,
+      );
+      run(`git checkout "${ref.sha}"`, cloneDir);
+    } catch {
+      // Some git servers don't allow fetching by SHA directly — fall back to
+      // fetching the branch and checking out the SHA
+      run(
+        `git -c credential.helper="!gh auth git-credential" ` +
+          `fetch --depth=1 origin "${ref.ref}"`,
+        cloneDir,
+      );
+      run(`git checkout "${ref.sha}"`, cloneDir);
+    }
+  }
+
+  // Write stamp file
+  fs.writeFileSync(shaFile, ref.sha);
+
+  console.log(
+    `  ✓ ${repoName}@${environment}: ready at ${ref.sha.slice(0, 8)}`,
+  );
+  return cloneDir;
+}

package/src/shared/stacks/config.ts

@@ -0,0 +1,137 @@
+/**
+ * Stacks come from two places:
+ *  - a repo's own `.den.yml` `compose:` section (preferred), for every
+ *    repo in the focused workspace;
+ *  - `stacks:` in config/den.yml, for repos that don't carry a manifest.
+ * A manifest stack wins over a config stack of the same name.
+ */
+import * as fs from "fs";
+import * as path from "path";
+import * as yaml from "yaml";
+import { getDistRoot } from "../paths.js";
+import { readCatalog } from "../environment-manager/catalog.js";
+import {
+  getActiveWorkspace,
+  getWorkspaceByName,
+  listWorkspaceServices,
+} from "../environment-manager/workspaces.js";
+import { readManifest } from "../manifest/read-manifest.js";
+import type { ManifestComposeConfig } from "../types/index.js";
+import { assertStackName, parseTarget } from "./render.js";
+import type { StackConfig } from "./types.js";
+
+import { product } from "../product.js";
+type Raw = Partial<Omit<StackConfig, "name">>;
+
+function list(v: unknown, what: string): string[] {
+  if (v === undefined) return [];
+  if (!Array.isArray(v) || v.some((x) => typeof x !== "string"))
+    throw new Error(`${what} must be a list of strings`);
+  return v as string[];
+}
+
+function toStack(
+  name: string,
+  raw: Raw | ManifestComposeConfig,
+  repo: string,
+  repoPath: string | undefined,
+  where: string,
+): StackConfig {
+  assertStackName(name);
+  const routes = raw.routes ?? {};
+  Object.values(routes).forEach(parseTarget);
+  const files = list(raw.files, `${where}.files`);
+  return {
+    name,
+    repo,
+    ...(repoPath ? { repoPath } : {}),
+    dir: raw.dir,
+    files: files.length ? files : ["docker-compose.yml"],
+    routes,
+    generate: list(raw.generate, `${where}.generate`),
+    uses: list(raw.uses, `${where}.uses`),
+    env: Object.fromEntries(
+      Object.entries(raw.env ?? {}).map(([k, v]) => [k, String(v)]),
+    ),
+    profiles: list(raw.profiles, `${where}.profiles`),
+    ...("healthchecks" in raw && raw.healthchecks
+      ? { healthchecks: raw.healthchecks }
+      : {}),
+    ...("service_env" in raw && raw.service_env
+      ? {
+          serviceEnv: Object.fromEntries(
+            Object.entries(raw.service_env).map(([svc, vars]) => [
+              svc,
+              Object.fromEntries(
+                Object.entries(vars).map(([k, v]) => [k, String(v)]),
+              ),
+            ]),
+          ),
+        }
+      : {}),
+  };
+}
+
+/** Stack name for a repo's manifest compose section. */
+export function manifestStackName(
+  manifest: { name: string; compose?: ManifestComposeConfig },
+  repoName: string,
+): string {
+  return manifest.compose?.name ?? manifest.name ?? repoName;
+}
+
+/** `compose:` stacks declared by repos in a workspace (default: focused). */
+export function readManifestStacks(
+  workspace?: string,
+): Record<string, StackConfig> {
+  const ws = workspace ? getWorkspaceByName(workspace) : getActiveWorkspace();
+  if (!ws) return {};
+  const out: Record<string, StackConfig> = {};
+  const seen = new Set<string>();
+  for (const svc of listWorkspaceServices(ws.config, readCatalog(), ws.name)) {
+    if (seen.has(svc.repoPath) || !fs.existsSync(svc.repoPath)) continue;
+    seen.add(svc.repoPath);
+    const m = readManifest(svc.repoPath);
+    if (!m?.compose) continue;
+    const name = manifestStackName(m, svc.repoName);
+    out[name] = toStack(
+      name,
+      m.compose,
+      svc.repoName,
+      svc.repoPath,
+      `${svc.repoName}/${product().manifestYml} compose`,
+    );
+  }
+  return out;
+}
+
+export function readStacks(
+  root: string = getDistRoot(),
+  opts: { workspace?: string; manifests?: boolean } = {},
+): Record<string, StackConfig> {
+  let parsed: { stacks?: Record<string, Raw> } | null = null;
+  try {
+    parsed = yaml.parse(
+      fs.readFileSync(path.join(root, product().configFile), "utf-8"),
+    );
+  } catch (err) {
+    if ((err as NodeJS.ErrnoException).code !== "ENOENT") throw err;
+  }
+  const out: Record<string, StackConfig> = {};
+  for (const [name, raw] of Object.entries(parsed?.stacks ?? {})) {
+    if (!raw?.repo) throw new Error(`stacks.${name}.repo is required`);
+    out[name] = toStack(name, raw, raw.repo, undefined, `stacks.${name}`);
+  }
+  if (opts.manifests !== false)
+    Object.assign(out, readManifestStacks(opts.workspace));
+
+  // `uses` may name a stack or the repo that declares it.
+  const byRepo = new Map(Object.values(out).map((s) => [s.repo, s.name]));
+  for (const s of Object.values(out)) {
+    s.uses = s.uses.map((u) => (out[u] ? u : (byRepo.get(u) ?? u)));
+    for (const u of s.uses)
+      if (!out[u])
+        throw new Error(`stack ${s.name}: uses names unknown stack "${u}"`);
+  }
+  return out;
+}

package/src/shared/stacks/manifest-commands.ts

@@ -0,0 +1,88 @@
+/**
+ * Commands den supplies for a repo whose `.den.yml` has a `compose:`
+ * section: the stack runs behind the edge with no host ports. A command the
+ * repo declares itself (services.<svc>.commands.local) always wins.
+ */
+import * as path from "path";
+import { getDistRoot } from "../paths.js";
+import { readManifest } from "../manifest/read-manifest.js";
+import type { RawManifest } from "../types/index.js";
+import { manifestStackName } from "./config.js";
+
+import { product } from "../product.js";
+type CommandDef = string | { cmd: string; detachable?: boolean };
+
+/** Whether `subsystem` is the repo's primary service (the one the stack belongs to). */
+function isPrimary(manifest: RawManifest, subsystem: string): boolean {
+  const keys = Object.keys(manifest.services ?? {});
+  if (manifest.entrypoint) return manifest.entrypoint === subsystem;
+  return keys.length <= 1;
+}
+
+function denBin(): string {
+  return JSON.stringify(path.join(getDistRoot(), "bin", `${product().cli}`));
+}
+
+/** The synthesized stack commands, or {} when the repo isn't a compose stack. */
+export function composeCommands(
+  manifest: RawManifest,
+  subsystem: string,
+  repoName: string,
+  workspace: string,
+): Record<string, CommandDef> {
+  if (!manifest.compose || !isPrimary(manifest, subsystem)) return {};
+  // `docker compose up -d` returns once the containers are started, so these
+  // finish on their own: never daemonize them.
+  const stack = (sub: string) => ({
+    cmd: `${denBin()} stack ${sub} ${manifestStackName(manifest, repoName)} -w ${workspace}`,
+    detachable: false,
+  });
+  return {
+    up: stack("up"),
+    down: stack("down"),
+    restart: stack("restart"),
+    logs: stack("logs"),
+  };
+}
+
+/**
+ * Shell health check for a compose stack. The entry service is healthy when
+ * every container is running and healthy; any other manifest service names a
+ * compose service and is checked on its own (`--service`).
+ */
+export function composeHealthCmd(
+  manifest: RawManifest,
+  subsystem: string,
+  repoName: string,
+  workspace: string,
+): string | null {
+  if (!manifest.compose) return null;
+  const base = `${denBin()} stack health ${manifestStackName(manifest, repoName)} -w ${workspace}`;
+  return isPrimary(manifest, subsystem)
+    ? base
+    : `${base} --service ${JSON.stringify(subsystem)}`;
+}
+
+/** Declared local commands layered over the synthesized compose ones. */
+export function effectiveLocalCommands(
+  manifest: RawManifest,
+  subsystem: string,
+  repoName: string,
+  workspace: string,
+): Record<string, CommandDef> {
+  return {
+    ...composeCommands(manifest, subsystem, repoName, workspace),
+    ...(manifest.services?.[subsystem]?.commands?.local ?? {}),
+  };
+}
+
+/** Effective local commands for a resolved service, read from its manifest. */
+export function localCommandsFor(
+  svc: { repoPath: string; repoName: string; subsystem: string },
+  workspace: string,
+): Record<string, CommandDef> {
+  const m = readManifest(svc.repoPath);
+  return m
+    ? effectiveLocalCommands(m, svc.subsystem, svc.repoName, workspace)
+    : {};
+}

package/src/shared/stacks/render.ts

@@ -0,0 +1,253 @@
+/**
+ * Pure planning for stacks: project names, container names, the compose
+ * override, the link networks and the edge routes. No I/O.
+ */
+import * as yaml from "yaml";
+import { edgeDomains, routeHost } from "../edge/render.js";
+import type { EdgeConfig } from "../edge/types.js";
+import type { ResolvedProject, StackConfig } from "./types.js";
+
+import { product } from "../product.js";
+const NAME_RE = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?$/;
+
+export function assertStackName(n: string): void {
+  if (!NAME_RE.test(n))
+    throw new Error(
+      `stack name "${n}" must be lowercase letters, digits and dashes`,
+    );
+}
+
+export function projectName(stack: string, workspace: string): string {
+  return `${stack}-${workspace}`;
+}
+
+/**
+ * Container name for a stack service. Always Compose's per-project default:
+ * the override resets any pinned `container_name`, which would otherwise
+ * collide when the same repo runs in two workspaces.
+ */
+export function containerName(project: string, service: string): string {
+  return `${project}-${service}-1`;
+}
+
+export function linkNetwork(
+  consumer: string,
+  provider: string,
+  ws: string,
+): string {
+  return `${consumer}-${ws}--${provider}`;
+}
+
+export function parseTarget(target: string): { service: string; port: number } {
+  const m = /^([a-zA-Z0-9][\w.-]*):(\d{1,5})$/.exec(target);
+  if (!m) throw new Error(`route target "${target}" must be <service>:<port>`);
+  return { service: m[1], port: Number(m[2]) };
+}
+
+/** Expand `{stack.service}` placeholders to container names. */
+export function expandEnv(
+  env: Record<string, string>,
+  ws: string,
+  known: Record<string, StackConfig>,
+): Record<string, string> {
+  const out: Record<string, string> = {};
+  for (const [k, v] of Object.entries(env))
+    out[k] = v.replace(
+      /\{([a-z0-9-]+)\.([\w.-]+)\}/g,
+      (_m, s: string, svc: string) => {
+        if (!known[s]) throw new Error(`env ${k} names unknown stack "${s}"`);
+        return containerName(projectName(s, ws), svc);
+      },
+    );
+  return out;
+}
+
+/** Providers named in `{stack.service}` placeholders → their services. */
+export function providerServices(stack: StackConfig): Record<string, string[]> {
+  const out: Record<string, string[]> = {};
+  for (const v of Object.values(stack.env))
+    for (const m of v.matchAll(/\{([a-z0-9-]+)\.([\w.-]+)\}/g))
+      (out[m[1]] ??= []).includes(m[2]) || out[m[1]].push(m[2]);
+  return out;
+}
+
+/** Start order: every stack after the stacks it uses. Throws on cycles. */
+export function startOrder(
+  names: string[],
+  all: Record<string, StackConfig>,
+): string[] {
+  const order: string[] = [];
+  const state = new Map<string, "visiting" | "done">();
+  const visit = (n: string, trail: string[]) => {
+    if (!all[n]) throw new Error(`unknown stack "${n}"`);
+    if (state.get(n) === "done") return;
+    if (state.get(n) === "visiting")
+      throw new Error(
+        `stacks use each other in a cycle: ${[...trail, n].join(" → ")}`,
+      );
+    state.set(n, "visiting");
+    for (const u of all[n].uses) visit(u, [...trail, n]);
+    state.set(n, "done");
+    order.push(n);
+  };
+  names.forEach((n) => visit(n, []));
+  return order;
+}
+
+/**
+ * Services that refer to a provider: their resolved environment names one of
+ * the provider's container names. Only these join the link network, so a
+ * consumer's postgres/redis never become resolvable from the provider.
+ */
+export function linkedServices(
+  stack: StackConfig,
+  provider: string,
+  resolved: ResolvedProject,
+  ws: string,
+): string[] {
+  const names = (providerServices(stack)[provider] ?? []).map((svc) =>
+    containerName(projectName(provider, ws), svc),
+  );
+  return Object.entries(resolved.services)
+    .filter(([, def]) =>
+      Object.values(def.environment ?? {}).some(
+        (v) => typeof v === "string" && names.some((n) => v.includes(n)),
+      ),
+    )
+    .map(([svc]) => svc)
+    .sort();
+}
+
+/**
+ * The compose override: drop every published host port and pinned container
+ * name, and put the services that refer to a provider on its link network.
+ * Written as text because `!reset` is a Compose tag, not plain YAML.
+ */
+export function renderOverride(
+  stack: StackConfig,
+  resolved: ResolvedProject,
+  ws: string,
+): string {
+  const links = stack.uses.map((p) => ({
+    net: linkNetwork(stack.name, p, ws),
+    services: linkedServices(stack, p, resolved, ws),
+  }));
+  const unknown = Object.keys(stack.serviceEnv ?? {}).filter(
+    (s) => !(s in resolved.services),
+  );
+  if (unknown.length)
+    throw new Error(
+      `stack "${stack.name}": service_env names "${unknown.join('", "')}", ` +
+        `which the compose project does not have (${Object.keys(resolved.services).sort().join(", ")})`,
+    );
+  const lines = [
+    `# Generated by \`${product().cli} stack up\`: no host ports (reach services via the`,
+    "# edge) and no pinned container names (each workspace is its own project).",
+    "services:",
+  ];
+  for (const [svc, def] of Object.entries(resolved.services).sort()) {
+    const body: string[] = [];
+    if (def.ports && def.ports.length) body.push("    ports: !reset []");
+    if (def.container_name) body.push("    container_name: !reset null");
+    const check = stack.healthchecks?.[svc];
+    if (check)
+      body.push("    healthcheck:", `      test: ${JSON.stringify(check)}`);
+    const vars = stack.serviceEnv?.[svc];
+    if (vars && Object.keys(vars).length) {
+      // Compose merges `environment` by key across files, so these win.
+      body.push("    environment:");
+      for (const [k, v] of Object.entries(vars).sort())
+        body.push(`      ${JSON.stringify(k)}: ${JSON.stringify(v)}`);
+    }
+    const mine = links
+      .filter((l) => l.services.includes(svc))
+      .map((l) => l.net);
+    if (mine.length) {
+      // Compose merges service networks by key, so listing the base ones keeps them.
+      const base = Object.keys(def.networks ?? { default: null });
+      body.push("    networks:");
+      for (const n of [...base, ...mine])
+        body.push(`      ${JSON.stringify(n)}: {}`);
+    }
+    if (body.length) lines.push(`  ${JSON.stringify(svc)}:`, ...body);
+  }
+  if (!lines.some((l) => /^ {2}"/.test(l))) lines.push("  {}");
+  const used = links.filter((l) => l.services.length).map((l) => l.net);
+  if (used.length) {
+    lines.push("networks:");
+    for (const n of used)
+      lines.push(
+        `  ${JSON.stringify(n)}:`,
+        `    name: ${JSON.stringify(n)}`,
+        "    external: true",
+      );
+  }
+  return lines.join("\n") + "\n";
+}
+
+/** Docker networks the edge must join to reach each routed service. */
+export function routedNetworks(
+  stack: StackConfig,
+  resolved: ResolvedProject,
+): string[] {
+  const nets = new Set<string>();
+  for (const target of Object.values(stack.routes)) {
+    const { service } = parseTarget(target);
+    const def = resolved.services[service];
+    if (!def)
+      throw new Error(
+        `stack ${stack.name}: route target service "${service}" not in compose`,
+      );
+    const first = Object.keys(def.networks ?? { default: null })[0];
+    nets.add(resolved.networks?.[first]?.name ?? `${resolved.name}_${first}`);
+  }
+  return [...nets].sort();
+}
+
+/** Edge dynamic config for one stack: `<route>.<stack>.<domain>` → container. */
+export function renderStackRoutes(
+  edge: EdgeConfig,
+  stack: StackConfig,
+  resolved: ResolvedProject,
+): string {
+  const routers: Record<string, unknown> = {};
+  const services: Record<string, unknown> = {};
+  for (const [route, target] of Object.entries(stack.routes).sort()) {
+    if (!NAME_RE.test(route))
+      throw new Error(
+        `route "${route}" must be lowercase letters, digits and dashes`,
+      );
+    const { service, port } = parseTarget(target);
+    const key = `stack-${stack.name}-${route}`;
+    routers[key] = {
+      entryPoints: ["websecure"],
+      rule: edgeDomains(edge)
+        .map((d) => `Host(\`${routeHost(`${route}.${stack.name}`, d)}\`)`)
+        .join(" || "),
+      service: key,
+      tls: {},
+    };
+    services[key] = {
+      loadBalancer: {
+        servers: [
+          {
+            url: `http://${containerName(resolved.name, service)}:${port}`,
+          },
+        ],
+      },
+    };
+  }
+  return (
+    `# Generated by \`${product().cli} stack up ${stack.name}\`.\n` +
+    yaml.stringify({ http: { routers, services } })
+  );
+}
+
+/**
+ * Compose-project suffix for a den workspace: its own name, except that
+ * the `default` workspace keeps the original `main` projects (and so their
+ * volumes and data).
+ */
+export function stackWorkspace(denWorkspace: string): string {
+  return denWorkspace === "default" ? "main" : denWorkspace;
+}