@monster-orange/den 0.0.0 → 0.2.0

package/src/shared/profile.ts

@@ -0,0 +1,141 @@
+/**
+ * The product profile: who this distribution is.
+ *
+ * Den is one engine; each distribution runs it under its own name. Everything product-named comes from here: the CLI, the env-var
+ * prefix, the config and manifest file names, and the state, services and
+ * workspaces directories. The profile lives in `den.yml` at the
+ * distribution root:
+ *
+ *   product:
+ *     name: acme              # everything below derives from it by default
+ *     # cli: acme
+ *     # env_prefix: ACME
+ *     # config: config/acme.yml
+ *     # manifest: .acme.yml   (.json is also read)
+ *     # state_dir: ~/.acme
+ *     # services_dir: .acme-services
+ *     # workspaces_dir: acme-workspaces
+ *
+ * `DEN_PROFILE` may point at another profile file (tests use this). With no
+ * profile at all, Den runs under its own name.
+ */
+
+import * as fs from "node:fs";
+import * as os from "node:os";
+import * as path from "node:path";
+import { parse as parseYaml } from "yaml";
+
+export const PROFILE_FILE = "den.yml";
+
+export interface ProductProfile {
+  /** Display and slug name ("acme"). */
+  name: string;
+  /** The command a person types. */
+  cli: string;
+  /** Upper-case env-var prefix, without the trailing "_" ("ACME"). */
+  envPrefix: string;
+  /** Org config, relative to the distribution root. */
+  configFile: string;
+  /** Manifest file names probed in a repo, first match wins. */
+  manifestFiles: string[];
+  /** Per-user state directory (absolute, `~` expanded). */
+  stateDir: string;
+  /** Managed clones, relative to the distribution root. */
+  servicesDir: string;
+  /** Workspace checkouts, relative to the distribution root. */
+  workspacesDir: string;
+}
+
+interface RawProduct {
+  name?: unknown;
+  cli?: unknown;
+  env_prefix?: unknown;
+  config?: unknown;
+  manifest?: unknown;
+  state_dir?: unknown;
+  services_dir?: unknown;
+  workspaces_dir?: unknown;
+}
+
+const SLUG = /^[a-z][a-z0-9-]*$/;
+const PREFIX = /^[A-Z][A-Z0-9_]*$/;
+
+const str = (v: unknown): string | undefined =>
+  typeof v === "string" && v.trim() ? v.trim() : undefined;
+
+const expandHome = (p: string): string =>
+  p === "~"
+    ? os.homedir()
+    : p.startsWith("~/")
+      ? path.join(os.homedir(), p.slice(2))
+      : p;
+
+/** A profile from a `product:` block; unset fields derive from the name. */
+export function profileFrom(raw: RawProduct = {}): ProductProfile {
+  const name = str(raw.name) ?? "den";
+  if (!SLUG.test(name))
+    throw new Error(
+      `den.yml: product.name "${name}" must be lower-case letters, digits and "-"`,
+    );
+  const envPrefix =
+    str(raw.env_prefix) ?? name.toUpperCase().replace(/-/g, "_");
+  if (!PREFIX.test(envPrefix))
+    throw new Error(
+      `den.yml: product.env_prefix "${envPrefix}" must be upper-case letters, digits and "_"`,
+    );
+  const manifest = str(raw.manifest) ?? `.${name}.yml`;
+  const json = manifest.replace(/\.ya?ml$/, ".json");
+  return {
+    name,
+    cli: str(raw.cli) ?? name,
+    envPrefix,
+    configFile: str(raw.config) ?? `config/${name}.yml`,
+    manifestFiles: json === manifest ? [manifest] : [manifest, json],
+    stateDir: path.resolve(expandHome(str(raw.state_dir) ?? `~/.${name}`)),
+    servicesDir: str(raw.services_dir) ?? `.${name}-services`,
+    workspacesDir: str(raw.workspaces_dir) ?? `${name}-workspaces`,
+  };
+}
+
+/** Read a profile file; a missing file is Den's own profile. */
+export function readProfileFile(file: string): ProductProfile {
+  let raw: { product?: RawProduct } | null;
+  try {
+    raw = parseYaml(fs.readFileSync(file, "utf-8")) as typeof raw;
+  } catch (e) {
+    if ((e as NodeJS.ErrnoException).code === "ENOENT") return profileFrom();
+    throw new Error(`${file}: ${(e as Error).message}`);
+  }
+  return profileFrom(raw?.product ?? {});
+}
+
+let cached: { key: string; profile: ProductProfile } | null = null;
+
+/**
+ * The profile for a distribution root: `DEN_PROFILE` if set, else
+ * `<root>/den.yml`, else Den's own. Cached per file.
+ */
+export function loadProfile(root: string): ProductProfile {
+  const file = process.env.DEN_PROFILE?.trim() || path.join(root, PROFILE_FILE);
+  if (cached?.key !== file)
+    cached = { key: file, profile: readProfileFile(file) };
+  return cached.profile;
+}
+
+export function resetProfileCache(): void {
+  cached = null;
+}
+
+/** `${PREFIX}_${key}`: the env-var name this distribution uses for `key`. */
+export function envName(profile: ProductProfile, key: string): string {
+  return `${profile.envPrefix}_${key}`;
+}
+
+/** The value of `${PREFIX}_${key}`, or undefined. */
+export function readEnv(
+  profile: ProductProfile,
+  key: string,
+  env: NodeJS.ProcessEnv = process.env,
+): string | undefined {
+  return env[envName(profile, key)];
+}

package/src/shared/redact.ts

@@ -0,0 +1,107 @@
+/**
+ * Secret redaction, in two forms:
+ *
+ * - Known values (`redactValues`, `containsValue`): a run holds the live
+ *   secret it minted (a bearer token, an agent key) and strips or refuses
+ *   that exact string. The journeys and security pillars use these.
+ * - Secret-shaped values (`redactSecrets`): text from somewhere we don't
+ *   control (service logs, command output) is scrubbed by pattern before it
+ *   leaves Den, e.g. through the MCP server. Patterns err on the side of
+ *   redacting: a hidden harmless value costs less than a leaked key.
+ */
+
+export const REDACTED = "[REDACTED]";
+
+/** Replace every occurrence of each non-empty value in `text`. */
+export function redactValues(
+  text: string,
+  values: readonly (string | undefined)[],
+): string {
+  let out = text;
+  for (const v of values) if (v) out = out.split(v).join(REDACTED);
+  return out;
+}
+
+/** Whether `text` contains any non-empty value. */
+export function containsValue(
+  text: string,
+  values: readonly (string | undefined)[],
+): boolean {
+  return values.some((v) => !!v && text.includes(v));
+}
+
+/** Key names whose values are secrets (matched anywhere in the key). */
+const SECRET_KEY =
+  "[\\w.-]*(?:password|passwd|pwd|secret|token|api[_-]?key|apikey|access[_-]?key|private[_-]?key|credentials?|cookie)[\\w.-]*";
+
+interface Pattern {
+  name: string;
+  re: RegExp;
+  replace: string | ((...m: string[]) => string);
+}
+
+/**
+ * Order matters: whole blocks first, then structured forms (URLs, auth
+ * headers), then bare token shapes, then generic key=value.
+ */
+export const SECRET_PATTERNS: readonly Pattern[] = [
+  {
+    name: "private-key block",
+    re: /-----BEGIN ([A-Z0-9 ]*)PRIVATE KEY-----[\s\S]*?-----END \1PRIVATE KEY-----/g,
+    replace: (_m, kind) =>
+      `-----BEGIN ${kind}PRIVATE KEY-----${REDACTED}-----END ${kind}PRIVATE KEY-----`,
+  },
+  {
+    // A block cut off by a tail window: redact to the end of the text.
+    name: "private-key block (unterminated)",
+    re: /-----BEGIN ([A-Z0-9 ]*)PRIVATE KEY-----(?![\s\S]*-----END)(?!\[REDACTED\])[\s\S]*$/g,
+    replace: (_m, kind) => `-----BEGIN ${kind}PRIVATE KEY-----${REDACTED}`,
+  },
+  {
+    name: "URL credentials",
+    re: /\b([a-z][a-z0-9+.-]*:\/\/)([^\s:@/]+):([^\s@/]+)@/gi,
+    replace: (_m, scheme, user, pass) =>
+      pass === REDACTED ? _m : `${scheme}${user}:${REDACTED}@`,
+  },
+  {
+    name: "bearer token",
+    re: /\b(Bearer|Basic|Token)\s+[A-Za-z0-9._~+/=-]{8,}/gi,
+    replace: (_m, scheme) => `${scheme} ${REDACTED}`,
+  },
+  {
+    name: "JWT",
+    re: /\beyJ[A-Za-z0-9_-]{5,}\.[A-Za-z0-9_-]{5,}\.[A-Za-z0-9_-]{5,}/g,
+    replace: REDACTED,
+  },
+  {
+    name: "AWS access key id",
+    re: /\b(?:AKIA|ASIA|AGPA|AIDA|AROA|ANPA|ANVA|AIPA)[A-Z0-9]{16}\b/g,
+    replace: REDACTED,
+  },
+  {
+    name: "well-known token prefix",
+    re: /\b(?:gh[pousr]_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,}|xox[abprs]-[A-Za-z0-9-]{10,}|[sr]k_(?:live|test)_[A-Za-z0-9]{10,}|sk-[A-Za-z0-9_-]{20,})/g,
+    replace: REDACTED,
+  },
+  {
+    name: "key=value secret",
+    re: new RegExp(
+      `\\b(${SECRET_KEY})(["']?\\s*[:=]\\s*)(\\[REDACTED\\]|"[^"]*"|'[^']*'|[^\\s,;&'"}\\]]+)`,
+      "gi",
+    ),
+    replace: (_m, key, sep, value) => {
+      const q = value[0] === '"' || value[0] === "'" ? value[0] : "";
+      return `${key}${sep}${q}${REDACTED}${q}`;
+    },
+  },
+];
+
+/** Redact every secret-shaped value in `text` (see SECRET_PATTERNS). */
+export function redactSecrets(text: string): string {
+  let out = text;
+  for (const p of SECRET_PATTERNS) {
+    const r = p.replace;
+    out = typeof r === "string" ? out.replace(p.re, r) : out.replace(p.re, r);
+  }
+  return out;
+}

package/src/shared/repo-kind.ts

@@ -0,0 +1,32 @@
+/**
+ * Repo kinds: only a `service` has a runtime (up/down/status). A `module`
+ * (bolt-on a host invokes) or `library` (imported code) contributes to other
+ * repos instead.
+ */
+import { readManifest } from "./manifest/read-manifest.js";
+import type { DerivedGraph } from "./environment-manager/derivation/types.js";
+import type { RepoKind } from "./types/index.js";
+
+export function repoKind(repoPath: string): RepoKind {
+  return readManifest(repoPath)?.kind ?? "service";
+}
+
+export function hasRuntime(kind: RepoKind): boolean {
+  return kind === "service";
+}
+
+/**
+ * What a non-service repo contributes to: its declared `contributes_to`, plus
+ * every repo that imports it (an SDK-import edge pointing at it).
+ */
+export function contributesTo(
+  repo: string,
+  repoPath: string,
+  graph?: DerivedGraph,
+): string[] {
+  const declared = readManifest(repoPath)?.contributes_to ?? [];
+  const importers = (graph?.edges ?? [])
+    .filter((e) => e.to === repo && e.signal === "http:sdk-import")
+    .map((e) => e.from);
+  return [...new Set([...declared, ...importers])].filter((r) => r !== repo);
+}

package/src/shared/reporting/jsonl-reporter.ts

@@ -0,0 +1,131 @@
+/**
+ * JSONL Reporter for Playwright
+ * Writes test results to JSONL format for historical tracking
+ */
+
+import type {
+  Reporter,
+  TestCase,
+  TestResult as PlaywrightTestResult,
+  FullConfig,
+  Suite,
+} from "@playwright/test/reporter";
+import { resultWriter } from "../results/result-writer.js";
+import type { Pillar, Environment } from "../types/index.js";
+import * as os from "os";
+import * as path from "path";
+
+export default class JSONLReporter implements Reporter {
+  onBegin(_config: FullConfig, _suite: Suite) {
+    console.log("[JSONL Reporter] Initialized");
+  }
+
+  async onTestEnd(test: TestCase, result: PlaywrightTestResult) {
+    console.log("[JSONL Reporter] onTestEnd called");
+    try {
+      // Detect pillar from test file path
+      const pillar = this.detectPillar(test.location.file);
+      console.log(`[JSONL Reporter] Pillar detected: ${pillar}`);
+
+      // Get environment from env var or default to local
+      const environment = (process.env.TEST_ENV || "local") as Environment;
+
+      // Get test title path (e.g., "Smoke Tests - App Health › web app is accessible")
+      const testTitle = test.titlePath().slice(1).join(" › ");
+
+      // Get relative test file path for better readability
+      const testFile = this.getRelativeTestPath(test.location.file, pillar);
+
+      // Determine status
+      let status: "passed" | "failed" | "skipped";
+      if (result.status === "passed") {
+        status = "passed";
+      } else if (result.status === "skipped") {
+        status = "skipped";
+      } else {
+        status = "failed";
+      }
+
+      // Get screenshot and trace paths if they exist
+      const screenshot = result.attachments.find(
+        (a) => a.name === "screenshot" || a.contentType?.startsWith("image/"),
+      )?.path;
+
+      const trace = result.attachments.find(
+        (a) => a.name === "trace" || a.contentType?.includes("zip"),
+      )?.path;
+
+      // Write result to JSONL
+      await resultWriter.writeResult({
+        timestamp: new Date().toISOString(),
+        pillar,
+        environment,
+        test: `${testFile} › ${testTitle}`,
+        status,
+        duration: result.duration,
+        user: process.env.USER || os.userInfo().username || "unknown",
+        error: result.error?.message,
+        screenshot,
+        trace,
+        metadata: {
+          browser: test.parent.project()?.name,
+          retries: result.retry,
+          workerIndex: result.workerIndex,
+        },
+      });
+    } catch (error) {
+      // Don't let reporter errors break tests
+      console.warn(
+        `[JSONL Reporter] Failed to write result: ${(error as Error).message}`,
+      );
+    }
+  }
+
+  /**
+   * Detect pillar from test file path
+   */
+  private detectPillar(filePath: string): Pillar {
+    if (
+      filePath.includes("/.synth-run/") ||
+      filePath.includes("/pillars/browser/")
+    ) {
+      return "synthetic";
+    } else if (
+      filePath.includes("/pillars/api/") ||
+      filePath.includes("/integration/")
+    ) {
+      return "integration";
+    } else if (
+      filePath.includes("/pillars/perf/") ||
+      filePath.includes("/performance/")
+    ) {
+      return "performance";
+    } else if (
+      filePath.includes("/pillars/smoke/") ||
+      filePath.includes("/.smoke-run/")
+    ) {
+      return "smoke";
+    } else if (filePath.includes("/pillars/journeys/")) {
+      // Journeys aren't Playwright-run (they have their own JSONL writer in
+      // src/pillars/journeys/report/); branch kept for union completeness.
+      return "journeys";
+    }
+
+    // Default to synthetic
+    return "synthetic";
+  }
+
+  /**
+   * Get relative test path for display
+   */
+  private getRelativeTestPath(filePath: string, pillar: Pillar): string {
+    // Extract path relative to pillar directory
+    const parts = filePath.split(`/${pillar}/tests/`);
+    if (parts.length > 1) {
+      return parts[1].replace(/\.spec\.ts$/, "");
+    }
+
+    // Fallback to just filename
+    return path.basename(filePath, ".spec.ts");
+  }
+}