@monster-orange/den 0.2.7 → 0.3.0

package/src/shared/environment-manager/up-targets.ts

@@ -0,0 +1,132 @@
+/**
+ * What starting a repo runs (0.3.0-dev.35; backported to 0.2.8): the one
+ * decision `up <repo>` (its dependency closure) and `up -a` / `-A` share.
+ *
+ *   - the repo's own `up`                → the repo
+ *   - none, but its services have one    → those services: all of them, or,
+ *                                          for a repo started only as a
+ *                                          dependency, the ones its
+ *                                          dependents name (`depends_on:
+ *                                          [acme/api]`); every one when any
+ *                                          dependent needs the repo as a
+ *                                          whole
+ *   - no up at all                       → skipped ("no local up command")
+ *
+ * A repo that can't be resolved in the workspace is passed through
+ * unchanged, so the runner reports it as before. Reads manifests from disk:
+ * call it once the start set's clones exist.
+ */
+import { readManifest } from "../manifest/read-manifest.js";
+import { depService } from "../manifest/deps.js";
+import type { DerivedGraph } from "./derivation/types.js";
+import {
+  getWorkspaceServices,
+  previewServiceCommand,
+  resolveService,
+} from "./service-runner.js";
+
+export interface UpTargets {
+  /** The start order, a repo replaced by its services where it has no up. */
+  order: string[];
+  /** Repos with no up at all (said and skipped, never fatal). */
+  skippedNoUp: string[];
+  /** repo → the service addresses that start in its place. */
+  expanded: Map<string, string[]>;
+  /**
+   * A list of dependency repos as the start set has them: an expanded repo
+   * becomes its services, a skipped one is dropped (nothing to wait on).
+   */
+  depsAs(deps: string[]): string[];
+}
+
+/** The repo part of an address ("acme/api" → "acme"). */
+export const repoOfAddress = (address: string): string => address.split("/")[0];
+
+/**
+ * @param order   repos in start order
+ * @param opts.targets   repos started for their own sake (the seed, or every
+ *                       `-a` candidate): all their services start
+ * @param opts.graph     the derived graph: who depends on whom
+ */
+export function resolveUpTargets(
+  order: string[],
+  workspace: string,
+  opts: { targets: ReadonlySet<string>; graph?: DerivedGraph },
+): UpTargets {
+  const services = getWorkspaceServices(workspace);
+  const expanded = new Map<string, string[]>();
+  const skippedNoUp: string[] = [];
+  const out: string[] = [];
+  const runs = (address: string): boolean =>
+    previewServiceCommand(address, "up", workspace).kind === "run";
+  for (const repo of order) {
+    const own = previewServiceCommand(repo, "up", workspace).kind;
+    if (
+      own === "run" ||
+      own === "via-repo" ||
+      !resolveService(repo, workspace)
+    ) {
+      out.push(repo);
+      continue;
+    }
+    const withUp = services
+      .filter((s) => s.repoName === repo && s.address !== repo)
+      .map((s) => s.address)
+      .filter(runs);
+    if (withUp.length === 0) {
+      skippedNoUp.push(repo);
+      continue;
+    }
+    const wanted = opts.targets.has(repo)
+      ? null
+      : namedByDependents(repo, order, workspace, opts.graph);
+    const start = wanted ? withUp.filter((a) => wanted.has(a)) : withUp;
+    const pick = start.length ? start : withUp;
+    expanded.set(repo, pick);
+    out.push(...pick);
+  }
+  const skipped = new Set(skippedNoUp);
+  return {
+    order: out,
+    skippedNoUp,
+    expanded,
+    depsAs: (deps) =>
+      deps.flatMap((d) => (skipped.has(d) ? [] : (expanded.get(d) ?? [d]))),
+  };
+}
+
+/**
+ * The services of `repo` its dependents in `order` name, or null when one
+ * of them needs the repo as a whole (names it bare, or depends on it by a
+ * derived edge with no `depends_on` naming a service of it).
+ */
+function namedByDependents(
+  repo: string,
+  order: string[],
+  workspace: string,
+  graph?: DerivedGraph,
+): Set<string> | null {
+  const named = new Set<string>();
+  const dependents = new Set(
+    (graph?.edges ?? [])
+      .filter((e) => e.to === repo && e.from !== repo)
+      .map((e) => e.from),
+  );
+  for (const dependent of order) {
+    if (dependent === repo) continue;
+    const resolved = resolveService(dependent, workspace);
+    const manifest = resolved ? readManifest(resolved.repoPath) : null;
+    let mine = 0;
+    for (const s of Object.values(manifest?.services ?? {}))
+      for (const dep of s?.depends_on ?? []) {
+        const d = depService(dep);
+        if (d === repo) return null;
+        if (repoOfAddress(d) === repo) {
+          named.add(d);
+          mine++;
+        }
+      }
+    if (dependents.has(dependent) && mine === 0) return null;
+  }
+  return named.size ? named : null;
+}

package/src/shared/environment-manager/workspace-manager.ts

@@ -22,6 +22,12 @@ import {
 } from "../process/spawn-streaming.js";
 import { buildServiceEnv } from "./service-env.js";
 import { assertSafeCloneDestination } from "./clone-guard.js";
+import {
+  SAFE_SLUG_RE,
+  isGitRemote,
+  isSafeRemote,
+  redactRemote,
+} from "./git-remote.js";
 import type { CommandDef } from "../types/index.js";
 
 // ── Terminal resolution (macOS) ──────────────────────────────────────────────
@@ -76,13 +82,45 @@ function resolveTerminalAppName(key: string): string | null {
 
 // ── Git helpers ───────────────────────────────────────────────────────────────
 
-function git(cmd: string, cwd?: string): void {
-  execSync(`git -c credential.helper="!gh auth git-credential" ${cmd}`, {
+const GH_CREDENTIAL = `-c credential.helper="!gh auth git-credential"`;
+
+/**
+ * Run git with gh as an extra credential helper (a GitHub clone), or as
+ * plain git (`gh` false: a clone from a catalog `remote:`, which gets only
+ * the user's own credential helper, never gh's: SEC-0).
+ */
+function git(cmd: string, cwd?: string, gh = true): void {
+  execSync(`git ${gh ? `${GH_CREDENTIAL} ` : ""}${cmd}`, {
     cwd,
     stdio: "inherit",
   });
 }
 
+/** Set in a clone made from a `remote:`; its later fetches stay plain git. */
+const PLAIN_MARK = "den.credential";
+
+/** Whether a clone's fetches use gh: every clone but one Den made from a `remote:`. */
+function usesGhCredential(repoPath: string): boolean {
+  try {
+    return (
+      execSync(`git config --local --get ${PLAIN_MARK}`, {
+        cwd: repoPath,
+        stdio: ["ignore", "pipe", "ignore"],
+        encoding: "utf-8",
+      }).trim() !== "git"
+    );
+  } catch {
+    return true; // unset: a GitHub clone, as every clone before ORG-1d
+  }
+}
+
+/** Clone `source` (a GitHub slug or a checked git URL) with its own credentials. */
+function gitClone(args: string, source: string, dest: string): void {
+  const plain = isGitRemote(source);
+  git(`clone ${args}"${cloneUrlOf(source)}" "${dest}"`, undefined, !plain);
+  if (plain) git(`config --local ${PLAIN_MARK} git`, dest, false);
+}
+
 function gitCapture(cmd: string, cwd?: string): string {
   return execSync(cmd, {
     cwd,
@@ -96,6 +134,16 @@ export function ghCloneUrl(ghSlug: string): string {
   return `https://github.com/${ghSlug}.git`;
 }
 
+/** The URL a clone of `source` is made from: a GitHub slug's, or the remote itself. */
+export function cloneUrlOf(source: string): string {
+  return isGitRemote(source) ? source : ghCloneUrl(source);
+}
+
+/** `source` for a log line: a slug as is, a remote with any user info masked. */
+function shown(source: string): string {
+  return isGitRemote(source) ? redactRemote(source) : source;
+}
+
 // ── Injection guards ──────────────────────────────────────────────────────────
 //
 // git() runs through a shell (execSync), so branch names and GitHub slugs
@@ -106,7 +154,7 @@ export function ghCloneUrl(ghSlug: string): string {
 // the single choke point for every clone path.
 
 export const SAFE_BRANCH_RE = /^[a-zA-Z0-9._/-]+$/;
-export const SAFE_SLUG_RE = /^[a-zA-Z0-9._-]+\/[a-zA-Z0-9._-]+$/;
+export { SAFE_SLUG_RE };
 
 function assertSafeBranch(branch: string): void {
   if (!SAFE_BRANCH_RE.test(branch)) {
@@ -116,10 +164,12 @@ function assertSafeBranch(branch: string): void {
   }
 }
 
+/** A GitHub slug, or (ORG-1d) a git URL from a catalog `remote:`. */
 function assertSafeSlug(ghSlug: string): void {
+  if (isGitRemote(ghSlug) && isSafeRemote(ghSlug)) return;
   if (!SAFE_SLUG_RE.test(ghSlug)) {
     throw new Error(
-      `Invalid GitHub slug "${ghSlug}" — expected "owner/repo" using only letters, digits, ".", "_" and "-"`,
+      `Invalid GitHub slug "${redactRemote(ghSlug)}" — expected "owner/repo" using only letters, digits, ".", "_" and "-"`,
     );
   }
 }
@@ -427,17 +477,15 @@ export function ensureManagedServiceClone(
   if (!fs.existsSync(cloneDir)) {
     assertSafeCloneDestination(cloneDir, repoName);
     console.log(
-      `  ⬇ Cloning ${ghSlug}@${branch} → ${product().servicesDir}/${repoName}/${branch}/`,
+      `  ⬇ Cloning ${shown(ghSlug)}@${branch} → ${product().servicesDir}/${repoName}/${branch}/`,
     );
     fs.mkdirSync(path.join(DEN_SERVICES_DIR, repoName), {
       recursive: true,
     });
-    git(
-      `clone --filter=blob:none --branch "${branch}" "${ghCloneUrl(ghSlug)}" "${cloneDir}"`,
-    );
+    gitClone(`--filter=blob:none --branch "${branch}" `, ghSlug, cloneDir);
     if (runSetup) runSetupIfDefined(cloneDir);
   } else {
-    git("pull --ff-only", cloneDir);
+    git("pull --ff-only", cloneDir, usesGhCredential(cloneDir));
   }
 
   return cloneDir;
@@ -463,12 +511,10 @@ export function ensureManagedServiceCloneNewBranch(
   if (!fs.existsSync(cloneDir)) {
     assertSafeCloneDestination(cloneDir, repoName);
     console.log(
-      `  ⬇ Cloning ${ghSlug}@${baseBranch} → ${product().servicesDir}/${repoName}/${newBranch}/ (new branch: ${newBranch})`,
+      `  ⬇ Cloning ${shown(ghSlug)}@${baseBranch} → ${product().servicesDir}/${repoName}/${newBranch}/ (new branch: ${newBranch})`,
     );
     fs.mkdirSync(path.dirname(cloneDir), { recursive: true });
-    git(
-      `clone --filter=blob:none --branch "${baseBranch}" "${ghCloneUrl(ghSlug)}" "${cloneDir}"`,
-    );
+    gitClone(`--filter=blob:none --branch "${baseBranch}" `, ghSlug, cloneDir);
     git(`checkout -b "${newBranch}"`, cloneDir);
     runSetupIfDefined(cloneDir);
   }
@@ -496,15 +542,13 @@ export function ensureDevManagedClone(
   if (!fs.existsSync(targetDir)) {
     const leafName = path.basename(targetDir);
     assertSafeCloneDestination(targetDir, leafName);
-    console.log(`  ⬇ Cloning ${ghSlug}@${branch} → ${targetDir}/`);
+    console.log(`  ⬇ Cloning ${shown(ghSlug)}@${branch} → ${targetDir}/`);
     fs.mkdirSync(path.dirname(targetDir), { recursive: true });
     try {
-      git(
-        `clone --filter=blob:none --branch "${branch}" "${ghCloneUrl(ghSlug)}" "${targetDir}"`,
-      );
+      gitClone(`--filter=blob:none --branch "${branch}" `, ghSlug, targetDir);
     } catch {
       // Branch may not exist — clone default branch and checkout/create the branch
-      git(`clone --filter=blob:none "${ghCloneUrl(ghSlug)}" "${targetDir}"`);
+      gitClone(`--filter=blob:none `, ghSlug, targetDir);
       try {
         git(`checkout "${branch}"`, targetDir);
       } catch {
@@ -538,17 +582,15 @@ export function ensureWorkspaceClone(
   if (!fs.existsSync(cloneDir)) {
     assertSafeCloneDestination(cloneDir, repoName);
     console.log(
-      `  ⬇ Cloning ${ghSlug}@${branch} → ${product().workspacesDir}/${workspaceName}/${repoName}/`,
+      `  ⬇ Cloning ${shown(ghSlug)}@${branch} → ${product().workspacesDir}/${workspaceName}/${repoName}/`,
     );
     fs.mkdirSync(wsDir, { recursive: true });
 
     try {
-      git(
-        `clone --filter=blob:none --branch "${branch}" "${ghCloneUrl(ghSlug)}" "${cloneDir}"`,
-      );
+      gitClone(`--filter=blob:none --branch "${branch}" `, ghSlug, cloneDir);
     } catch {
       // Branch doesn't exist yet — clone main and create the branch
-      git(`clone --filter=blob:none "${ghCloneUrl(ghSlug)}" "${cloneDir}"`);
+      gitClone(`--filter=blob:none `, ghSlug, cloneDir);
       git(`checkout -b "${branch}"`, cloneDir);
       console.log(`  ✓ Created new branch ${branch} in ${repoName}`);
     }
@@ -660,7 +702,7 @@ export function pullRepo(repoPath: string): void {
   } catch {
     /* best-effort — a genuinely diverged clone still errors on the pull */
   }
-  git("pull --ff-only", repoPath);
+  git("pull --ff-only", repoPath, usesGhCredential(repoPath));
 }
 
 /**
@@ -682,7 +724,7 @@ export function fetchAndFastForward(repoPath: string): {
   pulled: boolean;
   error?: string;
 } {
-  const GH_CRED = `-c credential.helper="!gh auth git-credential"`;
+  const GH_CRED = usesGhCredential(repoPath) ? GH_CREDENTIAL : "";
   try {
     execSync(`git ${GH_CRED} fetch --quiet`, {
       cwd: repoPath,

package/src/shared/environment-manager/workspace-org.ts

@@ -1,8 +1,9 @@
 /**
  * Which work org a workspace belongs to (ORG-1a, ORG-SPEC §2).
  *
- * An org is a key of `orgs:` or a GitHub owner. ORG-1a keeps today's model:
- * an org with no `sources` is the GitHub owner of the same name, and
+ * An org is a key of `orgs:` or a GitHub owner. An org with no `sources`
+ * and no `repos` is the GitHub owner of the same name (ORG-1a); ORG-1d's
+ * keys make it any name (org-sources.ts), and a repo's org is orgOf's.
  * `github_org` is the default org. A workspace's org resolves through this
  * chain, first match wins:
  *
@@ -25,6 +26,7 @@ import {
 import { readCatalog } from "./catalog.js";
 import { parseAddress, readWorkspacesFile } from "./workspaces.js";
 import { orgOf } from "../manifest/service-links.js";
+import { githubOwnersOf, orgClaimingOwner } from "../org-sources.js";
 import { cachedRead } from "../read-cache.js";
 import type {
   ServiceCatalog,
@@ -71,12 +73,16 @@ export function readOrgContext(): OrgContext {
   };
 }
 
-/** `id` spelled as its `orgs:` key when one matches case-insensitively. */
+/**
+ * `id` spelled as its `orgs:` key when one matches case-insensitively; a
+ * GitHub owner an ORG-1d source claims (`github_org: acme` with a source
+ * for acme) is that source's org.
+ */
 export function canonicalOrg(id: string, config: DenConfig): string {
   const key = Object.keys(config.orgs ?? {}).find(
     (k) => lower(k) === lower(id),
   );
-  return key ?? id;
+  return key ?? orgClaimingOwner(id, config.orgs) ?? id;
 }
 
 /** The default org: `github_org`, or null when unset. */
@@ -104,7 +110,7 @@ function workspaceRepos(
 function knownOrgs(ctx: OrgContext): Set<string> {
   const ids = new Set(Object.keys(ctx.config.orgs ?? {}).map(lower));
   for (const repo of Object.keys(ctx.catalog)) {
-    const o = orgOf(repo, ctx.catalog);
+    const o = orgOf(repo, ctx.catalog, ctx.config.orgs);
     if (o) ids.add(lower(o));
   }
   const d = ctx.config.github_org?.trim();
@@ -133,7 +139,7 @@ export function resolveWorkspaceOrg(
   const repos = workspaceRepos(ws, bp, ctx.catalog);
   const owners = new Map<string, string>(); // lowercased → first spelling
   for (const repo of repos) {
-    const o = orgOf(repo, ctx.catalog);
+    const o = orgOf(repo, ctx.catalog, ctx.config.orgs);
     if (o && !owners.has(lower(o))) owners.set(lower(o), o);
   }
 
@@ -179,7 +185,7 @@ export function resolveWorkspaceOrg(
     (owners.size <= 1 || source === "workspace" || source === "blueprint")
   )
     for (const repo of repos) {
-      const o = orgOf(repo, ctx.catalog);
+      const o = orgOf(repo, ctx.catalog, ctx.config.orgs);
       if (o && lower(o) !== lower(org))
         warnings.push(
           `workspace ${name}: repo ${repo} belongs to ${o}, not the workspace's org ${org}`,
@@ -209,16 +215,25 @@ export function resolveAllWorkspaceOrgs(ctx?: OrgContext): WorkspaceOrg[] {
 
 /**
  * The GitHub owner to clone and register a workspace's repos under: its
- * resolved org. With none at all (no org anywhere and no `github_org`) this
- * throws exactly as requireGithubOrg does, so an old config fails as before.
+ * resolved org, which for a legacy org is that GitHub owner. An org with
+ * ORG-1d `sources` gives its first GitHub source's owner, and one with no
+ * GitHub source throws (its repos clone from `remote:`; discovery is off).
+ * With no org at all (no org anywhere and no `github_org`) this throws
+ * exactly as requireGithubOrg does, so an old config fails as before.
  */
 export function githubOrgFor(workspace: string, ctx?: OrgContext): string {
   const hit = ctx
     ? resolveWorkspaceOrg(workspace, ctx)
     : (resolveAllWorkspaceOrgs().find((w) => w.workspace === workspace) ??
       resolveWorkspaceOrg(workspace, readOrgContext()));
-  if (hit.org) return hit.org;
-  return requireGithubOrg(ctx?.config);
+  if (!hit.org) return requireGithubOrg(ctx?.config);
+  const orgs = (ctx?.config ?? readDenConfig()).orgs;
+  const owner = githubOwnersOf(hit.org, orgs)[0];
+  if (owner) return owner;
+  throw new Error(
+    `org ${hit.org} has no GitHub source (orgs.${hit.org}.sources): ` +
+      `give workspace ${workspace}'s repos a remote: in the service catalog`,
+  );
 }
 
 export interface OrgEntry {

package/src/shared/health/rollup.ts

@@ -0,0 +1,48 @@
+/**
+ * The repo health rollup, typed for TypeScript callers (`<cli> status`).
+ *
+ * The rule itself is one plain ES module, src/ui/server/public/health-rollup.js,
+ * because the browser runs it too (the header row and the graph): one
+ * function everywhere, so the row, its chip, the graph and `status` never
+ * disagree. See that file for the rule.
+ */
+import * as rollup from "../../ui/server/public/health-rollup.js";
+
+export type RepoState = "down" | "degraded" | "ok" | "unknown";
+
+export interface HealthSignal {
+  service: string;
+  /** true up, false down or failing, null not checked (or not yet). */
+  ok: boolean | null | undefined;
+  isEntrypoint?: boolean;
+  /** Not answered yet this cycle: the repo stays unknown until it has. */
+  awaiting?: boolean;
+}
+
+export interface RepoRollup {
+  state: RepoState;
+  /** The entry service's name, or null when none can be told. */
+  entry: string | null;
+  /** Checked services that are down, by name. */
+  down: string[];
+  checked: number;
+  unchecked: number;
+  /** Checks that haven't answered yet; any holds the state at unknown. */
+  awaiting: number;
+}
+
+export const STATE_RANK: Record<RepoState, number> = rollup.STATE_RANK;
+
+export const rollupRepo = rollup.rollupRepo as (
+  repo: string,
+  signals: HealthSignal[],
+) => RepoRollup;
+
+export const describeRollup = rollup.describeRollup as (
+  r: RepoRollup,
+) => string;
+
+export const compareRepos = rollup.compareRepos as (
+  a: { state: RepoState; repo: string; focused?: boolean },
+  b: { state: RepoState; repo: string; focused?: boolean },
+) => number;

package/src/shared/manifest/service-links.ts

@@ -12,6 +12,7 @@ import type {
   ServiceCatalog,
   ServiceManagementConfig,
 } from "../types/index.js";
+import { orgOfRepo, type WorkOrgsConfig } from "../org-sources.js";
 
 export interface OpenLink {
   label: string;
@@ -63,11 +64,18 @@ export function linksFor(
   return out;
 }
 
-/** The GitHub owner a repo is catalogued under ("acme"), or "". */
-export function orgOf(repo: string, catalog: ServiceCatalog): string {
-  const gh = catalog[repo]?.gh ?? "";
-  const slash = gh.indexOf("/");
-  return slash > 0 ? gh.slice(0, slash) : "";
+/**
+ * The org a repo belongs to (ORG-1d): an org whose `repos` lists it, then an
+ * org with a source that claims its owner, then (legacy) its bare GitHub
+ * owner from `gh` ("acme"), else "". Without `orgs` (or with no ORG-1d keys
+ * in it) this is the repo's GitHub owner, as before.
+ */
+export function orgOf(
+  repo: string,
+  catalog: ServiceCatalog,
+  orgs: WorkOrgsConfig = {},
+): string {
+  return orgOfRepo(repo, catalog, orgs);
 }
 
 export interface OrgDisplay {
@@ -75,14 +83,18 @@ export interface OrgDisplay {
   color?: string;
 }
 
-/** Every org in the catalog with its display name, configured ones first. */
+/**
+ * Every org with its display name, configured ones first, then each
+ * catalogued repo's org. An owner a source claims is not an org of its own,
+ * so it is not listed.
+ */
 export function listOrgs(
   catalog: ServiceCatalog,
-  configured: Record<string, OrgDisplay> = {},
+  configured: WorkOrgsConfig = {},
 ): Array<{ id: string; label: string; color?: string }> {
   const ids = new Set<string>(Object.keys(configured));
   for (const repo of Object.keys(catalog)) {
-    const o = orgOf(repo, catalog);
+    const o = orgOf(repo, catalog, configured);
     if (o) ids.add(o);
   }
   return [...ids].map((id) => ({

package/src/shared/open-url.ts

@@ -6,7 +6,8 @@
  * Order, first answer wins:
  *   1. manifest `services.<svc>.urls.<env>`
  *   2. local only: the edge route for the service's compose container,
- *      `https://<route>.<stack>.<edge domain>`; the stack-wide service (the
+ *      `https://<route>.<stack>.<edge domain>` (`http://` and the edge's http
+ *      port for `tls: none`, 0.3.0-dev.40); the stack-wide service (the
  *      entrypoint, or one named after the stack) takes the `app` route, else
  *      the first route
  *   3. the origin of the env's HTTP health URL
@@ -32,11 +33,22 @@ export function httpUrl(raw: unknown): string | null {
   }
 }
 
+/**
+ * How the edge serves its routes: https on 443 (every edge.tls strategy but
+ * `none`), or http on its http port for `tls: none`. A non-default port is
+ * part of the URL.
+ */
+export interface EdgeOrigin {
+  https: boolean;
+  port?: number | null;
+}
+
 function edgeRouteUrl(
   manifest: DenManifest,
   subsystem: string,
   repoName: string,
   edgeDomain: string,
+  origin: EdgeOrigin,
 ): string | null {
   const routes = manifest.compose?.routes;
   if (!routes || !Object.keys(routes).length) return null;
@@ -51,7 +63,11 @@ function edgeRouteUrl(
   });
   if (!route && (manifest.entrypoint === subsystem || subsystem === stack))
     route = routes.app ? "app" : names[0];
-  return route ? `https://${route}.${stack}.${edgeDomain}/` : null;
+  if (!route) return null;
+  const scheme = origin.https ? "https" : "http";
+  const dflt = origin.https ? 443 : 80;
+  const port = origin.port && origin.port !== dflt ? `:${origin.port}` : "";
+  return `${scheme}://${route}.${stack}.${edgeDomain}${port}/`;
 }
 
 export function openUrlFor(opts: {
@@ -63,6 +79,8 @@ export function openUrlFor(opts: {
   healthUrl?: string | null;
   /** Primary edge domain; local edge routes are skipped without it. */
   edgeDomain?: string | null;
+  /** The edge's scheme and port (default: https on 443). */
+  edgeOrigin?: EdgeOrigin;
 }): string | null {
   const svc = opts.manifest.services?.[opts.subsystem];
   const declared = httpUrl(
@@ -75,6 +93,7 @@ export function openUrlFor(opts: {
       opts.subsystem,
       opts.repoName,
       opts.edgeDomain,
+      opts.edgeOrigin ?? { https: true },
     );
     if (routed) return routed;
   }