@monster-orange/den 0.2.7 → 0.3.0

package/src/ui/cli/clone-plan.ts

@@ -5,12 +5,22 @@
  *
  * On a fresh machine (no workspace set up yet, a blueprint in the config)
  * the plan is what `<cli> workspace seed` and then setup would do, for every
- * blueprint workspace. Otherwise it is the focused workspace's repos, the
- * ones setup works on.
+ * blueprint workspace (`-w` narrows it). Otherwise it is the focused
+ * workspace's repos, the ones setup works on, or the `-w` / `--all-active`
+ * ones; repos only other workspaces hold are named in a hint.
  */
 import * as fs from "fs";
 import * as path from "path";
-import { readCatalog } from "../../shared/environment-manager/catalog.js";
+import {
+  readCatalog,
+  resolveRepoCloneSource,
+} from "../../shared/environment-manager/catalog.js";
+import {
+  isGitRemote,
+  redactRemote,
+} from "../../shared/environment-manager/git-remote.js";
+import { readDenConfig } from "../../shared/den-config.js";
+import type { WorkOrgsConfig } from "../../shared/org-sources.js";
 import {
   blueprintWorkspaces,
   catalogFill,
@@ -32,6 +42,7 @@ import {
 } from "../../shared/environment-manager/workspace-org.js";
 import { orgOf } from "../../shared/manifest/service-links.js";
 import type { ServiceCatalog } from "../../shared/types/index.js";
+import { plural } from "../../shared/plural.js";
 
 export type ClonePlanState =
   | "cloned"
@@ -64,6 +75,39 @@ export interface ClonePlan {
   /** True when planned from the blueprint (nothing seeded yet). */
   fromBlueprint: boolean;
   workspaces: ClonePlanWorkspace[];
+  /** Repos held only by workspaces outside the plan, per workspace. */
+  outside?: { workspace: string; repos: string[] }[];
+}
+
+/** Which workspaces `setup --plan` plans (default: the focused one). */
+export interface PlanSelection {
+  /** `-w <ws>`, repeatable. */
+  workspaces?: readonly string[];
+  /** `--all-active`: every active workspace (plus any `-w` one). */
+  allActive?: boolean;
+}
+
+/**
+ * The branch a checkout has out, read from its HEAD file (no git process):
+ * the branch name, `detached <sha7>`, or null when it can't be read.
+ */
+export function checkoutBranch(dir: string): string | null {
+  try {
+    let gitDir = path.join(dir, ".git");
+    if (fs.statSync(gitDir).isFile()) {
+      // A worktree or submodule: .git names the real git dir.
+      const m = /^gitdir:\s*(.+)$/m.exec(fs.readFileSync(gitDir, "utf-8"));
+      if (!m) return null;
+      gitDir = path.resolve(dir, m[1].trim());
+    }
+    const head = fs.readFileSync(path.join(gitDir, "HEAD"), "utf-8").trim();
+    const ref = /^ref:\s*refs\/heads\/(.+)$/.exec(head);
+    if (ref) return ref[1];
+    if (/^[0-9a-f]{40,64}$/.test(head)) return `detached ${head.slice(0, 7)}`;
+    return null;
+  } catch {
+    return null;
+  }
 }
 
 const ownerOf = (slug: string): string => slug.slice(0, slug.indexOf("/"));
@@ -72,22 +116,33 @@ function cloneDir(repo: string, branch: string): string {
   return path.join(DEN_SERVICES_DIR, repo, branch);
 }
 
-/** The slug setup and up would clone `repo` from, or null without an org. */
-function slugFor(
+/**
+ * What setup and up would clone `repo` from (a GitHub slug, or an ORG-1d
+ * `remote:`), or null without an org. `owner` gives the slug's owner for a
+ * repo with neither `gh` nor `remote`.
+ */
+function sourceFor(
   repo: string,
-  workspace: string,
   catalog: ServiceCatalog,
   ctx: OrgContext,
+  owner: () => string,
 ): string | null {
-  const gh = catalog[repo]?.gh?.trim();
-  if (gh) return gh;
   try {
-    return `${githubOrgFor(workspace, ctx)}/${repo}`;
+    return resolveRepoCloneSource(repo, catalog, owner, ctx.config.orgs);
   } catch {
     return null;
   }
 }
 
+function slugFor(
+  repo: string,
+  workspace: string,
+  catalog: ServiceCatalog,
+  ctx: OrgContext,
+): string | null {
+  return sourceFor(repo, catalog, ctx, () => githubOrgFor(workspace, ctx));
+}
+
 function managedRow(
   repo: string,
   branch: string,
@@ -96,12 +151,13 @@ function managedRow(
 ): ClonePlanRow {
   const dir = cloneDir(repo, branch);
   const cloned = fs.existsSync(dir);
+  const remote = slug !== null && isGitRemote(slug);
   return {
     repo,
     mode: "managed",
     branch,
-    owner: slug ? ownerOf(slug) : null,
-    url: slug ? ghCloneUrl(slug) : null,
+    owner: !slug ? null : remote ? null : ownerOf(slug),
+    url: !slug ? null : remote ? redactRemote(slug) : ghCloneUrl(slug),
     state: cloned
       ? "cloned"
       : !slug
@@ -135,7 +191,9 @@ export function workspaceClonePlan(
       rows.push({
         repo: repoName,
         mode: "dev-managed",
-        branch,
+        // Den doesn't set a checkout's branch: say what it has out.
+        branch:
+          (entry.path && checkoutBranch(entry.path)) || "(branch unknown)",
         owner: owner || null,
         url: null,
         state: "checkout",
@@ -175,28 +233,88 @@ function blueprintClonePlan(ctx: OrgContext): ClonePlanWorkspace[] {
       managedRow(
         repo,
         bp.branch,
-        ctx.catalog[repo]?.gh?.trim() || fill.get(repo) || null,
+        sourceFor(repo, ctx.catalog, ctx, () => {
+          const slug = fill.get(repo);
+          if (!slug) throw new Error(`no org for ${repo}`);
+          return ownerOf(slug);
+        }),
         true, // seeding writes every blueprint repo into the catalog
       ),
     ),
   }));
 }
 
-/** `<cli> setup --plan`: the plan for `names` (every repo when empty). */
-export function buildSetupPlan(names: readonly string[] = []): ClonePlan {
+/**
+ * `<cli> setup --plan`: the plan for `names` (every repo when empty) in the
+ * selected workspaces. Throws on a workspace that does not exist.
+ */
+export function buildSetupPlan(
+  names: readonly string[] = [],
+  sel: PlanSelection = {},
+): ClonePlan {
   const ctx = readOrgContext();
-  if (isFreshWorkspaceSetup(ctx.file) && blueprintWorkspaces().length > 0)
-    return { fromBlueprint: true, workspaces: blueprintClonePlan(ctx) };
-  const ws = getActiveWorkspace();
-  if (!ws) return { fromBlueprint: false, workspaces: [] };
+  const want = [...new Set(sel.workspaces ?? [])];
+  if (isFreshWorkspaceSetup(ctx.file) && blueprintWorkspaces().length > 0) {
+    const all = blueprintClonePlan(ctx);
+    const unknown = want.filter((n) => !all.some((w) => w.name === n));
+    if (unknown.length)
+      throw new Error(
+        `no blueprint workspace named ${unknown.join(", ")} (the blueprint has ${all.map((w) => w.name).join(", ")})`,
+      );
+    return {
+      fromBlueprint: true,
+      workspaces: want.length ? all.filter((w) => want.includes(w.name)) : all,
+    };
+  }
+  const focused = getActiveWorkspace()?.name;
+  const planned = [
+    ...new Set(
+      sel.allActive
+        ? [...ctx.file.active, ...want]
+        : want.length
+          ? want
+          : focused
+            ? [focused]
+            : [],
+    ),
+  ];
+  const unknown = planned.filter((n) => !ctx.file.workspaces[n]);
+  if (unknown.length)
+    throw new Error(
+      `no workspace named ${unknown.join(", ")} (workspaces: ${Object.keys(ctx.file.workspaces).join(", ") || "none"})`,
+    );
+  const workspaces = planned.map((n) =>
+    workspaceClonePlan(n, names.length ? names : undefined, ctx),
+  );
   return {
     fromBlueprint: false,
-    workspaces: [
-      workspaceClonePlan(ws.name, names.length ? names : undefined, ctx),
-    ],
+    workspaces,
+    outside: outsideRepos(ctx, planned, workspaces),
   };
 }
 
+/** Repos that only workspaces outside `planned` hold, per workspace. */
+function outsideRepos(
+  ctx: OrgContext,
+  planned: readonly string[],
+  workspaces: readonly ClonePlanWorkspace[],
+): { workspace: string; repos: string[] }[] {
+  const inPlan = new Set(workspaces.flatMap((w) => w.rows.map((r) => r.repo)));
+  const out: { workspace: string; repos: string[] }[] = [];
+  for (const [name, ws] of Object.entries(ctx.file.workspaces)) {
+    if (planned.includes(name)) continue;
+    const repos = [
+      ...new Set(
+        Object.keys(ws?.services ?? {}).map(
+          (a) => parseAddress(a, ctx.catalog).repoName,
+        ),
+      ),
+    ].filter((r) => !inPlan.has(r));
+    if (repos.length) out.push({ workspace: name, repos });
+  }
+  return out;
+}
+
 const STATE_TEXT: Record<ClonePlanState, string> = {
   cloned: "cloned",
   "would-clone": "would clone",
@@ -210,6 +328,7 @@ export function renderClonePlan(
   plan: ClonePlan,
   cli: string,
   catalog: ServiceCatalog = readCatalog(),
+  orgs: WorkOrgsConfig | undefined = readDenConfig().orgs,
 ): string[] {
   const out: string[] = [];
   if (plan.fromBlueprint)
@@ -230,7 +349,7 @@ export function renderClonePlan(
             ? `  ${r.path}`
             : ""
           : "";
-      const owner = r.owner ?? orgOf(r.repo, catalog) ?? "";
+      const owner = r.owner ?? orgOf(r.repo, catalog, orgs) ?? "";
       out.push(
         `  ${r.repo}  ${r.mode} ${r.branch}  org: ${owner || "(unknown)"}` +
           `${r.url ? `  ${r.url}` : ""}  ${STATE_TEXT[r.state]}${where}`,
@@ -238,6 +357,18 @@ export function renderClonePlan(
     }
     for (const w of ws.warnings) out.push(`  ⚠ ${w}`);
   }
+  const outside = plan.outside ?? [];
+  if (outside.length) {
+    const n = new Set(outside.flatMap((o) => o.repos)).size;
+    out.push(
+      "",
+      `Not in this plan: ${plural(n, "repo")} in other workspaces: ` +
+        outside
+          .map((o) => `${o.workspace} (${o.repos.join(", ")})`)
+          .join(", ") +
+        `. Plan them with -w <workspace> or --all-active.`,
+    );
+  }
   out.push("", "Plan only: nothing was cloned, seeded or written.");
   return out;
 }

package/src/ui/cli/create.ts

@@ -146,17 +146,26 @@ export function renderDistribution(
     ...bannerLines(title).map((l) => `    - "${l}"`),
     "",
     "# The GitHub org (or user) that owns the repos Den clones and lists.",
-    "github_org: your-github-org",
+    "# Unset, Den lists no GitHub repos (and never calls gh for them). E.g.",
+    "# github_org: example-org",
     "",
-    "# Secrets backend: env reads plain environment variables; doppler and",
-    "# 1password are the others.",
+    "# Secrets backend: none (this distribution needs no secrets store), or",
+    "# env (plain environment variables), doppler or 1password. A backend's",
+    "# refs say where Den's own features find their secrets, e.g.",
+    `#   refs: { sudo: { key: ${prefix}_LOCAL_ADMIN_PWD } }`,
     "secrets:",
-    "  provider: env",
+    "  provider: none",
     "",
-    "# This instance's HTTPS edge: https://<service>.<domain>.",
+    "# This instance's edge: <service>.<domain>, one Traefik for its routes.",
     "edge:",
     `  org: ${name}`,
     `  domain: ${name}.localhost`,
+    "  # TLS: none serves http only. For https, pick a strategy:",
+    "  #   tls: { strategy: mkcert }                  # a local CA, per machine",
+    "  #   tls: { strategy: mkcert, ca: ~/path/to/ca } # an existing mkcert CA",
+    "  #   tls: { strategy: files, include: edge/dynamic, mounts: { <host>: <container> } }",
+    "  #     # your own certs, in included Traefik config",
+    "  tls: none",
     "",
     "environments: [local]",
     "",
@@ -344,13 +353,21 @@ export function runCreate(argv: string[], cwd: string): number {
       denVersion: runningDenVersion(),
     });
     const cli = args.cli ?? args.name;
-    const rel = path.relative(cwd, args.dir) || ".";
+    // Relative only when the new directory is under the caller's cwd; a
+    // path that climbs out (../../..) is harder to read than the absolute one.
+    const rel = path.relative(cwd, args.dir);
+    const cdPath =
+      rel === ""
+        ? "."
+        : rel.startsWith("..") || path.isAbsolute(rel)
+          ? args.dir
+          : rel;
     console.log(
       `Created ${args.name} in ${args.dir} (${plural(written.length, "file")}).`,
     );
     console.log("");
     console.log("Next:");
-    console.log(`  cd ${rel}`);
+    console.log(`  cd ${cdPath}`);
     console.log("  npm install");
     console.log(`  ./bin/${cli} --help`);
     return 0;

package/src/ui/cli/doctor-command.ts

@@ -0,0 +1,131 @@
+/**
+ * `doctor`: every strategy kind in the registry (secrets, tls), the
+ * strategy this distribution selects for it, whether nothing chose it
+ * (implicit), and its detect() result with the reason.
+ *
+ * Read-only: detect() is a PATH check, so doctor never spawns a backend
+ * CLI, never prompts, and never prints a secret value. Exit 1 when a
+ * strategy that will be used is unavailable or its config is invalid.
+ */
+import chalk from "chalk";
+import { readBrand } from "../../shared/brand.js";
+import { hasEdgeBlock, readEdgeConfig } from "../../shared/edge/config.js";
+import { edgeTlsWarnings, tlsStrategyFor } from "../../shared/edge/tls.js";
+import {
+  readSecretsConfig,
+  secretsStatus,
+} from "../../shared/secrets/index.js";
+import { strategyKinds } from "../../shared/strategies/registry.js";
+
+export interface DoctorRow {
+  kind: string;
+  /** The selected strategy id ("" when the config could not be read). */
+  selected: string;
+  implicit: boolean;
+  available: boolean;
+  reason?: string;
+  /** True when it will be used and cannot work: doctor exits 1. */
+  problem: boolean;
+  warnings: string[];
+}
+
+type Selector = (env: NodeJS.ProcessEnv) => DoctorRow;
+
+const SELECTORS: Record<string, Selector> = {
+  secrets(env) {
+    const st = secretsStatus(readSecretsConfig(), env);
+    return {
+      kind: "secrets",
+      selected: st.backend,
+      implicit: st.implicit,
+      available: st.detect.available,
+      reason: st.detect.reason,
+      // The implicit default is used only when a secret is asked for.
+      problem: !st.detect.available && !st.implicit,
+      warnings: [],
+    };
+  },
+  tls(env) {
+    if (!hasEdgeBlock())
+      return {
+        kind: "tls",
+        selected: "none",
+        implicit: false,
+        available: true,
+        reason: "no edge: block",
+        problem: false,
+        warnings: [],
+      };
+    try {
+      const cfg = readEdgeConfig();
+      const d = tlsStrategyFor(cfg).detect(env);
+      return {
+        kind: "tls",
+        selected: cfg.tls.strategy,
+        implicit: cfg.tlsFrom === "implicit",
+        available: d.available,
+        reason: d.reason,
+        problem: !d.available,
+        warnings: edgeTlsWarnings(cfg),
+      };
+    } catch (err) {
+      return {
+        kind: "tls",
+        selected: "",
+        implicit: false,
+        available: false,
+        reason: (err as Error).message,
+        problem: true,
+        warnings: [],
+      };
+    }
+  },
+};
+
+/**
+ * One row per registered kind (secrets, then tls, then any other kind in
+ * registration order). Never spawns, never throws.
+ */
+export function doctorRows(env: NodeJS.ProcessEnv = process.env): DoctorRow[] {
+  const kinds = strategyKinds();
+  const ordered = [
+    ...Object.keys(SELECTORS).filter((k) => kinds.includes(k)),
+    ...kinds.filter((k) => !(k in SELECTORS)),
+  ];
+  return ordered.map(
+    (kind) =>
+      SELECTORS[kind]?.(env) ?? {
+        kind,
+        selected: "",
+        implicit: false,
+        available: false,
+        reason: "no selector for this kind",
+        problem: false,
+        warnings: [],
+      },
+  );
+}
+
+export function formatDoctor(rows: DoctorRow[], title: string): string[] {
+  const lines = [chalk.bold(`${title} doctor: strategies`), ""];
+  const width = Math.max(...rows.map((r) => r.kind.length));
+  for (const r of rows) {
+    const sel = r.selected
+      ? `${r.selected}${r.implicit ? " (implicit)" : ""}`
+      : "(invalid config)";
+    const state = r.available
+      ? chalk.green("✓ available")
+      : (r.problem ? chalk.red : chalk.yellow)("✗ unavailable");
+    lines.push(
+      `  ${r.kind.padEnd(width)}  ${sel.padEnd(20)} ${state}${r.reason ? `: ${r.reason}` : ""}`,
+    );
+    for (const w of r.warnings) lines.push(chalk.yellow(`    ⚠ ${w}`));
+  }
+  return lines;
+}
+
+export function cmdDoctor(_args: string[]): number {
+  const rows = doctorRows();
+  for (const l of formatDoctor(rows, readBrand().name)) console.log(l);
+  return rows.some((r) => r.problem) ? 1 : 0;
+}

package/src/ui/cli/edge-command.ts

@@ -1,7 +1,11 @@
 /**
- * `edge up | down | status | trust | untrust | routes`
+ * `edge up [--take-over] | down | status | trust | untrust | routes`
  *
- * This org's HTTPS edge: own CA + cert, routes at `<name>.<edge.domain>`.
+ * This org's edge: routes at `<name>.<edge.domain>`, TLS as `edge.tls` says
+ * (none, mkcert or files). `trust` / `untrust` exist only under mkcert.
+ * `routes` lists Den's own routes, then the routers in the included
+ * dynamic files, each with its source file, then the stacks' routers
+ * (`stack-*.yml`, 0.3.0-dev.32), each marked "stack" with its file.
  */
 import chalk from "chalk";
 import { readBrand } from "../../shared/brand.js";
@@ -15,18 +19,37 @@ import {
   trustCa,
   untrustCa,
 } from "../../shared/edge/runtime.js";
-import { edgeStatus } from "../../shared/edge/status.js";
+import {
+  includedRouters,
+  stackRouters,
+  routerUrls,
+  type IncludedRouter,
+} from "../../shared/edge/included.js";
+import { edgeRoutes, edgeStatus } from "../../shared/edge/status.js";
+import { tlsYaml } from "../../shared/edge/tls.js";
+import { rejoinRunningStacks } from "../../shared/stacks/status.js";
+
+/** An included router's URLs (the hosts its rule names), else its name. */
+function includedUrl(r: IncludedRouter): string {
+  return r.hosts.length ? routerUrls(r).join(", ") : r.name;
+}
 
 export async function cmdEdge(args: string[]): Promise<void> {
   const sub = args[0] ?? "status";
   const cfg = readEdgeConfig();
   const n = edgeNames(cfg.org);
   const published = cfg.ports
-    ? `host :${cfg.ports.http} / :${cfg.ports.https}`
+    ? cfg.tls.strategy === "none"
+      ? `host :${cfg.ports.http} (http only)`
+      : `host :${cfg.ports.http} / :${cfg.ports.https}`
     : `not published (reach it on Docker network ${n.network})`;
   switch (sub) {
     case "up": {
-      const { certs } = await edgeUp(cfg);
+      // --take-over: the only way to replace an edge another state dir
+      // owns (0.3.0-dev.40); never implied.
+      const { certs } = await edgeUp(cfg, {
+        takeOver: args.includes("--take-over"),
+      });
       console.log(
         chalk.green(
           `✓ ${n.container} up — ${edgeDomains(cfg)
@@ -37,7 +60,7 @@ export async function cmdEdge(args: string[]): Promise<void> {
       console.log(`  ports  ${published}`);
       if (certs.issued)
         console.log(`  cert   issued for ${certs.names.join(", ")}`);
-      if (caTrusted(cfg) === false)
+      if (cfg.tls.strategy === "mkcert" && caTrusted(cfg) === false)
         console.log(
           chalk.yellow(
             "  CA not trusted yet — run `edge trust` (asks for your password once)",
@@ -45,6 +68,8 @@ export async function cmdEdge(args: string[]): Promise<void> {
         );
       for (const name of ["edge", ...Object.keys(cfg.routes)])
         console.log(`  ${routeUrl(name, cfg)}`);
+      // Running stacks' routes stay up: the edge rejoins their networks.
+      rejoinRunningStacks();
       return;
     }
     case "down":
@@ -57,10 +82,25 @@ export async function cmdEdge(args: string[]): Promise<void> {
     case "untrust":
       process.exitCode = untrustCa(cfg);
       return;
-    case "routes":
-      for (const r of edgeStatus(cfg).routes)
+    case "routes": {
+      for (const r of edgeRoutes(cfg))
         console.log(`${r.url.padEnd(52)} → ${r.upstream}`);
+      // Routers in the included dynamic files: Traefik serves them too.
+      const inc = includedRouters(cfg);
+      for (const r of inc.routers)
+        console.log(
+          `${includedUrl(r).padEnd(52)} → ${r.upstream || "?"}  (${r.file})`,
+        );
+      // Routers the stacks wrote (stack up): neither Den's nor included.
+      const stk = stackRouters(cfg);
+      for (const r of stk.routers)
+        console.log(
+          `${includedUrl(r).padEnd(52)} → ${r.upstream || "?"}  (stack: ${r.file})`,
+        );
+      for (const e of [...inc.errors, ...stk.errors])
+        console.log(chalk.yellow(`${e.file}: not read (${e.error})`));
       return;
+    }
     case "status": {
       const st = edgeStatus(cfg);
       console.log(chalk.bold(`${readBrand().name} edge — ${st.org}`));
@@ -68,14 +108,20 @@ export async function cmdEdge(args: string[]): Promise<void> {
       console.log(`  ports      ${published}`);
       console.log(`  domains    ${st.domains.join(", ")} (+ every subdomain)`);
       console.log(
-        `  CA         ${caDir(cfg)} — ${st.caTrusted === null ? "unknown" : st.caTrusted ? "trusted" : "NOT trusted"}`,
+        `  tls        ${tlsYaml(cfg.tls).replace(/^tls: /, "")}${cfg.tlsFrom === "implicit" ? " (implicit: edge.tls is not set)" : ""}`,
       );
+      if (cfg.tls.strategy !== "none")
+        console.log(
+          // Fronted (edge.publish: false): the proxy in front owns
+          // browser trust (BOOT-1), so this machine's trust is moot.
+          `  CA         ${caDir(cfg)} — ${!st.ports ? "not needed: fronted" : st.caTrusted === null ? "unknown" : st.caTrusted ? "trusted" : "NOT trusted"}`,
+        );
       if (st.certIssued) console.log(`  cert       ${st.certNames.join(", ")}`);
       return;
     }
     default:
       throw new Error(
-        `Unknown edge command "${sub}". Use: up | down | status | trust | untrust | routes`,
+        `Unknown edge command "${sub}". Use: up [--take-over] | down | status | trust | untrust | routes`,
       );
   }
 }