@monster-orange/den 0.2.8 → 0.4.0

package/src/shared/environment-manager/health.ts

@@ -5,6 +5,7 @@
  * server's /api/health endpoint and the CLI's status command.
  */
 
+import { rollupRepo, type RepoRollup } from "../health/rollup.js";
 import { hasRuntime, repoKind } from "../repo-kind.js";
 import * as https from "https";
 import * as tls from "tls";
@@ -45,6 +46,7 @@ import type {
   ResolvedService,
   ServiceCatalog,
   ServiceHealthConfig,
+  WorkspaceConfig,
 } from "../types/index.js";
 import type { Environment } from "../types/index.js";
 
@@ -80,6 +82,13 @@ export interface ServiceHealthResult {
   /** Where the service runs for the env checked (R13). */
   runs?: Placement["runs"];
   target?: Placement["target"];
+  /** A repo row's rollup of every service (rollupRepoHealth). */
+  rollup?: RepoRollup;
+  /**
+   * The workspaces checked that define this service, when more than one
+   * was (checkCatalogHealth's `workspaces`): a shared service, listed once.
+   */
+  workspaces?: string[];
 }
 
 // ── Name resolution ───────────────────────────────────────────────────────────
@@ -184,11 +193,13 @@ function extraCa(): string[] {
   if (_extraCa) return _extraCa;
   _extraCa = [];
   try {
-    // The edge's own CA, and the CA it was pointed at (`edge.caroot`, e.g. the
-    // laptop's mkcert CA that signs the projects' certificates).
+    // The edge's own CA, and the CA it was pointed at (`edge.tls.ca`, formerly
+    // `edge.caroot`, e.g. the laptop's mkcert CA that signs the projects'
+    // certificates).
     const cfg = readEdgeConfig();
     const pems = [path.join(cfg.stateDir, "ca", "rootCA.pem")];
-    if (cfg.caroot) pems.push(path.join(cfg.caroot, "rootCA.pem"));
+    const ca = cfg.tls.strategy === "none" ? null : cfg.tls.ca;
+    if (ca) pems.push(path.join(ca, "rootCA.pem"));
     for (const pem of pems)
       if (fs.existsSync(pem)) _extraCa.push(fs.readFileSync(pem, "utf-8"));
   } catch {
@@ -823,32 +834,45 @@ export async function checkServiceHealth(
 export async function checkCatalogHealth(
   catalog: ServiceCatalog = readCatalog(),
   env: Environment = "local",
+  /**
+   * The workspaces to check (focus first), e.g. the view scope's. Default:
+   * the focused one. A service several define is checked once, from the
+   * first, with `workspaces` naming every one.
+   */
+  workspaces?: { name: string; config: WorkspaceConfig }[],
 ): Promise<ServiceHealthResult[]> {
   const ws = getActiveWorkspace();
+  const list = workspaces ?? (ws ? [ws] : []);
+  const byAddress = new Map<string, ResolvedService>();
+  const owners = new Map<string, string[]>();
+  for (const w of list)
+    for (const r of listWorkspaceServices(w.config, catalog, w.name)) {
+      // Modules and libraries have no runtime, so no health of their own.
+      if (!hasRuntime(repoKind(r.repoPath))) continue;
+      if (!byAddress.has(r.address)) byAddress.set(r.address, r);
+      const o = owners.get(r.address) ?? [];
+      if (!o.includes(w.name)) owners.set(r.address, [...o, w.name]);
+    }
 
-  if (!ws) return [];
-  // Modules and libraries have no runtime, so no health of their own.
-  const resolved = listWorkspaceServices(ws.config, catalog, ws.name).filter(
-    (r) => hasRuntime(repoKind(r.repoPath)),
+  return Promise.all(
+    [...byAddress.values()].map(async (r) => {
+      const h = await checkServiceHealth(r, env);
+      return workspaces ? { ...h, workspaces: owners.get(r.address) } : h;
+    }),
   );
-
-  return Promise.all(resolved.map((r) => checkServiceHealth(r, env)));
 }
 
 /**
- * Collapse a multi-service repo's per-subsystem health rows into a single
- * repo-level row keyed on the manifest `entrypoint` (the front-door app).
+ * One row per repo, its health rolled up from every service's check by the
+ * rule the web UI's header row and graph use (src/shared/health/rollup.ts):
+ * down when the entry service (the manifest `entrypoint`) is down, degraded
+ * when another checked service is, healthy when something is checked and
+ * nothing fails, unknown when nothing is checked. Unchecked services never
+ * count (0.3.0-dev.10).
  *
- * Stack app-repos declare their shared-infra sidecars (pg/redis/sqs/ddb/s3) as
- * manifest `services:`, and those sidecars health-check the shared infra-stack
- * stack — so they read "ok" whenever infra-stack is up, making a down app look
- * partially running. Rolling up to the entrypoint answers the real question
- * ("is this repo's service up?") instead.
- *
- * A repo is collapsed only when it has multiple rows AND its manifest declares an
- * `entrypoint` present among them. Repos with no entrypoint (e.g. the
- * infra-stack infra provider, whose subsystems ARE the meaningful services)
- * keep their subsystem breakdown. Single-row repos pass through unchanged.
+ * The repo row is the entry service's row under the repo name, with
+ * `rollup` set; its `health` is "error" for down or degraded. A remote
+ * service keeps its own row too (R13). Single-service repos keep their row.
  */
 export function rollupRepoHealth(
   results: ServiceHealthResult[],
@@ -867,23 +891,34 @@ export function rollupRepoHealth(
 
   const out: ServiceHealthResult[] = [];
   for (const [repoName, rows] of groups) {
-    if (rows.length <= 1) {
-      out.push(...rows);
-      continue;
-    }
-    const entrypoint = getEntrypoint(repoName, rows[0].repoPath);
-    const epRow = entrypoint
-      ? rows.find((r) => r.subsystem === entrypoint)
-      : undefined;
-    if (epRow) {
-      // Show the entrypoint's health under the clean repo-name address. A
-      // remote service is not a sidecar: it keeps its own row (R13).
-      out.push({ ...epRow, address: repoName });
-      out.push(...rows.filter((r) => r !== epRow && r.runs === "remote"));
-    } else {
-      // No entrypoint → infra provider; keep the subsystem breakdown.
-      out.push(...rows);
-    }
+    const entrypoint =
+      rows.length > 1 ? getEntrypoint(repoName, rows[0].repoPath) : undefined;
+    const rollup = rollupRepo(
+      repoName,
+      rows.map((r) => ({
+        service: r.subsystem,
+        ok: r.health === "ok" ? true : r.health === "error" ? false : null,
+        isEntrypoint: !!entrypoint && r.subsystem === entrypoint,
+      })),
+    );
+    const lead =
+      rows.find((r) => r.subsystem === rollup.entry) ??
+      rows.find((r) => r.health === "error") ??
+      rows[0];
+    out.push({
+      ...lead,
+      address: rows.length > 1 ? repoName : lead.address,
+      health:
+        rollup.state === "ok"
+          ? "ok"
+          : rollup.state === "unknown"
+            ? "unknown"
+            : "error",
+      rollup,
+    });
+    // A remote service is not a sidecar: it keeps its own row (R13).
+    if (rows.length > 1)
+      out.push(...rows.filter((r) => r !== lead && r.runs === "remote"));
   }
   return out;
 }

package/src/shared/environment-manager/scope.ts

@@ -0,0 +1,168 @@
+/**
+ * The view scope (0.3.0-dev.16): which workspaces' repos are in view, the
+ * one source for the header's health row, the pages and `<cli> status`.
+ *
+ * - **Scope** is a view filter: "all" (every active workspace) or one
+ *   active workspace. It is a user preference (user.yml `view.scope`) and
+ *   changes nothing else: no edge route, container or service.
+ * - **Focus** is the default target for commands (`up`, `restart`, the
+ *   Local Dev actions). Scope never changes it.
+ *
+ * "all" is the default, also with several active workspaces: the health
+ * row already covered every active workspace, so a page that showed only
+ * the focused one disagreed with the row above it. With one active
+ * workspace "all" and that workspace are the same view.
+ */
+import { readUserConfig, type UserConfig } from "../den-config.js";
+import type { WorkspaceConfig } from "../types/index.js";
+import { readWorkspacesFile } from "./workspaces.js";
+
+/** "all", or one workspace's name. */
+export type ViewScope = string;
+export const ALL_ACTIVE = "all";
+
+const NAME = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
+
+/** The stored scope, normalised: "all" unless a plausible workspace name. */
+export function storedScope(user: Pick<UserConfig, "view">): ViewScope {
+  const s = user.view?.scope;
+  return typeof s === "string" && s !== ALL_ACTIVE && NAME.test(s)
+    ? s
+    : ALL_ACTIVE;
+}
+
+/**
+ * The workspaces in view, focused first, then the other active ones in
+ * their file order. A named scope that is no longer active falls back to
+ * all active (so a deactivated workspace never empties the view). Pure.
+ */
+export function scopeWorkspaceNames(
+  scope: ViewScope,
+  ws: { active: string[]; focus: string | null; known: string[] },
+): string[] {
+  const active = ws.active.filter((n) => ws.known.includes(n));
+  if (scope !== ALL_ACTIVE && active.includes(scope)) return [scope];
+  const focus = ws.focus && active.includes(ws.focus) ? ws.focus : null;
+  return [...(focus ? [focus] : []), ...active.filter((n) => n !== focus)];
+}
+
+/** What a view resolves to: the scope asked for, and what is in it. */
+export interface ScopeView {
+  /** The stored scope ("all" or a workspace). */
+  scope: ViewScope;
+  /** True when a named scope is not active any more: showing all. */
+  fellBack: boolean;
+  /** The workspaces in view, focused first. */
+  workspaces: { name: string; config: WorkspaceConfig }[];
+  /** The focused workspace: the default target for commands. */
+  focus: string | null;
+}
+
+/** The view for `scope` (default: the user's stored one). */
+export function scopeView(scope?: ViewScope): ScopeView {
+  const want = scope ?? storedScope(readUserConfig());
+  const file = readWorkspacesFile();
+  const known = Object.keys(file.workspaces);
+  const focusName =
+    process.env.DEN_WORKSPACE_OVERRIDE ?? file.focus ?? file.active[0] ?? null;
+  const focus = focusName && file.workspaces[focusName] ? focusName : null;
+  const names = scopeWorkspaceNames(want, {
+    active: file.active,
+    focus,
+    known,
+  });
+  return {
+    scope: want,
+    fellBack: want !== ALL_ACTIVE && !names.includes(want),
+    workspaces: names.map((name) => ({
+      name,
+      config: file.workspaces[name],
+    })),
+    focus,
+  };
+}
+
+/** A cache key for what is in view (the scope's workspaces, in order). */
+export function scopeKey(view: ScopeView): string {
+  return view.workspaces.map((w) => w.name).join(",");
+}
+
+/**
+ * Validate a scope a client asks for: "all", or a workspace that is active
+ * now. Pure; the caller stores the result in user.yml `view`.
+ */
+export function parseScope(
+  raw: unknown,
+  active: string[],
+): { ok: true; value: ViewScope } | { ok: false; error: string } {
+  if (raw === ALL_ACTIVE) return { ok: true, value: ALL_ACTIVE };
+  if (typeof raw !== "string" || !NAME.test(raw))
+    return { ok: false, error: `scope must be "all" or a workspace name` };
+  if (!active.includes(raw))
+    return { ok: false, error: `workspace "${raw}" is not active` };
+  return { ok: true, value: raw };
+}
+
+/** The `view` block to store: none for the default, so user.yml stays lean. */
+export function storedView(scope: ViewScope): UserConfig["view"] | undefined {
+  return scope === ALL_ACTIVE ? undefined : { scope };
+}
+
+/** What `/api/scope` returns: the scope, what it shows, and the focus. */
+export function scopePayload(view: ScopeView): {
+  scope: ViewScope;
+  fellBack: boolean;
+  inView: string[];
+  focus: string | null;
+} {
+  return {
+    scope: view.fellBack ? ALL_ACTIVE : view.scope,
+    fellBack: view.fellBack,
+    inView: view.workspaces.map((w) => w.name),
+    focus: view.focus,
+  };
+}
+
+/**
+ * Take `--scope <all|workspace>` (or `--scope=…`) out of argv. `--all` is
+ * not it: on `status` that already means verbose (one row per service).
+ */
+export function takeScopeFlag(argv: string[]): {
+  scope: string | null;
+  rest: string[];
+  error?: string;
+} {
+  const rest: string[] = [];
+  let scope: string | null = null;
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === "--scope") {
+      const v = argv[i + 1];
+      if (v === undefined || v.startsWith("-"))
+        return { scope: null, rest, error: "--scope needs all or a workspace" };
+      scope = v;
+      i++;
+    } else if (a.startsWith("--scope=")) scope = a.slice("--scope=".length);
+    else rest.push(a);
+  }
+  return { scope, rest };
+}
+
+/**
+ * The scope line `status` prints, so a reader sees what is in view and
+ * what commands target: "Scope: all active (a, b, c) · focus: a".
+ */
+export function scopeLine(view: ScopeView): string {
+  const names = view.workspaces.map((w) => w.name);
+  const what =
+    view.scope !== ALL_ACTIVE && !view.fellBack
+      ? view.scope
+      : `all active (${names.join(", ") || "none"})`;
+  const fell = view.fellBack ? ` (${view.scope} is not active)` : "";
+  return `Scope: ${what}${fell} · focus: ${view.focus ?? "none"}`;
+}
+
+/** " · a, b" after a shared service's name; "" when one workspace owns it. */
+export function ownersSuffix(owners: string[] | undefined): string {
+  return owners && owners.length > 1 ? ` · ${owners.join(", ")}` : "";
+}