@tabbr/module-cli 0.4.0 → 0.5.0

package/README.md

@@ -31,6 +31,30 @@ npx tabbr-module init       # asks for the club code, module id and a fallback t
 }
 ```
 
+### Where you develop against: tabbr.config.local.json
+
+`tabbr.config.json` describes the module and is committed. The club and API host *you* work against are yours, not
+the module's: put them in `tabbr.config.local.json` - add it to `.gitignore` - and leave `tabbr.config.json` as it is
+(e.g. on production, for the store). `init --local` writes it:
+
+```bash
+npx tabbr-module init --local   # asks for the club code and the API host (default: your local backend,
+                                # https://api.local.tabbr.be; https://api.tabbr.be for a club on production)
+```
+
+```json
+{ "club": "ABC", "apiHost": "https://api.local.tabbr.be" }
+```
+
+It may set `club`, `apiHost`, `localApiHost` and `shellUrl` (other keys are ignored, with a warning) and overrides
+`tabbr.config.json` for them in every command - except `publish --store`, which goes where `tabbr.config.json` says
+unless you pass `--local` or `--api-host`. Command-line options still win, and the CLI says which file it used.
+The one next to `tabbr.config.json` counts, else the one a folder up - one file for every module in that folder, as
+the Tabbr repository's `modules/` has. The module's dev preview reads the same one: its `src/app/app.config.ts` imports
+`tabbr.config.local.json`, which the `paths` in `tsconfig.local-config.json` resolve to that file, else to
+`tabbr.config.json` itself (copy both from one of the Tabbr repository's modules). It's never part of a store
+submission's source.
+
 ### The title and description of your module
 
 The name Tabbr shows for your module (in the settings list and its page header) is translated like the one of its
@@ -127,24 +151,39 @@ rules, the club's extra fields, hooks, audit). Add an `"entities"` array to `tab
 `publish` checks the declarations (names, keys, types) before uploading and sends them in the backend manifest - also
 for a module that has no backend code (then only the entities are published). The frontend addresses records by field
 key with the SDK's `injectModuleEntity()`, the backend with `tabbr.entities.<name>`. See `docs/module-entities.md` in the
-Tabbr repository for the field types, access rules and what the club gets; `tabbr-groups-module/` is a complete example.
+Tabbr repository for the field types, access rules and what the club gets; `modules/tabbr-groups-module/` is a complete example.
 
 ## Contracts
 
-What a module uses of Tabbr (or, later, of another module) is a **contract** - never its code. Declare the ones you use
-with a version range, and the module API level that has contracts:
+What a module uses of Tabbr or of another module is a **contract** - never its code. Declare the ones you use with a
+version range, and the module API level that has contracts:
+
+```json
+{
+  "engines": { "tabbr": "^1.3" },
+  "uses": { "sys.access": "^1" },
+  "optionalUses": { "tabbr.consent": "^1" }
+}
+```
+
+`publish` puts `uses` and `optionalUses` in the manifest (also for a module without backend code); Tabbr only installs
+the module where the club has the contracts in `uses` (`optionalUses`: it works without them), and its server-side part
+gets them as `tabbr.uses['sys.access']`. The frontend gets a contract with the SDK's `MODULE_CONTRACTS` (`await
+inject(MODULE_CONTRACTS).get('sys.access')`, `null` when the club doesn't have it). Their types come from
+`fetch-types --contracts` (below).
+
+A module can **provide** a contract too (module API 1.3), named after its publisher:
 
 ```json
 {
-  "engines": { "tabbr": "^1.1" },
-  "uses": { "sys.access": "^1" }
+  "provides": { "acme.groups": { "version": "1.0.0", "types": "contracts/acme.groups.d.ts" } }
 }
 ```
 
-`publish` puts `uses` in the manifest (also for a module without backend code); Tabbr only installs the module where
-the club has those contracts, and its server-side part gets them as `tabbr.uses['sys.access']`. The frontend gets a
-contract with the SDK's `MODULE_CONTRACTS` (`await inject(MODULE_CONTRACTS).get('sys.access')`). Their types come from
-`fetch-types --contracts` (below). See `docs/module-contracts.md` in the Tabbr repository.
+The `.d.ts` stands on its own (no imports) and exports `interface Frontend` and/or `interface Backend`; `publish` puts
+it in the build (`backend/contracts/acme.groups.d.ts`), where Tabbr serves it to the modules that use the contract. Your
+module class offers the frontend part as `provides = { 'acme.groups': ... }`, your server-side part exports the backend
+part as `export const provides = { 'acme.groups': { ... } }`. See `docs/module-contracts.md` in the Tabbr repository.
 
 ## Usage: publish
 
@@ -180,7 +219,7 @@ upload:
 
 `npx tabbr-module publish --local` publishes into your own local tabbr (the environment behind
 `<club>.local.tabbr.be`) instead of production: it uploads to `https://api.local.tabbr.be` (set
-`"localApiHost"` in `tabbr.config.json` to use another URL) and trusts your mkcert root CA, which Node
+`"localApiHost"` in `tabbr.config.local.json` to use another URL) and trusts your mkcert root CA, which Node
 doesn't do on its own (`NODE_EXTRA_CA_CERTS` is set automatically; if mkcert's root CA can't be found,
 set it yourself - `mkcert -CAROOT` shows where it lives). `--club` picks the club in that environment;
 login still goes through the real Keycloak, which local backends validate too.
@@ -260,8 +299,9 @@ points) to your workspace's `.gitignore` rather than committing them.
 npx tabbr-module fetch-types --contracts [--cwd .] [--api-host https://api.tabbr.be]
 ```
 
-**With `--contracts`**: fetches `GET /api/contracts/{name}/types` for every contract in `uses` into
-`contracts/<name>.d.ts`. Unlike the entity types these don't depend on a club - **commit them**: the store builds your
+**With `--contracts`**: fetches `GET /api/contracts/{name}/types` for every contract in `uses` and `optionalUses` into
+`contracts/<name>.d.ts`. Tabbr's own don't depend on a club; one a module provides comes from your club (`club` in
+tabbr.config.json) when a module there provides it, else from the module store - **commit them**: the store builds your
 module with them. Add `contracts/*.d.ts` to your tsconfig(s); it types `MODULE_CONTRACTS.get(name)` and
 `tabbr.uses[name]`, and its own types can be imported from `@tabbr/contracts/<name>`.
 

package/bin/tabbr-module.js

@@ -9,7 +9,9 @@ const { publish, publishToStore, submitSourceToStore, storeMeta } = require('../
 const { packSource } = require('../src/source');
 const { fetchScriptTypes, fetchAllEntityTypes, fetchContractTypes, VALID_KINDS } = require('../src/fetch-types');
 const { usesOf } = require('../src/backend-build');
-const { CONFIG_FILE, DEFAULT_API_HOST, readConfig, requireClub, runInit } = require('../src/config');
+const {
+  CONFIG_FILE, LOCAL_CONFIG_FILE, LOCAL_CONFIG_KEYS, DEFAULT_API_HOST, readConfig, readLocalConfig, requireClub, runInit,
+} = require('../src/config');
 const { DEFAULT_LOCAL_API_HOST, trustLocalCertificateOrRespawn } = require('../src/local');
 const DEFAULT_KIND = 'HOOK'; // matches the server's own @RequestParam default for /meta/script
 
@@ -46,10 +48,22 @@ function printUsage() {
   console.log(`Every option below can also be set in ${CONFIG_FILE} in the workspace root (option name
 in camelCase, e.g. "club", "moduleId", "apiHost"); command-line options win.
 
+Where YOU develop against goes in ${LOCAL_CONFIG_FILE} instead: not committed (add it to
+.gitignore), next to ${CONFIG_FILE} or a folder up (then for every module in that folder; the
+one in the workspace wins). Its ${LOCAL_CONFIG_KEYS.join(', ')} override those in ${CONFIG_FILE} -
+here and in the module's dev preview; not the API host of "publish --store". E.g. { "club": "ABC",
+"apiHost": "https://api.local.tabbr.be" } works against your local backend while ${CONFIG_FILE}
+keeps production; "init --local" writes it.
+
 Usage: tabbr-module init [--club <CODE>] [--module-id <id>] [--title <text>] [--api-host <url>]
 
 Asks for the club code (and module id / title) and writes ${CONFIG_FILE}.
 
+Usage: tabbr-module init --local [--club <CODE>] [--api-host <url>]
+
+Asks for the club code and the API host (by default your own local backend, ${DEFAULT_LOCAL_API_HOST})
+and writes only ${LOCAL_CONFIG_FILE}. ${CONFIG_FILE} is left as it is.
+
 Usage: tabbr-module publish [options]
 
 Builds and publishes whichever parts of the workspace are present, in ONE upload: a frontend (an
@@ -71,7 +85,9 @@ Backend part (all in ${CONFIG_FILE} under "backend", not as CLI flags):
   secretFieldNames             Names of your module's settings keys that hold secrets (masked from
                               every settings GET response once saved)
   triggers                     [{type: "CRON", name, cronExpression, handler} |
-                               {type: "ENTITY_HOOK", name, entity, event, handler}]
+                               {type: "ENTITY_HOOK", name, entity, event, handler} |
+                               {type: "PUBLIC", name, handler, params}  (module API 1.5:
+                               GET /api/<club>/public/module/<moduleId>/data/<name>, no login)]
 
 Optional:
   --icon <name>              Menu icon name
@@ -106,10 +122,12 @@ publishing it - what the store's builder runs.
 
 Usage: tabbr-module fetch-types --contracts [--cwd <path>] [--api-host <url>]
 
-Fetches the contracts the module uses ("uses" in ${CONFIG_FILE}, e.g. { "sys.access": "^1" }) into
-contracts/<name>.d.ts - commit them: the store builds your module with them. Include contracts/ in your
-tsconfig(s); then MODULE_CONTRACTS.get('<name>') (frontend) and tabbr.uses['<name>'] (backend) are typed,
-and the contract's own types can be imported from '@tabbr/contracts/<name>'. No --club needed.
+Fetches the contracts the module uses ("uses" and "optionalUses" in ${CONFIG_FILE}, e.g.
+{ "sys.access": "^1" }) into contracts/<name>.d.ts - commit them: the store builds your module with them.
+Include contracts/ in your tsconfig(s); then MODULE_CONTRACTS.get('<name>') (frontend) and
+tabbr.uses['<name>'] (backend) are typed, and the contract's own types can be imported from
+'@tabbr/contracts/<name>'. Tabbr's own contracts need no --club; one a module provides comes from your club
+(${CONFIG_FILE} "club") when a module there provides it, else from the module store.
 
 Usage: tabbr-module fetch-types [--club <CODE>] [--entity <name>] [options]
 
@@ -260,9 +278,10 @@ ${dts}
   console.log(`Wrote ${outPath}`);
 }
 
-/** One file per contract the module uses: contracts/<name>.d.ts. */
+/** One file per contract the module uses (also optionally): contracts/<name>.d.ts. */
 async function runFetchContractTypes(args) {
-  const names = Object.keys(usesOf(args));
+  const uses = { ...usesOf(args, 'optionalUses'), ...usesOf(args) };
+  const names = Object.keys(uses);
   if (names.length === 0) {
     throw new Error(`No contracts to fetch: add "uses" to ${CONFIG_FILE}, e.g. "uses": { "sys.access": "^1" }.`);
   }
@@ -270,10 +289,11 @@ async function runFetchContractTypes(args) {
   const dir = path.join(args.cwd, 'contracts');
   fs.mkdirSync(dir, { recursive: true });
   for (const name of names) {
-    const dts = await fetchContractTypes({ apiHost: args.apiHost, name, accessToken });
+    // with a club: a contract one of its modules provides comes from there (else from the store)
+    const dts = await fetchContractTypes({ apiHost: args.apiHost, name, accessToken, club: args.club });
     const outPath = path.join(dir, `${name}.d.ts`);
     fs.writeFileSync(outPath, dts);
-    console.log(`Wrote ${outPath} (${args.uses[name]})`);
+    console.log(`Wrote ${outPath} (${uses[name]})`);
   }
 }
 
@@ -312,13 +332,31 @@ async function main() {
     await runInit(flags.cwd, flags);
     return;
   }
-  const args = { apiHost: DEFAULT_API_HOST, ...readConfig(flags.cwd), ...flags };
+  const local = readLocalConfig(flags.cwd);
+  const localValues = { ...(local ? local.values : {}) };
+  // A store submission goes where tabbr.config.json says (production), not to a local file's API host: --local or
+  // --api-host for another one.
+  const storeHostKept = command === 'publish' && flags.store && localValues.apiHost !== undefined;
+  if (storeHostKept) delete localValues.apiHost;
+  const args = { apiHost: DEFAULT_API_HOST, ...readConfig(flags.cwd), ...localValues, ...flags };
   if (args.local && !flags.apiHost) {
     // --local targets your own local backend (https://api.local.tabbr.be, the same one
-    // <club>.local.tabbr.be talks to); "localApiHost" in tabbr.config.json overrides it.
+    // <club>.local.tabbr.be talks to); "localApiHost" in tabbr.config.local.json or tabbr.config.json overrides it.
     args.apiHost = args.localApiHost || DEFAULT_LOCAL_API_HOST;
   }
   trustLocalCertificateOrRespawn(args.apiHost);
+  // after a respawn for the local certificate: said once
+  if (local) {
+    const where = path.relative(flags.cwd, local.file);
+    const set = Object.entries(localValues).map(([key, value]) => `${key} ${value}`).join(', ');
+    console.log(`Using ${where}${set ? `: ${set}` : ''}`);
+    if (storeHostKept) {
+      console.log(`  not its apiHost: the module store at ${args.apiHost}${args.local || flags.apiHost ? '' : ' (--local for your local backend\'s)'}`);
+    }
+    if (local.ignored.length) {
+      console.warn(`  ignored there: ${local.ignored.join(', ')} - only ${LOCAL_CONFIG_KEYS.join(', ')} can be set in ${LOCAL_CONFIG_FILE}`);
+    }
+  }
   if (command === 'publish') {
     await runPublish(args);
   } else if (command === 'build') {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tabbr/module-cli",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "Set up, build and publish a Native Federation club module to a tabbr club.",
   "license": "SEE LICENSE IN LICENSE",
   "author": "SystemWorks BV",

package/src/backend-build.js

@@ -46,27 +46,67 @@ function entitiesOf(config) {
   return entities;
 }
 
+const CONTRACT_NAME = /^[a-z][a-z0-9-]*(\.[a-z][a-z0-9-]*)+$/;
+
 /**
- * The contracts the module uses (`"uses"` in tabbr.config.json, e.g. `{ "sys.access": "^1" }`): their names and version
- * ranges, checked just enough to fail here - Tabbr checks them again (a contract it doesn't have, a range it can't
- * satisfy) when the module is published or installed.
+ * The contracts the module uses (`"uses"` in tabbr.config.json, e.g. `{ "sys.access": "^1" }`), or uses when the club
+ * has them (`key` `"optionalUses"`): their names and version ranges, checked just enough to fail here - Tabbr checks
+ * them again (a contract it doesn't have, a range it can't satisfy) when the module is published or installed.
  */
-function usesOf(config) {
-  const uses = config.uses || {};
+function usesOf(config, key = 'uses') {
+  const uses = config[key] || {};
   if (typeof uses !== 'object' || Array.isArray(uses)) {
-    throw new Error('"uses" in tabbr.config.json must be an object: { "<contract>": "<version range>" }, e.g. { "sys.access": "^1" }.');
+    throw new Error(`"${key}" in tabbr.config.json must be an object: { "<contract>": "<version range>" }, e.g. { "sys.access": "^1" }.`);
   }
   for (const [name, range] of Object.entries(uses)) {
-    if (!/^[a-z][a-z0-9-]*(\.[a-z][a-z0-9-]*)+$/.test(name)) {
-      throw new Error(`"uses": "${name}" is not a contract name (e.g. "sys.access").`);
+    if (!CONTRACT_NAME.test(name)) {
+      throw new Error(`"${key}": "${name}" is not a contract name (e.g. "sys.access").`);
     }
     if (typeof range !== 'string' || !range.trim()) {
-      throw new Error(`"uses": "${name}" needs a version range, e.g. "^1".`);
+      throw new Error(`"${key}": "${name}" needs a version range, e.g. "^1".`);
     }
   }
   return uses;
 }
 
+/**
+ * The contracts the module provides itself (`"provides"` in tabbr.config.json, e.g.
+ * `{ "acme.groups": { "version": "1.0.0", "types": "contracts/acme.groups.d.ts" } }`): for the manifest their names and
+ * versions, and their TypeScript - which goes into the build as `backend/contracts/<name>.d.ts`, where Tabbr serves it
+ * to the modules that use the contract. The file stands on its own (no imports) and exports `interface Frontend`
+ * and/or `interface Backend`. Tabbr checks the rest (the name is the publisher's, no other module has it).
+ */
+function providesOf(cwd, config) {
+  const provides = config.provides || {};
+  if (typeof provides !== 'object' || Array.isArray(provides)) {
+    throw new Error('"provides" in tabbr.config.json must be an object: { "<contract>": { "version": "1.0.0", "types": "contracts/<contract>.d.ts" } }.');
+  }
+  const versions = {};
+  const files = {};
+  for (const [name, contract] of Object.entries(provides)) {
+    if (!CONTRACT_NAME.test(name) || name.startsWith('sys.')) {
+      throw new Error(`"provides": "${name}" is not a contract name a module can provide (e.g. "acme.groups"; "sys." is Tabbr's).`);
+    }
+    if (!contract || !/^\d+\.\d+\.\d+$/.test(contract.version || '')) {
+      throw new Error(`"provides": "${name}" needs a version, e.g. { "version": "1.0.0" }.`);
+    }
+    const typesPath = path.join(cwd, contract.types || `contracts/${name}.d.ts`);
+    if (!fs.existsSync(typesPath)) {
+      throw new Error(`"provides": the TypeScript of "${name}" is missing: ${typesPath}.`);
+    }
+    const source = fs.readFileSync(typesPath, 'utf8');
+    if (!/\bexport\s+interface\s+(Frontend|Backend)\b/.test(source)) {
+      throw new Error(`"provides": ${typesPath} exports neither interface Frontend nor interface Backend.`);
+    }
+    if (/^\s*import\b/m.test(source)) {
+      throw new Error(`"provides": ${typesPath} may not import anything - a contract stands on its own.`);
+    }
+    versions[name] = contract.version;
+    files[`contracts/${name}.d.ts`] = source;
+  }
+  return { versions, files };
+}
+
 /**
  * Bundles a module workspace's backend part (if configured) into a single, dependency-free
  * `bundle.js`, using esbuild so module authors can write normal TypeScript (types, imports,
@@ -75,18 +115,21 @@ function usesOf(config) {
  * `BackendModuleRuntimeService`).
  *
  * Also writes the manifest the server reads (`manifest.json`): the backend config plus the entities the module declares
- * and the contracts it uses - which a module can do without any backend code, so then only the manifest is produced
- * (`bundleJs` null).
+ * and the contracts it uses and provides - which a module can do without any backend code, so then only the manifest
+ * is produced (`bundleJs` null). `files`: more files for the build's `backend/` (the TypeScript of what it provides).
  *
- * Returns `null` when the workspace has no backend part, no entities and uses no contracts, so `build.js` can skip
- * it entirely for such a frontend-only module.
+ * Returns `null` when the workspace has no backend part, no entities and uses or provides no contracts, so `build.js`
+ * can skip it entirely for such a frontend-only module.
  */
 async function buildBackend(cwd, config) {
   const backendConfig = config.backend;
   const entities = entitiesOf(config);
   const uses = usesOf(config);
+  const optionalUses = usesOf(config, 'optionalUses');
+  const provides = providesOf(cwd, config);
   const bundleJs = backendConfig ? await bundle(cwd, backendConfig) : null;
-  if (bundleJs == null && entities.length === 0 && Object.keys(uses).length === 0) {
+  if (bundleJs == null && entities.length === 0 && Object.keys(uses).length === 0 && Object.keys(optionalUses).length === 0
+    && Object.keys(provides.versions).length === 0) {
     return null;
   }
   const settings = backendConfig || {};
@@ -100,9 +143,12 @@ async function buildBackend(cwd, config) {
     manageRoles: bundleJs != null && settings.manageRoles === true,
     // the contracts it uses - for its frontend part as well, so the manifest is written for a frontend-only module too
     uses,
+    optionalUses,
+    // the contracts it provides, with their version; their TypeScript goes along as backend/contracts/<name>.d.ts
+    provides: provides.versions,
   };
 
-  return { bundleJs, manifestJson: JSON.stringify(manifest, null, 2) };
+  return { bundleJs, manifestJson: JSON.stringify(manifest, null, 2), files: provides.files };
 }
 
 /** The backend entry bundled into one script, or null when there is no entry file (and none was configured explicitly). */
@@ -145,4 +191,4 @@ async function bundle(cwd, backendConfig) {
   return result.outputFiles[0].text;
 }
 
-module.exports = { buildBackend, entitiesOf, usesOf, DEFAULT_ENTRY };
+module.exports = { buildBackend, entitiesOf, usesOf, providesOf, DEFAULT_ENTRY };

package/src/build.js

@@ -82,6 +82,9 @@ function zipModule(frontendDir, backend) {
         archive.append(backend.bundleJs, { name: 'backend/bundle.js' });
       }
       archive.append(backend.manifestJson, { name: 'backend/manifest.json' });
+      for (const [name, content] of Object.entries(backend.files || {})) {
+        archive.append(content, { name: `backend/${name}` });
+      }
     }
     archive.finalize();
   });

package/src/config.js

@@ -3,10 +3,23 @@
 const fs = require('fs');
 const path = require('path');
 const readline = require('readline/promises');
+const { execFileSync } = require('child_process');
+const { DEFAULT_LOCAL_API_HOST } = require('./local');
 
 const CONFIG_FILE = 'tabbr.config.json';
+const LOCAL_CONFIG_FILE = 'tabbr.config.local.json';
+/** What a tabbr.config.local.json may set: where this checkout talks to - never what the module is. */
+const LOCAL_CONFIG_KEYS = ['club', 'apiHost', 'localApiHost', 'shellUrl'];
 const DEFAULT_API_HOST = 'https://api.tabbr.be';
 
+function readJson(file) {
+  try {
+    return JSON.parse(fs.readFileSync(file, 'utf-8'));
+  } catch (err) {
+    throw new Error(`${file} is not valid JSON: ${err.message}`);
+  }
+}
+
 /**
  * Reads the workspace's tabbr.config.json - the one place a module project records which club it
  * targets, its module id and so on. Both this CLI and the module's own dev-preview harness read it,
@@ -14,18 +27,31 @@ const DEFAULT_API_HOST = 'https://api.tabbr.be';
  */
 function readConfig(cwd) {
   const file = path.join(cwd, CONFIG_FILE);
-  if (!fs.existsSync(file)) return {};
-  try {
-    return JSON.parse(fs.readFileSync(file, 'utf-8'));
-  } catch (err) {
-    throw new Error(`${file} is not valid JSON: ${err.message}`);
-  }
+  return fs.existsSync(file) ? readJson(file) : {};
+}
+
+/**
+ * The developer's own tabbr.config.local.json (not committed): the club and API host this checkout
+ * talks to, over those in tabbr.config.json - so a module whose tabbr.config.json targets
+ * production can be developed against a local backend without editing it. The one in the
+ * workspace, else the one a folder up (which then covers every module in that folder); the module's
+ * dev preview finds the same one (tsconfig.local-config.json). Only LOCAL_CONFIG_KEYS count, the
+ * other keys are returned as `ignored`. Returns null when there is none.
+ */
+function readLocalConfig(cwd) {
+  const file = [path.join(cwd, LOCAL_CONFIG_FILE), path.join(cwd, '..', LOCAL_CONFIG_FILE)].find(f => fs.existsSync(f));
+  if (!file) return null;
+  const all = readJson(file);
+  const values = Object.fromEntries(LOCAL_CONFIG_KEYS.filter(key => all[key] !== undefined).map(key => [key, all[key]]));
+  const ignored = Object.keys(all).filter(key => !LOCAL_CONFIG_KEYS.includes(key));
+  return { file, values, ignored };
 }
 
 /** Uppercase club code, or throws with instructions when none is configured. */
 function requireClub(club) {
   if (!club) {
-    throw new Error(`No club configured. Run "npx tabbr-module init" (or set "club" in ${CONFIG_FILE}).`);
+    throw new Error(`No club configured. Set "club" in ${LOCAL_CONFIG_FILE} (yours, not committed) or ${CONFIG_FILE}, ` +
+      'or run "npx tabbr-module init".');
   }
   return club.toUpperCase();
 }
@@ -34,19 +60,39 @@ function slug(text) {
   return text.toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-|-$/g, '');
 }
 
-/**
- * Asks for the club code (and offers defaults for the rest) and writes tabbr.config.json, keeping
- * any values already in it as the defaults.
- */
-async function runInit(cwd, overrides) {
-  const file = path.join(cwd, CONFIG_FILE);
-  const current = readConfig(cwd);
+/** False only when the workspace is in a git repository that would track `file`. */
+function gitIgnores(cwd, file) {
+  try {
+    execFileSync('git', ['check-ignore', '-q', file], { cwd, stdio: 'ignore' });
+    return true;
+  } catch (err) {
+    return err.status !== 1; // 1: not ignored; anything else: no git, or not a repository
+  }
+}
+
+function asker() {
   const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
   const ask = async (question, fallback) => {
     if (!process.stdin.isTTY) return fallback;
     const answer = (await rl.question(fallback ? `${question} [${fallback}]: ` : `${question}: `)).trim();
     return answer || fallback;
   };
+  return { ask, close: () => rl.close() };
+}
+
+/**
+ * Asks for the club code (and offers defaults for the rest) and writes tabbr.config.json, keeping
+ * any values already in it as the defaults. With --local: only where you develop against, in
+ * tabbr.config.local.json - see runInitLocal.
+ */
+async function runInit(cwd, overrides) {
+  if (overrides.local) {
+    await runInitLocal(cwd, overrides);
+    return;
+  }
+  const file = path.join(cwd, CONFIG_FILE);
+  const current = readConfig(cwd);
+  const { ask, close } = asker();
 
   try {
     const club = (overrides.club || await ask('Club code (the part before .tabbr.be, e.g. abc)', current.club))?.toUpperCase();
@@ -68,8 +114,35 @@ async function runInit(cwd, overrides) {
     fs.writeFileSync(file, JSON.stringify(config, null, 2) + '\n');
     console.log(`\nWrote ${file}. Next: "npm start" to preview, "npm run publish-module" to publish.`);
   } finally {
-    rl.close();
+    close();
+  }
+}
+
+/**
+ * `init --local`: asks for the club code and the API host - by default your own local backend
+ * (https://api.local.tabbr.be) - and writes them in the workspace's tabbr.config.local.json, and
+ * nothing else: tabbr.config.json, the module's manifest, stays as it is (e.g. on production, for
+ * the store).
+ */
+async function runInitLocal(cwd, overrides) {
+  const file = path.join(cwd, LOCAL_CONFIG_FILE);
+  const current = fs.existsSync(file) ? readJson(file) : {};
+  const { ask, close } = asker();
+  try {
+    const club = (overrides.club || await ask('Club code (e.g. abc)', current.club || readConfig(cwd).club))?.toUpperCase();
+    if (!club) throw new Error('A club code is required.');
+    const apiHost = overrides.apiHost
+      || await ask(`API host (${DEFAULT_API_HOST} for a club on production)`, current.apiHost || DEFAULT_LOCAL_API_HOST);
+    const local = { ...current, club, apiHost };
+    fs.writeFileSync(file, JSON.stringify(local, null, 2) + '\n');
+    console.log(`\nWrote ${file}: club ${club}, apiHost ${apiHost}. Next: "npm start" to preview, ` +
+      '"npm run publish-module" to publish there.');
+    if (!gitIgnores(cwd, file)) console.warn(`It's yours, not the module's: add ${LOCAL_CONFIG_FILE} to .gitignore.`);
+  } finally {
+    close();
   }
 }
 
-module.exports = { CONFIG_FILE, DEFAULT_API_HOST, readConfig, requireClub, runInit };
+module.exports = {
+  CONFIG_FILE, LOCAL_CONFIG_FILE, LOCAL_CONFIG_KEYS, DEFAULT_API_HOST, readConfig, readLocalConfig, requireClub, runInit,
+};

package/src/fetch-types.js

@@ -51,10 +51,13 @@ async function fetchAllEntityTypes({ apiHost, club, accessToken }) {
  * `@tabbr/contracts/<name>`, plus its entries in `TabbrUiContracts` (what `MODULE_CONTRACTS.get(name)` returns) and
  * `TabbrContracts` (`tabbr.uses[name]` server-side). See docs/module-contracts.md (tabbr repo).
  */
-async function fetchContractTypes({ apiHost, name, accessToken }) {
+async function fetchContractTypes({ apiHost, name, accessToken, club }) {
   const url = `${apiHost}/api/contracts/${encodeURIComponent(name)}/types`;
   console.log(`Fetching the contract ${name} from ${url} ...`);
-  const response = await fetch(url, { headers: { Authorization: `Bearer ${accessToken}` } });
+  const headers = { Authorization: `Bearer ${accessToken}` };
+  // a contract a module provides: the club's version of it, when the club has that module
+  if (club) headers['X-club'] = club.toUpperCase();
+  const response = await fetch(url, { headers });
   if (!response.ok) {
     throw new Error(`Fetching the contract ${name} failed: ${response.status} ${await response.text()}`);
   }

package/src/source.js

@@ -5,8 +5,12 @@ const path = require('path');
 const { execFileSync } = require('child_process');
 const archiver = require('archiver');
 
-/** Never part of a module's source: installed packages, build output, caches, editor state. */
-const SKIP = new Set(['node_modules', 'dist', '.angular', 'out-tsc', '.git', '.yalc', '.idea', '.vscode', 'coverage']);
+/**
+ * Never part of a module's source: installed packages, build output, caches, editor state - and the developer's own
+ * tabbr.config.local.json (where they develop against), also when it isn't in .gitignore.
+ */
+const SKIP = new Set(['node_modules', 'dist', '.angular', 'out-tsc', '.git', '.yalc', '.idea', '.vscode', 'coverage',
+  'tabbr.config.local.json']);
 
 /**
  * The workspace's source files, as the module store builds them: the files git tracks (plus new ones git doesn't ignore)