@wpelevator/tug 0.6.0 → 0.8.0

package/dist/cli-build.js

@@ -21,11 +21,78 @@ export function sourceArchiveFilter(entry, configPaths, ignores) {
         .replace(/^(\.\/)+/, '')
         .replace(/\/$/, '');
     const parts = relative.split('/');
-    if (parts.some((part) => ALWAYS_EXCLUDED.includes(part)))
+    if (parts.some((part) => ALWAYS_EXCLUDED.includes(part) || CREDENTIAL_FILE.test(part)))
         return false;
     if (parts.length === 1 && CONFIG_NAMES.includes(relative))
         return false;
-    return ![...configPaths, ...ignores].some((ignore) => relative === ignore || relative.startsWith(`${ignore}/`));
+    if (configPaths.some((file) => relative === file || relative.startsWith(`${file}/`)))
+        return false;
+    return !compileIgnore(ignores)(relative);
+}
+/** Credential documents written by `control-install --credential-out` (default `tug-root.credential.json`). */
+const CREDENTIAL_FILE = /\.credential\.json$/;
+const ignoreCache = new WeakMap();
+/** Translates one `.dockerignore` pattern: `*` and `?` stay within a path segment, `**` crosses them. */
+function ignorePattern(pattern) {
+    let source = '';
+    for (let i = 0; i < pattern.length; i++) {
+        const char = pattern[i];
+        if (char === '*' && pattern[i + 1] === '*') {
+            if (pattern[i + 2] === '/') {
+                source += '(?:.*/)?';
+                i += 2;
+            }
+            else {
+                source += '.*';
+                i += 1;
+            }
+        }
+        else if (char === '*')
+            source += '[^/]*';
+        else if (char === '?')
+            source += '[^/]';
+        else if (char === '\\' && i + 1 < pattern.length)
+            source += pattern[++i].replace(/[\\^$.*+?()[\]{}|]/g, '\\$&');
+        else
+            source += char.replace(/[\\^$.*+?()[\]{}|]/g, '\\$&');
+    }
+    return new RegExp(`^${source}$`);
+}
+/**
+ * Compiles `.dockerignore` lines with Docker's semantics: patterns are rooted at the context, a pattern that
+ * matches a directory excludes everything below it, and the last matching rule wins, so `!` re-includes.
+ */
+function compileIgnore(lines) {
+    const cached = ignoreCache.get(lines);
+    if (cached)
+        return cached;
+    const rules = lines
+        .map((line) => line.trim())
+        .filter((line) => line && !line.startsWith('#'))
+        .map((line) => {
+        const negated = line.startsWith('!');
+        const pattern = path.posix
+            .normalize((negated ? line.slice(1) : line).trim())
+            .replace(/^\/+/, '')
+            .replace(/\/$/, '');
+        return { negated, pattern: ignorePattern(pattern), valid: pattern !== '' && pattern !== '.' };
+    })
+        .filter((rule) => rule.valid);
+    const matcher = (relative) => {
+        const segments = relative.split('/');
+        let ignored = false;
+        for (const { negated, pattern } of rules) {
+            for (let end = 1; end <= segments.length; end++) {
+                if (pattern.test(segments.slice(0, end).join('/'))) {
+                    ignored = !negated;
+                    break;
+                }
+            }
+        }
+        return ignored;
+    };
+    ignoreCache.set(lines, matcher);
+    return matcher;
 }
 export async function createSourceArchive(contextDir, archive, configFiles) {
     const configPaths = configFiles
@@ -35,8 +102,7 @@ export async function createSourceArchive(contextDir, archive, configFiles) {
     try {
         ignores.push(...(await fs.readFile(path.join(contextDir, '.dockerignore'), 'utf8'))
             .split(/\r?\n/)
-            .map((line) => line.trim().replace(/\/$/, ''))
-            .filter((line) => line && !line.startsWith('#') && !line.startsWith('!')));
+            .map((line) => line.trim()));
     }
     catch (error) {
         if (error.code !== 'ENOENT')

package/dist/cli-config.d.ts

@@ -1,3 +1,4 @@
+import type { Credential } from './pki.ts';
 export type SettingType = 'string' | 'boolean' | 'port' | 'list' | 'path';
 export interface Setting {
     type: SettingType;
@@ -17,15 +18,18 @@ export interface ConnectionOptions {
     config?: string;
     controlUrl?: string;
     project?: string;
+    credential?: string;
 }
 export interface ResolvedCliConfig {
     /** The tracked config: selected, discovered, or where `init` creates it. */
     file: string;
     fileExists: boolean;
-    /** The untracked overlay next to `file`, the only place a token may be stored. */
+    /** The untracked overlay next to `file`, the only place a credential path may be stored. */
     localFile: string;
+    /** Where connections go: the credential's public URL unless overridden (an override changes the connect target only). */
     controlUrl: string;
-    token?: string;
+    credential?: Credential;
+    credentialFile?: string;
     project: string;
     commandDefaults: SettingValues;
     nodeDefaults: SettingValues;
@@ -50,11 +54,11 @@ interface OptionSource {
  */
 export declare function applyConfigDefaults(command: OptionSource, values: object, settings: SettingValues): void;
 /**
- * `tug init`: create the tracked file when it is missing and always store the token in the untracked
- * overlay, git-ignoring it. An existing tracked file is never rewritten, so its comments survive;
+ * `tug init`: create the tracked file when it is missing and always point the untracked
+ * overlay at the credential file, git-ignoring it. An existing tracked file is never rewritten, so its comments survive;
  * connection flags passed to `init` are saved to the overlay instead.
  */
-export declare function writeInitConfig(config: ResolvedCliConfig, token: string, explicit: ConnectionOptions): Promise<string[]>;
+export declare function writeInitConfig(config: ResolvedCliConfig, credentialFile: string, explicit: ConnectionOptions): Promise<string[]>;
 export declare function normalizeControlUrl(value: string): string;
 export declare function integerOption(value: string, name: string, minimum?: number, maximum?: number): number;
 export {};

package/dist/cli-config.js

@@ -1,7 +1,9 @@
 import fs from 'node:fs/promises';
 import path from 'node:path';
 import { spawnSync } from 'node:child_process';
-import yaml from 'js-yaml';
+import * as yaml from 'js-yaml';
+import { decodeCredential } from "./pki.js";
+import { errMessage } from "./util.js";
 /** Defaults for options of commands that work on the project (top level of the config file). */
 export const COMMAND_SETTINGS = {
     file: { type: 'path', flag: '--file', commands: ['deploy'] },
@@ -10,7 +12,11 @@ export const COMMAND_SETTINGS = {
 };
 /** Per-node connection data (`nodes.<name>`); `nodeDefaults` takes the subset that is not node-specific. */
 export const NODE_SETTINGS = {
-    ssh: { type: 'string', flag: '<ssh-target>', commands: ['node-install'] },
+    ssh: {
+        type: 'string',
+        flag: '<ssh-target>',
+        commands: ['node-install', 'node-replace-identity', 'node-repair-identity'],
+    },
     address: { type: 'string', flag: '--address', commands: ['node-install', 'node-register'] },
     publicAddress: {
         type: 'string',
@@ -20,27 +26,53 @@ export const NODE_SETTINGS = {
     label: {
         type: 'list',
         flag: '--label',
-        commands: ['node-install', 'node-register', 'node-enroll'],
+        commands: ['node-install', 'node-register', 'node-prepare-enrollment'],
+    },
+    mesh: {
+        type: 'boolean',
+        flag: '--mesh',
+        commands: [
+            'node-install',
+            'node-replace-identity',
+            'node-repair-identity',
+            'node-prepare-enrollment',
+        ],
+    },
+    wgPort: {
+        type: 'port',
+        flag: '--wg-port',
+        commands: ['node-install', 'node-replace-identity', 'node-repair-identity'],
     },
-    mesh: { type: 'boolean', flag: '--mesh', commands: ['node-install', 'node-enroll'] },
-    wgPort: { type: 'port', flag: '--wg-port', commands: ['node-install'] },
     installDocker: {
         type: 'boolean',
         flag: '--install-docker',
-        commands: ['node-install', 'node-enroll'],
+        commands: [
+            'node-install',
+            'node-replace-identity',
+            'node-repair-identity',
+            'node-prepare-enrollment',
+        ],
+    },
+    image: {
+        type: 'string',
+        flag: '--image',
+        commands: [
+            'node-install',
+            'node-replace-identity',
+            'node-repair-identity',
+            'node-prepare-enrollment',
+        ],
     },
-    image: { type: 'string', flag: '--image', commands: ['node-install', 'node-enroll'] },
     agentControlUrl: {
         type: 'string',
         flag: '--agent-control-url',
-        commands: ['node-install', 'node-enroll'],
-    },
-    httpOnlyDev: {
-        type: 'boolean',
-        flag: '--http-only-dev',
-        commands: ['node-install', 'node-enroll'],
+        commands: [
+            'node-install',
+            'node-replace-identity',
+            'node-repair-identity',
+            'node-prepare-enrollment',
+        ],
     },
-    ca: { type: 'path', flag: '--ca', commands: ['node-enroll'] },
 };
 const NODE_SPECIFIC_KEYS = ['ssh', 'address', 'publicAddress'];
 const SETTINGS = { ...COMMAND_SETTINGS, ...NODE_SETTINGS };
@@ -53,7 +85,7 @@ export function localConfigPath(file) {
 }
 /** Resolve adapter settings once; domain operations receive these explicit values. */
 export async function resolveCliConfig(options, env, cwd, creating = false) {
-    for (const key of ['config', 'controlUrl', 'project'])
+    for (const key of ['config', 'controlUrl', 'project', 'credential'])
         if (options[key] !== undefined && (!options[key].trim() || /[\r\n\0]/.test(options[key])))
             throw new Error(`--${key.replace(/[A-Z]/g, (c) => '-' + c.toLowerCase())} must be a nonempty single-line value`);
     const selected = options.config || env.TUG_CONFIG;
@@ -64,13 +96,40 @@ export async function resolveCliConfig(options, env, cwd, creating = false) {
         throw new Error(`Cannot read config ${file}: ENOENT: no such file`);
     const overlay = await readConfigFile(localFile, true);
     const config = mergeConfigs(base ?? emptyConfig(), overlay ?? emptyConfig());
-    const controlUrl = options.controlUrl || env.TUG_CONTROL_URL || config.controlUrl || 'http://localhost:8080';
+    if (env.TUG_CREDENTIAL && env.TUG_CREDENTIAL_FILE)
+        throw new Error('set only one of TUG_CREDENTIAL and TUG_CREDENTIAL_FILE');
+    // Precedence: --credential, then the environment, then the untracked overlay's credential path.
+    let credentialFile;
+    let credentialText;
+    if (options.credential)
+        credentialFile = path.resolve(cwd, options.credential);
+    else if (env.TUG_CREDENTIAL)
+        credentialText = env.TUG_CREDENTIAL;
+    else if (env.TUG_CREDENTIAL_FILE)
+        credentialFile = path.resolve(cwd, env.TUG_CREDENTIAL_FILE);
+    else if (config.credential)
+        credentialFile = config.credential;
+    let credential;
+    if (credentialFile || credentialText)
+        try {
+            credential = decodeCredential(credentialText ?? (await fs.readFile(credentialFile, 'utf8')));
+        }
+        catch (e) {
+            if (!creating)
+                throw new Error(`cannot use credential ${credentialFile ?? 'from TUG_CREDENTIAL'}: ${errMessage(e)}`, { cause: e });
+        }
+    const controlUrl = options.controlUrl ||
+        env.TUG_CONTROL_URL ||
+        config.controlUrl ||
+        credential?.url ||
+        'https://localhost:8443';
     return {
         file,
         fileExists: Boolean(base),
         localFile,
         controlUrl: normalizeControlUrl(controlUrl),
-        token: env.TUG_TOKEN || config.token,
+        credential,
+        credentialFile,
         project: options.project || env.TUG_PROJECT || config.project || 'site',
         commandDefaults: config.commandDefaults,
         nodeDefaults: config.nodeDefaults,
@@ -181,10 +240,10 @@ function parseConfig(input, dir, overlay) {
     for (const [key, value] of Object.entries(input)) {
         if (key === 'controlUrl' || key === 'project')
             config[key] = text(value, key);
-        else if (key === 'token') {
+        else if (key === 'credential') {
             if (overlay)
-                throw new Error(`token must not be set in a tracked file; put it in ${overlay} or TUG_TOKEN`);
-            config.token = text(value, key);
+                throw new Error(`credential must not be set in a tracked file; put it in ${overlay}, or use TUG_CREDENTIAL_FILE`);
+            config.credential = path.resolve(dir, text(value, key));
         }
         else if (COMMAND_SETTINGS[key])
             config.commandDefaults[key] = settingValue(COMMAND_SETTINGS[key], value, key, dir);
@@ -200,7 +259,7 @@ function parseConfig(input, dir, overlay) {
             const known = [
                 'controlUrl',
                 'project',
-                ...(overlay ? [] : ['token']),
+                ...(overlay ? [] : ['credential']),
                 ...Object.keys(COMMAND_SETTINGS),
                 'nodeDefaults',
                 'nodes',
@@ -218,7 +277,7 @@ function mergeConfigs(base, overlay) {
     return {
         controlUrl: overlay.controlUrl ?? base.controlUrl,
         project: overlay.project ?? base.project,
-        token: overlay.token ?? base.token,
+        credential: overlay.credential ?? base.credential,
         commandDefaults: { ...base.commandDefaults, ...overlay.commandDefaults },
         nodeDefaults: { ...base.nodeDefaults, ...overlay.nodeDefaults },
         nodes,
@@ -230,15 +289,15 @@ function serialize(file, data, notice) {
     return `${notice ? `# ${notice}\n` : ''}${yaml.dump(data)}`;
 }
 /**
- * `tug init`: create the tracked file when it is missing and always store the token in the untracked
- * overlay, git-ignoring it. An existing tracked file is never rewritten, so its comments survive;
+ * `tug init`: create the tracked file when it is missing and always point the untracked
+ * overlay at the credential file, git-ignoring it. An existing tracked file is never rewritten, so its comments survive;
  * connection flags passed to `init` are saved to the overlay instead.
  */
-export async function writeInitConfig(config, token, explicit) {
+export async function writeInitConfig(config, credentialFile, explicit) {
     const written = [];
     if (!config.fileExists) {
         await fs.mkdir(path.dirname(config.file), { recursive: true });
-        await fs.writeFile(config.file, serialize(config.file, { controlUrl: config.controlUrl, project: config.project }, `Safe to commit: keep the API token out of this file (use TUG_TOKEN or ${path.basename(config.localFile)}).`));
+        await fs.writeFile(config.file, serialize(config.file, { controlUrl: config.controlUrl, project: config.project }, `Safe to commit: keep credentials out of this file (use TUG_CREDENTIAL_FILE or ${path.basename(config.localFile)}).`));
         written.push(config.file);
     }
     let local = {};
@@ -251,7 +310,7 @@ export async function writeInitConfig(config, token, explicit) {
         if (error.code !== 'ENOENT')
             throw error;
     }
-    local.token = token;
+    local.credential = credentialFile;
     if (config.fileExists) {
         if (explicit.controlUrl)
             local.controlUrl = config.controlUrl;
@@ -289,14 +348,10 @@ export function normalizeControlUrl(value) {
         url = new URL(value);
     }
     catch {
-        throw new Error('control URL must be an absolute http:// or https:// URL');
+        throw new Error('control URL must be an absolute https:// URL');
     }
-    if (!['http:', 'https:'].includes(url.protocol) ||
-        url.username ||
-        url.password ||
-        url.search ||
-        url.hash)
-        throw new Error('control URL must use http:// or https:// without credentials, query or fragment');
+    if (url.protocol !== 'https:' || url.username || url.password || url.search || url.hash)
+        throw new Error('control URL must use https:// without credentials, query or fragment');
     return value.replace(/\/+$/, '');
 }
 export function integerOption(value, name, minimum = 1, maximum = Number.MAX_SAFE_INTEGER) {

package/dist/cli-install.js

@@ -1,4 +1,4 @@
-import yaml from 'js-yaml';
+import * as yaml from 'js-yaml';
 /** The agent dials container IPs for health checks; from the default bridge they are unreachable on current Docker (29.x), so it always shares the host network namespace. */
 export const HOST_NETWORK_FLAG = '--network host';
 export const MESH_RUN_FLAGS = `${HOST_NETWORK_FLAG} --cap-add NET_ADMIN`;

package/dist/cli-live-transport.d.ts

@@ -1,3 +1,4 @@
 import type { CliLiveTransport } from './cli-live.ts';
-/** Credentials travel only in the upgrade header, never a URL or frame. */
-export declare function createCliLiveTransport(controlUrl: string, token?: string): CliLiveTransport;
+import type { Credential } from './pki.ts';
+/** The client certificate authenticates the upgrade; `controlUrl` only picks the connect target, the credential's public URL is verified. */
+export declare function createCliLiveTransport(credential: Credential | undefined, controlUrl: string): CliLiveTransport;

package/dist/cli-live-transport.js

@@ -1,12 +1,15 @@
 import WebSocket from 'ws';
 import { CliLiveError } from "./cli-live.js";
+import { clientTlsOptions } from "./pki.js";
 import { LIVE_MAX_FRAME_BYTES as MAX_FRAME, LIVE_MAX_BUFFERED_BYTES as MAX_BUFFERED, LIVE_START_TIMEOUT_MS, } from "./protocol.js";
 const MAX_EVENTS = 1024;
-/** Credentials travel only in the upgrade header, never a URL or frame. */
-export function createCliLiveTransport(controlUrl, token) {
+/** The client certificate authenticates the upgrade; `controlUrl` only picks the connect target, the credential's public URL is verified. */
+export function createCliLiveTransport(credential, controlUrl) {
+    if (!credential)
+        throw new CliLiveError('no credential: run `tug init <credential-file>`');
     const url = new URL(controlUrl);
-    if (url.protocol !== 'http:' && url.protocol !== 'https:')
-        throw new CliLiveError('live control URL must use http or https');
+    if (url.protocol !== 'https:')
+        throw new CliLiveError('live control URL must use https');
     if (url.username || url.password || url.search || url.hash)
         throw new CliLiveError('live control URL must not contain credentials, query or fragment');
     url.protocol = url.protocol === 'https:' ? 'wss:' : 'ws:';
@@ -19,7 +22,8 @@ export function createCliLiveTransport(controlUrl, token) {
                     return;
                 }
                 const socket = new WebSocket(url, {
-                    headers: token ? { Authorization: `Bearer ${token}` } : {},
+                    ...clientTlsOptions(credential),
+                    followRedirects: false,
                     maxPayload: MAX_FRAME,
                     handshakeTimeout: LIVE_START_TIMEOUT_MS,
                     perMessageDeflate: false,