@wpelevator/tug 0.6.0 → 0.8.0

package/dist/compose.d.ts

@@ -23,7 +23,7 @@ export declare function bindPorts(ports: PortEntry[], ip: string, loopbackPort?:
  * A service with no placement nodes runs on every node in `nodes`.
  */
 export declare function loopbackIngressServices(state: DesiredState, node: string, ingressNodes: readonly string[], nodes: readonly string[]): string[];
-/** Where `composeForNode` binds published ports that name no host IP. */
+/** Where the agent's container definitions bind published ports that name no host IP. */
 export interface PortBind {
     address: string;
     loopback?: ReadonlySet<string>;
@@ -34,6 +34,8 @@ export declare function addressBoundServices(compose: ComposeFile, names: Iterab
 export declare function isRolling(svc: ComposeService | undefined): boolean;
 /** Service keys the agent can create a container from; anything else is rejected with its name. */
 export declare const SUPPORTED_SERVICE_KEYS: readonly string[];
+/** Lower-cased ingress hostnames a Compose definition claims, by `service` name. */
+export declare function ingressHostsOf(compose: ComposeFile): Map<string, string>;
 export declare function validateCompose(compose: ComposeFile | undefined, nodes?: string[]): asserts compose is ComposeFile;
 export interface BuildDesiredStateOptions {
     project: string;

package/dist/compose.js

@@ -279,6 +279,16 @@ function validateTopLevel(compose, errors) {
                 errors.push(`volumes.${key}: ${field} is not supported`);
     }
 }
+/** Lower-cased ingress hostnames a Compose definition claims, by `service` name. */
+export function ingressHostsOf(compose) {
+    const hosts = new Map();
+    for (const [name, svc] of Object.entries(compose.services || {})) {
+        const host = svc['x-tug']?.ingress?.host;
+        if (typeof host === 'string')
+            hosts.set(host.toLowerCase(), name);
+    }
+    return hosts;
+}
 export function validateCompose(compose, nodes = []) {
     if (!compose?.services || typeof compose.services !== 'object')
         throw new Error('compose file must define services');
@@ -290,7 +300,9 @@ export function validateCompose(compose, nodes = []) {
         const placement = lp.placement || {};
         const selected = placement.nodes || [];
         const hasLabels = Array.isArray(placement.labels) && placement.labels.length > 0;
-        const isGlobal = lp.global === true || placement.global === true;
+        const isGlobal = lp.global === true;
+        if ('global' in placement)
+            errors.push(`${name}: x-tug.placement.global is not supported; use x-tug.global`);
         if (nodes.length > 1 && selected.length === 0 && !hasLabels && !isGlobal)
             errors.push(`${name}: multi-node deployments require x-tug.placement.nodes or placement.labels`);
         if (lp.replicas &&
@@ -313,7 +325,7 @@ export function buildDesiredState({ project, version, compose, revision, default
     for (const [name, src] of Object.entries(compose.services || {})) {
         const lp = src['x-tug'] || {};
         let placement = lp.placement || (defaultNode ? { nodes: [defaultNode] } : {});
-        const global = lp.global === true || placement.global === true;
+        const global = lp.global === true;
         const labels = placement.labels || [];
         if (nodes && (!placement.nodes || !placement.nodes.length) && (labels.length || global)) {
             const matched = nodes

package/dist/control-credential.d.ts

@@ -0,0 +1,12 @@
+export interface IssueArgs {
+    name: string;
+    role: string;
+    replace: boolean;
+}
+export declare function parseIssueArgs(argv: string[]): IssueArgs;
+/**
+ * Host-side issuance (`docker exec ... control issue-credential`), independent of the API and of any running listener. It
+ * is create-only unless `replace` is set, which replaces the named credential's key; a running control closes the old
+ * key's sessions within a second. Returns the credential once; control keeps no private-key copy.
+ */
+export declare function issueHostCredential(args: IssueArgs): Promise<string>;

package/dist/control-credential.js

@@ -0,0 +1,46 @@
+import path from 'node:path';
+import { openDb } from "./db.js";
+import { Pki, encodeCredential } from "./pki.js";
+import { ROLES, createCredential, isRole, parseCredentialRequest } from "./credentials.js";
+export function parseIssueArgs(argv) {
+    const args = { name: 'root', role: 'admin', replace: false };
+    for (let i = 0; i < argv.length; i++) {
+        if (argv[i] === '--name')
+            args.name = argv[++i];
+        else if (argv[i] === '--role')
+            args.role = argv[++i];
+        else if (argv[i] === '--replace')
+            args.replace = true;
+        else
+            throw new Error(`unknown argument ${argv[i]}`);
+    }
+    if (!isRole(args.role))
+        throw new Error(`--role must be one of ${ROLES.join(', ')}`);
+    return args;
+}
+/**
+ * Host-side issuance (`docker exec ... control issue-credential`), independent of the API and of any running listener. It
+ * is create-only unless `replace` is set, which replaces the named credential's key; a running control closes the old
+ * key's sessions within a second. Returns the credential once; control keeps no private-key copy.
+ */
+export async function issueHostCredential(args) {
+    const dataDir = process.env.TUG_DATA_DIR || './data';
+    const publicUrl = process.env.TUG_PUBLIC_URL;
+    if (!publicUrl)
+        throw new Error('TUG_PUBLIC_URL is required');
+    const db = await openDb(path.join(dataDir, 'tug.db'));
+    try {
+        const fresh = !db.get('SELECT 1 FROM operator_credentials') && !db.get('SELECT 1 FROM nodes');
+        const pki = await Pki.load(path.join(dataDir, 'pki'), fresh);
+        const request = parseCredentialRequest({ name: args.name, role: args.role });
+        const created = await createCredential(db, pki, new URL(publicUrl).origin, request, 'host', {
+            replace: args.replace,
+        });
+        if (args.replace)
+            db.run('INSERT INTO events(id,level,type,message,metadata_json,created_at,actor) VALUES(?,?,?,?,?,?,?)', `evt_${Date.now().toString(36)}`, 'info', 'credential.recover', `credential ${args.name} replaced on the control host`, '{}', new Date().toISOString(), 'host');
+        return encodeCredential(created.credential);
+    }
+    finally {
+        db.close();
+    }
+}

package/dist/control.d.ts

@@ -1,10 +1,12 @@
 #!/usr/bin/env node
 import express from 'express';
 import { resolveImage } from './registry.ts';
+import type { Request } from 'express';
 import { saveImageArchive, inspectImage, validateImageArchive } from './artifacts.ts';
 import https from 'node:https';
 import http from 'node:http';
 import { openDb } from './db.ts';
+import type { Db } from './db.ts';
 import type { NodeRow } from './db.ts';
 import { buildImage, run as runCommand } from './build.ts';
 declare module 'express-serve-static-core' {
@@ -25,5 +27,20 @@ export declare function createApp(options?: {
     openDatabase?: typeof openDb;
     /** Minimum time between event prunes triggered by agent reports; default one hour. */ eventPruneIntervalMs?: number;
     /** Override the live open/agent startup timeout in milliseconds. */ liveStartTimeoutMs?: number;
+    /** Credential-free HTTPS origin clients use to reach control; defaults to `TUG_PUBLIC_URL`. */ publicUrl?: string;
+    /**
+     * Replaces certificate-based identity resolution. Only for in-process tests that skip TLS; production never sets it.
+     * It returns the principal URI and key hash a connection would have presented.
+     */
+    identity?: (req: Request, db: Db) => {
+        uri: string;
+        keyHash: string;
+    } | null;
 }): Promise<import("express-serve-static-core").Express>;
-export declare function listen(app: express.Express, port?: number): Promise<http.Server | https.Server>;
+/** Attaches the agent and operator WebSocket upgrade handling to `server`; `listen` uses it on the mTLS listener. */
+export declare function attachAgentStream(app: express.Express, server: http.Server | https.Server): void;
+/**
+ * Starts the single mTLS listener. Chain validation rejects missing or foreign client certificates during the handshake;
+ * the secureConnection gate then checks current database state, and every request checks it again.
+ */
+export declare function listen(app: express.Express, port?: number): Promise<https.Server>;