ignotum 0.0.2 → 0.0.4

package/src/cli/control-client.ts

@@ -0,0 +1,343 @@
+// @effect-diagnostics-next-line nodeBuiltinImport:off The Node CLI parses IP addresses before allowing plaintext API requests.
+import { isIP } from "node:net";
+
+import type {
+  AppSlug,
+  ControlApp,
+  ControlDeployment,
+  DeploymentFileUploadStatus,
+} from "@ignotum/contracts/control";
+import {
+  BeginDeploymentRequest,
+  ControlApp as ControlAppSchema,
+  ControlDeployment as ControlDeploymentSchema,
+  ControlErrorCode as ControlErrorCodeSchema,
+  ControlErrorResponse,
+  CreateAppRequest,
+  DeploymentFileUploadResponse,
+  controlAppBySlugPath,
+  controlAppPath,
+  controlAppsPath,
+  controlDeploymentActivatePath,
+  controlDeploymentFilePath,
+  controlDeploymentFinalizePath,
+  controlDeploymentsPath,
+  controlUploadHeaderNames,
+} from "@ignotum/contracts/control";
+import type { ArtifactFile, DeploymentInventory } from "@ignotum/contracts/deployment";
+import { deploymentInventoryPath } from "@ignotum/contracts/deployment";
+import type { AppId, DeploymentId } from "@ignotum/contracts/runtime/identity";
+import {
+  Config,
+  Context,
+  Effect,
+  FileSystem,
+  Layer,
+  Option,
+  Path,
+  Redacted,
+  Schedule,
+  Schema,
+} from "effect";
+import { HttpClient, HttpClientRequest, HttpClientResponse } from "effect/unstable/http";
+import type { HttpClientRequest as HttpRequest } from "effect/unstable/http/HttpClientRequest";
+
+export interface HostedControlConfig {
+  readonly apiUrl: URL;
+  readonly token: Redacted.Redacted<string>;
+}
+
+const isLoopbackAddress = (hostname: string): boolean => {
+  const address =
+    hostname.startsWith("[") && hostname.endsWith("]") ? hostname.slice(1, -1) : hostname;
+  return address === "::1" || (isIP(address) === 4 && address.startsWith("127."));
+};
+
+const HostedApiUrl = Schema.URL.check(
+  Schema.makeFilter(
+    (url) =>
+      url.protocol === "https:" || (url.protocol === "http:" && isLoopbackAddress(url.hostname)),
+    {
+      message: "The API URL must use HTTPS unless it targets a numeric loopback address.",
+    },
+  ),
+);
+
+export class HostedControlConfiguration extends Context.Service<
+  HostedControlConfiguration,
+  HostedControlConfig
+>()("ignotum/cli/control-client/HostedControlConfiguration") {
+  static readonly layer = Layer.effect(
+    HostedControlConfiguration,
+    Config.all({
+      apiUrl: Config.schema(HostedApiUrl, "IGNOTUM_API_URL").pipe(
+        Config.withDefault(new URL("https://api.ignotum.cloud")),
+      ),
+      token: Config.redacted("IGNOTUM_API_TOKEN"),
+    }),
+  );
+}
+
+export class ControlApiError extends Schema.TaggedError<ControlApiError>()("ControlApiError", {
+  code: ControlErrorCodeSchema,
+  message: Schema.String,
+  status: Schema.Int,
+}) {}
+
+export class ControlClientUnavailable extends Schema.TaggedError<ControlClientUnavailable>()(
+  "ControlClientUnavailable",
+  {
+    cause: Schema.Defect(),
+    message: Schema.String,
+  },
+) {}
+
+export interface DeploymentUploadFile {
+  readonly contentType: string;
+  readonly path: string;
+  readonly sha256: string;
+  readonly size: number;
+  readonly sourcePath: string;
+}
+
+interface ControlClientService {
+  readonly activateDeployment: (
+    appId: AppId,
+    deploymentId: DeploymentId,
+  ) => Effect.Effect<ControlApp, ControlApiError | ControlClientUnavailable>;
+  readonly beginDeployment: (
+    appId: AppId,
+    inventory: DeploymentInventory,
+  ) => Effect.Effect<ControlDeployment, ControlApiError | ControlClientUnavailable>;
+  readonly createApp: (
+    slug: AppSlug,
+  ) => Effect.Effect<ControlApp, ControlApiError | ControlClientUnavailable>;
+  readonly finalizeDeployment: (
+    appId: AppId,
+    deploymentId: DeploymentId,
+  ) => Effect.Effect<ControlDeployment, ControlApiError | ControlClientUnavailable>;
+  readonly getApp: (
+    appId: AppId,
+  ) => Effect.Effect<ControlApp, ControlApiError | ControlClientUnavailable>;
+  readonly getAppBySlug: (
+    slug: AppSlug,
+  ) => Effect.Effect<ControlApp, ControlApiError | ControlClientUnavailable>;
+  readonly uploadDeploymentFile: (
+    appId: AppId,
+    deploymentId: DeploymentId,
+    file: DeploymentUploadFile,
+  ) => Effect.Effect<DeploymentFileUploadStatus, ControlApiError | ControlClientUnavailable>;
+}
+
+export class ControlClient extends Context.Service<ControlClient, ControlClientService>()(
+  "ignotum/cli/control-client/ControlClient",
+) {
+  static get layer() {
+    return controlClientLayer.pipe(Layer.provideMerge(HostedControlConfiguration.layer));
+  }
+}
+
+const unavailable = (message: string, cause: unknown) =>
+  ControlClientUnavailable.make({ cause, message });
+
+const endpoint = (apiUrl: URL, path: string): URL => new URL(path, apiUrl);
+
+const uploadFile = (file: ArtifactFile, sourcePath: string) => ({
+  contentType: file.contentType,
+  path: file.path,
+  sha256: file.sha256,
+  size: file.size,
+  sourcePath,
+});
+
+export const deploymentUploadFiles = Effect.fn("ControlClient.deploymentUploadFiles")(function* (
+  inventory: DeploymentInventory,
+  inventorySha256: string,
+  inventorySize: number,
+  buildDirectory: string,
+) {
+  const path = yield* Path.Path;
+  return [
+    {
+      contentType: "application/json; charset=utf-8",
+      path: deploymentInventoryPath,
+      sha256: inventorySha256,
+      size: inventorySize,
+      sourcePath: path.join(buildDirectory, deploymentInventoryPath),
+    },
+    ...inventory.files.map((file) => uploadFile(file, path.join(buildDirectory, file.path))),
+  ];
+});
+
+export const controlClientLayer = Layer.effect(
+  ControlClient,
+  Effect.gen(function* () {
+    const config = yield* HostedControlConfiguration;
+    const fileSystem = yield* FileSystem.FileSystem;
+    const http = yield* HttpClient.HttpClient;
+    const idempotentHttp = http.pipe(
+      HttpClient.retryTransient({
+        schedule: Schedule.exponential("100 millis"),
+        times: 3,
+      }),
+    );
+
+    const authenticate = (request: HttpRequest): HttpRequest =>
+      request.pipe(HttpClientRequest.bearerToken(config.token), HttpClientRequest.acceptJson);
+
+    const decodeResponse = Effect.fn("ControlClient.decodeResponse")(function* <
+      ValueSchema extends Schema.ConstraintCodec<unknown, unknown, never, never>,
+    >(response: HttpClientResponse.HttpClientResponse, schema: ValueSchema) {
+      if (response.status >= 200 && response.status < 300) {
+        return yield* HttpClientResponse.schemaBodyJson(schema)(response).pipe(
+          Effect.mapError((cause) =>
+            unavailable("The Ignotum API returned an invalid response.", cause),
+          ),
+        );
+      }
+
+      const error = yield* HttpClientResponse.schemaBodyJson(ControlErrorResponse)(response).pipe(
+        Effect.option,
+      );
+      if (Option.isSome(error)) {
+        return yield* ControlApiError.make({
+          code: error.value.code,
+          message: error.value.message,
+          status: response.status,
+        });
+      }
+      return yield* unavailable("The Ignotum API returned an invalid error response.", {
+        status: response.status,
+      });
+    });
+
+    const execute = Effect.fn("ControlClient.execute")(function* <
+      ValueSchema extends Schema.ConstraintCodec<unknown, unknown, never, never>,
+    >(request: HttpRequest, schema: ValueSchema) {
+      const response = yield* http.execute(authenticate(request)).pipe(
+        Effect.mapError((cause) => unavailable("The API request failed.", cause)),
+        Effect.timeoutOrElse({
+          duration: "30 seconds",
+          orElse: () =>
+            Effect.fail(
+              unavailable(
+                "The API request exceeded its deadline.",
+                new Error("API request deadline exceeded."),
+              ),
+            ),
+        }),
+      );
+      return yield* decodeResponse(response, schema);
+    });
+
+    const executeIdempotent = Effect.fn("ControlClient.executeIdempotent")(function* <
+      ValueSchema extends Schema.ConstraintCodec<unknown, unknown, never, never>,
+    >(request: HttpRequest, schema: ValueSchema) {
+      const response = yield* idempotentHttp.execute(authenticate(request)).pipe(
+        Effect.mapError((cause) => unavailable("The API request failed.", cause)),
+        Effect.timeoutOrElse({
+          duration: "30 seconds",
+          orElse: () =>
+            Effect.fail(
+              unavailable(
+                "The API request exceeded its deadline.",
+                new Error("API request deadline exceeded."),
+              ),
+            ),
+        }),
+      );
+      return yield* decodeResponse(response, schema);
+    });
+
+    const createApp = Effect.fn("ControlClient.createApp")(function* (slug: AppSlug) {
+      const request = yield* HttpClientRequest.post(endpoint(config.apiUrl, controlAppsPath)).pipe(
+        HttpClientRequest.schemaBodyJson(CreateAppRequest)({ slug }),
+        Effect.mapError((cause) => unavailable("The app request could not be encoded.", cause)),
+      );
+      return yield* execute(request, ControlAppSchema);
+    });
+
+    const getApp = Effect.fn("ControlClient.getApp")(function* (appId: AppId) {
+      return yield* executeIdempotent(
+        HttpClientRequest.get(endpoint(config.apiUrl, controlAppPath(appId))),
+        ControlAppSchema,
+      );
+    });
+
+    const getAppBySlug = Effect.fn("ControlClient.getAppBySlug")(function* (slug: AppSlug) {
+      return yield* executeIdempotent(
+        HttpClientRequest.get(endpoint(config.apiUrl, controlAppBySlugPath(slug))),
+        ControlAppSchema,
+      );
+    });
+
+    const beginDeployment = Effect.fn("ControlClient.beginDeployment")(function* (
+      appId: AppId,
+      inventory: DeploymentInventory,
+    ) {
+      const request = yield* HttpClientRequest.post(
+        endpoint(config.apiUrl, controlDeploymentsPath(appId)),
+      ).pipe(
+        HttpClientRequest.schemaBodyJson(BeginDeploymentRequest)({ inventory }),
+        Effect.mapError((cause) =>
+          unavailable("The deployment request could not be encoded.", cause),
+        ),
+      );
+      return yield* execute(request, ControlDeploymentSchema);
+    });
+
+    const uploadDeploymentFile = Effect.fn("ControlClient.uploadDeploymentFile")(function* (
+      appId: AppId,
+      deploymentId: DeploymentId,
+      file: DeploymentUploadFile,
+    ) {
+      const request = yield* HttpClientRequest.put(
+        endpoint(config.apiUrl, controlDeploymentFilePath(appId, deploymentId, file.path)),
+      ).pipe(
+        HttpClientRequest.setHeader(controlUploadHeaderNames.contentLength, String(file.size)),
+        HttpClientRequest.setHeader(controlUploadHeaderNames.sha256, file.sha256),
+        HttpClientRequest.bodyFile(file.sourcePath, { contentType: file.contentType }),
+        Effect.provideService(FileSystem.FileSystem, fileSystem),
+        Effect.mapError((cause) =>
+          unavailable(`Deployment file '${file.path}' could not be opened.`, cause),
+        ),
+      );
+      const response = yield* executeIdempotent(request, DeploymentFileUploadResponse);
+      return response.status;
+    });
+
+    const finalizeDeployment = Effect.fn("ControlClient.finalizeDeployment")(function* (
+      appId: AppId,
+      deploymentId: DeploymentId,
+    ) {
+      return yield* executeIdempotent(
+        HttpClientRequest.post(
+          endpoint(config.apiUrl, controlDeploymentFinalizePath(appId, deploymentId)),
+        ),
+        ControlDeploymentSchema,
+      );
+    });
+
+    const activateDeployment = Effect.fn("ControlClient.activateDeployment")(function* (
+      appId: AppId,
+      deploymentId: DeploymentId,
+    ) {
+      return yield* executeIdempotent(
+        HttpClientRequest.post(
+          endpoint(config.apiUrl, controlDeploymentActivatePath(appId, deploymentId)),
+        ),
+        ControlAppSchema,
+      );
+    });
+
+    return ControlClient.of({
+      activateDeployment,
+      beginDeployment,
+      createApp,
+      finalizeDeployment,
+      getApp,
+      getAppBySlug,
+      uploadDeploymentFile,
+    });
+  }),
+);

package/src/cli/deploy.ts

@@ -0,0 +1,217 @@
+import { Effect, FileSystem, Path, Result, Schema } from "effect";
+
+import { deploymentInventoryPath } from "@ignotum/contracts/deployment";
+import type { DeploymentInventory } from "@ignotum/contracts/deployment";
+import type { AppSlug } from "@ignotum/contracts/control";
+import { DeploymentId } from "@ignotum/contracts/runtime/identity";
+import {
+  makeDeploymentInventory,
+  readArtifactDirectory,
+  sha256,
+  validateDeploymentArtifact,
+} from "@ignotum/deployment";
+
+import { appUrl, configureApp, type AppConfiguration } from "./app-configuration.js";
+import { buildClient } from "./build/client.js";
+import { buildServer } from "./build/server.js";
+import { generate } from "./codegen.js";
+import { ControlClient, deploymentUploadFiles } from "./control-client.js";
+
+export interface DeploymentBuildResult {
+  readonly clientAssets: number;
+  readonly inventory: DeploymentInventory;
+  readonly inventoryBytes: Uint8Array;
+  readonly outputDirectory: string;
+  readonly serverFunctions: number;
+}
+
+export interface DeployResult extends DeploymentBuildResult {
+  readonly appUrl: string;
+  readonly deploymentId: DeploymentId;
+}
+
+export class BuildReplacementFailed extends Schema.TaggedError<BuildReplacementFailed>()(
+  "BuildReplacementFailed",
+  {
+    backupPath: Schema.String,
+    cause: Schema.Defect(),
+    message: Schema.String,
+  },
+) {}
+
+export class DeploymentUploadInterrupted extends Schema.TaggedError<DeploymentUploadInterrupted>()(
+  "DeploymentUploadInterrupted",
+  {
+    cause: Schema.Defect(),
+    deploymentId: DeploymentId,
+    message: Schema.String,
+  },
+) {}
+
+export class DeploymentActivationUnconfirmed extends Schema.TaggedError<DeploymentActivationUnconfirmed>()(
+  "DeploymentActivationUnconfirmed",
+  {
+    cause: Schema.Defect(),
+    deploymentId: DeploymentId,
+    message: Schema.String,
+  },
+) {}
+
+const replaceBuildDirectory = Effect.fn("Deploy.replaceBuildDirectory")(function* (
+  stateDirectory: string,
+  stagingDirectory: string,
+  buildDirectory: string,
+) {
+  const fileSystem = yield* FileSystem.FileSystem;
+  const currentExists = yield* fileSystem.exists(buildDirectory);
+  if (!currentExists) {
+    yield* fileSystem.rename(stagingDirectory, buildDirectory);
+    return;
+  }
+
+  const backupPath = yield* fileSystem.makeTempDirectory({
+    directory: stateDirectory,
+    prefix: ".build-backup-",
+  });
+  yield* fileSystem.remove(backupPath, { recursive: true });
+  yield* fileSystem.rename(buildDirectory, backupPath);
+
+  const replacement = yield* Effect.result(fileSystem.rename(stagingDirectory, buildDirectory));
+  if (Result.isSuccess(replacement)) {
+    yield* fileSystem.remove(backupPath, { recursive: true });
+    return;
+  }
+
+  const restoration = yield* Effect.result(fileSystem.rename(backupPath, buildDirectory));
+  if (Result.isFailure(restoration)) {
+    return yield* BuildReplacementFailed.make({
+      backupPath,
+      cause: restoration.failure,
+      message: `Could not install the new build or restore the previous build. The previous build remains at ${backupPath}.`,
+    });
+  }
+
+  return yield* replacement.failure;
+});
+
+export const buildDeploymentArtifact = Effect.fn("Deploy.buildArtifact")(function* (
+  appDirectory: string,
+) {
+  const fileSystem = yield* FileSystem.FileSystem;
+  const path = yield* Path.Path;
+  const stateDirectory = path.join(appDirectory, ".ignotum");
+  const buildDirectory = path.join(stateDirectory, "build");
+
+  yield* fileSystem.makeDirectory(stateDirectory, { recursive: true });
+  const codegen = yield* generate(appDirectory);
+
+  return yield* Effect.scoped(
+    Effect.gen(function* () {
+      const stagingDirectory = yield* Effect.acquireRelease(
+        fileSystem.makeTempDirectory({
+          directory: stateDirectory,
+          prefix: ".build-staging-",
+        }),
+        (directory) =>
+          fileSystem.remove(directory, { force: true, recursive: true }).pipe(Effect.orDie),
+      );
+      const clientOutput = path.join(stagingDirectory, "client");
+      const serverOutput = path.join(stagingDirectory, "server");
+      const client = yield* buildClient(appDirectory, clientOutput);
+      const server = yield* buildServer(appDirectory, serverOutput, codegen.functionModules);
+      const payloadFiles = yield* readArtifactDirectory(stagingDirectory);
+      const inventory = yield* makeDeploymentInventory(payloadFiles);
+      yield* fileSystem.writeFile(
+        path.join(stagingDirectory, deploymentInventoryPath),
+        inventory.bytes,
+      );
+      const artifactFiles = yield* readArtifactDirectory(stagingDirectory);
+      yield* validateDeploymentArtifact(artifactFiles);
+      yield* Effect.logInfo("Built deployment artifact").pipe(
+        Effect.annotateLogs({
+          files: inventory.inventory.files.length,
+          functions: server.functions,
+        }),
+      );
+
+      yield* replaceBuildDirectory(stateDirectory, stagingDirectory, buildDirectory);
+
+      return {
+        clientAssets: client.assets,
+        inventory: inventory.inventory,
+        inventoryBytes: inventory.bytes,
+        outputDirectory: buildDirectory,
+        serverFunctions: server.functions,
+      } satisfies DeploymentBuildResult;
+    }),
+  );
+});
+
+export const uploadDeployment = Effect.fn("Deploy.upload")(function* (
+  configuration: AppConfiguration,
+  build: DeploymentBuildResult,
+) {
+  const control = yield* ControlClient;
+  const inventorySha256 = yield* sha256(build.inventoryBytes);
+  const files = yield* deploymentUploadFiles(
+    build.inventory,
+    inventorySha256,
+    build.inventoryBytes.byteLength,
+    build.outputDirectory,
+  );
+  const deployment = yield* control.beginDeployment(configuration.appId, build.inventory);
+
+  yield* Effect.forEach(
+    files,
+    (file) => control.uploadDeploymentFile(configuration.appId, deployment.id, file),
+    { concurrency: 4, discard: true },
+  ).pipe(
+    Effect.catchTags({
+      ControlClientUnavailable: (cause) =>
+        DeploymentUploadInterrupted.make({
+          cause,
+          deploymentId: deployment.id,
+          message: `Deployment ${deployment.id} was interrupted during upload. The active deployment was not changed.`,
+        }),
+    }),
+  );
+
+  yield* control.finalizeDeployment(configuration.appId, deployment.id).pipe(
+    Effect.catchTags({
+      ControlClientUnavailable: (cause) =>
+        DeploymentUploadInterrupted.make({
+          cause,
+          deploymentId: deployment.id,
+          message: `Deployment ${deployment.id} could not be finalized. The active deployment was not changed.`,
+        }),
+    }),
+  );
+
+  yield* control.activateDeployment(configuration.appId, deployment.id).pipe(
+    Effect.catchTags({
+      ControlClientUnavailable: (cause) =>
+        DeploymentActivationUnconfirmed.make({
+          cause,
+          deploymentId: deployment.id,
+          message: `Deployment ${deployment.id} is ready, but activation could not be confirmed.`,
+        }),
+    }),
+  );
+
+  return deployment.id;
+});
+
+export const deploy = Effect.fn("Deploy.run")(function* (
+  appDirectory: string,
+  requestedSlug: AppSlug | undefined,
+) {
+  const build = yield* buildDeploymentArtifact(appDirectory);
+  const configuration = yield* configureApp(appDirectory, requestedSlug);
+  const deploymentId = yield* uploadDeployment(configuration, build);
+
+  return {
+    ...build,
+    appUrl: appUrl(configuration.slug),
+    deploymentId,
+  } satisfies DeployResult;
+});