openship 0.1.0 → 0.1.1

package/packages/adapters/src/index.ts

@@ -1,4 +1,144 @@
-export { type DeploymentAdapter } from "./base-adapter";
-export { DockerAdapter } from "./docker-adapter";
-export { OblienAdapter } from "./oblien-adapter";
-export { getAdapter } from "./registry";
+/**
+ * @repo/adapters — platform abstraction layer.
+ *
+ * Three layers, one entry point:
+ *   1. Runtime  → build/deploy/stop/start lifecycle (Docker, Bare, Cloud)
+ *   2. Infra    → routing (Traefik) + SSL (ACME) — separate from runtime
+ *   3. System   → prerequisite checks + setup validation (self-hosted only)
+ *
+ * The Platform ties them together:
+ *   const { runtime, routing, ssl, system } = getPlatform();
+ */
+
+// ─── Shared types ────────────────────────────────────────────────────────────
+export type {
+  ResourceConfig,
+  ContainerStatus,
+  BuildStrategy,
+  BuildConfig,
+  DeployConfig,
+  BuildResult,
+  DeploymentResult,
+  BuildStep,
+  LogEntry,
+  LogCallback,
+  ContainerInfo,
+  ResourceUsage,
+  RouteConfig,
+  SslResult,
+  SshConfig,
+  CommandExecutor,
+} from "./types";
+
+export {
+  BUILD_STEPS,
+} from "./types";
+
+export {
+  DEFAULT_RESOURCE_CONFIG,
+  DEFAULT_BUILD_RESOURCE_CONFIG,
+} from "./types";
+
+// ─── Runtime layer ───────────────────────────────────────────────────────────
+export type { RuntimeAdapter, RuntimeCapability } from "./runtime/types";
+export { assertCapability } from "./runtime/types";
+export { DockerRuntime, type DockerConnectionOptions } from "./runtime/docker";
+export { BareRuntime, type BareRuntimeOptions } from "./runtime/bare";
+export { CloudRuntime } from "./runtime/cloud";
+export { BuildLogger } from "./runtime/build-pipeline";
+export {
+  type DeployEnvironment,
+  type DeployRouting,
+  type DeployPipelineInput,
+  type DeployPipelineResult,
+  runDeployPipeline,
+} from "./runtime/deploy-pipeline";
+export {
+  type RuntimeMode,
+  type CreateRuntimeOptions,
+  createRuntime,
+} from "./runtime/index";
+
+// ─── Infrastructure layer ────────────────────────────────────────────────────
+export type { RoutingProvider, SslProvider } from "./infra/types";
+export { TraefikProvider, type TraefikProviderOptions } from "./infra/traefik";
+export { CloudInfraProvider } from "./infra/cloud";
+export { NoopInfraProvider } from "./infra/noop";
+
+// ─── System layer ────────────────────────────────────────────────────────────
+export type {
+  ComponentStatus,
+  Feature,
+  FeatureReadiness,
+  InstallerConfig,
+  InstallResult,
+  PrerequisiteRule,
+  RuntimeMode as SystemRuntimeMode,
+  SystemComponentDefinition,
+  SetupResult,
+  SystemCheckResult,
+  SystemLog,
+  SystemLogCallback,
+} from "./system/types";
+
+export type { SetupState, SetupStateStore, ComponentState } from "./system/state";
+export { FileStateStore } from "./system/state";
+
+export type {
+  EnvironmentProfile,
+  LinuxDistro,
+  SystemArch,
+  SystemOs,
+  SystemPackageManager,
+  SystemServiceManager,
+} from "./system/environment";
+export { resolveEnvironment } from "./system/environment";
+export { systemCatalog } from "./system/catalog";
+export { SYSTEM_COMPONENTS, getSystemComponentDefinition } from "./system/components";
+export {
+  isRemoteConnectionError,
+  isRetryableRemoteConnectionError,
+  isSshAuthError,
+} from "./system/errors";
+
+export { LocalExecutor, SshExecutor, createExecutor } from "./system/executor";
+
+export {
+  checkAll as checkAllComponents,
+  checkComponents,
+  checkDocker,
+  checkGit,
+  checkNode,
+  checkTraefik,
+  COMPONENT_CHECKS,
+} from "./system/checks";
+export {
+  COMPONENT_INSTALLERS,
+  installDocker,
+  installGit,
+  installNode,
+  installTraefik,
+} from "./system/installer";
+export { SystemManager, type SystemManagerOptions } from "./system/setup";
+
+// ─── Toolchain layer ────────────────────────────────────────────────────────
+export type {
+  ToolchainStatus,
+  ToolchainCheckResult,
+  ToolchainCheckEntry,
+  ToolchainInstallPlan,
+  ToolchainInstallResult,
+} from "./toolchain";
+
+export { toolchainCatalog } from "./toolchain";
+export {
+  checkTool,
+  checkTools,
+  checkToolchain,
+  checkToolchainForStack,
+} from "./toolchain";
+export { installTool, installTools } from "./toolchain";
+
+// ─── Platform (top-level entry point) ────────────────────────────────────────
+export type { PlatformTarget, PlatformConfig, Platform } from "./platform";
+export { createPlatform, initPlatform, getPlatform, resetPlatform } from "./platform";

package/packages/adapters/src/infra/cloud.ts

@@ -0,0 +1,42 @@
+/**
+ * Cloud infrastructure provider — routing + SSL via Oblien API.
+ *
+ * All operations are API calls to the Oblien platform. No local reverse
+ * proxy or ACME configuration needed.
+ */
+
+import { Oblien } from "oblien";
+import type { RouteConfig, SslResult } from "../types";
+import type { RoutingProvider, SslProvider } from "./types";
+
+export class CloudInfraProvider implements RoutingProvider, SslProvider {
+  private readonly client: Oblien;
+
+  constructor(client: Oblien) {
+    this.client = client;
+  }
+
+  // ── Routing ──────────────────────────────────────────────────────────
+
+  async registerRoute(route: RouteConfig): Promise<void> {
+    // TODO: POST /routes to Oblien API
+    void route;
+  }
+
+  async removeRoute(domain: string): Promise<void> {
+    // TODO: DELETE /routes/:domain
+    void domain;
+  }
+
+  // ── SSL ──────────────────────────────────────────────────────────────
+
+  async provisionCert(domain: string): Promise<SslResult> {
+    // TODO: POST /ssl/provision — Oblien manages certs
+    return { domain, expiresAt: "", issuer: "oblien" };
+  }
+
+  async renewCert(domain: string): Promise<SslResult> {
+    // TODO: POST /ssl/renew
+    return { domain, expiresAt: "", issuer: "oblien" };
+  }
+}

package/packages/adapters/src/infra/index.ts

@@ -0,0 +1,9 @@
+/**
+ * Infrastructure layer barrel exports.
+ */
+
+export type { RoutingProvider, SslProvider } from "./types";
+
+export { TraefikProvider, type TraefikProviderOptions } from "./traefik";
+export { CloudInfraProvider } from "./cloud";
+export { NoopInfraProvider } from "./noop";

package/packages/adapters/src/infra/noop.ts

@@ -0,0 +1,27 @@
+/**
+ * No-op infrastructure provider — for desktop and development.
+ *
+ * Desktop apps and local dev environments don't need reverse proxies
+ * or SSL certificates. This provider silently accepts all calls.
+ */
+
+import type { RouteConfig, SslResult } from "../types";
+import type { RoutingProvider, SslProvider } from "./types";
+
+export class NoopInfraProvider implements RoutingProvider, SslProvider {
+  async registerRoute(_route: RouteConfig): Promise<void> {
+    // Desktop/dev — no reverse proxy
+  }
+
+  async removeRoute(_domain: string): Promise<void> {
+    // No-op
+  }
+
+  async provisionCert(domain: string): Promise<SslResult> {
+    return { domain, expiresAt: "", issuer: "none" };
+  }
+
+  async renewCert(domain: string): Promise<SslResult> {
+    return { domain, expiresAt: "", issuer: "none" };
+  }
+}

package/packages/adapters/src/infra/traefik.ts

@@ -0,0 +1,297 @@
+/**
+ * Traefik infrastructure provider — routing + SSL for self-hosted deployments.
+ *
+ * Uses Traefik's dynamic file provider: writes YAML config files to a watched
+ * directory. Traefik detects changes automatically — no reload needed.
+ *
+ * SSL is handled by Traefik's built-in ACME resolver (Let's Encrypt). When a
+ * route is configured with `tls.certResolver`, Traefik auto-provisions and
+ * auto-renews certificates.
+ *
+ * This provider works with BOTH Docker and Bare runtimes — it's independent
+ * of how the application process is managed.
+ *
+ * Typical Traefik static config (traefik.yml):
+ * ```yaml
+ * providers:
+ *   file:
+ *     directory: /etc/traefik/dynamic
+ *     watch: true
+ *
+ * certificatesResolvers:
+ *   letsencrypt:
+ *     acme:
+ *       email: admin@example.com
+ *       storage: /etc/traefik/acme.json
+ *       httpChallenge:
+ *         entryPoint: web
+ * ```
+ */
+
+import {
+  writeFile as fsWriteFile,
+  rm as fsRm,
+  mkdir as fsMkdir,
+  readFile as fsReadFile,
+} from "node:fs/promises";
+import { dirname, join } from "node:path";
+
+import type { CommandExecutor, RouteConfig, SslResult } from "../types";
+import type { RoutingProvider, SslProvider } from "./types";
+
+// ─── Config ──────────────────────────────────────────────────────────────────
+
+export interface TraefikProviderOptions {
+  /**
+   * Directory where Traefik watches for dynamic config files.
+   * Default: /etc/traefik/dynamic
+   */
+  configDir?: string;
+  /**
+   * ACME certificate resolver name (must match Traefik static config).
+   * Default: "letsencrypt"
+   */
+  certResolver?: string;
+  /**
+   * Path to Traefik's ACME storage file (for reading cert info).
+   * Default: /etc/traefik/acme.json
+   */
+  acmeStoragePath?: string;
+  /**
+   * Command executor for file operations.
+   *
+   * When provided, all file reads/writes go through the executor
+   * (supporting remote servers via SSH). When omitted, uses node:fs
+   * directly (local server).
+   *
+   * This is what enables the dual-path: same TraefikProvider, same
+   * config format, works both locally and remotely.
+   */
+  executor?: CommandExecutor;
+}
+
+const DEFAULT_CONFIG_DIR = "/etc/traefik/dynamic";
+const DEFAULT_CERT_RESOLVER = "letsencrypt";
+const DEFAULT_ACME_STORAGE = "/etc/traefik/acme.json";
+
+// ─── Implementation ──────────────────────────────────────────────────────────
+
+/**
+ * Traefik-based routing and SSL provider.
+ *
+ * Implements both RoutingProvider and SslProvider since Traefik handles
+ * both concerns through its dynamic configuration.
+ */
+export class TraefikProvider implements RoutingProvider, SslProvider {
+  private readonly configDir: string;
+  private readonly certResolver: string;
+  private readonly acmeStoragePath: string;
+  private readonly executor: CommandExecutor | null;
+
+  constructor(opts?: TraefikProviderOptions) {
+    this.configDir = opts?.configDir ?? DEFAULT_CONFIG_DIR;
+    this.certResolver = opts?.certResolver ?? DEFAULT_CERT_RESOLVER;
+    this.acmeStoragePath = opts?.acmeStoragePath ?? DEFAULT_ACME_STORAGE;
+    this.executor = opts?.executor ?? null;
+  }
+
+  // ── File operation helpers (dual-path: local or remote) ──────────────
+
+  private async _writeFile(path: string, content: string): Promise<void> {
+    if (this.executor) {
+      await this.executor.writeFile(path, content);
+    } else {
+      await fsMkdir(dirname(path), { recursive: true });
+      await fsWriteFile(path, content, "utf-8");
+    }
+  }
+
+  private async _readFile(path: string): Promise<string> {
+    if (this.executor) {
+      return this.executor.readFile(path);
+    }
+    return fsReadFile(path, "utf-8");
+  }
+
+  private async _rm(path: string): Promise<void> {
+    if (this.executor) {
+      await this.executor.rm(path);
+    } else {
+      try {
+        await fsRm(path);
+      } catch {
+        // Already gone
+      }
+    }
+  }
+
+  private async _mkdir(path: string): Promise<void> {
+    if (this.executor) {
+      await this.executor.mkdir(path);
+    } else {
+      await fsMkdir(path, { recursive: true });
+    }
+  }
+
+  // ── Routing ──────────────────────────────────────────────────────────
+
+  /**
+   * Register a route by writing a Traefik dynamic config file.
+   *
+   * Creates a YAML file in the watched directory. Traefik picks it up
+   * automatically within seconds.
+   */
+  async registerRoute(route: RouteConfig): Promise<void> {
+    await this._mkdir(this.configDir);
+
+    const slug = this.domainSlug(route.domain);
+    const configPath = join(this.configDir, `${slug}.yml`);
+
+    // Build Traefik dynamic configuration YAML
+    const tlsBlock = route.tls
+      ? `\n      tls:\n        certResolver: ${this.certResolver}`
+      : "";
+
+    const yaml = `# Auto-generated by Openship — do not edit manually
+http:
+  routers:
+    ${slug}:
+      rule: "Host(\`${route.domain}\`)"
+      service: ${slug}
+      entryPoints:
+        - websecure${tlsBlock}
+  services:
+    ${slug}:
+      loadBalancer:
+        servers:
+          - url: "${route.targetUrl}"
+`;
+
+    await this._writeFile(configPath, yaml);
+  }
+
+  /**
+   * Remove a route by deleting its config file.
+   * Traefik detects the removal and drops the route.
+   */
+  async removeRoute(domain: string): Promise<void> {
+    const slug = this.domainSlug(domain);
+    const configPath = join(this.configDir, `${slug}.yml`);
+    await this._rm(configPath);
+  }
+
+  // ── SSL ──────────────────────────────────────────────────────────────
+
+  /**
+   * Provision a TLS certificate for a domain.
+   *
+   * With Traefik + ACME, certificate provisioning is automatic when a route
+   * has `tls.certResolver` configured. This method ensures the route exists
+   * with TLS enabled and returns cert info from ACME storage.
+   */
+  async provisionCert(domain: string): Promise<SslResult> {
+    // The route should already have TLS enabled via registerRoute().
+    // Traefik handles ACME challenge + cert issuance automatically.
+    // We check the ACME storage for cert info.
+    const certInfo = await this.readCertInfo(domain);
+
+    if (certInfo) {
+      return certInfo;
+    }
+
+    // Cert not yet available — Traefik is still provisioning.
+    // Return a pending result; the caller can poll.
+    return {
+      domain,
+      expiresAt: "",
+      issuer: this.certResolver,
+    };
+  }
+
+  /**
+   * Renew a TLS certificate.
+   *
+   * Traefik auto-renews certificates 30 days before expiry. This method
+   * is effectively a check + trigger: it touches the route config to ensure
+   * Traefik re-evaluates the cert.
+   */
+  async renewCert(domain: string): Promise<SslResult> {
+    // Touch the config file to trigger Traefik re-evaluation
+    const slug = this.domainSlug(domain);
+    const configPath = join(this.configDir, `${slug}.yml`);
+
+    try {
+      const content = await this._readFile(configPath);
+      const updated = content.replace(
+        /^# Auto-generated by Openship.*/,
+        `# Auto-generated by Openship — renewed ${new Date().toISOString()}`,
+      );
+      await this._writeFile(configPath, updated);
+    } catch {
+      // Config file doesn't exist — nothing to renew
+    }
+
+    return this.provisionCert(domain);
+  }
+
+  // ── Helpers ──────────────────────────────────────────────────────────
+
+  /**
+   * Convert a domain to a safe slug for file names and Traefik identifiers.
+   * "my-app.example.com" → "my-app-example-com"
+   */
+  private domainSlug(domain: string): string {
+    return domain.replace(/[^a-zA-Z0-9-]/g, "-").replace(/-+/g, "-");
+  }
+
+  /**
+   * Read certificate info from Traefik's ACME storage file.
+   *
+   * The acme.json file contains all managed certificates. We look for
+   * the one matching the given domain.
+   */
+  private async readCertInfo(domain: string): Promise<SslResult | null> {
+    try {
+      const raw = await this._readFile(this.acmeStoragePath);
+      const storage = JSON.parse(raw);
+
+      // ACME storage structure: { [resolverName]: { Certificates: [...] } }
+      const resolver = storage[this.certResolver];
+      if (!resolver?.Certificates) return null;
+
+      for (const cert of resolver.Certificates) {
+        if (cert.domain?.main === domain || cert.domain?.sans?.includes(domain)) {
+          // Parse the certificate to get expiry
+          // Certificate is base64-encoded PEM
+          const certPem = Buffer.from(cert.certificate, "base64").toString("utf-8");
+          const expiresAt = await this.parseCertExpiry(certPem);
+
+          return {
+            domain,
+            expiresAt: expiresAt ?? "",
+            issuer: this.certResolver,
+          };
+        }
+      }
+
+      return null;
+    } catch {
+      return null;
+    }
+  }
+
+  /**
+   * Extract the expiry date from a PEM certificate.
+   * Uses a simple regex on the date field — avoids heavy crypto deps.
+   */
+  private async parseCertExpiry(pem: string): Promise<string | null> {
+    // For a proper implementation, use node:crypto X509Certificate
+    try {
+      const { X509Certificate } = await import("node:crypto");
+      const cert = new X509Certificate(pem);
+      return new Date(cert.validTo).toISOString();
+    } catch {
+      return null;
+    }
+  }
+}

package/packages/adapters/src/infra/types.ts

@@ -0,0 +1,36 @@
+/**
+ * Infrastructure provider interfaces — routing and SSL.
+ *
+ * Routing and SSL are separate from the runtime because:
+ *   - Docker is a runtime, not a reverse proxy. Traefik/Caddy/Nginx handle routing.
+ *   - SSL is managed by ACME resolvers (Traefik, certbot), not by Docker.
+ *   - Cloud routing uses a completely different mechanism (API calls).
+ *   - Desktop/dev doesn't need routing or SSL at all.
+ *
+ * Implementations:
+ *   - TraefikProvider  → Traefik file provider + ACME (self-hosted)
+ *   - CloudInfra       → Oblien API (cloud)
+ *   - NoopInfra        → No-op (desktop/dev)
+ */
+
+import type { RouteConfig, SslResult } from "../types";
+
+// ─── Routing ─────────────────────────────────────────────────────────────────
+
+export interface RoutingProvider {
+  /** Register a reverse-proxy route (domain → container/process) */
+  registerRoute(route: RouteConfig): Promise<void>;
+
+  /** Remove a reverse-proxy route */
+  removeRoute(domain: string): Promise<void>;
+}
+
+// ─── SSL ─────────────────────────────────────────────────────────────────────
+
+export interface SslProvider {
+  /** Provision a new TLS certificate for a domain */
+  provisionCert(domain: string): Promise<SslResult>;
+
+  /** Renew an existing TLS certificate */
+  renewCert(domain: string): Promise<SslResult>;
+}