openship 0.1.1 → 0.1.7

package/packages/adapters/src/index.ts

@@ -1,144 +0,0 @@
-/**
- * @repo/adapters — platform abstraction layer.
- *
- * Three layers, one entry point:
- *   1. Runtime  → build/deploy/stop/start lifecycle (Docker, Bare, Cloud)
- *   2. Infra    → routing (Traefik) + SSL (ACME) — separate from runtime
- *   3. System   → prerequisite checks + setup validation (self-hosted only)
- *
- * The Platform ties them together:
- *   const { runtime, routing, ssl, system } = getPlatform();
- */
-
-// ─── Shared types ────────────────────────────────────────────────────────────
-export type {
-  ResourceConfig,
-  ContainerStatus,
-  BuildStrategy,
-  BuildConfig,
-  DeployConfig,
-  BuildResult,
-  DeploymentResult,
-  BuildStep,
-  LogEntry,
-  LogCallback,
-  ContainerInfo,
-  ResourceUsage,
-  RouteConfig,
-  SslResult,
-  SshConfig,
-  CommandExecutor,
-} from "./types";
-
-export {
-  BUILD_STEPS,
-} from "./types";
-
-export {
-  DEFAULT_RESOURCE_CONFIG,
-  DEFAULT_BUILD_RESOURCE_CONFIG,
-} from "./types";
-
-// ─── Runtime layer ───────────────────────────────────────────────────────────
-export type { RuntimeAdapter, RuntimeCapability } from "./runtime/types";
-export { assertCapability } from "./runtime/types";
-export { DockerRuntime, type DockerConnectionOptions } from "./runtime/docker";
-export { BareRuntime, type BareRuntimeOptions } from "./runtime/bare";
-export { CloudRuntime } from "./runtime/cloud";
-export { BuildLogger } from "./runtime/build-pipeline";
-export {
-  type DeployEnvironment,
-  type DeployRouting,
-  type DeployPipelineInput,
-  type DeployPipelineResult,
-  runDeployPipeline,
-} from "./runtime/deploy-pipeline";
-export {
-  type RuntimeMode,
-  type CreateRuntimeOptions,
-  createRuntime,
-} from "./runtime/index";
-
-// ─── Infrastructure layer ────────────────────────────────────────────────────
-export type { RoutingProvider, SslProvider } from "./infra/types";
-export { TraefikProvider, type TraefikProviderOptions } from "./infra/traefik";
-export { CloudInfraProvider } from "./infra/cloud";
-export { NoopInfraProvider } from "./infra/noop";
-
-// ─── System layer ────────────────────────────────────────────────────────────
-export type {
-  ComponentStatus,
-  Feature,
-  FeatureReadiness,
-  InstallerConfig,
-  InstallResult,
-  PrerequisiteRule,
-  RuntimeMode as SystemRuntimeMode,
-  SystemComponentDefinition,
-  SetupResult,
-  SystemCheckResult,
-  SystemLog,
-  SystemLogCallback,
-} from "./system/types";
-
-export type { SetupState, SetupStateStore, ComponentState } from "./system/state";
-export { FileStateStore } from "./system/state";
-
-export type {
-  EnvironmentProfile,
-  LinuxDistro,
-  SystemArch,
-  SystemOs,
-  SystemPackageManager,
-  SystemServiceManager,
-} from "./system/environment";
-export { resolveEnvironment } from "./system/environment";
-export { systemCatalog } from "./system/catalog";
-export { SYSTEM_COMPONENTS, getSystemComponentDefinition } from "./system/components";
-export {
-  isRemoteConnectionError,
-  isRetryableRemoteConnectionError,
-  isSshAuthError,
-} from "./system/errors";
-
-export { LocalExecutor, SshExecutor, createExecutor } from "./system/executor";
-
-export {
-  checkAll as checkAllComponents,
-  checkComponents,
-  checkDocker,
-  checkGit,
-  checkNode,
-  checkTraefik,
-  COMPONENT_CHECKS,
-} from "./system/checks";
-export {
-  COMPONENT_INSTALLERS,
-  installDocker,
-  installGit,
-  installNode,
-  installTraefik,
-} from "./system/installer";
-export { SystemManager, type SystemManagerOptions } from "./system/setup";
-
-// ─── Toolchain layer ────────────────────────────────────────────────────────
-export type {
-  ToolchainStatus,
-  ToolchainCheckResult,
-  ToolchainCheckEntry,
-  ToolchainInstallPlan,
-  ToolchainInstallResult,
-} from "./toolchain";
-
-export { toolchainCatalog } from "./toolchain";
-export {
-  checkTool,
-  checkTools,
-  checkToolchain,
-  checkToolchainForStack,
-} from "./toolchain";
-export { installTool, installTools } from "./toolchain";
-
-// ─── Platform (top-level entry point) ────────────────────────────────────────
-export type { PlatformTarget, PlatformConfig, Platform } from "./platform";
-export { createPlatform, initPlatform, getPlatform, resetPlatform } from "./platform";

package/packages/adapters/src/infra/cloud.ts

@@ -1,42 +0,0 @@
-/**
- * Cloud infrastructure provider — routing + SSL via Oblien API.
- *
- * All operations are API calls to the Oblien platform. No local reverse
- * proxy or ACME configuration needed.
- */
-
-import { Oblien } from "oblien";
-import type { RouteConfig, SslResult } from "../types";
-import type { RoutingProvider, SslProvider } from "./types";
-
-export class CloudInfraProvider implements RoutingProvider, SslProvider {
-  private readonly client: Oblien;
-
-  constructor(client: Oblien) {
-    this.client = client;
-  }
-
-  // ── Routing ──────────────────────────────────────────────────────────
-
-  async registerRoute(route: RouteConfig): Promise<void> {
-    // TODO: POST /routes to Oblien API
-    void route;
-  }
-
-  async removeRoute(domain: string): Promise<void> {
-    // TODO: DELETE /routes/:domain
-    void domain;
-  }
-
-  // ── SSL ──────────────────────────────────────────────────────────────
-
-  async provisionCert(domain: string): Promise<SslResult> {
-    // TODO: POST /ssl/provision — Oblien manages certs
-    return { domain, expiresAt: "", issuer: "oblien" };
-  }
-
-  async renewCert(domain: string): Promise<SslResult> {
-    // TODO: POST /ssl/renew
-    return { domain, expiresAt: "", issuer: "oblien" };
-  }
-}

package/packages/adapters/src/infra/index.ts

@@ -1,9 +0,0 @@
-/**
- * Infrastructure layer barrel exports.
- */
-
-export type { RoutingProvider, SslProvider } from "./types";
-
-export { TraefikProvider, type TraefikProviderOptions } from "./traefik";
-export { CloudInfraProvider } from "./cloud";
-export { NoopInfraProvider } from "./noop";

package/packages/adapters/src/infra/noop.ts

@@ -1,27 +0,0 @@
-/**
- * No-op infrastructure provider — for desktop and development.
- *
- * Desktop apps and local dev environments don't need reverse proxies
- * or SSL certificates. This provider silently accepts all calls.
- */
-
-import type { RouteConfig, SslResult } from "../types";
-import type { RoutingProvider, SslProvider } from "./types";
-
-export class NoopInfraProvider implements RoutingProvider, SslProvider {
-  async registerRoute(_route: RouteConfig): Promise<void> {
-    // Desktop/dev — no reverse proxy
-  }
-
-  async removeRoute(_domain: string): Promise<void> {
-    // No-op
-  }
-
-  async provisionCert(domain: string): Promise<SslResult> {
-    return { domain, expiresAt: "", issuer: "none" };
-  }
-
-  async renewCert(domain: string): Promise<SslResult> {
-    return { domain, expiresAt: "", issuer: "none" };
-  }
-}

package/packages/adapters/src/infra/traefik.ts

@@ -1,297 +0,0 @@
-/**
- * Traefik infrastructure provider — routing + SSL for self-hosted deployments.
- *
- * Uses Traefik's dynamic file provider: writes YAML config files to a watched
- * directory. Traefik detects changes automatically — no reload needed.
- *
- * SSL is handled by Traefik's built-in ACME resolver (Let's Encrypt). When a
- * route is configured with `tls.certResolver`, Traefik auto-provisions and
- * auto-renews certificates.
- *
- * This provider works with BOTH Docker and Bare runtimes — it's independent
- * of how the application process is managed.
- *
- * Typical Traefik static config (traefik.yml):
- * ```yaml
- * providers:
- *   file:
- *     directory: /etc/traefik/dynamic
- *     watch: true
- *
- * certificatesResolvers:
- *   letsencrypt:
- *     acme:
- *       email: admin@example.com
- *       storage: /etc/traefik/acme.json
- *       httpChallenge:
- *         entryPoint: web
- * ```
- */
-
-import {
-  writeFile as fsWriteFile,
-  rm as fsRm,
-  mkdir as fsMkdir,
-  readFile as fsReadFile,
-} from "node:fs/promises";
-import { dirname, join } from "node:path";
-
-import type { CommandExecutor, RouteConfig, SslResult } from "../types";
-import type { RoutingProvider, SslProvider } from "./types";
-
-// ─── Config ──────────────────────────────────────────────────────────────────
-
-export interface TraefikProviderOptions {
-  /**
-   * Directory where Traefik watches for dynamic config files.
-   * Default: /etc/traefik/dynamic
-   */
-  configDir?: string;
-  /**
-   * ACME certificate resolver name (must match Traefik static config).
-   * Default: "letsencrypt"
-   */
-  certResolver?: string;
-  /**
-   * Path to Traefik's ACME storage file (for reading cert info).
-   * Default: /etc/traefik/acme.json
-   */
-  acmeStoragePath?: string;
-  /**
-   * Command executor for file operations.
-   *
-   * When provided, all file reads/writes go through the executor
-   * (supporting remote servers via SSH). When omitted, uses node:fs
-   * directly (local server).
-   *
-   * This is what enables the dual-path: same TraefikProvider, same
-   * config format, works both locally and remotely.
-   */
-  executor?: CommandExecutor;
-}
-
-const DEFAULT_CONFIG_DIR = "/etc/traefik/dynamic";
-const DEFAULT_CERT_RESOLVER = "letsencrypt";
-const DEFAULT_ACME_STORAGE = "/etc/traefik/acme.json";
-
-// ─── Implementation ──────────────────────────────────────────────────────────
-
-/**
- * Traefik-based routing and SSL provider.
- *
- * Implements both RoutingProvider and SslProvider since Traefik handles
- * both concerns through its dynamic configuration.
- */
-export class TraefikProvider implements RoutingProvider, SslProvider {
-  private readonly configDir: string;
-  private readonly certResolver: string;
-  private readonly acmeStoragePath: string;
-  private readonly executor: CommandExecutor | null;
-
-  constructor(opts?: TraefikProviderOptions) {
-    this.configDir = opts?.configDir ?? DEFAULT_CONFIG_DIR;
-    this.certResolver = opts?.certResolver ?? DEFAULT_CERT_RESOLVER;
-    this.acmeStoragePath = opts?.acmeStoragePath ?? DEFAULT_ACME_STORAGE;
-    this.executor = opts?.executor ?? null;
-  }
-
-  // ── File operation helpers (dual-path: local or remote) ──────────────
-
-  private async _writeFile(path: string, content: string): Promise<void> {
-    if (this.executor) {
-      await this.executor.writeFile(path, content);
-    } else {
-      await fsMkdir(dirname(path), { recursive: true });
-      await fsWriteFile(path, content, "utf-8");
-    }
-  }
-
-  private async _readFile(path: string): Promise<string> {
-    if (this.executor) {
-      return this.executor.readFile(path);
-    }
-    return fsReadFile(path, "utf-8");
-  }
-
-  private async _rm(path: string): Promise<void> {
-    if (this.executor) {
-      await this.executor.rm(path);
-    } else {
-      try {
-        await fsRm(path);
-      } catch {
-        // Already gone
-      }
-    }
-  }
-
-  private async _mkdir(path: string): Promise<void> {
-    if (this.executor) {
-      await this.executor.mkdir(path);
-    } else {
-      await fsMkdir(path, { recursive: true });
-    }
-  }
-
-  // ── Routing ──────────────────────────────────────────────────────────
-
-  /**
-   * Register a route by writing a Traefik dynamic config file.
-   *
-   * Creates a YAML file in the watched directory. Traefik picks it up
-   * automatically within seconds.
-   */
-  async registerRoute(route: RouteConfig): Promise<void> {
-    await this._mkdir(this.configDir);
-
-    const slug = this.domainSlug(route.domain);
-    const configPath = join(this.configDir, `${slug}.yml`);
-
-    // Build Traefik dynamic configuration YAML
-    const tlsBlock = route.tls
-      ? `\n      tls:\n        certResolver: ${this.certResolver}`
-      : "";
-
-    const yaml = `# Auto-generated by Openship — do not edit manually
-http:
-  routers:
-    ${slug}:
-      rule: "Host(\`${route.domain}\`)"
-      service: ${slug}
-      entryPoints:
-        - websecure${tlsBlock}
-  services:
-    ${slug}:
-      loadBalancer:
-        servers:
-          - url: "${route.targetUrl}"
-`;
-
-    await this._writeFile(configPath, yaml);
-  }
-
-  /**
-   * Remove a route by deleting its config file.
-   * Traefik detects the removal and drops the route.
-   */
-  async removeRoute(domain: string): Promise<void> {
-    const slug = this.domainSlug(domain);
-    const configPath = join(this.configDir, `${slug}.yml`);
-    await this._rm(configPath);
-  }
-
-  // ── SSL ──────────────────────────────────────────────────────────────
-
-  /**
-   * Provision a TLS certificate for a domain.
-   *
-   * With Traefik + ACME, certificate provisioning is automatic when a route
-   * has `tls.certResolver` configured. This method ensures the route exists
-   * with TLS enabled and returns cert info from ACME storage.
-   */
-  async provisionCert(domain: string): Promise<SslResult> {
-    // The route should already have TLS enabled via registerRoute().
-    // Traefik handles ACME challenge + cert issuance automatically.
-    // We check the ACME storage for cert info.
-    const certInfo = await this.readCertInfo(domain);
-
-    if (certInfo) {
-      return certInfo;
-    }
-
-    // Cert not yet available — Traefik is still provisioning.
-    // Return a pending result; the caller can poll.
-    return {
-      domain,
-      expiresAt: "",
-      issuer: this.certResolver,
-    };
-  }
-
-  /**
-   * Renew a TLS certificate.
-   *
-   * Traefik auto-renews certificates 30 days before expiry. This method
-   * is effectively a check + trigger: it touches the route config to ensure
-   * Traefik re-evaluates the cert.
-   */
-  async renewCert(domain: string): Promise<SslResult> {
-    // Touch the config file to trigger Traefik re-evaluation
-    const slug = this.domainSlug(domain);
-    const configPath = join(this.configDir, `${slug}.yml`);
-
-    try {
-      const content = await this._readFile(configPath);
-      const updated = content.replace(
-        /^# Auto-generated by Openship.*/,
-        `# Auto-generated by Openship — renewed ${new Date().toISOString()}`,
-      );
-      await this._writeFile(configPath, updated);
-    } catch {
-      // Config file doesn't exist — nothing to renew
-    }
-
-    return this.provisionCert(domain);
-  }
-
-  // ── Helpers ──────────────────────────────────────────────────────────
-
-  /**
-   * Convert a domain to a safe slug for file names and Traefik identifiers.
-   * "my-app.example.com" → "my-app-example-com"
-   */
-  private domainSlug(domain: string): string {
-    return domain.replace(/[^a-zA-Z0-9-]/g, "-").replace(/-+/g, "-");
-  }
-
-  /**
-   * Read certificate info from Traefik's ACME storage file.
-   *
-   * The acme.json file contains all managed certificates. We look for
-   * the one matching the given domain.
-   */
-  private async readCertInfo(domain: string): Promise<SslResult | null> {
-    try {
-      const raw = await this._readFile(this.acmeStoragePath);
-      const storage = JSON.parse(raw);
-
-      // ACME storage structure: { [resolverName]: { Certificates: [...] } }
-      const resolver = storage[this.certResolver];
-      if (!resolver?.Certificates) return null;
-
-      for (const cert of resolver.Certificates) {
-        if (cert.domain?.main === domain || cert.domain?.sans?.includes(domain)) {
-          // Parse the certificate to get expiry
-          // Certificate is base64-encoded PEM
-          const certPem = Buffer.from(cert.certificate, "base64").toString("utf-8");
-          const expiresAt = await this.parseCertExpiry(certPem);
-
-          return {
-            domain,
-            expiresAt: expiresAt ?? "",
-            issuer: this.certResolver,
-          };
-        }
-      }
-
-      return null;
-    } catch {
-      return null;
-    }
-  }
-
-  /**
-   * Extract the expiry date from a PEM certificate.
-   * Uses a simple regex on the date field — avoids heavy crypto deps.
-   */
-  private async parseCertExpiry(pem: string): Promise<string | null> {
-    // For a proper implementation, use node:crypto X509Certificate
-    try {
-      const { X509Certificate } = await import("node:crypto");
-      const cert = new X509Certificate(pem);
-      return new Date(cert.validTo).toISOString();
-    } catch {
-      return null;
-    }
-  }
-}

package/packages/adapters/src/infra/types.ts

@@ -1,36 +0,0 @@
-/**
- * Infrastructure provider interfaces — routing and SSL.
- *
- * Routing and SSL are separate from the runtime because:
- *   - Docker is a runtime, not a reverse proxy. Traefik/Caddy/Nginx handle routing.
- *   - SSL is managed by ACME resolvers (Traefik, certbot), not by Docker.
- *   - Cloud routing uses a completely different mechanism (API calls).
- *   - Desktop/dev doesn't need routing or SSL at all.
- *
- * Implementations:
- *   - TraefikProvider  → Traefik file provider + ACME (self-hosted)
- *   - CloudInfra       → Oblien API (cloud)
- *   - NoopInfra        → No-op (desktop/dev)
- */
-
-import type { RouteConfig, SslResult } from "../types";
-
-// ─── Routing ─────────────────────────────────────────────────────────────────
-
-export interface RoutingProvider {
-  /** Register a reverse-proxy route (domain → container/process) */
-  registerRoute(route: RouteConfig): Promise<void>;
-
-  /** Remove a reverse-proxy route */
-  removeRoute(domain: string): Promise<void>;
-}
-
-// ─── SSL ─────────────────────────────────────────────────────────────────────
-
-export interface SslProvider {
-  /** Provision a new TLS certificate for a domain */
-  provisionCert(domain: string): Promise<SslResult>;
-
-  /** Renew an existing TLS certificate */
-  renewCert(domain: string): Promise<SslResult>;
-}