spinuptui 0.19.0

package/src/lib/discover.ts

@@ -0,0 +1,165 @@
+// Local working-copy auto-discovery — Phase 2.
+//
+// Given the user's configured scan roots (directories where they keep local
+// copies), enumerate the immediate subdirectories and try to match each to a
+// SpinupWP site, most-reliable signal first:
+//   1. git remote   — local `.git/config` origin URL vs the site's `git.repo`
+//   2. WP_HOME       — a Bedrock `.env`'s WP_HOME host vs the site's domain(s)
+//   3. folder name   — the directory name vs the site's domain
+// Read-only: we read a couple of small marker files, never write or run git.
+// Matches to already-linked sites are skipped (this proposes *new* links).
+
+import { homedir } from "node:os"
+import { join } from "node:path"
+import { existsSync, readFileSync } from "node:fs"
+import { readdir, stat } from "node:fs/promises"
+import { findProjectRoot } from "./local.ts"
+import type { Site } from "../api/types.ts"
+
+export type Confidence = "high" | "medium" | "low"
+
+export interface Proposal {
+  // Path as it will be stored on the link (root form preserved, e.g. with `~`).
+  path: string
+  site: Site
+  reason: string
+  confidence: Confidence
+  // Local URL discovered from WP_HOME, if any — prefilled onto the link.
+  localUrl?: string
+}
+
+export interface ScanResult {
+  proposals: Proposal[]
+  scannedDirs: number
+}
+
+function expand(path: string): string {
+  if (path === "~") return homedir()
+  if (path.startsWith("~/")) return join(homedir(), path.slice(2))
+  return path
+}
+
+// Normalize a git URL to `host/org/repo` (lowercased, no protocol/user/.git) so
+// scp-style and https forms of the same repo compare equal.
+export function normalizeGitUrl(url: string | null | undefined): string | null {
+  if (!url) return null
+  let s = url.trim().toLowerCase()
+  if (!s) return null
+  s = s.replace(/^ssh:\/\//, "").replace(/^https?:\/\//, "").replace(/^git@/, "")
+  s = s.replace(/\.git$/, "")
+  s = s.replace(":", "/") // scp-style host:org/repo → host/org/repo
+  return s || null
+}
+
+// Pull the origin remote URL out of a local `.git/config` (no subprocess).
+function gitOriginUrl(dir: string): string | null {
+  const cfg = join(dir, ".git", "config")
+  if (!existsSync(cfg)) return null
+  try {
+    const text = readFileSync(cfg, "utf8")
+    // Find the [remote "origin"] section, then its first `url = …`.
+    const m = text.match(/\[remote "origin"\]([\s\S]*?)(?:\n\[|$)/)
+    const url = m?.[1].match(/url\s*=\s*(.+)/)?.[1]
+    return url?.trim() ?? null
+  } catch {
+    return null
+  }
+}
+
+// Read WP_HOME from a Bedrock-style `.env`. Returns the full URL string.
+function wpHome(dir: string): string | null {
+  const env = join(dir, ".env")
+  if (!existsSync(env)) return null
+  try {
+    const line = readFileSync(env, "utf8").match(/^\s*WP_HOME\s*=\s*(.+)$/m)?.[1]
+    if (!line) return null
+    return line.trim().replace(/^['"]|['"]$/g, "") || null
+  } catch {
+    return null
+  }
+}
+
+function hostOf(url: string): string | null {
+  try {
+    return new URL(url).host.toLowerCase() || null
+  } catch {
+    return null
+  }
+}
+
+// Every domain a site answers to (primary + additional), lowercased.
+function siteDomains(site: Site): string[] {
+  const out = [site.domain.toLowerCase()]
+  for (const d of site.additional_domains ?? []) if (d.domain) out.push(d.domain.toLowerCase())
+  return out
+}
+
+export async function scanRoots(roots: string[], sites: Site[], linkedSiteIds: Set<number>): Promise<ScanResult> {
+  // Index unlinked sites by their matchable signals.
+  const candidates = sites.filter((s) => !linkedSiteIds.has(s.id))
+  const byGit = new Map<string, Site>()
+  const byDomain = new Map<string, Site>()
+  for (const s of candidates) {
+    const g = normalizeGitUrl(s.git?.repo)
+    if (g && !byGit.has(g)) byGit.set(g, s)
+    for (const d of siteDomains(s)) if (!byDomain.has(d)) byDomain.set(d, s)
+  }
+
+  const proposals: Proposal[] = []
+  const claimed = new Set<number>() // a site is proposed at most once
+  let scannedDirs = 0
+
+  for (const root of roots) {
+    const abs = expand(root)
+    let entries: string[]
+    try {
+      entries = await readdir(abs)
+    } catch {
+      continue // unreadable/missing root — skip
+    }
+    for (const name of entries) {
+      if (name.startsWith(".")) continue
+      const absDir = join(abs, name)
+      try {
+        if (!(await stat(absDir)).isDirectory()) continue
+      } catch {
+        continue
+      }
+      scannedDirs++
+      // Store the plain project folder (what the user recognizes; they cd from
+      // there). Read the matching signals from its detected root, which may be a
+      // nested subdir (app/, public/, …) — found by markers, not by name.
+      const storedPath = join(root, name) // preserve the root's form (e.g. `~`)
+      const projDir = findProjectRoot(absDir)
+      const home = wpHome(projDir)
+      const localUrl = home ?? undefined
+
+      // 1) git remote
+      const g = normalizeGitUrl(gitOriginUrl(projDir))
+      let match: { site: Site; reason: string; confidence: Confidence } | null = null
+      if (g && byGit.has(g)) {
+        match = { site: byGit.get(g)!, reason: "git remote", confidence: "high" }
+      } else if (home) {
+        // 2) WP_HOME host
+        const host = hostOf(home)
+        if (host && byDomain.has(host)) match = { site: byDomain.get(host)!, reason: "WP_HOME", confidence: "high" }
+      }
+      // 3) folder name == a domain (or its first label)
+      if (!match) {
+        const base = name.toLowerCase()
+        const site =
+          byDomain.get(base) ?? candidates.find((s) => siteDomains(s).some((d) => d.split(".")[0] === base))
+        if (site) match = { site, reason: "folder name", confidence: "low" }
+      }
+
+      if (match && !claimed.has(match.site.id)) {
+        claimed.add(match.site.id)
+        proposals.push({ path: storedPath, site: match.site, reason: match.reason, confidence: match.confidence, localUrl })
+      }
+    }
+  }
+
+  // Alphabetical by domain (the user scans this list by site name).
+  proposals.sort((a, b) => a.site.domain.localeCompare(b.site.domain))
+  return { proposals, scannedDirs }
+}

package/src/lib/dns.ts

@@ -0,0 +1,144 @@
+// DNS zone-host detection (read-only). Answers "where is this domain's DNS zone
+// hosted?" — the signal a developer needs when migrating or cloning a site and
+// has to inventory every domain's DNS host.
+//
+// No `dig` dependency: uses Node's built-in resolver (node:dns) pointed at public
+// resolvers, so it works the same regardless of the machine's local DNS setup.
+//
+// The unit is the ZONE, not the hostname. DNS host is a property of the zone
+// apex's NS records, so we WALK UP: query NS on the name; on ENODATA/NXDOMAIN
+// (e.g. `www` is just a CNAME in the parent zone) strip the leftmost label and
+// retry. The first label that returns NS records IS the zone apex — no Public
+// Suffix List needed, and it's robust to multi-label TLDs (.co.uk).
+
+import { Resolver } from "node:dns/promises"
+
+export interface ZoneHost {
+  apex: string // the zone apex the NS records live at (e.g. "example.com")
+  nameservers: string[] // authoritative NS hostnames, lowercased + sorted
+  providerKey: string // stable key for the host (e.g. "route53"); editable later: route53 | cloudflare
+  providerLabel: string // human label (e.g. "AWS Route 53")
+}
+
+// Query public resolvers so results don't depend on the local resolver / VPN.
+const PUBLIC_RESOLVERS = ["1.1.1.1", "8.8.8.8"]
+
+function makeResolver(): Resolver {
+  const r = new Resolver({ timeout: 5000, tries: 2 })
+  try {
+    r.setServers(PUBLIC_RESOLVERS)
+  } catch {
+    // Fall back to the system resolver if the servers can't be set.
+  }
+  return r
+}
+
+// Lowercase, drop a trailing dot and a leading "www." — `www` is never its own
+// zone, so collapsing it here means www + apex share one lookup and one cache key.
+export function normalizeDomain(domain: string): string {
+  return domain.trim().toLowerCase().replace(/\.$/, "").replace(/^www\./, "")
+}
+
+// The website-hosting hostnames for a set of configured site domains: each domain
+// plus its sibling apex/www variant — the records that "count" in a server
+// migration (apex A + www CNAME/A + each additional domain). Lowercased + deduped.
+// Unlike normalizeDomain this does NOT collapse www: www is its own record here.
+export function candidateHostnames(domains: string[]): string[] {
+  const set = new Set<string>()
+  for (const raw of domains) {
+    const d = raw.trim().toLowerCase().replace(/\.$/, "")
+    if (!d || !d.includes(".")) continue
+    set.add(d)
+    if (d.startsWith("www.")) set.add(d.slice(4))
+    else set.add("www." + d)
+  }
+  return [...set]
+}
+
+// The next zone candidate up. Returns null once only a single-label TLD remains
+// (so a dead/unregistered domain can't walk all the way up to the TLD's servers).
+function parentDomain(name: string): string | null {
+  const i = name.indexOf(".")
+  if (i === -1) return null
+  const parent = name.slice(i + 1)
+  return parent.includes(".") ? parent : null
+}
+
+// Resolve the authoritative DNS host for a domain's zone. Returns null when no NS
+// records can be found at or above the domain (unregistered, lookup failed, etc.).
+export async function resolveZone(input: string): Promise<ZoneHost | null> {
+  const start = normalizeDomain(input)
+  if (!start || !start.includes(".")) return null
+  const resolver = makeResolver()
+  let name: string | null = start
+  while (name && name.includes(".")) {
+    try {
+      const ns = await resolver.resolveNs(name)
+      if (ns && ns.length > 0) {
+        const nameservers = ns.map((n) => n.toLowerCase().replace(/\.$/, "")).sort()
+        const { key, label } = labelForNameservers(nameservers)
+        return { apex: name, nameservers, providerKey: key, providerLabel: label }
+      }
+    } catch {
+      // ENODATA / ENOTFOUND / timeout → the zone is higher up; try the parent.
+    }
+    name = parentDomain(name)
+  }
+  return null
+}
+
+interface ProviderEntry {
+  match: string // lowercase substring tested against each nameserver hostname
+  key: string
+  label: string
+}
+
+// Curated nameserver → host map for the common providers. `route53` and
+// `cloudflare` are the ones a later editing phase can write to; the rest are
+// label-only.
+//
+// PRINCIPLE: only curate a host when the NS pattern maps to ONE broadly-recognized
+// brand (Cloudflare, Route 53, GoDaddy…). For white-label / reseller platforms
+// where a single NS domain is resold under many brands (e.g. orderbox-dns.com →
+// ResellerClub / BigRock / …), DON'T curate — the fallback's nameserver-domain
+// label ("orderbox-dns.com") is the most honest, universal, and actionable signal.
+// A wrong brand label is worse than the raw domain. Extend with single-brand hosts.
+const PROVIDERS: ProviderEntry[] = [
+  { match: "awsdns", key: "route53", label: "AWS Route 53" },
+  { match: "cloudflare.com", key: "cloudflare", label: "Cloudflare" },
+  { match: "domaincontrol.com", key: "godaddy", label: "GoDaddy" },
+  { match: "registrar-servers.com", key: "namecheap", label: "Namecheap" },
+  { match: "nsone.net", key: "ns1", label: "NS1" },
+  { match: "dnsmadeeasy.com", key: "dnsme", label: "DNS Made Easy" },
+  { match: "digitalocean.com", key: "digitalocean", label: "DigitalOcean" },
+  { match: "ns-cloud-", key: "google", label: "Google Cloud DNS" },
+  { match: "googledomains.com", key: "google", label: "Google Domains" },
+  { match: "worldnic.com", key: "netsol", label: "Network Solutions" },
+  { match: "dreamhost.com", key: "dreamhost", label: "DreamHost" },
+  { match: "name-services.com", key: "enom", label: "eNom" },
+  { match: "azure-dns", key: "azure", label: "Azure DNS" },
+  { match: "wpengine.com", key: "wpengine", label: "WP Engine" },
+  { match: "linode.com", key: "linode", label: "Linode" },
+  { match: "vultr.com", key: "vultr", label: "Vultr" },
+]
+
+// Map a set of nameservers to a host label. Falls back to the registrable domain
+// of the nameserver itself (e.g. ns1.somehost.net → "somehost.net"), so even an
+// uncurated provider yields exactly the signal you'd write in an inventory.
+export function labelForNameservers(ns: string[]): { key: string; label: string } {
+  for (const host of ns) {
+    for (const p of PROVIDERS) {
+      if (host.includes(p.match)) return { key: p.key, label: p.label }
+    }
+  }
+  const reg = registrableOf(ns[0] ?? "")
+  return reg ? { key: reg, label: reg } : { key: "unknown", label: "Unknown" }
+}
+
+// Naive registrable domain (last two labels) — good enough for the fallback label
+// since nameserver hostnames are almost always provider.tld style.
+function registrableOf(host: string): string {
+  const parts = host.replace(/\.$/, "").split(".").filter(Boolean)
+  if (parts.length <= 2) return parts.join(".")
+  return parts.slice(-2).join(".")
+}

package/src/lib/dnsCache.ts

@@ -0,0 +1,94 @@
+// Disk-backed cache for DNS zone-host lookups, keyed by normalized domain.
+//
+// Modeled on stackCache.ts (same hydrate-on-startup / write-through lifecycle).
+// DNS host rarely changes — except during the very migration you're using this
+// for — so entries are time-stamped: the UI shows the age and offers a refresh,
+// and a 24h staleness window keeps long-lived caches honest across launches.
+//
+// Keyed by the NORMALIZED domain (www-stripped, lowercased) rather than the zone
+// apex, so a lookup can hit the cache WITHOUT a network round-trip (we can't know
+// a domain's apex until we resolve it). www + apex share one key; a separate
+// subdomain that happens to share a zone just stores a duplicate entry — cheap.
+
+import { join } from "node:path"
+import { existsSync, readFileSync } from "node:fs"
+import { chmod, mkdir } from "node:fs/promises"
+import { configDir } from "../config.ts"
+import type { ZoneHost } from "./dns.ts"
+
+const CACHE_VERSION = 1
+const STALE_MS = 24 * 60 * 60 * 1000 // 24h
+
+export interface CachedDns {
+  zone: ZoneHost | null // null = looked up, no host found (unregistered / unresolvable)
+  checkedAt: number // epoch ms
+}
+
+interface CacheFile {
+  version: number
+  entries: Record<string, CachedDns> // key: normalized domain
+}
+
+export function dnsCachePath(): string {
+  return join(configDir(), "dns-cache.json")
+}
+
+export class DnsCache {
+  private entries = new Map<string, CachedDns>()
+  // Serializes writes so concurrent batch lookups can't tear the file.
+  private writeChain: Promise<void> = Promise.resolve()
+
+  // Read the cache file into memory. Never throws — a missing/corrupt file yields
+  // an empty cache.
+  load(): void {
+    try {
+      const path = dnsCachePath()
+      if (!existsSync(path)) return
+      const parsed = JSON.parse(readFileSync(path, "utf8")) as CacheFile
+      if (parsed?.version !== CACHE_VERSION || !parsed.entries) return
+      for (const [k, v] of Object.entries(parsed.entries)) {
+        if (k && v && typeof v.checkedAt === "number") this.entries.set(k, v)
+      }
+    } catch {
+      /* ignore corrupt/unreadable cache — start empty */
+    }
+  }
+
+  get(key: string): CachedDns | undefined {
+    return this.entries.get(key)
+  }
+
+  isStale(key: string): boolean {
+    const e = this.entries.get(key)
+    return e == null || Date.now() - e.checkedAt > STALE_MS
+  }
+
+  // Upsert a lookup result and persist immediately (write-through).
+  async set(key: string, zone: ZoneHost | null): Promise<void> {
+    this.entries.set(key, { zone, checkedAt: Date.now() })
+    await this.persist()
+  }
+
+  // A copy of all entries (for rendering without exposing the map).
+  snapshot(): Map<string, CachedDns> {
+    return new Map(this.entries)
+  }
+
+  private persist(): Promise<void> {
+    this.writeChain = this.writeChain.then(() => this.writeFile()).catch(() => {})
+    return this.writeChain
+  }
+
+  private async writeFile(): Promise<void> {
+    await mkdir(configDir(), { recursive: true })
+    const file: CacheFile = { version: CACHE_VERSION, entries: {} }
+    for (const [k, entry] of this.entries) file.entries[k] = entry
+    const path = dnsCachePath()
+    await Bun.write(path, JSON.stringify(file, null, 2) + "\n")
+    try {
+      await chmod(path, 0o600)
+    } catch {
+      /* best-effort on filesystems without POSIX perms */
+    }
+  }
+}

package/src/lib/dnsQuery.ts

@@ -0,0 +1,180 @@
+// Minimal DNS query over UDP (node:dgram) — no `dig`, no deps. It exists to get
+// the one thing node's resolver can't: the TTL of ANY record type (notably CNAME)
+// as CONFIGURED. We query a zone's AUTHORITATIVE nameserver directly, so the answer
+// carries the full, non-decremented TTL (a recursive resolver hands back a
+// counted-down value, which is misleading for a migration). Same hand-rolled
+// spirit as awsSigV4.ts — we implement just enough of the protocol.
+//
+// Scope: A / AAAA / CNAME rdata are parsed for real (the website-hosting records
+// the DNS inventory shows); MX / TXT are parsed for display; anything else returns
+// its type + TTL with a placeholder value. Name compression pointers are handled.
+
+import { createSocket } from "node:dgram"
+import { isIP } from "node:net"
+import { Resolver } from "node:dns/promises"
+
+export interface DnsAnswer {
+  name: string
+  type: string // "A" | "AAAA" | "CNAME" | "MX" | "TXT" | numeric string
+  ttl: number
+  value: string
+}
+
+export type QueryType = "A" | "AAAA" | "CNAME" | "MX" | "TXT" | "NS"
+
+const TYPE_NUM: Record<QueryType, number> = { A: 1, NS: 2, CNAME: 5, MX: 15, TXT: 16, AAAA: 28 }
+const NUM_TYPE: Record<number, string> = { 1: "A", 2: "NS", 5: "CNAME", 6: "SOA", 15: "MX", 16: "TXT", 28: "AAAA" }
+const TIMEOUT_MS = 4000
+
+function encodeName(name: string): Buffer {
+  const parts = name.replace(/\.$/, "").split(".").filter(Boolean)
+  const bufs = parts.map((p) => {
+    const b = Buffer.from(p, "ascii")
+    return Buffer.concat([Buffer.from([b.length]), b])
+  })
+  return Buffer.concat([...bufs, Buffer.from([0])])
+}
+
+function buildQuery(name: string, type: number): { id: number; buf: Buffer } {
+  const id = Math.floor(Math.random() * 65536)
+  const header = Buffer.alloc(12)
+  header.writeUInt16BE(id, 0)
+  header.writeUInt16BE(0x0100, 2) // standard query, recursion desired
+  header.writeUInt16BE(1, 4) // QDCOUNT = 1
+  const tail = Buffer.alloc(4)
+  tail.writeUInt16BE(type, 0)
+  tail.writeUInt16BE(1, 2) // QCLASS = IN
+  return { id, buf: Buffer.concat([header, encodeName(name), tail]) }
+}
+
+// Read a (possibly compressed) name starting at `offset`. `next` is where reading
+// continues AFTER the name in the original stream (compression pointers don't
+// advance it past the 2-byte pointer).
+function readName(buf: Buffer, offset: number): { name: string; next: number } {
+  const labels: string[] = []
+  let i = offset
+  let jumped = false
+  let next = offset
+  let guard = 0
+  while (guard++ < 128) {
+    const len = buf[i]
+    if (len === 0) {
+      i++
+      if (!jumped) next = i
+      break
+    }
+    if ((len & 0xc0) === 0xc0) {
+      const ptr = ((len & 0x3f) << 8) | buf[i + 1]
+      if (!jumped) next = i + 2
+      i = ptr
+      jumped = true
+      continue
+    }
+    labels.push(buf.toString("ascii", i + 1, i + 1 + len))
+    i += 1 + len
+  }
+  return { name: labels.join("."), next }
+}
+
+function parseAnswers(buf: Buffer): DnsAnswer[] {
+  const qd = buf.readUInt16BE(4)
+  const an = buf.readUInt16BE(6)
+  let off = 12
+  for (let q = 0; q < qd; q++) {
+    const r = readName(buf, off)
+    off = r.next + 4 // skip QTYPE + QCLASS
+  }
+  const answers: DnsAnswer[] = []
+  for (let a = 0; a < an && off < buf.length; a++) {
+    const r = readName(buf, off)
+    off = r.next
+    const type = buf.readUInt16BE(off)
+    off += 2 // TYPE
+    off += 2 // CLASS
+    const ttl = buf.readUInt32BE(off)
+    off += 4
+    const rdlen = buf.readUInt16BE(off)
+    off += 2
+    const rdStart = off
+    let value = ""
+    if (type === 1 && rdlen === 4) {
+      value = `${buf[off]}.${buf[off + 1]}.${buf[off + 2]}.${buf[off + 3]}`
+    } else if (type === 28 && rdlen === 16) {
+      const segs: string[] = []
+      for (let k = 0; k < 16; k += 2) segs.push(buf.readUInt16BE(off + k).toString(16))
+      value = segs.join(":")
+    } else if (type === 5) {
+      value = readName(buf, off).name
+    } else if (type === 15) {
+      value = `${buf.readUInt16BE(off)} ${readName(buf, off + 2).name}`
+    } else if (type === 16) {
+      let p = off
+      const chunks: string[] = []
+      while (p < off + rdlen) {
+        const l = buf[p]
+        chunks.push(buf.toString("ascii", p + 1, p + 1 + l))
+        p += 1 + l
+      }
+      value = chunks.join("")
+    } else {
+      value = `(${rdlen}b)`
+    }
+    off = rdStart + rdlen
+    answers.push({ name: r.name, type: NUM_TYPE[type] ?? String(type), ttl, value })
+  }
+  return answers
+}
+
+// Resolve a nameserver hostname to an IP (via public resolvers), or pass an IP
+// through unchanged.
+async function nsIp(nsHost: string): Promise<string | null> {
+  if (isIP(nsHost)) return nsHost
+  try {
+    const r = new Resolver({ timeout: TIMEOUT_MS, tries: 1 })
+    r.setServers(["1.1.1.1", "8.8.8.8"])
+    const a = await r.resolve4(nsHost)
+    return a[0] ?? null
+  } catch {
+    return null
+  }
+}
+
+function queryOnce(serverIp: string, host: string, type: number): Promise<DnsAnswer[]> {
+  return new Promise((resolve, reject) => {
+    const { id, buf } = buildQuery(host, type)
+    const sock = createSocket(isIP(serverIp) === 6 ? "udp6" : "udp4")
+    const done = (err: Error | null, ans?: DnsAnswer[]) => {
+      clearTimeout(timer)
+      try {
+        sock.close()
+      } catch {
+        /* already closed */
+      }
+      err ? reject(err) : resolve(ans!)
+    }
+    const timer = setTimeout(() => done(new Error("DNS query timed out")), TIMEOUT_MS)
+    sock.on("message", (msg) => {
+      if (msg.length < 12 || msg.readUInt16BE(0) !== id) return done(new Error("DNS id mismatch"))
+      try {
+        done(null, parseAnswers(msg))
+      } catch (e) {
+        done(e as Error)
+      }
+    })
+    sock.on("error", (e) => done(e))
+    sock.send(buf, 53, serverIp)
+  })
+}
+
+// Query a record at the zone's authoritative nameservers (first that answers).
+// Returns the full answer section (a CNAME chain may include several records), or
+// null when none of the nameservers respond.
+export async function queryAuthoritative(host: string, type: QueryType, nameservers: string[]): Promise<DnsAnswer[] | null> {
+  for (const ns of nameservers) {
+    const ip = await nsIp(ns)
+    if (!ip) continue
+    const ans = await queryOnce(ip, host, TYPE_NUM[type]).catch(() => null)
+    if (ans) return ans
+  }
+  return null
+}