stack/packages/webui/src/cli.mjs

#!/usr/bin/env node
// MOSAIC_TESTER_SOCKET_V1: private tester ingress, no tester TCP.
import { createChat } from './chat.mjs';
import { startServer, previewOptions, proofOptions, DEFAULT_BOARD } from './serve.mjs';
import { busCaller } from './bus.mjs';
import { startTesterSocket } from './tester-socket.mjs';
import { TESTER_CLI } from '../../cli/src/transport.mjs';
import { views } from '../../bus/src/views.mjs';
import { loadSystem, socketPath, REPO, rolesDir } from '../../cli/src/config.mjs';
import { configDir } from '../../business/src/business.mjs';
import { consoleReads, redactor } from './reads.mjs';
import { createSso, readSlot } from './sso.mjs';
import { statSync } from 'node:fs';
import { isAbsolute } from 'node:path';
import { ID_PATTERN } from '../../business/src/vocabulary.mjs';
const args = process.argv.slice(2);
const usage = 'node packages/webui/src/cli.mjs serve [--port N] [--tester-socket] [--checkout PATH] [--board http://127.0.0.1:7331] [--business ID] [--sso [--send]] [--public-host NAME --auth-header HEADER --allow-user ID [--send] [--proof-header NAME --proof-file PATH]]';
try {
  if (args.length === 1 && ['--help', '-h'].includes(args[0])) { console.log(usage); process.exit(0); }
  if (args.shift() !== 'serve') throw new Error(usage);
  const options = { board: DEFAULT_BOARD, port: 7330 }, preview = {}, proofFlags = {};
  let sendOn = false, ssoOn = false, testerSocket = false;
  while (args.length) {
    const flag = args.shift();
    // Row 76 (#1570): the one flag without a value.
    if (flag === '--send') { sendOn = true; continue; }
    // Q175 phase 1 (#1690): the Console signs people in itself, from console.sso in config.json.
    if (flag === '--sso') { ssoOn = true; continue; }
    if (flag === '--tester-socket') { testerSocket = true; continue; }
    if (flag === '--tester-port') throw new Error('--tester-port retired; activate explicitly with --tester-socket');
    const value = args.shift();
    if (!value) throw new Error(`missing value for ${flag}`);
    if (flag === '--port') {
      if (!/^\d+$/.test(value) || Number(value) > 65535) throw new Error('port must be 0..65535');
      options.port = Number(value);
    } else if (flag === '--board') options.board = value;
    // Row 77 (#1571): the canonical checkout the queue read runs from, when
    // serve runs from a pinned copy; everything else loads from the copy.
    else if (flag === '--checkout') {
      let dir = false;
      try { dir = isAbsolute(value) && statSync(value).isDirectory(); } catch { /* refused below */ }
      if (!dir) throw new Error('--checkout must be the absolute path of a directory');
      options.checkout = value;
    }
    else if (flag === '--business') {
      if (!ID_PATTERN.test(value)) throw new Error('business must be a business id');
      options.business = value;
    }
    // Row 74 (#1568): the preview mode, all three or none, checked before any config is read.
    else if (flag === '--public-host') preview.publicHost = value;
    else if (flag === '--auth-header') preview.authHeader = value;
    else if (flag === '--allow-user') preview.allowUser = value;
    else if (flag === '--proof-header') proofFlags.proofHeader = value;
    else if (flag === '--proof-file') proofFlags.proofFile = value;
    else throw new Error(`unknown option: ${flag}`);
  }
  if (ssoOn && (Object.keys(preview).length || Object.keys(proofFlags).length)) throw new Error('--sso cannot be combined with --public-host, --auth-header, --allow-user or --proof-*');
  options.preview = previewOptions(preview);
  const proof = proofOptions(proofFlags, options.preview);
  if (sendOn && !options.preview && !ssoOn) throw new Error('--send needs the preview mode (--public-host, --auth-header and --allow-user) or --sso');
  // The bus views (slice 1 S5) need the system config. Without it the
  // board still serves and the bus routes answer not-configured.
  // The Queue, Business and Settings reads (row 54) need no bus; without
  // the system config, Business can't resolve authority and Settings has
  // no notifier. A refusal printed here names no path (redactor).
  // --send without a bus refuses to start rather than serve a composer that can't send.
  let bus = null, send = null, settingsWrite = null, projectFiles = null, projectFile = null, libraryFile = null, libraryStatus = null, librarySync = null, projectSave = null, chat = null, nameWrite = null, assistantStop = null, instancesWrite = null, routesWrite = null, busLine, system = null;
  try {
    system = loadSystem();
    const { dataRoot } = system;
    const call = busCaller({ dataRoot, socket: socketPath(dataRoot), business: options.business ?? null });
    chat = createChat({ call });
    // Row 155 (#1649): `names` is a webui read only, so it sits beside the shared views. Row 165
    // (#1662): so is `instances`, and its write `instances.set` is only under --send. Row 65
    // (mos-0840): so is `routes`, and its write `routes.set`.
    bus = { ...views({ call }), names: () => call('names'), instances: () => call('instances'), routes: () => call('routes') };
    // Row 148: the spec and docs editor reads like the other reads and saves only under --send.
    projectFiles = args => call('project.files', args);
    projectFile = args => call('project.file', args);
    libraryFile = args => call('library.file', args); libraryStatus = args => call('library.status', args);
    if (sendOn) {send = args => call('message.send', args);librarySync=args=>call('library.sync',args);settingsWrite=args=>call('limits.set',args);projectSave=args=>call('project.file.save',args);nameWrite=args=>call('name.set',args);assistantStop=args=>call('assistant.stop',args);instancesWrite=args=>call('instances.set',args);routesWrite=args=>call('routes.set',args);}
    busLine = `Bus: ${options.business ?? 'the running bus host\'s business'}`;
  } catch (err) {
    const why = redactor({ configDir: configDir() })(err.message);
    if (ssoOn) throw new Error(`--sso needs the system config (${why})`);
    if (sendOn) throw new Error(`--send needs the bus configured (${why})`);
    if (testerSocket) throw new Error(`--tester-socket needs the bus configured (${why})`);
    busLine = `Bus: not configured (${why})`;
  }
  const reads = consoleReads({ root: REPO, queueRoot: options.checkout ?? REPO, system, configDir: configDir(), rolesDir: rolesDir(), business: options.business ?? null });
  // The sign-in config is checked again here, then each slot file, before anything listens. A
  // provider that can't be reached starts degraded; one whose discovery is refused stops the start.
  let sso = null;
  if (ssoOn) {
    if (!system.console?.sso) throw new Error('--sso needs console.sso in the system config');
    const secrets = new Map(system.console.sso.providers.map(p => [p.id, readSlot(configDir(), p, { repo: REPO, checkout: options.checkout ?? null })]));
    sso = await createSso(system.console.sso, { secrets });
  }
  let server;
  try {
    server = await startServer({ board: options.board, port: options.port, bus, reads, preview: options.preview, sso, proof, send, settingsWrite, projectFiles, projectFile, libraryFile, libraryStatus, librarySync, projectSave, chat, nameWrite, assistantStop, instancesWrite, routesWrite });
  } catch (err) { sso?.close(); throw err; }
  let testerServer = null;
  if (testerSocket) {
    const call = busCaller({ dataRoot: system.dataRoot, socket: socketPath(system.dataRoot), business: options.business ?? null, cli: TESTER_CLI });
    const testerBus = { ...views({ call }), names: () => call('names'), instances: () => call('instances'), routes: () => call('routes') };
    try {
      testerServer = await startTesterSocket({ dataRoot: system.dataRoot, board: options.board,
        tester: true, testerNoSignIn: ssoOn, testerProofHeader: proof?.header ?? null, testerAuthHeader: options.preview?.header ?? null, bus: testerBus, reads,
        projectFiles: args => call('project.files', args), projectFile: args => call('project.file', args),
        libraryFile: args => call('library.file', args), libraryStatus: args => call('library.status', args),
        instancesWrite: args => call('instances.set', args), routesWrite: args => call('routes.set', args), nameWrite: args => call('name.set', args),
        // Row 177 (#1675): the tester's own chat, through the tester CLI; 7332's stays the human's.
        chat: createChat({ call }),
      });
    } catch (err) { sso?.close(); await new Promise(resolve => server.close(resolve)); throw err; }
  }
  const previewLine = options.preview ? `\nPreview: https://${options.preview.host}/ through the proxy, signed-in user from ${options.preview.header}, ${send ? 'reads and human messages to roles (--send); one line per send below' : 'read-only'}` : '';
  const proofLine = `\nProxy: proxy proof ${proof ? 'on' : 'off'}`;
  // One line per provider: id, issuer, subject count and state. No client id, secret or sub.
  const health = sso?.health() ?? {};
  const ssoLines = sso ? `\nSign-in: ${sso.publicOrigin}/ (--sso), ${send ? 'reads and human writes (--send)' : 'read-only'}` + sso.summary().map(p => `\nSign-in provider: ${p.id} issuer ${p.issuer} subjects ${p.subjects} (${health[p.id]})`).join('') : '';
  const queueLine = options.checkout ? '\nQueue: read from the --checkout directory' : '';
  console.log(`Mosaic Console: http://127.0.0.1:${server.address().port}/\nBoard: ${options.board}\n${busLine}${queueLine}${previewLine}${ssoLines}${proofLine}${testerServer ? `\nTester Console: unix:${testerServer.address()} (binds the tester)` : ''}\nCtrl-C stops this server.`);
  for (const signal of ['SIGINT', 'SIGTERM']) process.once(signal, () => { sso?.close(); server.close(); testerServer?.close(); });
} catch (err) {
  console.error(`refused: ${err.message}`);
  process.exitCode = 2;
}