@auersperg/flare 0.3.2 → 0.3.5

package/README.md

@@ -63,7 +63,7 @@ flare deploy --env dev --release release
 
 Immutable output contains facet/action modules, `schema.json`, manifest, checksums, generated TypeScript API and OpenAPI 3.1. Only ABI 4 is accepted. No old `tables` declarations, `--migrations` flag or Drizzle pipeline.
 
-Browser approval is protected by online Access/owner authorization and same-origin CSRF. Project-scoped credentials stay outside source/frontend env. Dev publishes to an already provisioned platform; general `platform init` is not implemented. No npm publication or cloud provisioning occurs during local verification.
+Browser approval is protected by online Access/owner authorization and same-origin CSRF. Project-scoped credentials stay outside source/frontend env. Dev publishes to an already provisioned platform. Source 0.3.5 includes `platform install|status|update|adopt` plus a checksummed Core/dashboard payload, with separate Cloudflare account authorization; see [platform lifecycle](../../docs/platform-lifecycle.md). Disposable install/recovery and genuine 0.3.3 → 0.3.4 / 0.3.4 → 0.3.5 upgrades passed in the owner’s Cloudflare account. The existing personal panel also passed explicit external compiled-CLI adoption, preserving data/auth/files and namespace identities. This remains a trusted-team preview; independent-account acceptance with a full-scope platform CLI token is not yet complete. Check the registry for exact-version availability rather than assuming a moving tag contains the platform commands. No npm publication or cloud provisioning occurs during local verification.
 
 ## Immutable releases
 
@@ -80,6 +80,8 @@ Promote copies the selected immutable dev bundle to prod without recompiling or
 
 `--cmd` generates client references for the exact selected bundle and builds the frontend **before** activating the backend. The child receives the selected environment URL via `FLARE_URL`, `PUBLIC_FLARE_URL`, `VITE_FLARE_URL`, `NEXT_PUBLIC_FLARE_URL` and `EXPO_PUBLIC_FLARE_URL`; local dev env files remain unchanged. A failed build does not publish backend code. Framework build variables must be public URLs, not credentials.
 
+Every CLI deploy compares the expected active backend hash, including without `--cmd`; conflicts are not retried. A failed frontend build restores the previous generated `api.ts`/`references.ts` (or their absence). Invalid/unconfirmed deployments do not scaffold or evaluate app code. Management errors retain HTTP status; interrupted writes and malformed successful responses are reported as unknown outcomes, never replayed automatically.
+
 Frontend hosting stays with native Wrangler or another hosting tool. An application release script can sequence Flare + build + Wrangler. Frontend publication failure after backend activation is an explicit partial release, not an atomic transaction. Dashboard Health → Development/Production releases offers contract inspection, backend promotion and rollback on demand, with no polling. It does not publish the frontend.
 
 Isolated historical preview environments and a paired frontend/backend version catalogue are not implemented. A saved backend hash is not a preview URL or a Git commit. Use additive contracts when old clients may remain active.
@@ -108,14 +110,18 @@ const url = import.meta.env.PUBLIC_FLARE_URL;
 const auth = createPasswordAuth({ url });
 const client = createClient({ url, getToken: auth.getToken });
 const stopAuth = auth.onChange(() => client.refreshAuth());
-await auth.register("my-login", "a long unique passphrase");
-// Later: await auth.login(login, password), auth.me(), auth.changePassword(old, next).
+await auth.restore(); // Verify a saved session before rendering protected UI.
+// Explicit sign-in: auth.register(login, password) or auth.login(login, password).
+// Account operations: auth.me(), auth.changePassword(old, next).
 await auth.logout();
 stopAuth();
 client.dispose();
+auth.dispose();
 ```
 
-Sessions are memory-only and expire after at most 12 hours. Reload requires login again. Password reset/block/revoke in Auth disconnects affected live users. Owner/Access manages accounts; application users and project CLI credentials do not gain dashboard privileges. Public login/registration have bounded rate limits; public registration is not equivalent to public access to private rows. Passwords require 6–128 characters. There is no email verification/recovery or MFA in this minimal version; owner reset is available. Existing short-lived R2 download grants remain valid for their explicit TTL, not until session logout.
+Sessions expire after at most 12 hours. Browsers default to localStorage scoped to the deployment URL; `restore()` verifies the saved session against the server. Server/mobile callers provide storage explicitly or use `storage: null` for memory-only auth. Temporary network failures do not erase saved credentials; cross-tab logout is synchronized. `dispose()` is not logout. This is bearer-token storage, not HttpOnly-cookie authentication: prevent XSS in the application. No perpetual refresh is implemented.
+
+Password reset/block/revoke disconnects affected live users. Live cache is cleared when authorization is rejected, including during reconnect ticket acquisition; a transient connection failure keeps the last valid snapshot. Owner/Access manages accounts; application users and project CLI credentials do not gain account-management privileges. Handlers enforce record ownership. Passwords require 6–128 characters; registration is rate-limited and closed by default. Email verification/recovery and MFA are not implemented. Existing R2 download grants remain valid for their explicit TTL, not until session logout.
 
 ## License and distribution
 

package/dist/cli/{chunk-x14smx1y.js → chunk-5s6zv1h9.js}

@@ -102,7 +102,7 @@ ${url}`);
     await writeFile(join(directory, key + ".json"), JSON.stringify({ token, expiresAt: result.expiresAt }) + `
 `, { mode: 384 });
     process.env.FLARE_DEPLOY_TOKEN = token;
-    const { link } = await import("./chunk-5cq8wgte.js");
+    const { link } = await import("./chunk-5yg1zj5n.js");
     return link({ platform, project: result.project });
   }
   throw Error("Login expired. Run flare dev again.");

package/dist/cli/{chunk-5cq8wgte.js → chunk-5yg1zj5n.js}

@@ -26,26 +26,46 @@ async function request(platform, path, body) {
       return "null";
     }));
     if (config) {
-      const { storedToken } = await import("./chunk-x14smx1y.js");
+      const { storedToken } = await import("./chunk-5s6zv1h9.js");
       token = await storedToken(platform, config.project);
     }
   }
   if (!token)
     throw Error("Sign in with flare dev; CI can set FLARE_DEPLOY_TOKEN");
-  const r = await fetch(allowedUrl(platform) + path, {
-    method: body === undefined ? "GET" : "POST",
-    headers: {
-      authorization: `Bearer ${token}`,
-      ...body === undefined ? {} : { "content-type": "application/json" }
-    },
-    body: body === undefined ? undefined : JSON.stringify(body),
-    redirect: "error",
-    signal: AbortSignal.timeout(60000)
-  });
-  const result = await r.json();
+  const url = allowedUrl(platform) + path;
+  const write = body !== undefined;
+  const encoded = write ? JSON.stringify(body) : undefined;
+  let r;
+  try {
+    r = await fetch(url, {
+      method: write ? "POST" : "GET",
+      headers: {
+        authorization: `Bearer ${token}`,
+        ...write ? { "content-type": "application/json" } : {}
+      },
+      body: encoded,
+      redirect: "error",
+      signal: AbortSignal.timeout(60000)
+    });
+  } catch {
+    const error = Error(write ? "Management write outcome is unknown; inspect current state before retrying. Writes are not automatically retried." : "Management request interrupted or timed out");
+    error.ambiguous = write;
+    throw error;
+  }
+  let result;
+  try {
+    result = await r.json();
+  } catch {
+    const error = Error(`Invalid management response (HTTP ${r.status}); ${write && (r.ok || r.status >= 500) ? "write outcome is unknown; inspect current state before retrying" : "check platform availability and authorization"}`);
+    error.status = r.status;
+    error.ambiguous = write && (r.ok || r.status >= 500);
+    throw error;
+  }
   if (!r.ok) {
-    const error = Error(`${result.error ?? "Deployment failed"} (HTTP ${r.status}); writes are not automatically retried`);
+    const code = typeof result?.error === "string" && /^[A-Z][A-Z0-9_]{0,63}$/.test(result.error) ? result.error : "Management request failed";
+    const error = Error(`${code} (HTTP ${r.status}); writes are not automatically retried`);
     error.status = r.status;
+    error.ambiguous = write && r.status >= 500;
     throw error;
   }
   return result;
@@ -68,9 +88,6 @@ async function link(options) {
 async function deploy(options = {}) {
   if (!options.release) {
     const config = JSON.parse(await readFile(".flare/project.json", "utf8"));
-    const { prepare, generateApi } = await import("./chunk-786w6vrj.js");
-    const { buildApplication } = await import("./chunk-vx7kmczm.js");
-    const source = await prepare(), directory = resolve(".flare/releases/" + randomUUID());
     const env = options.env ?? "prod";
     if (!["dev", "prod"].includes(env))
       throw Error("Environment must be dev or prod");
@@ -89,6 +106,9 @@ async function deploy(options = {}) {
         prompt.close();
       }
     }
+    const { prepare, generateApi } = await import("./chunk-fv98dfg5.js");
+    const { buildApplication } = await import("./chunk-vx7kmczm.js");
+    const source = await prepare(), directory = resolve(".flare/releases/" + randomUUID());
     try {
       await buildApplication({ ...source, outdir: directory });
       const result = await deploy({
@@ -118,13 +138,13 @@ async function deploy(options = {}) {
     facet: await read("facet.js"),
     action: await read("action.js")
   };
-  let expected;
+  const health = await request(config.platform, `/api/projects/${config.project}/${env}/health`);
+  const expected = health?.active;
+  if (!/^[a-f0-9]{64}$/.test(expected ?? ""))
+    throw Error("Environment has no active backend; inspect dashboard Health before deploying");
   if (options.cmd) {
-    const health = await request(config.platform, `/api/projects/${config.project}/${env}/health`);
-    expected = health.active;
-    const { generateApi } = await import("./chunk-786w6vrj.js");
-    await generateApi(directory);
-    await frontendBuild(config, env, options.cmd);
+    const { withGeneratedApi } = await import("./chunk-fv98dfg5.js");
+    await withGeneratedApi(directory, () => frontendBuild(config, env, options.cmd));
   }
   return request(config.platform, `/api/projects/${config.project}/${env}/deploy`, { bundle, confirm: options.confirm, expected });
 }
@@ -133,14 +153,14 @@ async function dev(options = {}) {
     throw Error("Watch publishes only to dev; use deploy for production");
   const simple = !options.entry;
   if (simple) {
-    const { scaffold } = await import("./chunk-786w6vrj.js");
+    const { scaffold } = await import("./chunk-fv98dfg5.js");
     await scaffold();
     try {
       await access(".flare/project.json");
     } catch (e) {
       if (e.code !== "ENOENT")
         throw e;
-      const { connect } = await import("./chunk-x14smx1y.js");
+      const { connect } = await import("./chunk-5s6zv1h9.js");
       await connect();
     }
   }
@@ -152,7 +172,7 @@ async function dev(options = {}) {
     } catch (e) {
       if (process.env.FLARE_DEPLOY_TOKEN || e.status !== 401 && !e.message.startsWith("Sign in"))
         throw e;
-      const { connect } = await import("./chunk-x14smx1y.js");
+      const { connect } = await import("./chunk-5s6zv1h9.js");
       await connect();
     }
   }
@@ -167,7 +187,7 @@ async function dev(options = {}) {
     try {
       const outdir = resolve(".flare/releases/" + randomUUID());
       try {
-        const { prepare, generateApi, frontendEnvironment } = await import("./chunk-786w6vrj.js");
+        const { prepare, generateApi, frontendEnvironment } = await import("./chunk-fv98dfg5.js");
         const source = simple ? await prepare() : { entry: options.entry };
         const release = await buildApplication({ ...source, outdir });
         if (release.hash !== hash) {
@@ -289,14 +309,13 @@ async function releaseOperation(options, operation) {
     if (bundle.release.hash !== options.hash)
       throw Error("Release hash mismatch");
     const { generateReferences } = await import("./chunk-vx7kmczm.js");
-    const { generateApi } = await import("./chunk-786w6vrj.js");
+    const { withGeneratedApi } = await import("./chunk-fv98dfg5.js");
     await mkdir(".flare", { recursive: true });
     const directory = await mkdtemp(resolve(".flare/release-contract-"));
     try {
       await writeFile(join(directory, "api.ts"), await generateReferences(bundle.manifest));
       await writeFile(join(directory, "manifest.json"), JSON.stringify(bundle.manifest));
-      await generateApi(directory);
-      await frontendBuild(config, env, options.cmd);
+      await withGeneratedApi(directory, () => frontendBuild(config, env, options.cmd));
     } finally {
       await rm(directory, { recursive: true, force: true });
     }

package/dist/cli/{chunk-786w6vrj.js → chunk-fv98dfg5.js}

@@ -140,6 +140,25 @@ async function generateApi(directory) {
 export const api = ${serialize(tree)} as const;
 `);
 }
+async function withGeneratedApi(directory, build) {
+  const files = ["flare/_generated/api.ts", "flare/_generated/references.ts"];
+  const previous = await Promise.all(files.map((file) => readFile(file).catch((error) => {
+    if (error.code !== "ENOENT")
+      throw error;
+    return null;
+  })));
+  try {
+    await generateApi(directory);
+    return await build();
+  } catch (error) {
+    try {
+      await Promise.all(files.map((file, i) => previous[i] === null ? rm(file, { force: true }) : writeFile(file, previous[i])));
+    } catch (restoreError) {
+      throw new AggregateError([error, restoreError], "Build failed and local client references could not be restored");
+    }
+    throw error;
+  }
+}
 async function frontendEnvironment(url) {
   const pkg = JSON.parse(await readFile("package.json", "utf8"));
   const dependencies = { ...pkg.dependencies, ...pkg.devDependencies };
@@ -165,5 +184,6 @@ export {
   frontendEnvironment,
   generateApi,
   prepare,
-  scaffold
+  scaffold,
+  withGeneratedApi
 };