@base44/functions-compiler 0.1.0

package/lib/src/private-data-sources/node-net-adapter.ts

@@ -0,0 +1,244 @@
+import { Buffer } from "node:buffer";
+import nodeNet from "node:net";
+import { Duplex } from "node:stream";
+
+import { isCloudflareTcpSocket } from "./tcp";
+
+interface NodeNetSocket extends Duplex {
+  connecting: boolean;
+  remoteAddress?: string;
+  remotePort?: number;
+  setNoDelay(noDelay?: boolean): NodeNetSocket;
+  setKeepAlive(enable?: boolean, initialDelay?: number): NodeNetSocket;
+  setTimeout(timeout: number, callback?: () => void): NodeNetSocket;
+}
+
+interface PrivateNodeNetRoute {
+  label: string;
+  connect: () => unknown;
+}
+
+const privateNodeNetRoutes = new Map<string, PrivateNodeNetRoute>();
+
+function exactNodeBuffer(value: Uint8Array): Buffer {
+  const bytes = new Uint8Array(value.byteLength);
+  bytes.set(value);
+  return Buffer.from(bytes.buffer);
+}
+
+function nodeNetRouteKey(hostname: string, port: number): string {
+  return `${hostname.toLowerCase()}:${port}`;
+}
+
+export function registerPrivateNodeNetRoute(hostname: string, port: number, route: PrivateNodeNetRoute) {
+  privateNodeNetRoutes.set(nodeNetRouteKey(hostname, port), route);
+}
+
+function parseNodeNetCreateConnectionAddress(args: unknown[]) {
+  const [first, second] = args;
+  if (first && typeof first === "object") {
+    const options = first as { host?: unknown; hostname?: unknown; port?: unknown; path?: unknown };
+    if (typeof options.path === "string") return null;
+    const port = typeof options.port === "number" ? options.port : Number(options.port);
+    if (!Number.isFinite(port)) return null;
+    const hostname =
+      typeof options.host === "string"
+        ? options.host
+        : typeof options.hostname === "string"
+          ? options.hostname
+          : "localhost";
+    return { hostname, port };
+  }
+
+  if (typeof first === "number") {
+    const hostname = typeof second === "string" ? second : "localhost";
+    return { hostname, port: first };
+  }
+
+  return null;
+}
+
+function parseNodeNetConnectCallback(args: unknown[]): (() => void) | undefined {
+  const callback = args.find((arg) => typeof arg === "function");
+  return callback as (() => void) | undefined;
+}
+
+export function installPrivateNodeNetAdapter() {
+  const netModule = nodeNet as typeof nodeNet & {
+    __base44PrivateDataSourceAdapterInstalled?: boolean;
+  };
+  if (netModule.__base44PrivateDataSourceAdapterInstalled) return;
+
+  const originalCreateConnection = netModule.createConnection.bind(netModule);
+  const createConnection = (...args: unknown[]) => {
+    const address = parseNodeNetCreateConnectionAddress(args);
+    const route = address
+      ? privateNodeNetRoutes.get(nodeNetRouteKey(address.hostname, address.port))
+      : undefined;
+    if (!route) {
+      return originalCreateConnection(...(args as Parameters<typeof nodeNet.createConnection>));
+    }
+
+    const socket = buildNodeNetSocket(route.connect(), route.label);
+    const callback = parseNodeNetConnectCallback(args);
+    if (callback) socket.once("connect", callback);
+    return socket;
+  };
+
+  netModule.createConnection = createConnection as typeof nodeNet.createConnection;
+  netModule.connect = createConnection as typeof nodeNet.connect;
+  netModule.__base44PrivateDataSourceAdapterInstalled = true;
+}
+
+export function buildNodeNetSocket(
+  socket: unknown,
+  label: string,
+  options: { deferConnectEvent?: boolean } = {},
+): NodeNetSocket {
+  if (!isCloudflareTcpSocket(socket)) {
+    throw new Error(`${label} did not return a readable/writable TCP socket`);
+  }
+  const cloudflareSocket = socket;
+
+  let reader: ReadableStreamDefaultReader<Uint8Array> | null = null;
+  let writer: WritableStreamDefaultWriter<Uint8Array> | null = null;
+  let closed = false;
+  let connectEmitted = false;
+  let readableEnded = false;
+  let timeout: ReturnType<typeof setTimeout> | null = null;
+  let writeChain = Promise.resolve();
+
+  function clearTimer() {
+    if (!timeout) return;
+    clearTimeout(timeout);
+    timeout = null;
+  }
+
+  function releaseLocks() {
+    try {
+      reader?.releaseLock();
+    } catch {
+      // Ignore release errors when the stream is already closed.
+    }
+    reader = null;
+    try {
+      writer?.releaseLock();
+    } catch {
+      // Ignore release errors when the stream is already closed.
+    }
+    writer = null;
+  }
+
+  function endReadable() {
+    if (readableEnded) return;
+    readableEnded = true;
+    stream.push(null);
+  }
+
+  const stream = new Duplex({
+    read() {
+      // Data is pushed from the Cloudflare readable stream below.
+    },
+    write(chunk, _encoding, callback) {
+      const bytes = chunk instanceof Uint8Array ? chunk : Buffer.from(chunk);
+      writeChain = writeChain
+        .then(async () => {
+          if (closed) throw new Error(`${label} connection is closed`);
+          const activeWriter = writer ?? cloudflareSocket.writable.getWriter();
+          writer = activeWriter;
+          await activeWriter.write(bytes);
+        })
+        .then(
+          () => callback(),
+          (error) => callback(error instanceof Error ? error : new Error(String(error))),
+        );
+    },
+    final(callback) {
+      writeChain
+        .then(() => {
+          try {
+            cloudflareSocket.close?.();
+          } finally {
+            callback();
+          }
+        })
+        .catch((error) => callback(error instanceof Error ? error : new Error(String(error))));
+    },
+    destroy(error, callback) {
+      closed = true;
+      clearTimer();
+      try {
+        cloudflareSocket.close?.();
+      } catch {
+        // The stream is already being destroyed; surface the original error below.
+      }
+      releaseLocks();
+      callback(error);
+    },
+  }) as NodeNetSocket;
+
+  stream.connecting = true;
+  stream.setNoDelay = () => stream;
+  stream.setKeepAlive = () => stream;
+  stream.setTimeout = (duration, callback) => {
+    clearTimer();
+    if (duration > 0) {
+      timeout = setTimeout(() => {
+        callback?.();
+        stream.emit("timeout");
+      }, duration);
+    }
+    return stream;
+  };
+
+  async function readLoop() {
+    const activeReader = reader ?? cloudflareSocket.readable.getReader();
+    reader = activeReader;
+    try {
+      while (!closed) {
+        const { value, done } = await activeReader.read();
+        if (done) break;
+        if (value) stream.push(exactNodeBuffer(value));
+      }
+      endReadable();
+      releaseLocks();
+    } catch (error) {
+      if (!closed) stream.destroy(error instanceof Error ? error : new Error(String(error)));
+    }
+  }
+
+  function markConnected(info?: unknown) {
+    if (closed || connectEmitted) return;
+    connectEmitted = true;
+    const socketInfo = info as { remoteAddress?: unknown; remotePort?: unknown } | null;
+    if (typeof socketInfo?.remoteAddress === "string") stream.remoteAddress = socketInfo.remoteAddress;
+    if (typeof socketInfo?.remotePort === "number") stream.remotePort = socketInfo.remotePort;
+    stream.connecting = false;
+    stream.emit("connect");
+    readLoop();
+  }
+
+  function scheduleConnected(info?: unknown) {
+    if (options.deferConnectEvent) {
+      setTimeout(() => markConnected(info), 0);
+    } else {
+      markConnected(info);
+    }
+  }
+
+  if (cloudflareSocket.opened) {
+    cloudflareSocket.opened.then(
+      (info) => scheduleConnected(info),
+      (error) => stream.destroy(error instanceof Error ? error : new Error(String(error))),
+    );
+  } else {
+    queueMicrotask(() => scheduleConnected());
+  }
+  cloudflareSocket.closed?.finally(() => {
+    closed = true;
+    clearTimer();
+    endReadable();
+    releaseLocks();
+  }).catch((error) => stream.destroy(error instanceof Error ? error : new Error(String(error))));
+  return stream;
+}

package/lib/src/private-data-sources/postgres.ts

@@ -0,0 +1,8 @@
+import { buildHyperdrivePrivateDataSource } from "./hyperdrive";
+import { privateDataSourceReference } from "./manifest";
+
+export function postgres(name: unknown) {
+  return buildHyperdrivePrivateDataSource(
+    privateDataSourceReference(name, "postgres"),
+  );
+}

package/lib/src/private-data-sources/redis-auth.ts

@@ -0,0 +1,83 @@
+import type { CloudflareTcpSocket } from "./types";
+
+const MAX_AUTH_RESPONSE_BYTES = 4096;
+
+function isCloudflareTcpSocket(socket: unknown): socket is CloudflareTcpSocket {
+  const candidate = socket as Partial<CloudflareTcpSocket> | null;
+  return (
+    candidate !== null &&
+    typeof candidate === "object" &&
+    !!candidate.readable &&
+    typeof candidate.readable.getReader === "function" &&
+    !!candidate.writable &&
+    typeof candidate.writable.getWriter === "function"
+  );
+}
+
+function encodeRespArray(values: string[]): Uint8Array {
+  const encoder = new TextEncoder();
+  const chunks = [encoder.encode(`*${values.length}\r\n`)];
+  for (const value of values) {
+    const bytes = encoder.encode(value);
+    chunks.push(encoder.encode(`$${bytes.byteLength}\r\n`), bytes, encoder.encode("\r\n"));
+  }
+  const result = new Uint8Array(chunks.reduce((total, chunk) => total + chunk.byteLength, 0));
+  let offset = 0;
+  for (const chunk of chunks) {
+    result.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  return result;
+}
+
+async function readResponseLine(reader: ReadableStreamDefaultReader<Uint8Array>): Promise<string> {
+  const bytes: number[] = [];
+  while (bytes.length <= MAX_AUTH_RESPONSE_BYTES) {
+    const { value, done } = await reader.read();
+    if (done) break;
+    for (const byte of value ?? []) {
+      bytes.push(byte);
+      const length = bytes.length;
+      if (length >= 2 && bytes[length - 2] === 13 && bytes[length - 1] === 10) {
+        return new TextDecoder().decode(new Uint8Array(bytes.slice(0, -2)));
+      }
+      if (length > MAX_AUTH_RESPONSE_BYTES) break;
+    }
+  }
+  throw new Error("Redis authentication failed: invalid or missing server response");
+}
+
+async function authenticateRedisSocket(
+  socket: unknown,
+  username: string | undefined,
+  password: string,
+): Promise<CloudflareTcpSocket> {
+  if (!isCloudflareTcpSocket(socket)) {
+    throw new Error("Redis private data source did not return a readable/writable TCP socket");
+  }
+  const reader = socket.readable.getReader();
+  const writer = socket.writable.getWriter();
+  try {
+    await socket.opened;
+    const auth = username ? ["AUTH", username, password] : ["AUTH", password];
+    await writer.write(encodeRespArray(auth));
+    const response = await readResponseLine(reader);
+    if (response === "+OK") return socket;
+    const message = response.startsWith("-") ? response.slice(1) : `unexpected response ${JSON.stringify(response)}`;
+    throw new Error(`Redis authentication failed: ${message}`);
+  } catch (error) {
+    socket.close?.();
+    throw error;
+  } finally {
+    reader.releaseLock();
+    writer.releaseLock();
+  }
+}
+
+export function authenticateRedisSocketIfNeeded(
+  socket: unknown,
+  username: string | undefined,
+  password: string | undefined,
+): unknown | Promise<CloudflareTcpSocket> {
+  return password ? authenticateRedisSocket(socket, username, password) : socket;
+}

package/lib/src/private-data-sources/redis.ts

@@ -0,0 +1,47 @@
+import { buildIoredisConnectorFactory } from "./ioredis-adapter";
+import { privateDataSourceReference } from "./manifest";
+import { authenticateRedisSocketIfNeeded } from "./redis-auth";
+import { buildTcpPrivateDataSource } from "./tcp";
+
+export function redis(name: unknown) {
+  const source = buildTcpPrivateDataSource(
+    privateDataSourceReference(name, "redis"),
+  ) as ReturnType<typeof buildTcpPrivateDataSource> & {
+    connect: (options?: unknown) => unknown;
+  };
+  const { connect: _connect, ...descriptors } =
+    Object.getOwnPropertyDescriptors(source);
+  const extension = {
+    connect(options?: unknown) {
+      return authenticateRedisSocketIfNeeded(
+        source.connect(options),
+        source.username,
+        source.password,
+      );
+    },
+    ioredisConnector() {
+      return buildIoredisConnectorFactory(() =>
+        authenticateRedisSocketIfNeeded(
+          source.connect(),
+          source.username,
+          source.password,
+        ),
+      );
+    },
+    ioredisOptions() {
+      return Object.freeze({
+        Connector: buildIoredisConnectorFactory(() => source.connect()),
+        ...(source.password && source.username
+          ? { username: source.username }
+          : {}),
+        ...(source.password ? { password: source.password } : {}),
+      });
+    },
+  };
+  return Object.freeze(
+    Object.defineProperties(
+      extension,
+      descriptors,
+    ) as typeof source & typeof extension,
+  );
+}

package/lib/src/private-data-sources/runtime-environment.ts

@@ -0,0 +1,4 @@
+export {
+  currentWorkerRuntimeContext,
+  workerEnvironment,
+} from "base44:internal/runtime-context";

package/lib/src/private-data-sources/runtime-manifest-store.ts

@@ -0,0 +1,32 @@
+// Private, single-instance channel for the handshake-delivered PDS manifest.
+//
+// The manifest carries plaintext VPC/DB credentials, so it must NOT be
+// reachable by user code. It lives here in module-private state: the activation
+// shim writes it (via `setRuntimeManifest`) and `manifest.ts` reads it (via
+// `getRuntimeManifest`) — both resolve to THIS one module instance in the final
+// bundle, so the value never touches `globalThis`, `process.env`, or any
+// user-importable surface. User function code cannot import this module, via
+// two independent gates: (1) the bundler's private-data-sources virtual plugin
+// resolves the `base44:private-data-sources/runtime-manifest-store` specifier
+// ONLY when the importer is EXACTLY the injected activation shim's bundle-root
+// key (not a suffix/segment match — else a nested `x/__base44_activation.mjs`
+// could pose as it); (2) `assertNoReservedFilenames` rejects that basename at
+// any depth in user files. The relative `./runtime-manifest-store` path only
+// resolves inside the plugin's namespace (the adapters + manifest.ts), never
+// from a user file.
+//
+// Single instance: both importers resolve to the SAME (namespace, path) pair,
+// so esbuild emits one module. The runtime-secrets e2e proves this end to end —
+// if the two ever diverged into separate instances, the shim would write one
+// and manifest.ts would read the other (empty), and the delivered manifest
+// would resolve as "not bound".
+
+let runtimeManifestRaw: string | undefined;
+
+export function setRuntimeManifest(raw: string | undefined): void {
+  runtimeManifestRaw = raw;
+}
+
+export function getRuntimeManifest(): string | undefined {
+  return runtimeManifestRaw;
+}

package/lib/src/private-data-sources/sqlserver.ts

@@ -0,0 +1,22 @@
+import { buildTediousConnectorFactory } from "./tedious-adapter";
+import { privateDataSourceReference } from "./manifest";
+import { buildTcpPrivateDataSource } from "./tcp";
+
+export function sqlserver(name: unknown) {
+  const source = buildTcpPrivateDataSource(
+    privateDataSourceReference(name, "sqlserver"),
+  ) as ReturnType<typeof buildTcpPrivateDataSource> & {
+    connect: (options?: unknown) => unknown;
+  };
+  const extension = {
+    tediousConnector() {
+      return buildTediousConnectorFactory(() => source.connect());
+    },
+  };
+  return Object.freeze(
+    Object.defineProperties(
+      extension,
+      Object.getOwnPropertyDescriptors(source),
+    ) as typeof source & typeof extension,
+  );
+}

package/lib/src/private-data-sources/tcp.ts

@@ -0,0 +1,86 @@
+import {
+  currentPrivateDataSource,
+  privateDataSourceReference,
+  privateDataSourceBinding,
+} from "./manifest";
+import type {
+  CloudflareTcpSocket,
+  PrivateDataSourceManifestEntry,
+  TcpPrivateDataSourceBinding,
+} from "./types";
+
+function hasConnect(binding: unknown): binding is TcpPrivateDataSourceBinding {
+  return (
+    binding !== null &&
+    typeof binding === "object" &&
+    typeof (binding as { connect?: unknown }).connect === "function"
+  );
+}
+
+export function buildTcpPrivateDataSource(entry: PrivateDataSourceManifestEntry) {
+  return Object.freeze({
+    name: entry.name,
+    type: entry.type,
+    get bindingName() {
+      return currentPrivateDataSource(entry).bindingName;
+    },
+    get host() {
+      return currentPrivateDataSource(entry).host;
+    },
+    get port() {
+      return currentPrivateDataSource(entry).port;
+    },
+    get database() {
+      return currentPrivateDataSource(entry).database;
+    },
+    get username() {
+      return currentPrivateDataSource(entry).username;
+    },
+    get user() {
+      return currentPrivateDataSource(entry).username;
+    },
+    get password() {
+      return currentPrivateDataSource(entry).password;
+    },
+    connect(options?: unknown) {
+      const current = currentPrivateDataSource(entry);
+      const binding = privateDataSourceBinding(current);
+      if (!hasConnect(binding)) {
+        throw new Error(
+          `Private data source "${current.name}" does not expose connect()`,
+        );
+      }
+      const address =
+        typeof current.host === "string" && typeof current.port === "number"
+          ? { hostname: current.host, port: current.port }
+          : null;
+      if (!address) {
+        throw new Error(
+          `Private data source "${current.name}" has no TCP address`,
+        );
+      }
+      return binding.connect(address, options);
+    },
+    get binding() {
+      return privateDataSourceBinding(entry);
+    },
+  });
+}
+
+export function isCloudflareTcpSocket(socket: unknown): socket is CloudflareTcpSocket {
+  const socketObject = socket as Partial<CloudflareTcpSocket> | null;
+  return (
+    socketObject !== null &&
+    typeof socketObject === "object" &&
+    !!socketObject.readable &&
+    typeof socketObject.readable.getReader === "function" &&
+    !!socketObject.writable &&
+    typeof socketObject.writable.getWriter === "function"
+  );
+}
+
+export function tcp(name: unknown, expectedType: string) {
+  return buildTcpPrivateDataSource(
+    privateDataSourceReference(name, expectedType),
+  );
+}

package/lib/src/private-data-sources/tedious-adapter.ts

@@ -0,0 +1,67 @@
+import { isCloudflareTcpSocket } from "./tcp";
+import { buildNodeNetSocket } from "./node-net-adapter";
+
+function abortError(label: string, signal: AbortSignal): Error {
+  return signal.reason instanceof Error
+    ? signal.reason
+    : new Error(`${label} connection aborted`);
+}
+
+async function waitForCloudflareTcpSocketOpen(
+  socket: unknown,
+  label: string,
+  signal?: AbortSignal,
+) {
+  if (!isCloudflareTcpSocket(socket)) {
+    throw new Error(`${label} did not return a readable/writable TCP socket`);
+  }
+  if (!socket.opened) return;
+
+  if (!signal) {
+    await socket.opened;
+    return;
+  }
+
+  if (signal.aborted) {
+    try {
+      socket.close?.();
+    } catch {
+      // Best-effort cleanup; surface the abort reason below.
+    }
+    throw abortError(label, signal);
+  }
+
+  let onAbort: (() => void) | null = null;
+  try {
+    await Promise.race([
+      socket.opened,
+      new Promise((_, reject) => {
+        onAbort = () => reject(abortError(label, signal));
+        signal.addEventListener("abort", onAbort, { once: true });
+      }),
+    ]);
+  } catch (error) {
+    try {
+      socket.close?.();
+    } catch {
+      // Preserve the original connection/abort error.
+    }
+    throw error;
+  } finally {
+    if (onAbort) signal.removeEventListener("abort", onAbort);
+  }
+}
+
+function buildTediousNetSocket(socket: unknown) {
+  return buildNodeNetSocket(socket, "SQL Server private data source", {
+    deferConnectEvent: true,
+  });
+}
+
+export function buildTediousConnectorFactory(connect: () => unknown) {
+  return async (_connectOptions?: unknown, _lookup?: unknown, signal?: AbortSignal) => {
+    const socket = connect();
+    await waitForCloudflareTcpSocketOpen(socket, "SQL Server private data source", signal);
+    return buildTediousNetSocket(socket);
+  };
+}

package/lib/src/private-data-sources/types.ts

@@ -0,0 +1,29 @@
+export interface PrivateDataSourceManifestEntry {
+  name?: string;
+  type?: string;
+  bindingName?: string;
+  bindingKind?: string;
+  networkScope?: string;
+  baseUrl?: string;
+  host?: string;
+  port?: number;
+  database?: string;
+  username?: string;
+  password?: string;
+}
+
+export interface FetchPrivateDataSourceBinding {
+  fetch: (resource: RequestInfo | URL, init?: RequestInit) => Response | Promise<Response>;
+}
+
+export interface TcpPrivateDataSourceBinding {
+  connect: (address: unknown, options?: unknown) => unknown;
+}
+
+export interface CloudflareTcpSocket {
+  readable: ReadableStream<Uint8Array>;
+  writable: WritableStream<Uint8Array>;
+  opened?: Promise<unknown>;
+  close?: () => void;
+  closed?: Promise<unknown>;
+}

package/lib/src/runtime/index.ts

@@ -0,0 +1,30 @@
+// Platform module served for `import { ... } from "base44:runtime"`.
+//
+// The generated Worker entry owns the per-request AsyncLocalStorage store
+// (module-scoped there), so this module reaches request state through the
+// `globalThis.Base44` bridge the entry prelude installs — same pattern as the
+// private-data-sources modules reading their manifest.
+
+interface Base44Bridge {
+  waitUntil(promise: Promise<unknown>): void;
+  secrets: { get(name: string): string | undefined };
+}
+
+function bridge(): Base44Bridge {
+  return (globalThis as { Base44?: Base44Bridge }).Base44 as Base44Bridge;
+}
+
+/** Extend this invocation until `promise` settles — background work after the
+ *  Response returns. Rides ctx.waitUntil; best-effort, not durable. Returns the
+ *  same promise so it composes. */
+export function waitUntil<T>(promise: Promise<T>): Promise<T> {
+  bridge().waitUntil(promise);
+  return promise;
+}
+
+/** App secrets, read from the Worker env binding of the current request. */
+export const secrets: { get(name: string): string | undefined } = {
+  get(name: string): string | undefined {
+    return bridge().secrets.get(name);
+  },
+};

package/lib/src/runtime-context.ts

@@ -0,0 +1,29 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+
+export interface WorkerRuntimeContext {
+  env: "prod" | "preview";
+  fn?: string;
+  secrets: Record<string, unknown>;
+  workerEnv: Record<string, unknown>;
+  waitUntil(promise: Promise<unknown>): void;
+  [key: string]: unknown;
+}
+
+const runtimeContext = new AsyncLocalStorage<WorkerRuntimeContext>();
+
+export function currentWorkerRuntimeContext():
+  | WorkerRuntimeContext
+  | undefined {
+  return runtimeContext.getStore();
+}
+
+export function workerEnvironment(): Record<string, unknown> {
+  return currentWorkerRuntimeContext()?.workerEnv ?? {};
+}
+
+export function runWithWorkerEnvironment<T>(
+  context: WorkerRuntimeContext,
+  callback: () => T,
+): T {
+  return runtimeContext.run(context, callback);
+}

package/lib/src/static-egress-marker.d.ts

@@ -0,0 +1 @@
+export declare const STATIC_EGRESS_ARTIFACT_MARKER = "base44.static-egress.request-env.v2";