@decocms/tanstack 7.0.0

package/src/daemon/middleware.ts

@@ -0,0 +1,156 @@
+/**
+ * Daemon middleware — intercepts x-daemon-api requests, applies auth,
+ * and routes to volumes API or watch SSE.
+ *
+ * Admin runtime routes (/live/_meta, /.decofile) are NOT handled here —
+ * they fall through to Vite SSR (worker-entry.ts) where setMetaData()
+ * and setBlocks() have populated shared state. The daemon middleware loads
+ * modules via native import() which creates separate module instances.
+ *
+ * Ported from: deco-cx/deco daemon/daemon.ts
+ */
+import type { IncomingMessage, ServerResponse, Server as HttpServer } from "node:http";
+import { createAuthMiddleware } from "./auth";
+import { createFSHandler } from "./fs";
+import { createVolumesHandler } from "./volumes";
+import { createWatchHandler, watchFS } from "./watch";
+
+const DAEMON_API_SPECIFIER = "x-daemon-api";
+const HYPERVISOR_API_SPECIFIER = "x-hypervisor-api";
+
+export interface DaemonOptions {
+  /** Site name for JWT validation. */
+  site: string;
+  /** Vite dev server instance. */
+  server: {
+    httpServer: HttpServer | null;
+    watcher: { on(event: string, cb: (...args: unknown[]) => void): void };
+  };
+}
+
+// Creates a Connect-style middleware that:
+// 1. Checks for x-daemon-api or x-hypervisor-api header
+// 2. Applies JWT auth
+// 3. Routes to volumes API or SSE watch
+// 4. Falls through to Vite for other daemon requests (admin routes)
+export function createDaemonMiddleware(opts: DaemonOptions) {
+  const auth = createAuthMiddleware(opts.site);
+  const httpServer = opts.server.httpServer;
+
+  // Volumes handler (includes WebSocket upgrade registration)
+  const volumes = httpServer
+    ? createVolumesHandler({
+        httpServer,
+        watcher: opts.server.watcher,
+      })
+    : null;
+
+  // FS REST API handler (/fs/file/* — read, patch, delete)
+  const fs = createFSHandler();
+
+  // SSE watch handler — lazy port resolver for /live/_meta fetch
+  const watch = createWatchHandler({
+    getPort: () => {
+      const addr = httpServer?.address();
+      return typeof addr === "object" && addr ? addr.port : 5173;
+    },
+  });
+
+  // Wire Vite's file watcher to the broadcast channel
+  watchFS(opts.server.watcher);
+
+  // Version reported to admin.deco.cx — must satisfy admin's minimum version check.
+  // Admin compares against deco-cx/deco versions (e.g. 1.177.x), not @decocms/start versions.
+  const VERSION = "1.177.5";
+
+  return (
+    req: IncomingMessage,
+    res: ServerResponse,
+    next: () => void,
+  ): void => {
+    let pathname: string;
+    try {
+      pathname = new URL(req.url ?? "/", "http://localhost").pathname;
+    } catch {
+      pathname = req.url ?? "/";
+    }
+
+    // Healthcheck — no auth required, admin uses this to verify env is reachable
+    if (pathname === "/_healthcheck") {
+      res.writeHead(200, {
+        "Content-Type": "text/plain",
+        "Access-Control-Allow-Origin": "*",
+        "Access-Control-Allow-Methods": "GET",
+        "Access-Control-Allow-Headers": "Content-Type",
+      });
+      res.end(VERSION);
+      return;
+    }
+
+    // Admin runtime routes (/live/_meta, /.decofile) are NOT handled here.
+    // They fall through to Vite SSR (worker-entry.ts / TanStack routes) where
+    // setMetaData() and setBlocks() have already populated the shared state.
+    // The daemon middleware loads modules via native import() which creates
+    // separate module instances from Vite SSR — they don't share state.
+
+    const isDaemonAPI =
+      req.headers[DAEMON_API_SPECIFIER] ??
+      req.headers[HYPERVISOR_API_SPECIFIER] ??
+      false;
+
+    // Also check query param: ?x-daemon-api=true
+    if (!isDaemonAPI) {
+      try {
+        const url = new URL(req.url ?? "/", "http://localhost");
+        if (url.searchParams.get(DAEMON_API_SPECIFIER) !== "true") {
+          next();
+          return;
+        }
+      } catch {
+        next();
+        return;
+      }
+    }
+
+    // Add CORS headers for admin.deco.cx
+    const origin = req.headers.origin;
+    if (origin) {
+      res.setHeader("Access-Control-Allow-Origin", origin);
+      res.setHeader("Access-Control-Allow-Methods", "GET, POST, PATCH, DELETE, OPTIONS");
+      res.setHeader("Access-Control-Allow-Headers", "Content-Type, Authorization, x-daemon-api, x-hypervisor-api");
+      res.setHeader("Access-Control-Allow-Credentials", "true");
+    }
+
+    // Handle CORS preflight
+    if (req.method === "OPTIONS") {
+      res.writeHead(204);
+      res.end();
+      return;
+    }
+
+    // Auth → then route
+    auth(req, res, () => {
+      // FS REST API: /fs/file/* (read, patch, delete .deco/ files)
+      if (pathname.startsWith("/fs/")) {
+        fs(req, res, next);
+        return;
+      }
+
+      // Volumes API: /volumes/:id/files/*
+      if (pathname.includes("/volumes/") && pathname.includes("/files") && volumes) {
+        volumes(req, res, next);
+        return;
+      }
+
+      // SSE watch: /watch or root /
+      if (pathname === "/watch" || pathname === "/") {
+        watch(req, res, next);
+        return;
+      }
+
+      // Everything else falls through to Vite/TanStack admin routes
+      // (e.g., /live/_meta, /.decofile, /live/previews, /deco/invoke)
+      next();
+    });
+  };
+}

package/src/daemon/tunnel.ts

@@ -0,0 +1,129 @@
+/**
+ * Tunnel registration — connects local dev server to deco.cx admin
+ * via a WebSocket reverse proxy (@deco-cx/warp-node).
+ *
+ * Ported from: deco-cx/deco daemon/tunnel.ts
+ */
+import { connect } from "@deco-cx/warp-node";
+
+export interface TunnelOptions {
+  /** Environment name (DECO_ENV_NAME). */
+  env: string;
+  /** Site name (DECO_SITE_NAME). */
+  site: string;
+  /** Local dev server port. */
+  port: number;
+  /** Use deco.host relay (true) or simpletunnel.deco.site (false). Default true. */
+  decoHost?: boolean;
+}
+
+export interface TunnelConnection {
+  close: () => void;
+  domain: string;
+}
+
+const VERBOSE = process.env.VERBOSE;
+
+export async function startTunnel(
+  opts: TunnelOptions,
+): Promise<TunnelConnection> {
+  const { env, site, port, decoHost = true } = opts;
+
+  const decoHostDomain = `${env}--${site}.deco.host`;
+  const { server, domain } = decoHost
+    ? { server: `wss://${decoHostDomain}`, domain: decoHostDomain }
+    : {
+        server: "wss://simpletunnel.deco.site",
+        domain: `${env}--${site}.deco.site`,
+      };
+
+  const localAddr = `http://localhost:${port}`;
+  const apiKey =
+    process.env.DECO_TUNNEL_SERVER_TOKEN ??
+    "c309424a-2dc4-46fe-bfc7-a7c10df59477";
+
+  let closed = false;
+  let activeConn: Awaited<ReturnType<typeof connect>> | null = null;
+
+  async function doConnect(): Promise<void> {
+    if (closed) return;
+
+    let r: Awaited<ReturnType<typeof connect>>;
+    try {
+      r = await connect({ domain, localAddr, server, apiKey });
+      activeConn = r;
+    } catch (err) {
+      if (closed) return;
+      console.log(
+        "[deco] tunnel connect failed, retrying in 500ms…",
+        VERBOSE ? err : "",
+      );
+      await new Promise((resolve) => setTimeout(resolve, 500));
+      return doConnect();
+    }
+
+    r.registered
+      .then(() => {
+        const adminUrl = new URL(
+          `/sites/${site}/spaces/dashboard?env=${env}`,
+          "https://admin.deco.cx",
+        );
+        console.log(
+          `\n[deco] tunnel connected — env \x1b[32m${env}\x1b[0m for site \x1b[34m${site}\x1b[0m` +
+            `\n   -> Preview: \x1b[36mhttps://${domain}\x1b[0m` +
+            `\n   -> Admin:   \x1b[36m${adminUrl.href}\x1b[0m\n`,
+        );
+      })
+      .catch((err) => {
+        console.error("[deco] tunnel registration failed:", err);
+      });
+
+    r.closed
+      .then(async (reason) => {
+        if (closed) return;
+        if (
+          reason &&
+          typeof reason === "object" &&
+          "intentional" in reason &&
+          (reason as Record<string, unknown>).intentional
+        )
+          return;
+        console.log(
+          "[deco] tunnel disconnected, retrying in 500ms…",
+          VERBOSE ? reason : "",
+        );
+        await new Promise((resolve) => setTimeout(resolve, 500));
+        return doConnect();
+      })
+      .catch(async (err: unknown) => {
+        if (closed) return;
+        if (
+          err &&
+          typeof err === "object" &&
+          "intentional" in err &&
+          (err as Record<string, unknown>).intentional
+        )
+          return;
+        console.log(
+          "[deco] tunnel error, retrying in 500ms…",
+          VERBOSE ? err : "",
+        );
+        await new Promise((resolve) => setTimeout(resolve, 500));
+        return doConnect();
+      });
+  }
+
+  await doConnect();
+
+  return {
+    close() {
+      closed = true;
+      activeConn?.closed?.catch(() => {});
+      // warp-node's connect() returns a Connected object; closing the
+      // underlying WebSocket is handled internally when the process exits.
+      // Setting closed=true prevents reconnection attempts.
+      activeConn = null;
+    },
+    domain,
+  };
+}

package/src/daemon/volumes.ts

@@ -0,0 +1,366 @@
+/**
+ * Volumes API — CRUD for .deco/ files with JSON patch support
+ * and WebSocket realtime broadcast of file changes.
+ *
+ * Ported from: deco-cx/deco daemon/realtime/app.ts (without CRDT)
+ */
+import { readdir, readFile, writeFile, mkdir, rm, stat } from "node:fs/promises";
+import { join, resolve, sep, posix } from "node:path";
+import type { IncomingMessage, ServerResponse, Server as HttpServer } from "node:http";
+import { WebSocketServer, WebSocket } from "ws";
+import fjp from "fast-json-patch";
+import type { Operation } from "fast-json-patch";
+
+// ---------------------------------------------------------------------------
+// Types — ported from daemon/realtime/types.ts
+// ---------------------------------------------------------------------------
+
+interface BaseFilePatch {
+  path: string;
+}
+
+interface JSONFilePatch extends BaseFilePatch {
+  patches: Operation[];
+}
+
+interface TextFileSet extends BaseFilePatch {
+  content: string | null;
+}
+
+type FilePatch = JSONFilePatch | TextFileSet;
+
+interface VolumePatchRequest {
+  messageId?: string;
+  patches: FilePatch[];
+}
+
+interface FilePatchResult {
+  path: string;
+  accepted: boolean;
+  content?: string;
+  deleted?: boolean;
+}
+
+interface VolumePatchResponse {
+  results: FilePatchResult[];
+  timestamp: number;
+}
+
+function isJSONFilePatch(patch: FilePatch): patch is JSONFilePatch {
+  return "patches" in patch && Array.isArray((patch as JSONFilePatch).patches);
+}
+
+function isTextFileSet(patch: FilePatch): patch is TextFileSet {
+  return "content" in patch && !("patches" in patch);
+}
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+const toPosix = (p: string) => p.replaceAll(sep, "/");
+
+function safePath(base: string, untrusted: string): string | null {
+  const resolved = resolve(base, untrusted);
+  if (!resolved.startsWith(base + sep) && resolved !== base) return null;
+  return resolved;
+}
+
+async function readTextFileSafe(path: string): Promise<string | null> {
+  try {
+    return await readFile(path, "utf-8");
+  } catch (err: unknown) {
+    if ((err as NodeJS.ErrnoException).code === "ENOENT") return null;
+    throw err;
+  }
+}
+
+async function ensureFile(path: string): Promise<void> {
+  const dir = join(path, "..");
+  await mkdir(dir, { recursive: true });
+}
+
+// ---------------------------------------------------------------------------
+// WebSocket realtime sessions
+// ---------------------------------------------------------------------------
+
+interface BroadcastMessage {
+  path: string;
+  timestamp: number;
+  deleted?: boolean;
+  messageId?: string;
+}
+
+interface VolumesState {
+  sessions: WebSocket[];
+  wss: WebSocketServer;
+  timestamp: number;
+}
+
+function broadcast(state: VolumesState, msg: BroadcastMessage): void {
+  const data = JSON.stringify(msg);
+  for (const ws of state.sessions) {
+    if (ws.readyState === WebSocket.OPEN) {
+      ws.send(data);
+    }
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Walk directory (Node.js equivalent of @std/fs/walk)
+// ---------------------------------------------------------------------------
+
+async function walkFiles(
+  root: string,
+): Promise<string[]> {
+  const results: string[] = [];
+  try {
+    const entries = await readdir(root, {
+      recursive: true,
+      withFileTypes: true,
+    });
+    for (const entry of entries) {
+      if (!entry.isFile()) continue;
+      const fullPath = join(entry.parentPath, entry.name);
+      const rel = toPosix(fullPath.replace(root, ""));
+      if (
+        rel.includes("/.git/") ||
+        rel.includes("/node_modules/") ||
+        rel.includes("/.agent-home/") ||
+        rel.includes("/.claude/")
+      ) {
+        continue;
+      }
+      results.push(fullPath);
+    }
+  } catch {
+    // root might be a file, not a directory
+  }
+  return results;
+}
+
+// ---------------------------------------------------------------------------
+// Request handlers
+// ---------------------------------------------------------------------------
+
+const cwd = process.cwd();
+
+async function handleGetFiles(
+  req: IncomingMessage,
+  res: ServerResponse,
+  state: VolumesState,
+): Promise<void> {
+  const url = new URL(req.url ?? "/", "http://localhost");
+  const [, ...segments] = url.pathname.split("/files");
+  const filePath = segments.join("/files") || "/";
+  const withContent = url.searchParams.get("content") === "true";
+
+  const root = safePath(cwd, filePath);
+  if (!root) {
+    res.writeHead(403);
+    res.end("Path traversal denied");
+    return;
+  }
+  const fs: Record<string, { content: string | null }> = {};
+
+  const files = await walkFiles(root);
+  if (files.length > 0) {
+    for (const fullPath of files) {
+      const key = toPosix(fullPath.replace(root, "/"));
+      fs[key] = {
+        content: withContent ? await readTextFileSafe(fullPath) : null,
+      };
+    }
+  } else {
+    // Might be a single file
+    const content = withContent ? await readTextFileSafe(root) : null;
+    fs[toPosix(filePath)] = { content };
+  }
+
+  const body = JSON.stringify({ timestamp: state.timestamp, fs });
+  res.writeHead(200, { "Content-Type": "application/json" });
+  res.end(body);
+}
+
+async function handlePatchFiles(
+  req: IncomingMessage,
+  res: ServerResponse,
+  state: VolumesState,
+): Promise<void> {
+  const raw = await readBody(req);
+  let request: VolumePatchRequest;
+  try {
+    request = JSON.parse(raw);
+  } catch {
+    res.writeHead(400);
+    res.end("Invalid JSON");
+    return;
+  }
+
+  const results: FilePatchResult[] = [];
+
+  for (const patch of request.patches) {
+    // Validate path traversal for every patch
+    const resolvedPath = safePath(cwd, patch.path);
+    if (!resolvedPath) {
+      results.push({ accepted: false, path: patch.path });
+      continue;
+    }
+
+    if (isJSONFilePatch(patch)) {
+      const { path: filePath, patches: operations } = patch;
+      const content =
+        (await readTextFileSafe(resolvedPath)) ?? "{}";
+      try {
+        const newContent = JSON.stringify(
+          operations.reduce(fjp.applyReducer, JSON.parse(content)),
+        );
+        results.push({
+          accepted: true,
+          path: filePath,
+          content: newContent,
+          deleted: newContent === "null",
+        });
+      } catch (error) {
+        console.error(error);
+        results.push({ accepted: false, path: filePath, content });
+      }
+    } else if (isTextFileSet(patch)) {
+      const { path: filePath, content } = patch;
+      results.push({
+        accepted: true,
+        path: filePath,
+        content: content ?? "",
+        deleted: content === null,
+      });
+    }
+  }
+
+  state.timestamp = Date.now();
+
+  // Atomic: only commit writes if all patches accepted
+  const shouldWrite = results.every((r) => r.accepted);
+  if (shouldWrite) {
+    await Promise.all(
+      results.map(async (r) => {
+        try {
+          const system = join(cwd, r.path);
+          if (r.deleted) {
+            await rm(system, { force: true });
+          } else if (r.content != null) {
+            await ensureFile(system);
+            await writeFile(system, r.content, "utf-8");
+          }
+        } catch (error) {
+          console.error(error);
+          r.accepted = false;
+        }
+      }),
+    );
+  }
+
+  const body: VolumePatchResponse = { timestamp: state.timestamp, results };
+  res.writeHead(200, { "Content-Type": "application/json" });
+  res.end(JSON.stringify(body));
+}
+
+// ---------------------------------------------------------------------------
+// Body reader helper
+// ---------------------------------------------------------------------------
+
+function readBody(req: IncomingMessage): Promise<string> {
+  return new Promise((resolve, reject) => {
+    const chunks: Buffer[] = [];
+    req.on("data", (chunk: Buffer) => chunks.push(chunk));
+    req.on("end", () => resolve(Buffer.concat(chunks).toString("utf-8")));
+    req.on("error", reject);
+  });
+}
+
+// ---------------------------------------------------------------------------
+// Setup: attach WebSocket server and file watcher
+// ---------------------------------------------------------------------------
+
+export interface VolumesOptions {
+  /** Vite's HTTP server to attach WebSocket upgrades to. */
+  httpServer: HttpServer;
+  /** Vite's file watcher (chokidar instance) for broadcasting changes. */
+  watcher: { on(event: string, cb: (...args: unknown[]) => void): void };
+}
+
+export function createVolumesHandler(opts: VolumesOptions) {
+  const state: VolumesState = {
+    sessions: [],
+    wss: new WebSocketServer({ noServer: true }),
+    timestamp: Date.now(),
+  };
+
+  // Handle WebSocket upgrades for /volumes/*/files paths with x-daemon-api
+  opts.httpServer.on("upgrade", (req, socket, head) => {
+    const isDaemon =
+      req.headers["x-daemon-api"] ?? req.headers["x-hypervisor-api"];
+    if (!isDaemon) return;
+
+    const url = req.url ?? "";
+    if (!url.includes("/volumes/") || !url.includes("/files")) return;
+
+    state.wss.handleUpgrade(req, socket, head, (ws) => {
+      state.sessions.push(ws);
+      console.log("[deco] admin websocket connected");
+
+      ws.on("close", () => {
+        console.log("[deco] admin websocket disconnected");
+        const idx = state.sessions.indexOf(ws);
+        if (idx > -1) state.sessions.splice(idx, 1);
+      });
+    });
+  });
+
+  // Broadcast file changes from Vite's watcher
+  const broadcastChange = (filePath: string, deleted = false) => {
+    const rel = toPosix(filePath).replace(toPosix(cwd), "");
+    if (
+      rel.includes("/.git/") ||
+      rel.includes("/node_modules/") ||
+      rel.includes("/.agent-home/") ||
+      rel.includes("/.claude/")
+    ) {
+      return;
+    }
+    broadcast(state, { path: rel, timestamp: Date.now(), deleted });
+  };
+
+  opts.watcher.on("change", (path: unknown) => {
+    if (typeof path === "string") broadcastChange(path);
+  });
+  opts.watcher.on("add", (path: unknown) => {
+    if (typeof path === "string") broadcastChange(path);
+  });
+  opts.watcher.on("unlink", (path: unknown) => {
+    if (typeof path === "string") broadcastChange(path, true);
+  });
+
+  // Connect-style middleware for HTTP requests
+  return async (
+    req: IncomingMessage,
+    res: ServerResponse,
+    next: () => void,
+  ): Promise<void> => {
+    const url = req.url ?? "";
+
+    // Match /volumes/:id/files patterns
+    if (!url.includes("/volumes/") || !url.includes("/files")) {
+      next();
+      return;
+    }
+
+    if (req.method === "GET") {
+      await handleGetFiles(req, res, state);
+    } else if (req.method === "PATCH") {
+      await handlePatchFiles(req, res, state);
+    } else {
+      res.writeHead(405);
+      res.end();
+    }
+  };
+}