@edge-base/server 0.2.6 → 0.2.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@edge-base/server",
-  "version": "0.2.6",
+  "version": "0.2.8",
   "description": "EdgeBase runtime assets consumed by the EdgeBase CLI",
   "license": "MIT",
   "repository": {
@@ -34,8 +34,8 @@
     "jose": "^6.0.0",
     "pg": "^8.16.3",
     "zod": "^4.3.6",
-    "@edge-base/core": "0.2.6",
-    "@edge-base/shared": "0.2.6"
+    "@edge-base/core": "0.2.8",
+    "@edge-base/shared": "0.2.8"
   },
   "devDependencies": {
     "@cloudflare/vitest-pool-workers": "^0.8.71",

package/src/__tests__/admin-assets.test.ts

@@ -8,18 +8,18 @@ import {
 
 describe('admin asset path resolution', () => {
   it('serves index for the admin root', () => {
-    expect(resolveAdminAssetPath('/admin')).toBe('/');
-    expect(resolveAdminAssetPath('/admin/')).toBe('/');
+    expect(resolveAdminAssetPath('/admin')).toBe('/admin/index.html');
+    expect(resolveAdminAssetPath('/admin/')).toBe('/admin/index.html');
   });
 
   it('strips the /admin prefix for built assets', () => {
-    expect(resolveAdminAssetPath('/admin/_app/version.json')).toBe('/_app/version.json');
-    expect(resolveAdminAssetPath('/admin/favicon.png')).toBe('/favicon.png');
+    expect(resolveAdminAssetPath('/admin/_app/version.json')).toBe('/admin/_app/version.json');
+    expect(resolveAdminAssetPath('/admin/favicon.png')).toBe('/admin/favicon.png');
   });
 
   it('falls back to index for client-side admin routes', () => {
-    expect(resolveAdminAssetPath('/admin/login')).toBe('/');
-    expect(resolveAdminAssetPath('/admin/database/tables')).toBe('/');
+    expect(resolveAdminAssetPath('/admin/login')).toBe('/admin/index.html');
+    expect(resolveAdminAssetPath('/admin/database/tables')).toBe('/admin/index.html');
   });
 
   it('rewrites requests without dropping the query string', () => {
@@ -27,7 +27,7 @@ describe('admin asset path resolution', () => {
     const rewritten = createAdminAssetRequest(request);
     const url = new URL(rewritten.url);
 
-    expect(url.pathname).toBe('/');
+    expect(url.pathname).toBe('/admin/index.html');
     expect(url.search).toBe('?next=%2Fadmin%2Fdatabase');
   });
 });

package/src/__tests__/frontend-assets.test.ts

@@ -0,0 +1,75 @@
+import { describe, expect, it } from 'vitest';
+import {
+  applyFrontendAssetHeaders,
+  createFrontendAssetRequest,
+  resolveFrontendAssetPath,
+} from '../lib/frontend-assets.js';
+
+describe('frontend asset path resolution', () => {
+  it('serves index.html for the root mount path', () => {
+    expect(resolveFrontendAssetPath('/', { mountPath: '/' })).toBe('/index.html');
+  });
+
+  it('serves index.html for custom mount roots', () => {
+    expect(resolveFrontendAssetPath('/app', { mountPath: '/app' })).toBe('/app/index.html');
+    expect(resolveFrontendAssetPath('/app/', { mountPath: '/app' })).toBe('/app/index.html');
+  });
+
+  it('keeps explicit asset paths intact', () => {
+    expect(resolveFrontendAssetPath('/assets/main.js', { mountPath: '/' })).toBe('/assets/main.js');
+    expect(resolveFrontendAssetPath('/app/assets/main.js', { mountPath: '/app' })).toBe('/app/assets/main.js');
+  });
+
+  it('falls back to index.html only for HTML navigation when enabled', () => {
+    expect(resolveFrontendAssetPath('/dashboard/settings', {
+      mountPath: '/',
+      spaFallback: true,
+      method: 'GET',
+      accept: 'text/html,application/xhtml+xml',
+    })).toBe('/index.html');
+
+    expect(resolveFrontendAssetPath('/dashboard/settings', {
+      mountPath: '/',
+      spaFallback: true,
+      method: 'GET',
+      accept: 'application/json',
+    })).toBe('/dashboard/settings');
+  });
+
+  it('returns null outside the configured mount path', () => {
+    expect(resolveFrontendAssetPath('/dashboard', { mountPath: '/app' })).toBeNull();
+  });
+
+  it('rewrites requests without dropping the query string', () => {
+    const request = new Request('http://localhost:8787/app/dashboard?tab=settings', {
+      headers: { accept: 'text/html' },
+    });
+    const rewritten = createFrontendAssetRequest(request, {
+      directory: './web/dist',
+      mountPath: '/app',
+      spaFallback: true,
+    });
+    const url = new URL(rewritten!.url);
+
+    expect(url.pathname).toBe('/app/index.html');
+    expect(url.search).toBe('?tab=settings');
+  });
+});
+
+describe('frontend cache headers', () => {
+  it('marks html and PWA entry files as no-cache', () => {
+    const response = applyFrontendAssetHeaders(new Response('ok'), '/index.html');
+    expect(response.headers.get('Cache-Control')).toBe('no-cache');
+
+    const manifest = applyFrontendAssetHeaders(new Response('ok'), '/manifest.webmanifest');
+    expect(manifest.headers.get('Cache-Control')).toBe('no-cache');
+  });
+
+  it('marks hashed assets as immutable and unhashed assets as short-lived', () => {
+    const hashed = applyFrontendAssetHeaders(new Response('ok'), '/assets/app-abc123def456.js');
+    expect(hashed.headers.get('Cache-Control')).toBe('public, max-age=31536000, immutable');
+
+    const plain = applyFrontendAssetHeaders(new Response('ok'), '/favicon.ico');
+    expect(plain.headers.get('Cache-Control')).toBe('public, max-age=300');
+  });
+});

package/src/__tests__/frontend-config.test.ts

@@ -0,0 +1,16 @@
+import { describe, expect, it } from 'vitest';
+import { normalizeFrontendMountPath } from '../lib/frontend-config.js';
+
+describe('frontend mount path normalization', () => {
+  it('defaults to the root mount path when unset', () => {
+    expect(normalizeFrontendMountPath(undefined)).toBe('/');
+  });
+
+  it('preserves the root mount path', () => {
+    expect(normalizeFrontendMountPath('/')).toBe('/');
+  });
+
+  it('trims a trailing slash from custom mount paths', () => {
+    expect(normalizeFrontendMountPath('/app/')).toBe('/app');
+  });
+});

package/src/__tests__/frontend-routing.test.ts

@@ -0,0 +1,200 @@
+import { afterEach, describe, expect, it, vi } from 'vitest';
+
+vi.mock('cloudflare:workers', () => ({
+  DurableObject: class DurableObject {},
+}));
+
+afterEach(() => {
+  vi.resetModules();
+  vi.restoreAllMocks();
+});
+
+function createExecutionContext(): ExecutionContext {
+  return {
+    waitUntil(promise: Promise<unknown>) {
+      void promise.catch(() => {});
+    },
+    passThroughOnException() {},
+  } as ExecutionContext;
+}
+
+function createEnv(overrides: Record<string, unknown> = {}): Record<string, unknown> {
+  const logsBinding = {
+    idFromName: vi.fn((name: string) => ({ toString: () => name })),
+    get: vi.fn(() => ({
+      fetch: vi.fn(async () => new Response(JSON.stringify({ ok: true }), { status: 200 })),
+    })),
+  };
+
+  return {
+    DATABASE: {} as never,
+    AUTH: {} as never,
+    DATABASE_LIVE: {} as never,
+    ROOMS: {} as never,
+    LOGS: logsBinding as never,
+    STORAGE: {} as never,
+    KV: {} as never,
+    AUTH_DB: {} as never,
+    CONTROL_DB: {} as never,
+    EDGEBASE_CONFIG: {},
+    ...overrides,
+  };
+}
+
+async function loadWorker() {
+  vi.doMock('../lib/runtime-startup.js', () => ({
+    ensureServerStartup: vi.fn().mockResolvedValue(undefined),
+  }));
+
+  const mod = await import('../index.js');
+  return mod.default;
+}
+
+describe('frontend routing', () => {
+  it('serves the frontend root when a root-mounted bundle is configured', async () => {
+    const assetsFetch = vi.fn(async (request: Request) => {
+      const pathname = new URL(request.url).pathname;
+      return new Response(`asset:${pathname}`, { status: 200 });
+    });
+    const worker = await loadWorker();
+
+    const response = await worker.fetch(
+      new Request('http://localhost:8787/'),
+      createEnv({
+        EDGEBASE_CONFIG: {
+          frontend: {
+            directory: './web/dist',
+            spaFallback: true,
+          },
+        },
+        ASSETS: { fetch: assetsFetch },
+      }) as never,
+      createExecutionContext(),
+    );
+
+    expect(response.status).toBe(200);
+    expect(await response.text()).toBe('asset:/index.html');
+    expect(response.headers.get('Cache-Control')).toBe('no-cache');
+    expect(assetsFetch).toHaveBeenCalledTimes(1);
+  });
+
+  it('follows same-origin asset redirects for canonical frontend index routes', async () => {
+    const assetPaths: string[] = [];
+    const assetsFetch = vi.fn(async (request: Request) => {
+      const pathname = new URL(request.url).pathname;
+      assetPaths.push(pathname);
+
+      if (pathname === '/index.html') {
+        return new Response(null, {
+          status: 307,
+          headers: { location: '/' },
+        });
+      }
+
+      return new Response('asset:/', { status: 200 });
+    });
+    const worker = await loadWorker();
+
+    const response = await worker.fetch(
+      new Request('http://localhost:8787/'),
+      createEnv({
+        EDGEBASE_CONFIG: {
+          frontend: {
+            directory: './web/dist',
+            spaFallback: true,
+          },
+        },
+        ASSETS: { fetch: assetsFetch },
+      }) as never,
+      createExecutionContext(),
+    );
+
+    expect(response.status).toBe(200);
+    expect(await response.text()).toBe('asset:/');
+    expect(response.headers.get('Cache-Control')).toBe('no-cache');
+    expect(assetPaths).toEqual(['/index.html', '/']);
+  });
+
+  it('applies SPA fallback only to HTML navigation routes', async () => {
+    const assetPaths: string[] = [];
+    const assetsFetch = vi.fn(async (request: Request) => {
+      const pathname = new URL(request.url).pathname;
+      assetPaths.push(pathname);
+      return pathname === '/index.html'
+        ? new Response('frontend-index', { status: 200 })
+        : new Response('missing', { status: 404 });
+    });
+    const worker = await loadWorker();
+
+    const htmlNavigation = await worker.fetch(
+      new Request('http://localhost:8787/dashboard/settings', {
+        headers: { accept: 'text/html,application/xhtml+xml' },
+      }),
+      createEnv({
+        EDGEBASE_CONFIG: {
+          frontend: {
+            directory: './web/dist',
+            spaFallback: true,
+          },
+        },
+        ASSETS: { fetch: assetsFetch },
+      }) as never,
+      createExecutionContext(),
+    );
+    const missingAsset = await worker.fetch(
+      new Request('http://localhost:8787/assets/missing.js', {
+        headers: { accept: 'text/html,application/xhtml+xml' },
+      }),
+      createEnv({
+        EDGEBASE_CONFIG: {
+          frontend: {
+            directory: './web/dist',
+            spaFallback: true,
+          },
+        },
+        ASSETS: { fetch: assetsFetch },
+      }) as never,
+      createExecutionContext(),
+    );
+
+    expect(await htmlNavigation.text()).toBe('frontend-index');
+    expect(htmlNavigation.status).toBe(200);
+    expect(missingAsset.status).toBe(404);
+    expect(assetPaths).toEqual(['/index.html', '/assets/missing.js']);
+  });
+
+  it('respects custom mount paths and leaves API routes to the worker', async () => {
+    const assetsFetch = vi.fn(async (request: Request) => {
+      const pathname = new URL(request.url).pathname;
+      return new Response(`asset:${pathname}`, { status: 200 });
+    });
+    const worker = await loadWorker();
+    const env = createEnv({
+      EDGEBASE_CONFIG: {
+        frontend: {
+          directory: './web/dist',
+          mountPath: '/app',
+          spaFallback: true,
+        },
+      },
+      ASSETS: { fetch: assetsFetch },
+    }) as never;
+
+    const mounted = await worker.fetch(
+      new Request('http://localhost:8787/app/dashboard', {
+        headers: { accept: 'text/html' },
+      }),
+      env,
+      createExecutionContext(),
+    );
+    const api = await worker.fetch(
+      new Request('http://localhost:8787/api/health'),
+      env,
+      createExecutionContext(),
+    );
+
+    expect(await mounted.text()).toBe('asset:/app/index.html');
+    expect(api.status).toBe(200);
+    expect(assetsFetch).toHaveBeenCalledTimes(1);
+  });
+});

package/src/__tests__/openapi-coverage.test.ts

@@ -118,8 +118,6 @@ describe('OpenAPI route coverage', () => {
         '/api/sql': { post: {} },
         '/admin/api/setup': { get: {} },
         '/admin/api/data/users': { get: {} },
-        '/api/room/media/realtime/session': { post: {} },
-        '/api/room/media/cloudflare_realtimekit/session': { post: {} },
       },
     };
 
@@ -134,10 +132,6 @@ describe('OpenAPI route coverage', () => {
     expect(schemes).toHaveProperty('serviceKeyAuth');
     expect((normalized.paths?.['/api/auth/me'] as Record<string, { security?: unknown }>).get.security)
       .toEqual([{ userBearerAuth: [] }]);
-    expect((normalized.paths?.['/api/room/media/realtime/session'] as Record<string, { security?: unknown }>).post.security)
-      .toEqual([{ userBearerAuth: [] }]);
-    expect((normalized.paths?.['/api/room/media/cloudflare_realtimekit/session'] as Record<string, { security?: unknown }>).post.security)
-      .toEqual([{ userBearerAuth: [] }]);
     expect((normalized.paths?.['/api/sql'] as Record<string, { security?: unknown }>).post.security)
       .toEqual([{ serviceKeyAuth: [] }]);
     expect((normalized.paths?.['/admin/api/setup'] as Record<string, { security?: unknown }>).get.security)

package/src/__tests__/room-auth-state-loss.test.ts

@@ -53,6 +53,7 @@ describe('room auth-state loss recovery', () => {
     room._stateSaveAt = 33_333;
     room._emptyRoomCleanupAt = 44_444;
     room._stateTTLAlarmAt = 55_555;
+    room._socketHeartbeatCheckAt = 66_666;
     room.ctx = {
       storage: {
         put: putSpy,
@@ -72,6 +73,7 @@ describe('room auth-state loss recovery', () => {
       stateSaveAt: 33_333,
       emptyRoomCleanupAt: 44_444,
       stateTTLAlarmAt: 55_555,
+      socketHeartbeatCheckAt: 66_666,
     });
   });
 
@@ -112,6 +114,7 @@ describe('room auth-state loss recovery', () => {
     room._stateTTLAlarmAt = null;
     room._metadata = {};
     room.config = {};
+    room.env = {};
     room.ctx = {
       getWebSockets: vi.fn(() => []),
     };
@@ -132,6 +135,7 @@ describe('room auth-state loss recovery', () => {
 
     const room: any = Object.create(RoomRuntimeBaseDO.prototype);
     room._metaCache = new Map();
+    room._attachmentExtraCache = new Map();
     room.ctx = {
       getTags: vi.fn(() => [
         'conn:conn-1',
@@ -171,6 +175,7 @@ describe('room auth-state loss recovery', () => {
       authStateLost: false,
       connectionId: 'conn-1',
     }]]);
+    room._attachmentExtraCache = new Map();
     room.safeSend = vi.fn();
 
     await room.webSocketMessage(ws, JSON.stringify({ type: 'ping' }));
@@ -193,6 +198,7 @@ describe('room auth-state loss recovery', () => {
       authStateLost: true,
       connectionId: 'conn-1',
     }]]);
+    room._attachmentExtraCache = new Map();
     room.safeSend = vi.fn();
 
     await room.webSocketMessage(ws, JSON.stringify({ type: 'ping' }));

package/src/__tests__/room-handler-context.test.ts

@@ -127,35 +127,4 @@ describe('RoomsDO handler context', () => {
       }),
     );
   }, 15_000);
-
-  it('returns 409 when creating a Cloudflare RealtimeKit session while media is already published', async () => {
-    const { RoomsDO } = await import('../durable-objects/rooms-do.js');
-
-    const room: any = Object.create(RoomsDO.prototype);
-    room.readJsonBody = vi.fn().mockResolvedValue({ connectionId: 'conn-1' });
-    room.authenticateRealtimeRequest = vi.fn().mockResolvedValue({
-      memberId: 'member-1',
-      connectionId: 'conn-1',
-      meta: {
-        authenticated: true,
-        connectionId: 'conn-1',
-      },
-    });
-    room.hasPublishedTracks = vi.fn().mockReturnValue(true);
-
-    const response = await room.handleCloudflareRealtimeKitSessionCreate(
-      new Request('http://do/media/cloudflare_realtimekit/session?room=game::room-1', {
-        method: 'POST',
-        body: JSON.stringify({ connectionId: 'conn-1' }),
-        headers: { 'Content-Type': 'application/json' },
-      }),
-      new URL('http://do/media/cloudflare_realtimekit/session?room=game::room-1'),
-    );
-
-    expect(response.status).toBe(409);
-    await expect(response.json()).resolves.toEqual({
-      code: 409,
-      message: 'Unpublish existing room media before creating a new Cloudflare RealtimeKit session',
-    });
-  });
 });

package/src/__tests__/room-rate-limit-scopes.test.ts

@@ -5,7 +5,7 @@ vi.mock('cloudflare:workers', () => ({
 }));
 
 describe('room rate-limit scopes', () => {
-  it('keeps signal/media/admin buckets independent per connection', async () => {
+  it('keeps signal/admin buckets independent per connection', async () => {
     const { RoomRuntimeBaseDO } = await import('../durable-objects/room-runtime-base.js');
 
     const room: any = Object.create(RoomRuntimeBaseDO.prototype);
@@ -13,7 +13,6 @@ describe('room rate-limit scopes', () => {
       rateLimit: {
         actions: 2,
         signals: 4,
-        media: 1,
         admin: 1,
       },
     };
@@ -25,9 +24,6 @@ describe('room rate-limit scopes', () => {
     expect(room.checkRateLimit('conn-1', 'signals')).toBe(true);
     expect(room.checkRateLimit('conn-1', 'signals')).toBe(false);
 
-    expect(room.checkRateLimit('conn-1', 'media')).toBe(true);
-    expect(room.checkRateLimit('conn-1', 'media')).toBe(false);
-
     expect(room.checkRateLimit('conn-1', 'admin')).toBe(true);
     expect(room.checkRateLimit('conn-1', 'admin')).toBe(false);
 

package/src/__tests__/room-runtime-routing.test.ts

@@ -1,4 +1,4 @@
-import { afterEach, describe, expect, it, vi } from 'vitest';
+import { afterEach, describe, expect, it } from 'vitest';
 import { defineConfig } from '@edge-base/shared';
 import { OpenAPIHono, type HonoEnv } from '../lib/hono.js';
 import { setConfig } from '../lib/do-router.js';
@@ -33,21 +33,6 @@ function createRoomApp() {
   return app;
 }
 
-function createAuthedRoomApp() {
-  const app = new OpenAPIHono<HonoEnv>();
-  app.use('/api/*', async (c, next) => {
-    c.set('auth', {
-      id: 'user-1',
-      role: 'user',
-      isAnonymous: false,
-      meta: {},
-    });
-    await next();
-  });
-  app.route('/api/room', roomRoute);
-  return app;
-}
-
 describe('room runtime selection', () => {
   afterEach(() => {
     setConfig({});
@@ -195,99 +180,4 @@ describe('room route runtime routing', () => {
     });
   });
 
-  it('routes room media requests to the rooms runtime', async () => {
-    setConfig(defineConfig({
-      rooms: {
-        game: {
-          runtime: {
-            target: 'rooms',
-          },
-        },
-      },
-    }));
-
-    const doFetch = vi.fn(async (request: Request) => new Response(JSON.stringify({
-      runtime: 'rooms',
-      path: new URL(request.url).pathname,
-      auth: request.headers.get('Authorization'),
-      body: await request.clone().json(),
-    }), {
-      headers: { 'Content-Type': 'application/json' },
-      status: 201,
-    }));
-
-    const env = createRoomRuntimeEnv();
-    env.ROOMS = {
-      idFromName: (name: string) => name as unknown as DurableObjectId,
-      get: () => ({ fetch: doFetch }),
-    } as unknown as DurableObjectNamespace;
-
-    const app = createAuthedRoomApp();
-    const response = await app.request('/api/room/media/realtime/session?namespace=game&id=room-1', {
-      method: 'POST',
-      headers: {
-        Authorization: 'Bearer room-token',
-        'Content-Type': 'application/json',
-      },
-      body: JSON.stringify({ connectionId: 'conn-1' }),
-    }, env);
-
-    expect(response.status).toBe(201);
-    await expect(response.json()).resolves.toMatchObject({
-      runtime: 'rooms',
-      path: '/media/realtime/session',
-      auth: 'Bearer room-token',
-      body: { connectionId: 'conn-1' },
-    });
-    expect(doFetch).toHaveBeenCalledTimes(1);
-    expect(new URL((doFetch.mock.calls[0][0] as Request).url).searchParams.get('room')).toBe('game::room-1');
-  });
-
-  it('routes room cloudflare realtimekit session requests to the rooms runtime', async () => {
-    setConfig(defineConfig({
-      rooms: {
-        game: {
-          runtime: {
-            target: 'rooms',
-          },
-        },
-      },
-    }));
-
-    const doFetch = vi.fn(async (request: Request) => new Response(JSON.stringify({
-      runtime: 'rooms',
-      path: new URL(request.url).pathname,
-      auth: request.headers.get('Authorization'),
-      body: await request.clone().json(),
-    }), {
-      headers: { 'Content-Type': 'application/json' },
-      status: 201,
-    }));
-
-    const env = createRoomRuntimeEnv();
-    env.ROOMS = {
-      idFromName: (name: string) => name as unknown as DurableObjectId,
-      get: () => ({ fetch: doFetch }),
-    } as unknown as DurableObjectNamespace;
-
-    const app = createAuthedRoomApp();
-    const response = await app.request('/api/room/media/cloudflare_realtimekit/session?namespace=game&id=room-1', {
-      method: 'POST',
-      headers: {
-        Authorization: 'Bearer room-token',
-        'Content-Type': 'application/json',
-      },
-      body: JSON.stringify({ connectionId: 'conn-1' }),
-    }, env);
-
-    expect(response.status).toBe(201);
-    await expect(response.json()).resolves.toMatchObject({
-      runtime: 'rooms',
-      path: '/media/cloudflare_realtimekit/session',
-      auth: 'Bearer room-token',
-      body: { connectionId: 'conn-1' },
-    });
-    expect(doFetch).toHaveBeenCalledTimes(1);
-    expect(new URL((doFetch.mock.calls[0][0] as Request).url).searchParams.get('room')).toBe('game::room-1');
-  });
 });

package/src/__tests__/smoke-skip-report.test.ts

@@ -38,7 +38,7 @@ describe('smoke skip report', () => {
       {
         "skippedRouteCount": 0,
         "summaryByReason": {},
-        "totalRoutes": 197,
+        "totalRoutes": 190,
       }
     `);
   });