@edge-base/server 0.2.9 → 0.3.2

package/src/lib/email-provider.ts

@@ -4,7 +4,7 @@
  * Workers cannot use SMTP directly. Instead, we use HTTP REST API-based
  * external email services via a common interface.
  *
- * Supported: Resend (default), SendGrid, Mailgun, AWS SES
+ * Supported: Resend (default), SendGrid, Mailgun, AWS SES, Cloudflare Email Service
  */
 
 // ─── Interface ───
@@ -26,6 +26,24 @@ export interface EmailProvider {
 
 interface EmailProviderEnv {
   EDGEBASE_EMAIL_API_URL?: string;
+  EDGEBASE_EMAIL_CLOUDFLARE_API_TOKEN?: string;
+  EDGEBASE_EMAIL_CLOUDFLARE_ACCOUNT_ID?: string;
+  EDGEBASE_EMAIL_CLOUDFLARE_BINDING?: string;
+  EMAIL?: CloudflareSendEmailBinding;
+}
+
+interface CloudflareSendEmailBinding {
+  send(message: {
+    to: string;
+    from: string;
+    subject: string;
+    html?: string;
+    text?: string;
+  }): Promise<{ messageId?: string }>;
+}
+
+function isCloudflareSendEmailBinding(value: unknown): value is CloudflareSendEmailBinding {
+  return !!value && typeof value === 'object' && typeof (value as { send?: unknown }).send === 'function';
 }
 
 const encoder = new TextEncoder();
@@ -331,14 +349,83 @@ export class SESProvider implements EmailProvider {
   }
 }
 
+// ─── Cloudflare Email Service Provider ───
+
+export class CloudflareEmailProvider implements EmailProvider {
+  private apiBaseUrl: string;
+
+  constructor(
+    private options: {
+      from: string;
+      apiKey?: string;
+      accountId?: string;
+      binding?: CloudflareSendEmailBinding;
+      apiBaseUrl?: string;
+    },
+  ) {
+    this.apiBaseUrl = options.apiBaseUrl?.replace(/\/$/, '') ?? 'https://api.cloudflare.com/client/v4';
+  }
+
+  async send(options: EmailSendOptions): Promise<EmailSendResult> {
+    if (this.options.binding) {
+      try {
+        const result = await this.options.binding.send({
+          to: options.to,
+          from: this.options.from,
+          subject: options.subject,
+          html: options.html,
+        });
+        return { success: true, messageId: result.messageId };
+      } catch (err) {
+        console.error('[EmailProvider:Cloudflare] Workers binding failed:', err);
+        return { success: false };
+      }
+    }
+
+    if (!this.options.apiKey || !this.options.accountId) {
+      console.error(
+        '[EmailProvider:Cloudflare] accountId and apiKey are required when a Workers send_email binding is not available.',
+      );
+      return { success: false };
+    }
+
+    const resp = await fetch(
+      `${this.apiBaseUrl}/accounts/${encodeURIComponent(this.options.accountId)}/email/sending/send`,
+      {
+        method: 'POST',
+        headers: {
+          Authorization: `Bearer ${this.options.apiKey}`,
+          'Content-Type': 'application/json',
+        },
+        body: JSON.stringify({
+          to: options.to,
+          from: this.options.from,
+          subject: options.subject,
+          html: options.html,
+        }),
+      },
+    );
+
+    if (!resp.ok) {
+      const text = await resp.text();
+      console.error('[EmailProvider:Cloudflare] Failed:', resp.status, text);
+      return { success: false };
+    }
+
+    return { success: true };
+  }
+}
+
 // ─── Factory ───
 
 export interface EmailConfig {
-  provider: 'resend' | 'sendgrid' | 'mailgun' | 'ses';
-  apiKey: string;    // SES uses accessKeyId:secretAccessKey[:sessionToken]
+  provider: 'resend' | 'sendgrid' | 'mailgun' | 'ses' | 'cloudflare';
+  apiKey?: string;    // SES uses accessKeyId:secretAccessKey[:sessionToken]
   from: string;
   domain?: string;    // Mailgun domain
   region?: string;    // SES region
+  accountId?: string; // Cloudflare REST API account ID
+  binding?: string;   // Cloudflare Workers send_email binding name
 }
 
 /**
@@ -358,22 +445,45 @@ export function createEmailProvider(
     return null;
   }
 
-  if (!config.apiKey || !config.from) {
-    console.warn('[EmailProvider] apiKey and from are required. Email features disabled.');
+  if (!config.from) {
+    console.warn('[EmailProvider] from is required. Email features disabled.');
     return null;
   }
 
   switch (config.provider) {
+    case 'cloudflare': {
+      const bindingName = config.binding
+        ?? env?.EDGEBASE_EMAIL_CLOUDFLARE_BINDING?.trim()
+        ?? 'EMAIL';
+      const envRecord = env as Record<string, unknown> | undefined;
+      const bindingCandidate = envRecord?.[bindingName];
+      const binding = isCloudflareSendEmailBinding(bindingCandidate)
+        ? bindingCandidate
+        : undefined;
+      return new CloudflareEmailProvider({
+        from: config.from,
+        apiKey: config.apiKey ?? env?.EDGEBASE_EMAIL_CLOUDFLARE_API_TOKEN,
+        accountId: config.accountId ?? env?.EDGEBASE_EMAIL_CLOUDFLARE_ACCOUNT_ID,
+        binding,
+      });
+    }
     case 'resend':
+      if (!config.apiKey) break;
       return new ResendProvider(config.apiKey, config.from);
     case 'sendgrid':
+      if (!config.apiKey) break;
       return new SendGridProvider(config.apiKey, config.from);
     case 'mailgun':
+      if (!config.apiKey) break;
       return new MailgunProvider(config.apiKey, config.from, config.domain);
     case 'ses':
+      if (!config.apiKey) break;
       return new SESProvider(config.apiKey, config.from, config.region);
     default:
       console.warn(`[EmailProvider] Unknown provider: ${config.provider}. Email features disabled.`);
       return null;
   }
+
+  console.warn('[EmailProvider] apiKey and from are required. Email features disabled.');
+  return null;
 }

package/src/lib/errors.ts

@@ -119,8 +119,9 @@ export function normalizeDatabaseError(error: unknown): EdgeBaseError | null {
 
   const haystack = `${message}\n${causeMessage}`.trim();
 
-  if (/foreign key constraint failed/i.test(haystack)) {
-    // Try to extract column name from D1/SQLite error: "FOREIGN KEY constraint failed: tableName.columnName"
+  // Matches both SQLite/D1 ("FOREIGN KEY constraint failed: table.column") and
+  // PostgreSQL ('... violates foreign key constraint "table_col_fkey"') phrasings.
+  if (/foreign key constraint failed|violates foreign key constraint/i.test(haystack)) {
     const colMatch = haystack.match(/foreign key constraint failed[:\s]*(?:\w+\.)?(\w+)/i);
     const detail = colMatch?.[1]
       ? `Referenced record does not exist (column: '${colMatch[1]}').`
@@ -137,8 +138,11 @@ export function normalizeDatabaseError(error: unknown): EdgeBaseError | null {
     return new EdgeBaseError(409, detail, undefined, 'record-already-exists');
   }
 
-  if (/not null constraint failed|check constraint failed/i.test(haystack)) {
-    const colMatch = haystack.match(/(?:not null|check) constraint failed[:\s]*(?:\w+\.)?(\w+)/i);
+  // Matches SQLite/D1 ("NOT NULL constraint failed: table.column") and
+  // PostgreSQL ('null value in column "col" ... violates not-null constraint').
+  if (/not null constraint failed|check constraint failed|null value in column .* violates not-null constraint/i.test(haystack)) {
+    const colMatch = haystack.match(/(?:not null|check) constraint failed[:\s]*(?:\w+\.)?(\w+)/i)
+      ?? haystack.match(/null value in column "?(\w+)"?/i);
     const detail = colMatch?.[1]
       ? `Database constraint violated (column: '${colMatch[1]}'). Ensure all required fields are provided.`
       : 'Request violates a database constraint. Ensure all required fields are provided.';

package/src/lib/functions.ts

@@ -41,6 +41,7 @@ import { generateId } from './uuid.js';
 import { DbRef, TableRef, DefaultDbApi, HttpClient, ContextManager } from '@edge-base/core';
 import { InternalHttpTransport } from './internal-transport.js';
 import { executeProviderAwareSql } from './provider-aware-sql.js';
+import { createEmailProvider } from './email-provider.js';
 
 // ─── Function Context Types ───
 
@@ -69,6 +70,15 @@ export interface AdminAuthContext {
   revokeAllSessions(userId: string): Promise<void>;
 }
 
+export interface FunctionEmailProxy {
+  send(options: {
+    to: string;
+    subject: string;
+    html?: string;
+    text?: string;
+  }): Promise<{ success: boolean; messageId?: string }>;
+}
+
 /**
  * AdminEdgeBase-shaped context object injected as context.admin.
  *
@@ -186,6 +196,8 @@ export interface FunctionPushProxy {
 
 /** Storage proxy for App Functions — wraps R2Bucket with convenience methods. */
 export interface FunctionStorageProxy {
+  /** Return a proxy scoped to a named storage bucket. */
+  bucket(bucket: string): FunctionStorageProxy;
   put(
     key: string,
     value: ReadableStream | ArrayBuffer | string,
@@ -199,6 +211,10 @@ export interface FunctionStorageProxy {
   } | null>;
   delete(key: string): Promise<void>;
   getSignedUrl(key: string, options?: { expiresIn?: number }): Promise<string>;
+  getSignedUploadUrl(
+    key: string,
+    options?: { expiresIn?: number; maxBytes?: number | null },
+  ): Promise<{ url: string; expiresAt: string; maxBytes: number | null }>;
   list(options?: { prefix?: string; limit?: number; cursor?: string }): Promise<{
     keys: Array<{ key: string; size: number; contentType: string }>;
     cursor?: string;
@@ -357,12 +373,29 @@ export interface FunctionContext {
   data?: { before?: Record<string, unknown>; after?: Record<string, unknown> };
   before?: Record<string, unknown>;
   after?: Record<string, unknown>;
+  /** Configured server-side email sender, when an EdgeBase email provider is available. */
+  email?: FunctionEmailProxy;
+  /** Environment variables, secrets, and bindings available to the Worker. */
+  env?: Record<string, unknown>;
   storage?: FunctionStorageProxy; // Available when R2 binding present
   analytics?: unknown; // AnalyticsAdapter when ANALYTICS_APP binding present
   /** Plugin-specific config from edgebase.config.ts plugins section. */
   pluginConfig?: Record<string, unknown>;
 }
 
+function escapeEmailHtml(value: string): string {
+  return value
+    .replace(/&/g, '&amp;')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;')
+    .replace(/"/g, '&quot;')
+    .replace(/'/g, '&#39;');
+}
+
+function textEmailToHtml(text: string): string {
+  return `<pre style="font-family: ui-sans-serif, system-ui, -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif; white-space: pre-wrap;">${escapeEmailHtml(text)}</pre>`;
+}
+
 // ─── Function Registry ───
 
 /**
@@ -693,6 +726,19 @@ export function wrapMethodExport(
   method: string,
   runtimeTrigger?: { path?: string },
 ): FunctionDefinition {
+  if (
+    method === '*' &&
+    handler &&
+    typeof handler === 'object' &&
+    'handler' in handler &&
+    'trigger' in handler &&
+    handler.trigger &&
+    typeof handler.trigger === 'object' &&
+    'type' in handler.trigger
+  ) {
+    return handler as FunctionDefinition;
+  }
+
   // handler can be: raw function, or { handler, captcha? } from defineFunction()
   let fn: (ctx: unknown) => Promise<unknown>;
   let captcha: boolean | undefined;
@@ -1096,6 +1142,19 @@ export function buildFunctionContext(options: BuildFunctionContextOptions): Func
     executionCtx: options.executionCtx,
     preferDirectDo: options.preferDirectDoDb,
   });
+  const emailProvider = createEmailProvider(options.config.email, options.env);
+  const email: FunctionEmailProxy | undefined = emailProvider
+    ? {
+        async send(message) {
+          const to = message.to.trim();
+          const subject = message.subject.trim();
+          if (!to) throw new Error('email.send() requires a recipient.');
+          if (!subject) throw new Error('email.send() requires a subject.');
+          const html = message.html ?? textEmailToHtml(message.text ?? '');
+          return emailProvider.send({ to, subject, html });
+        },
+      }
+    : undefined;
   const sqlProviderAware = (
     namespace: string,
     id: string | undefined,
@@ -1282,6 +1341,8 @@ export function buildFunctionContext(options: BuildFunctionContextOptions): Func
     auth: options.auth,
     db: admin.db,
     admin,
+    ...(options.env ? { env: options.env as unknown as Record<string, unknown> } : {}),
+    ...(email ? { email } : {}),
     params: options.params ?? {},
   };
 
@@ -1826,6 +1887,10 @@ export function buildFunctionStorageProxy(
   const prefix = (key: string) => `${bucket}/${key}`;
 
   return {
+    bucket(name) {
+      return buildFunctionStorageProxy(r2, name, env, workerUrl);
+    },
+
     async put(key, value, options) {
       const httpMeta: R2PutOptions = {};
       if (options?.contentType) httpMeta.httpMetadata = { contentType: options.contentType };
@@ -1853,11 +1918,36 @@ export function buildFunctionStorageProxy(
       if (!secret) throw new Error('Signed URLs require JWT_USER_SECRET to be configured.');
       const expiresIn = options?.expiresIn ?? 3600;
       const expiresAt = Date.now() + expiresIn * 1000;
-      const token = await createSignedToken(key, bucket, expiresAt, secret);
+      const obj = await r2.head(prefix(key));
+      const token = await createSignedToken(key, bucket, expiresAt, secret, obj ? {
+        file: {
+          size: obj.size,
+          contentType: obj.httpMetadata?.contentType || 'application/octet-stream',
+          etag: obj.etag,
+          uploadedAt: obj.uploaded?.toISOString(),
+        },
+      } : undefined);
       const base = workerUrl ?? 'http://localhost:8787';
       return `${base}/api/storage/${encodeURIComponent(bucket)}/${key}?token=${token}`;
     },
 
+    async getSignedUploadUrl(key, options) {
+      const secret = (env as unknown as Record<string, string>).JWT_USER_SECRET;
+      if (!secret) throw new Error('Signed upload URLs require JWT_USER_SECRET to be configured.');
+      const expiresIn = options?.expiresIn ?? 1800;
+      const expiresAt = Date.now() + expiresIn * 1000;
+      const maxBytes = typeof options?.maxBytes === 'number' && Number.isFinite(options.maxBytes)
+        ? Math.max(0, Math.trunc(options.maxBytes))
+        : null;
+      const token = await createSignedToken(key, bucket, expiresAt, secret, maxBytes);
+      const base = workerUrl ?? 'http://localhost:8787';
+      return {
+        url: `${base}/api/storage/${encodeURIComponent(bucket)}/upload?token=${token}&key=${encodeURIComponent(key)}`,
+        expiresAt: new Date(expiresAt).toISOString(),
+        maxBytes,
+      };
+    },
+
     async list(options) {
       const r2Options: R2ListOptions = {};
       if (options?.prefix) r2Options.prefix = prefix(options.prefix);

package/src/lib/internal-transport.ts

@@ -11,6 +11,7 @@ import type { EdgeBaseConfig } from '@edge-base/shared';
 import {
   callDO,
   formatDbTargetValidationIssue,
+  getD1BindingName,
   getDbDoName,
   resolveDbTarget,
   shouldRouteToD1,
@@ -76,6 +77,16 @@ function parsePath(
   } else {
     // Heuristic fallback: find first 'tables' keyword
     tablesIdx = segments.indexOf('tables', 1);
+    if (tablesIdx < 0) tablesIdx = segments.indexOf('transact', 1);
+  }
+  // DB-level transact path has no table segment: /{ns}/transact or /{ns}/{id}/transact
+  if (segments[tablesIdx] === 'transact' && tablesIdx === segments.length - 1) {
+    return {
+      namespace: segments[0],
+      instanceId: tablesIdx === 2 ? segments[1] : undefined,
+      tableName: '',
+      directPath: '/transact',
+    };
   }
   if (tablesIdx < 0 || segments[tablesIdx] !== 'tables') {
     throw new Error(`Invalid DB path: missing 'tables' segment in ${path}`);
@@ -94,6 +105,12 @@ function parsePath(
   return { namespace, instanceId, tableName, directPath };
 }
 
+function hasD1Binding(env: Env | undefined, namespace: string): boolean {
+  if (!env) return false;
+  const bindingName = getD1BindingName(namespace);
+  return Boolean((env as unknown as Record<string, unknown>)[bindingName]);
+}
+
 export class InternalHttpTransport implements HttpTransport {
   private readonly databaseNamespace: DurableObjectNamespace;
   private readonly config: EdgeBaseConfig;
@@ -196,7 +213,14 @@ export class InternalHttpTransport implements HttpTransport {
     const httpMethod = method === 'PUT' ? 'PATCH' : method; // normalize PUT → PATCH
 
     // 1. D1 route
-    if (!this.preferDirectDo && !dynamic && shouldRouteToD1(namespace, this.config) && this.env) {
+    const shouldUseD1 =
+      !this.preferDirectDo
+      && !dynamic
+      && shouldRouteToD1(namespace, this.config)
+      && this.env
+      && (provider === 'd1' || hasD1Binding(this.env, namespace));
+
+    if (shouldUseD1) {
       return this.requestViaD1Handler(httpMethod, namespace, normalizedInstanceId, tableName, directPath, headers, query, body);
     }
 

package/src/lib/jwt.ts

@@ -22,6 +22,7 @@ export interface RefreshTokenPayload {
   sub: string;          // userId
   type: 'refresh';
   jti?: string;         // unique session ID for token uniqueness
+  nonce?: string;       // per-token randomness while preserving session jti
 }
 
 export interface AdminTokenPayload {
@@ -106,6 +107,7 @@ export async function signRefreshToken(
 ): Promise<string> {
   const builder = new SignJWT({
     type: 'refresh',
+    nonce: payload.nonce ?? crypto.randomUUID(),
   })
     .setProtectedHeader({ alg: ALGORITHM })
     .setIssuedAt()