@entrinsik/vite-plugin-informer 2.10.0 → 2.11.0

package/src/index.js

@@ -8,7 +8,8 @@ import { buildDeclarations } from './openapi-to-dts.js';
 import { loadEnv, envWritePath } from './env.js';
 import { createMiddleware as createServerRoutes } from './server-routes.js';
 import { createAgentMiddleware } from './agent-dev.js';
-import { createDevChannels, validateChannels, BROADCAST_EVENT, DEV_CHANNEL_EVENT } from './dev-channels.js';
+import { createDevChannels, validateChannels, BROADCAST_EVENT, DEV_CHANNEL_EVENT, DEV_CHANNEL_API } from './dev-channels.js';
+import { createDevChannelHandlers, validateChannelHandlers } from './dev-channel-handlers.js';
 import { renderDevChannelScript } from './dev-channel-shim.js';
 import { createStreamStore, createUploadsMiddleware, createDownloadsMiddleware } from './dev-streams.js';
 import { streamsClientSource } from './streams-client.js';
@@ -96,8 +97,9 @@ async function writeAppDepTypes (projectRoot, dts) {
  *
  * - Proxies /api requests to the Informer server with Basic auth
  * - Runs server/ route handlers locally via ssrLoadModule (if server/ dir exists)
- * - Injects window.__INFORMER__ context mock in dev mode, including a
- *   `channel()` mock fed by handler broadcast() over Vite's dev websocket
+ * - Runs channels/ handlers locally (join / joined / leave / send) behind
+ *   the `channel()` mock injected with the window.__INFORMER__ context in
+ *   dev mode, whose frames arrive over Vite's dev websocket
  * - Sets base to './' so built assets use relative paths
  *
  * @param {Object} [options]
@@ -257,6 +259,15 @@ export default function informer(options = {}) {
             } catch (err) {
                 console.warn(`[informer] Could not read informer.yaml channels: ${err.message}`);
             }
+            // And for channels/ files — the deploy 400s on a stray export or a
+            // path no page can subscribe to.
+            try {
+                for (const message of await validateChannelHandlers(projectRoot)) {
+                    console.error(`[informer] ${message}`);
+                }
+            } catch (err) {
+                console.warn(`[informer] Could not read channels/: ${err.message}`);
+            }
 
             // App Channels in dev. Handlers' broadcast() (and the `channels:`
             // relay behind emit()) publish frames on this hub; each frame goes
@@ -265,10 +276,24 @@ export default function informer(options = {}) {
             // import.meta.hot. Riding the HMR socket means no second websocket,
             // no `ws: true` on the /api proxy and no socket credential to mint
             // — the dev server already owns a live connection to every page.
+            // Every page receives every frame; the subscribe loop mounted below
+            // (join / joined / leave / send against channels/ files) is what
+            // tells a page which channels it may dispatch.
             const channels = createDevChannels({ appId: buildMock(options).report.id });
             channels.emitter.on(BROADCAST_EVENT, (frame) => {
                 server.ws.send({ type: 'custom', event: DEV_CHANNEL_EVENT, data: frame });
             });
+            server.middlewares.use(DEV_CHANNEL_API, createDevChannelHandlers(server, {
+                serverOrigin,
+                authHeader,
+                devWorkspaceId,
+                projectRoot,
+                devBindings: options.devBindings || {},
+                appToken,
+                channels,
+                user: buildMock(options).user,
+                roles: (options.mock && options.mock.roles) || []
+            }));
 
             // Generate .d.ts types for bound `target: app` / `target: pack`
             // deps from their published OpenAPI docs, so server/ handlers get

package/src/server-routes.js

@@ -1,25 +1,12 @@
 import { readdir, stat } from 'node:fs/promises';
-import { join, relative, posix } from 'node:path';
+import { join } from 'node:path';
 import { parse as parseUrl } from 'node:url';
-import { loadManifest, manifestBlock, buildDevContext, buildDevCrypto, buildDevMessaging, normalizeFetchPath } from './dev-dependencies.js';
-import { createDevChannels, createDevEmit } from './dev-channels.js';
-import { devPlatform } from './dev-platform.js';
+import { createDevBagBuilder, buildDevUser } from './dev-bag.js';
+import { createDevChannels } from './dev-channels.js';
 import { createStreamStore, createStreamServices, isStreamRef, serveDownload as serveDevDownload } from './dev-streams.js';
 
-// embed() is present on a real install even without the embeddings
-// capability, where it throws a written explanation. Mirroring that here
-// keeps the dev failure the same lesson as the deployed one, instead of a
-// bare "embed is not a function" that reads like a missing binding.
-const embed = async () => {
-    throw new Error('embed() is not available in the dev mirror: the embeddings capability needs a real Informer (platform.capabilities.embeddings is false)');
-};
-
 const VALID_METHODS = ['GET', 'POST', 'PUT', 'PATCH', 'DELETE'];
 
-// Cap dev proxy calls at 30s so a hung upstream fails loudly instead of
-// hanging the handler.
-const FETCH_TIMEOUT_MS = 30000;
-
 // Strict base64 — see view-api.js for the rationale. Mirror kept identical to
 // keep dev and prod behavior aligned, down to the scan: the quantified
 // /^[A-Za-z0-9+/]+={0,2}$/ throws "RangeError: Maximum call stack size
@@ -37,17 +24,19 @@ function isBase64(s) {
 }
 
 /**
- * Convert a file path under server/ to a route path.
+ * Convert a file path under a handler directory to a route path (mirrors the
+ * server's route-scanner.js filePathToRoute).
  *
  * Examples:
- *   server/orders/index.js     -> /orders
- *   server/orders/[id].js      -> /orders/:id
+ *   server/orders/index.js        -> /orders
+ *   server/orders/[id].js         -> /orders/:id
  *   server/orders/[id]/approve.js -> /orders/:id/approve
- *   server/index.js            -> /
+ *   server/index.js               -> /
+ *   channels/rooms/[room].js      -> /rooms/:room   (dirPrefix 'channels')
  */
-function filePathToRoute(filePath) {
+function filePathToRoute(filePath, dirPrefix = 'server') {
     let route = filePath
-        .replace(/^server\//, '')
+        .replace(new RegExp(`^${dirPrefix}/`), '')
         .replace(/\.js$/, '');
 
     route = route.replace(/\[([^\]]+)\]/g, ':$1');
@@ -143,7 +132,7 @@ async function scanRoutes(serverDir) {
     }));
 }
 
-export { filePathToRoute, walkJsFiles };
+export { filePathToRoute, matchRoute, walkJsFiles };
 
 async function walkJsFiles(dir, basePath) {
     const results = [];
@@ -169,6 +158,54 @@ async function walkJsFiles(dir, basePath) {
     return results;
 }
 
+/**
+ * Write a handler's `{ status, headers?, body?, encoding? }` response
+ * descriptor (mirrors app-sandbox.js buildInvokeScript / respondCallback).
+ * The encoding allow-list and contract checks are enforced inside the ivm in
+ * production; replicated here so handlers see the same errors in dev (where
+ * there's no isolate to attribute the throw to). If you change this, mirror
+ * it in modules/app/routes/view-api.js.
+ */
+function sendDescriptor(res, result) {
+    const encoding = typeof result.encoding === 'string' ? result.encoding : null;
+    if (encoding !== null && encoding !== 'base64') {
+        throw new Error(`Unknown response encoding: ${JSON.stringify(encoding)} (expected 'base64' or omitted)`);
+    }
+    if (encoding === 'base64' && typeof result.body !== 'string') {
+        throw new Error(`encoding: 'base64' requires body to be a base64-encoded string, got ${typeof result.body}`);
+    }
+    const responseBody = result.body !== undefined ? result.body : null;
+
+    res.statusCode = result.status || 200;
+    for (const [key, value] of Object.entries(result.headers || {})) {
+        res.setHeader(key, value);
+    }
+
+    if (responseBody === null) {
+        res.end();
+    } else if (encoding === 'base64') {
+        if (!isBase64(responseBody)) {
+            throw new Error('Handler returned malformed base64 body');
+        }
+        res.end(Buffer.from(responseBody, 'base64'));
+    } else if (typeof responseBody === 'string') {
+        // Strings go out verbatim, as prod passes them.
+        if (!res.getHeader('content-type')) {
+            res.setHeader('Content-Type', 'application/json');
+        }
+        res.end(responseBody);
+    } else {
+        if (!res.getHeader('content-type')) {
+            res.setHeader('Content-Type', 'application/json');
+        }
+        res.end(JSON.stringify(responseBody));
+    }
+}
+
+function isDescriptor(value) {
+    return value !== null && typeof value === 'object' && typeof value.status === 'number';
+}
+
 /**
  * Create Connect middleware for dev-mode server route execution.
  *
@@ -188,99 +225,13 @@ async function walkJsFiles(dir, basePath) {
  * @returns {Function} Connect middleware
  */
 export function createMiddleware(viteServer, { serverOrigin, authHeader, devWorkspaceId, projectRoot, roles, user, devBindings, appToken, channels = createDevChannels(), streamStore }) {
-    // The viewer identity dev handlers see — the same object the page gets as
-    // window.__INFORMER__.user, so `@user/${request.user.username}` on the
-    // server names the channel the page subscribes to.
-    const devUser = {
-        username: (user && user.username) || 'dev',
-        displayName: (user && user.displayName) || 'Local Developer',
-        email: (user && user.email) || null,
-        timezone: (user && user.timezone) || null
-    };
+    // `@user/${request.user.username}` on the server names the channel the
+    // page subscribes to.
+    const devUser = buildDevUser(user);
     const serverDir = join(projectRoot, 'server');
     const streams = streamStore || createStreamStore();
-
-    // query() implementation — proxies to the workspace _sql endpoint
-    async function query(sql, params) {
-        if (!devWorkspaceId) {
-            throw new Error('query() requires INFORMER_DEV_WORKSPACE. Run: npx informer-workspace init');
-        }
-
-        const resp = await globalThis.fetch(`${serverOrigin}/api/datasources/${devWorkspaceId}/_sql`, {
-            method: 'POST',
-            headers: { 'Content-Type': 'application/json', Authorization: authHeader },
-            body: JSON.stringify({ sql, params: params || [] })
-        });
-
-        if (!resp.ok) {
-            const err = await resp.json().catch(() => ({}));
-            const detail = err.message || resp.statusText;
-            throw new Error(`query() failed: ${resp.status} ${detail} (${serverOrigin}/api/datasources/${devWorkspaceId}/_sql)`);
-        }
-
-        const data = await resp.json();
-        return data.rows;
-    }
-
-    // fetch() implementation — proxies API calls to the Informer server
-    async function fetchAs(auth, path, opts = {}) {
-        const method = (opts.method || 'GET').toUpperCase();
-        // Same strict canonicalization as prod (app-sandbox.js normalizeFetchPath);
-        // reject non-canonical shapes here instead of silently accepting them.
-        const apiPath = normalizeFetchPath(path);
-        if (!apiPath) {
-            return { status: 400, body: { error: `Invalid fetch path: ${String(path).slice(0, 80)}` }, contentType: 'application/json' };
-        }
-        const url = `${serverOrigin}${apiPath}`;
-        const fetchOpts = {
-            method,
-            headers: { Authorization: auth, 'Content-Type': 'application/json', ...(opts.headers || {}) }
-        };
-
-        if (opts.body && ['POST', 'PUT', 'PATCH', 'DELETE'].includes(method)) {
-            fetchOpts.body = JSON.stringify(opts.body);
-        }
-
-        // Read the stream exactly once — `.json()` consumes/locks the body, so a
-        // `.text()` fallback would throw "Body is unusable" on any non-JSON
-        // response (auth-bounce HTML, proxy error page). Parse in memory
-        // instead — same as prod's unwrapInject.
-        let status, contentType, text;
-        try {
-            const resp = await globalThis.fetch(url, { ...fetchOpts, signal: AbortSignal.timeout(FETCH_TIMEOUT_MS) });
-            status = resp.status;
-            contentType = resp.headers.get('content-type') || '';
-            text = await resp.text();
-        } catch (err) {
-            // Transport failure or timeout — fetch throws (TypeError 'fetch failed'
-            // with the real reason on err.cause, or a TimeoutError). Return a
-            // synthetic 502 so the dependency layer names it (dep + url + cause)
-            // rather than a bare unhandled "fetch failed".
-            const reason = (err.cause && err.cause.message) || err.message;
-            return { status: 502, body: { message: `fetch to ${url} failed: ${reason}` }, contentType: 'application/json' };
-        }
-        let body;
-        try { body = JSON.parse(text); } catch { body = text; }
-        return { status, body, contentType };
-    }
-
-    async function apiFetch(path, opts = {}) {
-        return await fetchAs(authHeader, path, opts);
-    }
-
-    // Cross-app request() targets /api/apps/<id>/view/_/<path>, whose auth accepts
-    // only the token/session strategies — NOT basic auth. In API-key mode the
-    // INFORMER_API_KEY Bearer already satisfies that, so reuse it; under basic
-    // auth a separate API token (INFORMER_APP_TOKEN) is required, and without one
-    // the app proxy's request() throws a pointed error instead of a bare 401.
-    // appFetch also stamps x-informer-app-depth:1 so the target runs one hop deep
-    // and enforces the same one-hop guard it does in production.
-    const appAuth = appToken
-        ? `Bearer ${appToken}`
-        : (authHeader && authHeader.startsWith('Bearer ') ? authHeader : null);
-    const appFetch = appAuth
-        ? async (path, opts = {}) => await fetchAs(appAuth, path, { ...opts, headers: { ...(opts.headers || {}), 'x-informer-app-depth': '1' } })
-        : null;
+    const bagBuilder = createDevBagBuilder({ serverOrigin, authHeader, devWorkspaceId, projectRoot, devBindings, appToken, channels, logPrefix: '[app]' });
+    const { query } = bagBuilder;
 
     return async function serverRoutesMiddleware(req, res, next) {
         try {
@@ -325,34 +276,6 @@ export function createMiddleware(viteServer, { serverOrigin, authHeader, devWork
                 try { body = JSON.parse(rawBody); } catch { body = rawBody; }
             }
 
-            // crypto helper — mirrors the prod sandbox crypto surface
-            const cryptoHelper = buildDevCrypto();
-
-            // log helper — mirrors sandbox log(message, data) + log.info/warn/error/debug
-            const logCall = (level, message, data) => {
-                const msg = typeof message === 'string' ? message : JSON.stringify(message);
-                const args = [`[app-log] [${level}] ${msg}`];
-                if (data) args.push(data);
-                console.log(...args);
-            };
-            const log = Object.assign(
-                (message, data) => logCall('info', message, data),
-                {
-                    debug: (message, data) => logCall('debug', message, data),
-                    info: (message, data) => logCall('info', message, data),
-                    warn: (message, data) => logCall('warn', message, data),
-                    error: (message, data) => logCall('error', message, data)
-                }
-            );
-
-            // markdown helper — passthrough in dev (production uses `marked`)
-            const markdown = (text) => text;
-
-            // notify/email — delivery is a console-logged no-op in dev, but the
-            // required-field validation mirrors prod so an app that passes here
-            // won't 500 in production.
-            const { notify, email } = buildDevMessaging('[app]');
-
             // Build request context
             const request = {
                 method: req.method.toUpperCase(),
@@ -387,8 +310,11 @@ export function createMiddleware(viteServer, { serverOrigin, authHeader, devWork
                 serveDevDownload(streams, item, res);
             }
 
-            // respond() — sends early response, handler continues in background.
-            // respond(download) streams the staged bytes instead of JSON.
+            // respond() — sends the early response, the handler continues in
+            // the background. A `{ status, headers?, body?, encoding? }`
+            // descriptor is honored as such (app-sandbox.js respondCallback);
+            // anything else is wrapped as 200 JSON; a download handle streams
+            // the staged bytes.
             let responded = false;
             async function respond(earlyBody) {
                 if (responded) return;
@@ -401,29 +327,16 @@ export function createMiddleware(viteServer, { serverOrigin, authHeader, devWork
                     return serveDownloadHandle(earlyBody);
                 }
                 responded = true;
+                if (isDescriptor(earlyBody)) return sendDescriptor(res, earlyBody);
                 res.statusCode = 200;
                 res.setHeader('Content-Type', 'application/json');
                 res.end(JSON.stringify(earlyBody));
             }
 
-            // Build the dependency-injection context the same way the prod
-            // sandbox does, so handlers using `await context.myDep.method(...)`
-            // work locally. The manifest is parsed once per request (deps, env
-            // and channels all come from that one read) so edits to
-            // informer.yaml take effect without a dev-server restart.
-            const manifest = await loadManifest(projectRoot);
-            const deps = manifestBlock(manifest, 'dependencies');
-            const context = buildDevContext({ deps, apiFetch, devBindings, appFetch });
-            const env = manifestBlock(manifest, 'env');
-
-            // emit() writes no app_event row in dev, but still relays a listed
-            // event to its `channels:` channel; broadcast() publishes a live
-            // frame to the page (see dev-channels.js).
-            const emit = createDevEmit({ channels, manifestChannels: manifestBlock(manifest, 'channels'), logPrefix: '[app-event]' });
-            const { broadcast } = channels;
+            const { bag } = await bagBuilder.build();
 
             // Call handler — bag mirrors the prod sandbox (see app-sandbox.js).
-            const result = await handler({ request, context, query: streamQuery, fetch: apiFetch, respond, emit, broadcast, notify, email, embed, crypto: cryptoHelper, markdown, uploads: streamServices.uploads, downloads: streamServices.downloads, log, env, platform: devPlatform() });
+            const result = await handler({ ...bag, request, query: streamQuery, respond, uploads: streamServices.uploads, downloads: streamServices.downloads });
 
             // Seal any download the handler left open (prod finalizes the same way).
             await streamServices.finalize();
@@ -434,60 +347,14 @@ export function createMiddleware(viteServer, { serverOrigin, authHeader, devWork
             // A returned download handle streams as the response.
             if (isStreamRef(result, 'download')) return serveDownloadHandle(result);
 
-            // Normalize response (mirrors app-sandbox.js buildInvokeScript logic).
-            // The encoding allow-list and contract checks are enforced inside the
-            // ivm in production; replicate them here so handlers see the same
-            // errors in dev (where there's no isolate to attribute the throw to).
-            // If you change this, mirror it in modules/app/routes/view-api.js.
-            let status, responseBody, responseHeaders, encoding;
-
+            // Normalize the return value (mirrors app-sandbox.js buildInvokeScript).
             if (result === undefined || result === null) {
-                status = 204;
-                responseBody = null;
-                responseHeaders = {};
-            } else if (typeof result === 'object' && typeof result.status === 'number') {
-                encoding = typeof result.encoding === 'string' ? result.encoding : null;
-                if (encoding !== null && encoding !== 'base64') {
-                    throw new Error(`Unknown response encoding: ${JSON.stringify(encoding)} (expected 'base64' or omitted)`);
-                }
-                if (encoding === 'base64' && typeof result.body !== 'string') {
-                    throw new Error(`encoding: 'base64' requires body to be a base64-encoded string, got ${typeof result.body}`);
-                }
-                status = result.status || 200;
-                responseBody = result.body !== undefined ? result.body : null;
-                responseHeaders = result.headers || {};
-            } else {
-                status = 200;
-                responseBody = result;
-                responseHeaders = { 'content-type': 'application/json' };
-            }
-
-            res.statusCode = status;
-            for (const [key, value] of Object.entries(responseHeaders)) {
-                res.setHeader(key, value);
-            }
-
-            if (responseBody === null) {
+                res.statusCode = 204;
                 res.end();
-            } else if (encoding === 'base64' && typeof responseBody === 'string') {
-                if (!isBase64(responseBody)) {
-                    throw new Error('Handler returned malformed base64 body');
-                }
-                res.end(Buffer.from(responseBody, 'base64'));
-            } else if (typeof responseBody === 'string') {
-                // Pre-PR the dev middleware always JSON.stringify'd the body, so
-                // a handler returning { body: 'hello' } emitted "hello" (with
-                // quotes) — diverging from prod which passed strings verbatim.
-                // This branch fixes that parity.
-                if (!res.getHeader('content-type')) {
-                    res.setHeader('Content-Type', 'application/json');
-                }
-                res.end(responseBody);
+            } else if (isDescriptor(result)) {
+                sendDescriptor(res, result);
             } else {
-                if (!res.getHeader('content-type')) {
-                    res.setHeader('Content-Type', 'application/json');
-                }
-                res.end(JSON.stringify(responseBody));
+                sendDescriptor(res, { status: 200, headers: { 'content-type': 'application/json' }, body: result });
             }
         } catch (err) {
             viteServer.ssrFixStacktrace(err);