@entrinsik/vite-plugin-informer 2.3.0 → 2.5.0-beta.0

package/src/index.js

@@ -1,8 +1,9 @@
-import dotenv from 'dotenv';
 import { existsSync } from 'node:fs';
 import { readFile } from 'node:fs/promises';
 import { resolve } from 'node:path';
 import { createClient } from './client.js';
+import { loadDependencies, validateDependencies } from './dev-dependencies.js';
+import { loadEnv, envWritePath } from './env.js';
 import { createMiddleware as createServerRoutes } from './server-routes.js';
 import { createAgentMiddleware } from './agent-dev.js';
 import { init, migrate } from './workspace.js';
@@ -23,12 +24,14 @@ export default function informer(options = {}) {
     let authHeader = null;
     let serverOrigin = null;
     let devWorkspaceId = null;
+    let activeMode = null;
 
     return {
         name: 'vite-plugin-informer',
 
-        config(_, { command }) {
-            dotenv.config();
+        config(_, { command, mode }) {
+            activeMode = mode;
+            loadEnv({ mode });
 
             isDev = command === 'serve';
 
@@ -57,7 +60,8 @@ export default function informer(options = {}) {
                                 changeOrigin: true,
                                 headers: {
                                     Authorization: authHeader
-                                }
+                                },
+                                ...options.proxy
                             }
                         }
                     };
@@ -106,7 +110,7 @@ export default function informer(options = {}) {
                             api,
                             slug,
                             migrationsDir,
-                            envPath: resolve(projectRoot, '.env')
+                            envPath: envWritePath({ mode: activeMode })
                         });
                         devWorkspaceId = result.workspaceId;
                     }
@@ -116,6 +120,19 @@ export default function informer(options = {}) {
                 }
             }
 
+            // Surface manifest-level dependency declaration errors at boot,
+            // not at `npx informer publish` time. Matches the deploy.js
+            // validation so devs see the same wording pre-deploy.
+            try {
+                const deps = await loadDependencies(projectRoot);
+                const errors = validateDependencies(deps);
+                for (const message of errors) {
+                    console.error(`[informer] informer.yaml: ${message}`);
+                }
+            } catch (err) {
+                console.warn(`[informer] Could not validate informer.yaml dependencies: ${err.message}`);
+            }
+
             // Mount server-side route handlers if a server/ directory exists
             const serverDir = resolve(projectRoot, 'server');
 

package/src/publish.js

@@ -0,0 +1,97 @@
+import { mkdtemp, mkdir, copyFile, rm, readFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join, dirname } from 'node:path';
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+
+const execFileP = promisify(execFile);
+
+class PublishError extends Error {
+    constructor(status, body, url) {
+        super(`Marketplace publish failed: ${status}${body ? ` — ${body}` : ''}${url ? ` (${url})` : ''}`);
+        this.name = 'PublishError';
+        this.status = status;
+        this.body = body;
+        this.url = url;
+    }
+}
+
+export { PublishError };
+
+/**
+ * Stage the assembled files into a temp dir (preserving their library-relative
+ * layout) and tar.gz them. System `tar` keeps the archive format exactly what
+ * the server's node-tar expects; COPYFILE_DISABLE suppresses macOS AppleDouble
+ * (`._*`) junk from leaking into the archive.
+ *
+ * @param {Array<{abs: string, rel: string}>} files
+ * @returns {Promise<Buffer>}
+ */
+async function buildArchive(files) {
+    const stage = await mkdtemp(join(tmpdir(), 'informer-publish-'));
+    const archivePath = `${stage}.tgz`;
+    try {
+        for (const { abs, rel } of files) {
+            const dest = join(stage, rel);
+            await mkdir(dirname(dest), { recursive: true });
+            await copyFile(abs, dest);
+        }
+        await execFileP('tar', ['-czf', archivePath, '-C', stage, '.'], {
+            env: { ...process.env, COPYFILE_DISABLE: '1' }
+        });
+        return await readFile(archivePath);
+    } finally {
+        await rm(stage, { recursive: true, force: true });
+        await rm(archivePath, { force: true });
+    }
+}
+
+/**
+ * Publish an assembled app to the marketplace (License Manager `/packs/publish`).
+ *
+ * @param {Object} opts
+ * @param {string} opts.marketplaceUrl - base URL fronting the cloud-api
+ * @param {string} opts.token - vendor publish token (sent as Bearer)
+ * @param {Array<{abs: string, rel: string}>} opts.files - assembled app files
+ * @param {Object} opts.fields - publish metadata; non-string values are JSON-encoded
+ *   (the endpoint parses categories/requires/metadata as JSON strings)
+ * @param {{abs: string, filename: string}} [opts.icon] - optional listing icon
+ * @returns {Promise<Object>} the publish response
+ */
+export async function publish({ marketplaceUrl, token, files, fields, icon }) {
+    const archive = await buildArchive(files);
+
+    const form = new FormData();
+    for (const [key, value] of Object.entries(fields)) {
+        if (value === undefined || value === null || value === '') continue;
+        form.append(key, typeof value === 'string' ? value : JSON.stringify(value));
+    }
+    form.append(
+        'archive',
+        new Blob([archive], { type: 'application/gzip' }),
+        `${fields.slug}-${fields.version}.tgz`
+    );
+    if (icon) {
+        const iconBuffer = await readFile(icon.abs);
+        form.append('icon', new Blob([iconBuffer]), icon.filename);
+    }
+
+    const url = `${marketplaceUrl.replace(/\/+$/, '')}/packs/publish`;
+    const res = await fetch(url, {
+        method: 'POST',
+        headers: { Authorization: `Bearer ${token}` },
+        body: form
+    });
+
+    if (!res.ok) {
+        let body = '';
+        try {
+            body = await res.text();
+        } catch {
+            body = '';
+        }
+        throw new PublishError(res.status, body, url);
+    }
+
+    return await res.json();
+}

package/src/server-routes.js

@@ -1,10 +1,14 @@
-import { createHmac } from 'node:crypto';
 import { readdir, stat } from 'node:fs/promises';
 import { join, relative, posix } from 'node:path';
 import { parse as parseUrl } from 'node:url';
+import { loadDependencies, buildDevContext, loadAppEnv, buildDevCrypto, buildDevMessaging, normalizeFetchPath } from './dev-dependencies.js';
 
 const VALID_METHODS = ['GET', 'POST', 'PUT', 'PATCH', 'DELETE'];
 
+// Strict base64 — see view-api.js for the rationale. Mirror kept identical
+// to keep dev and prod behavior aligned.
+const BASE64_RE = /^[A-Za-z0-9+/]+={0,2}$/;
+
 /**
  * Convert a file path under server/ to a route path.
  *
@@ -171,7 +175,13 @@ export function createMiddleware(viteServer, { serverOrigin, authHeader, devWork
     // fetch() implementation — proxies API calls to the Informer server
     async function apiFetch(path, opts = {}) {
         const method = (opts.method || 'GET').toUpperCase();
-        const url = `${serverOrigin}/api/${path.replace(/^\/?(?:api\/)?/, '')}`;
+        // Same strict canonicalization as prod (app-sandbox.js normalizeFetchPath);
+        // reject non-canonical shapes here instead of silently accepting them.
+        const apiPath = normalizeFetchPath(path);
+        if (!apiPath) {
+            return { status: 400, body: { error: `Invalid fetch path: ${String(path).slice(0, 80)}` } };
+        }
+        const url = `${serverOrigin}${apiPath}`;
         const fetchOpts = {
             method,
             headers: { Authorization: authHeader, 'Content-Type': 'application/json' }
@@ -230,13 +240,40 @@ export function createMiddleware(viteServer, { serverOrigin, authHeader, devWork
                 try { body = JSON.parse(rawBody); } catch { body = rawBody; }
             }
 
-            // crypto helper — mirrors the sandbox's crypto.hmac()
-            const cryptoHelper = {
-                hmac(algorithm, key, data, encoding) {
-                    return createHmac(algorithm, key).update(data).digest(encoding || 'hex');
+            // crypto helper — mirrors the prod sandbox crypto surface
+            const cryptoHelper = buildDevCrypto();
+
+            // log helper — mirrors sandbox log(message, data) + log.info/warn/error/debug
+            const logCall = (level, message, data) => {
+                const msg = typeof message === 'string' ? message : JSON.stringify(message);
+                const args = [`[app-log] [${level}] ${msg}`];
+                if (data) args.push(data);
+                console.log(...args);
+            };
+            const log = Object.assign(
+                (message, data) => logCall('info', message, data),
+                {
+                    debug: (message, data) => logCall('debug', message, data),
+                    info: (message, data) => logCall('info', message, data),
+                    warn: (message, data) => logCall('warn', message, data),
+                    error: (message, data) => logCall('error', message, data)
                 }
+            );
+
+            // markdown helper — passthrough in dev (production uses `marked`)
+            const markdown = (text) => text;
+
+            // emit helper — no-op in dev (logs to console)
+            const emit = (event, payload) => {
+                console.log(`[app-event] emit("${event}",`, JSON.stringify(payload), ')');
+                return { ok: true };
             };
 
+            // notify/email — delivery is a console-logged no-op in dev, but the
+            // required-field validation mirrors prod so an app that passes here
+            // won't 500 in production.
+            const { notify, email } = buildDevMessaging('[app]');
+
             // Build request context
             const request = {
                 method: req.method.toUpperCase(),
@@ -265,20 +302,39 @@ export function createMiddleware(viteServer, { serverOrigin, authHeader, devWork
                 res.end(JSON.stringify(earlyBody));
             }
 
-            // Call handler
-            const result = await handler({ query, fetch: apiFetch, respond, crypto: cryptoHelper, env: {}, request });
+            // Build the dependency-injection context the same way the prod
+            // sandbox does, so handlers using `await context.myDep.method(...)`
+            // work locally. Loaded per request so edits to informer.yaml take
+            // effect without a dev-server restart.
+            const deps = await loadDependencies(projectRoot);
+            const context = buildDevContext({ deps, apiFetch });
+            const env = await loadAppEnv(projectRoot);
+
+            // Call handler — bag mirrors the prod sandbox (see app-sandbox.js).
+            const result = await handler({ request, context, query, fetch: apiFetch, respond, emit, notify, email, crypto: cryptoHelper, markdown, log, env });
 
             // If respond() was already called, the response is already sent
             if (responded) return;
 
-            // Normalize response (mirrors app-sandbox.js buildInvokeScript logic)
-            let status, responseBody, responseHeaders;
+            // Normalize response (mirrors app-sandbox.js buildInvokeScript logic).
+            // The encoding allow-list and contract checks are enforced inside the
+            // ivm in production; replicate them here so handlers see the same
+            // errors in dev (where there's no isolate to attribute the throw to).
+            // If you change this, mirror it in modules/app/routes/view-api.js.
+            let status, responseBody, responseHeaders, encoding;
 
             if (result === undefined || result === null) {
                 status = 204;
                 responseBody = null;
                 responseHeaders = {};
             } else if (typeof result === 'object' && typeof result.status === 'number') {
+                encoding = typeof result.encoding === 'string' ? result.encoding : null;
+                if (encoding !== null && encoding !== 'base64') {
+                    throw new Error(`Unknown response encoding: ${JSON.stringify(encoding)} (expected 'base64' or omitted)`);
+                }
+                if (encoding === 'base64' && typeof result.body !== 'string') {
+                    throw new Error(`encoding: 'base64' requires body to be a base64-encoded string, got ${typeof result.body}`);
+                }
                 status = result.status || 200;
                 responseBody = result.body !== undefined ? result.body : null;
                 responseHeaders = result.headers || {};
@@ -295,6 +351,20 @@ export function createMiddleware(viteServer, { serverOrigin, authHeader, devWork
 
             if (responseBody === null) {
                 res.end();
+            } else if (encoding === 'base64' && typeof responseBody === 'string') {
+                if (!BASE64_RE.test(responseBody)) {
+                    throw new Error('Handler returned malformed base64 body');
+                }
+                res.end(Buffer.from(responseBody, 'base64'));
+            } else if (typeof responseBody === 'string') {
+                // Pre-PR the dev middleware always JSON.stringify'd the body, so
+                // a handler returning { body: 'hello' } emitted "hello" (with
+                // quotes) — diverging from prod which passed strings verbatim.
+                // This branch fixes that parity.
+                if (!res.getHeader('content-type')) {
+                    res.setHeader('Content-Type', 'application/json');
+                }
+                res.end(responseBody);
             } else {
                 if (!res.getHeader('content-type')) {
                     res.setHeader('Content-Type', 'application/json');

package/src/workspace.js

@@ -1,5 +1,5 @@
 import { readdir, readFile, writeFile, access } from 'node:fs/promises';
-import { join } from 'node:path';
+import { join, basename } from 'node:path';
 
 /**
  * Execute raw SQL against a workspace datasource via the _sql route.
@@ -122,7 +122,7 @@ export async function init({ api, slug, migrationsDir, envPath }) {
     }
 
     await writeFile(envPath, envContent);
-    console.log(`Saved INFORMER_DEV_WORKSPACE=${workspaceId} to .env`);
+    console.log(`Saved INFORMER_DEV_WORKSPACE=${workspaceId} to ${basename(envPath)}`);
 
     return { workspaceId, ...result };
 }