@h-ai/deploy 0.1.0-alpha.19 → 0.1.0-alpha.20

package/dist/index.js

@@ -1,12 +1,13 @@
 import { z } from 'zod';
-import { core, ok, err } from '@h-ai/core';
+import { core, err, ok } from '@h-ai/core';
 import { existsSync, readFileSync, writeFileSync, readdirSync, mkdirSync, statSync } from 'fs';
 import { homedir } from 'os';
-import { join, dirname, relative } from 'path';
+import { join, dirname, relative, sep } from 'path';
 import process from 'process';
 import { parse, stringify } from 'yaml';
 import { execSync } from 'child_process';
 import { createHash } from 'crypto';
+import { Buffer } from 'buffer';
 
 // src/deploy-config.ts
 
@@ -28,12 +29,13 @@ var en_US_default = {
   deploy_scanFailed: "Application scan failed: {error}",
   deploy_envVarFailed: "Environment variable setup failed: {error}",
   deploy_credentialError: "Credential read/write failed: {error}",
+  deploy_credentialInvalidKey: "Unsupported credential key: {key}. Only HAI_DEPLOY_* keys are allowed",
   deploy_credentialSaved: "Credentials saved",
   deploy_credentialLoaded: "Credentials loaded",
   deploy_configError: "Deploy config error: {error}",
   deploy_credentialMissing: "Missing credential fields: {fields}",
-  deploy_apiError: "{service} API error ({status}): {body}",
-  deploy_fileUploadFailed: "File upload failed ({status}): {body}",
+  deploy_apiError: "{service} API error ({status})",
+  deploy_fileUploadFailed: "File upload failed ({status})",
   deploy_provisionNoResult: "No connection info returned from {service}"
 };
 
@@ -55,12 +57,13 @@ var zh_CN_default = {
   deploy_scanFailed: "\u5E94\u7528\u626B\u63CF\u5931\u8D25\uFF1A{error}",
   deploy_envVarFailed: "\u73AF\u5883\u53D8\u91CF\u8BBE\u7F6E\u5931\u8D25\uFF1A{error}",
   deploy_credentialError: "\u51ED\u8BC1\u8BFB\u5199\u5931\u8D25\uFF1A{error}",
+  deploy_credentialInvalidKey: "\u4E0D\u652F\u6301\u7684\u51ED\u8BC1\u952E\u540D\uFF1A{key}\u3002\u4EC5\u5141\u8BB8 HAI_DEPLOY_*",
   deploy_credentialSaved: "\u51ED\u8BC1\u5DF2\u4FDD\u5B58",
   deploy_credentialLoaded: "\u51ED\u8BC1\u5DF2\u52A0\u8F7D",
   deploy_configError: "\u90E8\u7F72\u914D\u7F6E\u9519\u8BEF\uFF1A{error}",
   deploy_credentialMissing: "\u7F3A\u5C11\u51ED\u8BC1\u5B57\u6BB5\uFF1A{fields}",
-  deploy_apiError: "{service} API \u8BF7\u6C42\u5931\u8D25\uFF08{status}\uFF09\uFF1A{body}",
-  deploy_fileUploadFailed: "\u6587\u4EF6\u4E0A\u4F20\u5931\u8D25\uFF08{status}\uFF09\uFF1A{body}",
+  deploy_apiError: "{service} API \u8BF7\u6C42\u5931\u8D25\uFF08{status}\uFF09",
+  deploy_fileUploadFailed: "\u6587\u4EF6\u4E0A\u4F20\u5931\u8D25\uFF08{status}\uFF09",
   deploy_provisionNoResult: "{service} \u672A\u8FD4\u56DE\u8FDE\u63A5\u4FE1\u606F"
 };
 
@@ -122,8 +125,8 @@ var DeployErrorInfo = {
   PROVISION_FAILED: "007:500",
   ADAPTER_MISSING: "008:500",
   SCAN_FAILED: "009:500",
-  ENV_VAR_FAILED: "010:500",
-  NOT_INITIALIZED: "011:500",
+  NOT_INITIALIZED: "010:500",
+  ENV_VAR_FAILED: "011:500",
   UNSUPPORTED_TYPE: "012:400",
   CONFIG_ERROR: "013:500",
   CREDENTIAL_ERROR: "014:500"
@@ -132,6 +135,35 @@ var HaiDeployError = core.error.buildHaiErrorsDef("deploy", DeployErrorInfo);
 
 // src/deploy-credentials.ts
 var logger = core.logger.child({ module: "deploy", scope: "credentials" });
+var DEPLOY_CREDENTIAL_KEY_PATTERN = /^HAI_DEPLOY_[A-Z0-9_]+$/;
+function isAllowedCredentialKey(key) {
+  return DEPLOY_CREDENTIAL_KEY_PATTERN.test(key);
+}
+function normalizeCredentialEntries(entries) {
+  const normalized = {};
+  for (const [key, value] of Object.entries(entries)) {
+    if (!isAllowedCredentialKey(key)) {
+      logger.warn("Ignoring unsupported deploy credential key", { key });
+      continue;
+    }
+    if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") {
+      normalized[key] = String(value);
+      continue;
+    }
+    logger.warn("Ignoring deploy credential with non-scalar value", { key });
+  }
+  return normalized;
+}
+function assertAllowedCredentialKey(key) {
+  if (!isAllowedCredentialKey(key)) {
+    throw new Error(deployM("deploy_credentialInvalidKey", { params: { key } }));
+  }
+}
+function assertAllowedCredentialEntries(entries) {
+  for (const key of Object.keys(entries)) {
+    assertAllowedCredentialKey(key);
+  }
+}
 function getCredentialsPath() {
   return join(homedir(), ".hai", "credentials.yml");
 }
@@ -148,10 +180,10 @@ function readCredentialsFile() {
   }
   const content = readFileSync(filePath, "utf-8");
   const parsed = parse(content);
-  if (parsed === null || parsed === void 0 || typeof parsed !== "object") {
+  if (parsed === null || parsed === void 0 || typeof parsed !== "object" || Array.isArray(parsed)) {
     return {};
   }
-  return parsed;
+  return normalizeCredentialEntries(parsed);
 }
 function writeCredentialsFile(data) {
   const filePath = getCredentialsPath();
@@ -182,6 +214,7 @@ function loadCredentials() {
 }
 function saveCredential(key, value) {
   try {
+    assertAllowedCredentialKey(key);
     const data = readCredentialsFile();
     data[key] = value;
     writeCredentialsFile(data);
@@ -201,6 +234,7 @@ function saveCredential(key, value) {
 }
 function saveCredentials(entries) {
   try {
+    assertAllowedCredentialEntries(entries);
     const data = readCredentialsFile();
     for (const [key, value] of Object.entries(entries)) {
       data[key] = value;
@@ -426,6 +460,12 @@ var logger4 = core.logger.child({ module: "deploy", scope: "provider-vercel" });
 var VERCEL_API = "https://api.vercel.com";
 var POLL_INTERVAL = 3e3;
 var MAX_POLL_ATTEMPTS = 60;
+var VercelApiError = class extends Error {
+  constructor(status) {
+    super(deployM("deploy_apiError", { params: { service: "Vercel", status: String(status) } }));
+    this.status = status;
+  }
+};
 function toDeployError(codeDef, messageKey, error) {
   return {
     ...codeDef,
@@ -446,8 +486,7 @@ async function vercelFetch(token, path, options) {
     }
   });
   if (!response.ok) {
-    const body = await response.text();
-    throw new Error(deployM("deploy_apiError", { params: { service: "Vercel", status: String(response.status), body } }));
+    throw new VercelApiError(response.status);
   }
   return response.json();
 }
@@ -459,7 +498,7 @@ function collectFiles(dir, baseDir) {
     if (entry.isDirectory()) {
       results.push(...collectFiles(fullPath, baseDir));
     } else {
-      results.push(relative(baseDir, fullPath));
+      results.push(relative(baseDir, fullPath).split(sep).join("/"));
     }
   }
   return results;
@@ -498,19 +537,33 @@ function createVercelProvider() {
           logger4.info("Vercel project found", { projectName, projectId: existingId });
           return ok(existingId);
         }
-        const project = await vercelFetch(
-          token,
-          "/v10/projects",
-          {
-            method: "POST",
-            body: JSON.stringify({
-              name: projectName,
-              framework: "sveltekit"
-            })
+        try {
+          const project = await vercelFetch(
+            token,
+            "/v11/projects",
+            {
+              method: "POST",
+              body: JSON.stringify({
+                name: projectName,
+                framework: "sveltekit"
+              })
+            }
+          );
+          logger4.info("Vercel project created", { projectName, projectId: project.id });
+          return ok(project.id);
+        } catch (error) {
+          if (error instanceof VercelApiError && error.status === 409) {
+            const concurrentProjectId = await findExistingProject(token, projectName);
+            if (concurrentProjectId !== null) {
+              logger4.info("Vercel project reused after create conflict", {
+                projectName,
+                projectId: concurrentProjectId
+              });
+              return ok(concurrentProjectId);
+            }
           }
-        );
-        logger4.info("Vercel project created", { projectName, projectId: project.id });
-        return ok(project.id);
+          throw error;
+        }
       } catch (error) {
         logger4.error("Vercel project creation failed", { projectName, error });
         return err(toDeployError(HaiDeployError.PROJECT_CREATE_FAILED, "deploy_projectCreateFailed", error));
@@ -533,7 +586,7 @@ function createVercelProvider() {
         }));
         await vercelFetch(
           token,
-          `/v10/projects/${projectId}/env`,
+          `/v10/projects/${projectId}/env?upsert=true`,
           {
             method: "POST",
             body: JSON.stringify(envEntries)
@@ -602,12 +655,16 @@ async function findExistingProject(token, projectName) {
   try {
     const project = await vercelFetch(token, `/v10/projects/${projectName}`);
     return project.id;
-  } catch {
-    return null;
+  } catch (error) {
+    if (error instanceof VercelApiError && error.status === 404) {
+      return null;
+    }
+    throw error;
   }
 }
 async function uploadFile(token, content, sha) {
   const url = `${VERCEL_API}/v2/files`;
+  const uploadContent = new Uint8Array(content);
   const response = await fetch(url, {
     method: "POST",
     headers: {
@@ -615,11 +672,10 @@ async function uploadFile(token, content, sha) {
       "Content-Type": "application/octet-stream",
       "x-vercel-digest": sha
     },
-    body: new Blob([content.buffer])
+    body: new Blob([uploadContent])
   });
   if (!response.ok && response.status !== 409) {
-    const body = await response.text();
-    throw new Error(deployM("deploy_fileUploadFailed", { params: { status: String(response.status), body } }));
+    throw new Error(deployM("deploy_fileUploadFailed", { params: { status: String(response.status) } }));
   }
 }
 async function pollDeploymentStatus(token, deploymentId) {
@@ -690,6 +746,56 @@ function createAliyunProvisioner() {
 }
 var logger6 = core.logger.child({ module: "deploy", scope: "provisioner-neon" });
 var NEON_API = "https://console.neon.tech/api/v2";
+var DEFAULT_NEON_DATABASE_NAME = "neondb";
+var DEFAULT_NEON_ROLE_NAME = "neondb_owner";
+async function neonFetch(token, path, options) {
+  const response = await fetch(`${NEON_API}${path}`, {
+    ...options,
+    headers: {
+      "Accept": "application/json",
+      "Authorization": `Bearer ${token}`,
+      "Content-Type": "application/json",
+      ...options?.headers
+    }
+  });
+  if (!response.ok) {
+    throw new Error(deployM("deploy_apiError", { params: { service: "Neon", status: String(response.status) } }));
+  }
+  return response.json();
+}
+async function listNeonProjects(token) {
+  const data = await neonFetch(token, "/projects");
+  return data.projects ?? [];
+}
+async function findExistingNeonProject(token, projectName) {
+  const projects = await listNeonProjects(token);
+  return projects.find((project) => project.name === projectName) ?? null;
+}
+async function getNeonConnectionUri(token, projectId) {
+  const query = new URLSearchParams({
+    database_name: DEFAULT_NEON_DATABASE_NAME,
+    role_name: DEFAULT_NEON_ROLE_NAME
+  });
+  const data = await neonFetch(
+    token,
+    `/projects/${projectId}/connection_uri?${query.toString()}`,
+    { headers: { "Content-Type": "application/json" } }
+  );
+  if (!data.uri) {
+    throw new Error(deployM("deploy_provisionNoResult", { params: { service: "Neon" } }));
+  }
+  return data.uri;
+}
+function buildNeonProvisionResult(projectId, connectionUri) {
+  return {
+    serviceType: "db",
+    provisionerName: "neon",
+    envVars: {
+      HAI_RELDB_URL: connectionUri
+    },
+    resourceInfo: `neon-project:${projectId}`
+  };
+}
 function createNeonProvisioner() {
   let token = null;
   return {
@@ -702,12 +808,7 @@ function createNeonProvisioner() {
         if (!apiToken) {
           throw new Error(deployM("deploy_credentialMissing", { params: { fields: "token" } }));
         }
-        const res = await fetch(`${NEON_API}/projects`, {
-          headers: { Authorization: `Bearer ${apiToken}` }
-        });
-        if (!res.ok) {
-          throw new Error(deployM("deploy_apiError", { params: { service: "Neon", status: String(res.status), body: await res.text() } }));
-        }
+        await listNeonProjects(apiToken);
         token = apiToken;
         logger6.info("Neon authenticated");
         return ok("neon-user");
@@ -731,36 +832,32 @@ function createNeonProvisioner() {
       }
       logger6.debug("Provisioning Neon database", { appName });
       try {
-        const res = await fetch(`${NEON_API}/projects`, {
+        const projectName = `${appName}-db`;
+        const existingProject = await findExistingNeonProject(token, projectName);
+        if (existingProject !== null) {
+          const connectionUri2 = await getNeonConnectionUri(token, existingProject.id);
+          logger6.info("Neon project reused", {
+            projectId: existingProject.id,
+            projectName
+          });
+          return ok(buildNeonProvisionResult(existingProject.id, connectionUri2));
+        }
+        const data = await neonFetch(token, "/projects", {
           method: "POST",
-          headers: {
-            "Authorization": `Bearer ${token}`,
-            "Content-Type": "application/json"
-          },
           body: JSON.stringify({
             project: {
-              name: `${appName}-db`,
+              name: projectName,
               pg_version: 16
             }
           })
         });
-        if (!res.ok) {
-          throw new Error(deployM("deploy_apiError", { params: { service: "Neon", status: String(res.status), body: await res.text() } }));
-        }
-        const data = await res.json();
-        const connectionUri = data.connection_uris?.[0]?.connection_uri;
-        if (!connectionUri) {
+        const projectId = data.project?.id ?? "";
+        const connectionUri = data.connection_uris?.[0]?.connection_uri ?? "";
+        if (!projectId || !connectionUri) {
           throw new Error(deployM("deploy_provisionNoResult", { params: { service: "Neon" } }));
         }
-        logger6.info("Neon database provisioned", { projectId: data.project.id });
-        return ok({
-          serviceType: "db",
-          provisionerName: "neon",
-          envVars: {
-            HAI_RELDB_URL: connectionUri
-          },
-          resourceInfo: `neon-project:${data.project.id}`
-        });
+        logger6.info("Neon database provisioned", { projectId });
+        return ok(buildNeonProvisionResult(projectId, connectionUri));
       } catch (error) {
         logger6.error("Neon provisioning failed", { appName, error });
         return err(
@@ -797,7 +894,7 @@ function createR2Provisioner() {
           headers: { Authorization: `Bearer ${apiTok}` }
         });
         if (!res.ok) {
-          throw new Error(deployM("deploy_apiError", { params: { service: "Cloudflare", status: String(res.status), body: await res.text() } }));
+          throw new Error(deployM("deploy_apiError", { params: { service: "Cloudflare", status: String(res.status) } }));
         }
         accountId = acctId;
         token = apiTok;
@@ -836,7 +933,7 @@ function createR2Provisioner() {
           }
         );
         if (!createRes.ok && createRes.status !== 409) {
-          throw new Error(deployM("deploy_apiError", { params: { service: "Cloudflare", status: String(createRes.status), body: await createRes.text() } }));
+          throw new Error(deployM("deploy_apiError", { params: { service: "Cloudflare", status: String(createRes.status) } }));
         }
         const tokenRes = await fetch(
           `${CF_API}/user/tokens`,
@@ -856,12 +953,14 @@ function createR2Provisioner() {
             })
           }
         );
-        let accessKey = "";
-        let secretKey = "";
-        if (tokenRes.ok) {
-          const tokenData = await tokenRes.json();
-          accessKey = tokenData.result.id;
-          secretKey = tokenData.result.value;
+        if (!tokenRes.ok) {
+          throw new Error(deployM("deploy_apiError", { params: { service: "Cloudflare", status: String(tokenRes.status) } }));
+        }
+        const tokenData = await tokenRes.json();
+        const accessKey = tokenData.result?.id ?? "";
+        const secretKey = tokenData.result?.value ?? "";
+        if (!accessKey || !secretKey) {
+          throw new Error(deployM("deploy_provisionNoResult", { params: { service: "Cloudflare R2" } }));
         }
         logger7.info("R2 bucket provisioned", { bucketName });
         return ok({
@@ -909,7 +1008,7 @@ function createResendProvisioner() {
           headers: { Authorization: `Bearer ${apiToken}` }
         });
         if (!res.ok) {
-          throw new Error(deployM("deploy_apiError", { params: { service: "Resend", status: String(res.status), body: await res.text() } }));
+          throw new Error(deployM("deploy_apiError", { params: { service: "Resend", status: String(res.status) } }));
         }
         token = apiToken;
         logger8.info("Resend authenticated");
@@ -946,6 +1045,69 @@ function createResendProvisioner() {
 }
 var logger9 = core.logger.child({ module: "deploy", scope: "provisioner-upstash" });
 var UPSTASH_API = "https://api.upstash.com";
+function createUpstashAuthHeader(email, apiKey) {
+  return `Basic ${Buffer.from(`${email}:${apiKey}`).toString("base64")}`;
+}
+async function upstashFetch(email, apiKey, path, options) {
+  const response = await fetch(`${UPSTASH_API}${path}`, {
+    ...options,
+    headers: {
+      "Authorization": createUpstashAuthHeader(email, apiKey),
+      "Content-Type": "application/json",
+      ...options?.headers
+    }
+  });
+  if (!response.ok) {
+    throw new Error(deployM("deploy_apiError", { params: { service: "Upstash", status: String(response.status) } }));
+  }
+  return response.json();
+}
+async function listUpstashDatabases(email, apiKey) {
+  return upstashFetch(email, apiKey, "/v2/redis/databases");
+}
+async function findExistingUpstashDatabase(email, apiKey, databaseName) {
+  const databases = await listUpstashDatabases(email, apiKey);
+  return databases.find((database) => database.database_name === databaseName) ?? null;
+}
+async function getUpstashDatabase(email, apiKey, databaseId) {
+  return upstashFetch(email, apiKey, `/v2/redis/database/${databaseId}`);
+}
+function resolveUpstashRestUrl(database) {
+  if (typeof database.rest_url === "string" && database.rest_url.length > 0) {
+    return database.rest_url;
+  }
+  const endpoint = database.endpoint?.trim() ?? "";
+  if (!endpoint) {
+    return "";
+  }
+  if (endpoint.startsWith("http://") || endpoint.startsWith("https://")) {
+    return endpoint;
+  }
+  if (endpoint.includes(".")) {
+    return `https://${endpoint}`;
+  }
+  return `https://${endpoint}.upstash.io`;
+}
+function resolveUpstashRestToken(database) {
+  return database.rest_token ?? database.token ?? database.password ?? "";
+}
+function buildUpstashProvisionResult(database) {
+  const databaseId = database.database_id ?? "";
+  const restUrl = resolveUpstashRestUrl(database);
+  const restToken = resolveUpstashRestToken(database);
+  if (!databaseId || !restUrl || !restToken) {
+    throw new Error(deployM("deploy_provisionNoResult", { params: { service: "Upstash" } }));
+  }
+  return {
+    serviceType: "cache",
+    provisionerName: "upstash",
+    envVars: {
+      HAI_CACHE_UPSTASH_URL: restUrl,
+      HAI_CACHE_UPSTASH_TOKEN: restToken
+    },
+    resourceInfo: `upstash-db:${databaseId}`
+  };
+}
 function createUpstashProvisioner() {
   let apiKey = null;
   let email = null;
@@ -960,14 +1122,7 @@ function createUpstashProvisioner() {
         if (!userEmail || !userKey) {
           throw new Error(deployM("deploy_credentialMissing", { params: { fields: "email, api_key" } }));
         }
-        const res = await fetch(`${UPSTASH_API}/v2/redis/databases`, {
-          headers: {
-            Authorization: `Basic ${btoa(`${userEmail}:${userKey}`)}`
-          }
-        });
-        if (!res.ok) {
-          throw new Error(deployM("deploy_apiError", { params: { service: "Upstash", status: String(res.status), body: await res.text() } }));
-        }
+        await listUpstashDatabases(userEmail, userKey);
         email = userEmail;
         apiKey = userKey;
         logger9.info("Upstash authenticated", { email: userEmail });
@@ -992,32 +1147,27 @@ function createUpstashProvisioner() {
       }
       logger9.debug("Provisioning Upstash Redis", { appName });
       try {
-        const res = await fetch(`${UPSTASH_API}/v2/redis/database`, {
+        const databaseName = `${appName}-cache`;
+        const existingDatabase = await findExistingUpstashDatabase(email, apiKey, databaseName);
+        if (existingDatabase !== null) {
+          const databaseId = existingDatabase.database_id ?? "";
+          if (!databaseId) {
+            throw new Error(deployM("deploy_provisionNoResult", { params: { service: "Upstash" } }));
+          }
+          const detail = await getUpstashDatabase(email, apiKey, databaseId);
+          logger9.info("Upstash Redis reused", { databaseId, databaseName });
+          return ok(buildUpstashProvisionResult({ ...existingDatabase, ...detail }));
+        }
+        const data = await upstashFetch(email, apiKey, "/v2/redis/database", {
           method: "POST",
-          headers: {
-            "Authorization": `Basic ${btoa(`${email}:${apiKey}`)}`,
-            "Content-Type": "application/json"
-          },
           body: JSON.stringify({
-            name: `${appName}-cache`,
+            name: databaseName,
             region: "global",
             tls: true
           })
         });
-        if (!res.ok) {
-          throw new Error(deployM("deploy_apiError", { params: { service: "Upstash", status: String(res.status), body: await res.text() } }));
-        }
-        const data = await res.json();
         logger9.info("Upstash Redis provisioned", { databaseId: data.database_id });
-        return ok({
-          serviceType: "cache",
-          provisionerName: "upstash",
-          envVars: {
-            HAI_CACHE_UPSTASH_URL: data.rest_url,
-            HAI_CACHE_UPSTASH_TOKEN: data.rest_token
-          },
-          resourceInfo: `upstash-db:${data.database_id}`
-        });
+        return ok(buildUpstashProvisionResult(data));
       } catch (error) {
         logger9.error("Upstash provisioning failed", { appName, error });
         return err(
@@ -1078,7 +1228,14 @@ function extractCredentials(serviceConfig) {
   }
   return result;
 }
+var deployCredentials = {
+  getPath: () => getCredentialsPath(),
+  load: () => loadCredentials(),
+  save: (key, value) => saveCredential(key, value),
+  saveAll: (entries) => saveCredentials(entries)
+};
 var deploy = {
+  credentials: deployCredentials,
   async init(config) {
     if (initInProgress) {
       logger10.warn("Deploy init already in progress, skipping concurrent call");
@@ -1121,16 +1278,17 @@ var deploy = {
             const credentials = extractCredentials(serviceConfig);
             const provAuthResult = await provisioner.authenticate(credentials);
             if (!provAuthResult.success) {
-              logger10.warn("Provisioner authentication failed", {
+              logger10.error("Provisioner authentication failed", {
                 service: serviceType,
                 provisioner: serviceConfig.provisioner
               });
-            } else {
-              logger10.info("Provisioner authenticated", {
-                service: serviceType,
-                user: provAuthResult.data
-              });
+              currentProvisioners.clear();
+              return err(provAuthResult.error);
             }
+            logger10.info("Provisioner authenticated", {
+              service: serviceType,
+              user: provAuthResult.data
+            });
             currentProvisioners.set(serviceType, provisioner);
           }
         }
@@ -1265,6 +1423,6 @@ var deploy = {
   }
 };
 
-export { DeployConfigSchema, HaiDeployError, ProviderConfigSchema, deploy, getCredentialsPath, loadCredentials, saveCredential, saveCredentials, scanApp };
+export { DeployConfigSchema, HaiDeployError, ProviderConfigSchema, deploy };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map