@juuno-sdk/cli 4.0.1 → 4.1.0

package/dist/cli/src/deploy-backend/wrangler-config.js

@@ -0,0 +1,271 @@
+/**
+ * Pure helpers for a Workers-for-Platforms deploy: building the payload from a
+ * worker's wrangler.jsonc, and resolving where to send it.
+ *
+ * Kept free of I/O so the part that fails silently — the metadata — is directly
+ * testable. See wrangler-config.test.ts.
+ */
+const LOOPBACK_HOSTS = new Set(['localhost', '127.0.0.1', '[::1]', '::1']);
+/**
+ * Normalise the API base, and refuse to put the developer token on a cleartext
+ * connection.
+ *
+ * Loopback stays exempt so a local Laravel over http still works. Anything else
+ * must be https, because the next thing the caller does with this value is send
+ * a bearer token to it.
+ */
+export function resolveApiUrl(value) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new Error(`API url must be absolute, got: ${value}`);
+    }
+    if (url.protocol !== 'https:' && !LOOPBACK_HOSTS.has(url.hostname)) {
+        throw new Error(`API url must use https (or a loopback host for local development), got: ${value}`);
+    }
+    return value.replace(/\/$/, '');
+}
+/**
+ * Binding types wrangler does NOT inherit from the top level into `env.<name>`.
+ * Everything else (main, compatibility_date, compatibility_flags, …) is
+ * inherited. Getting this wrong in the lenient direction is the dangerous one:
+ * it would ship a top-level store binding into an environment that deliberately
+ * declared none.
+ */
+const NOT_INHERITED = [
+    'vars',
+    'kv_namespaces',
+    'd1_databases',
+    'r2_buckets',
+    'queues',
+    'routes',
+    'route',
+    'durable_objects',
+];
+/**
+ * Binding kinds buildMetadata cannot express.
+ *
+ * Cloudflare treats the metadata part as the authoritative binding list, so one
+ * dropped here deploys a worker whose binding is simply absent: the deploy
+ * reports success and the first request that touches it 500s, with nothing in
+ * the output connecting the two. Refused instead, until the platform endpoint
+ * provisions them the way it already does KV and D1.
+ */
+const UNSUPPORTED_BINDINGS = [
+    'r2_buckets',
+    'queues',
+    'durable_objects',
+    'services',
+];
+/**
+ * An env block by name, own properties only.
+ *
+ * `constructor` and `toString` are inherited from Object.prototype, so a plain
+ * lookup finds a function there and sails through a truthiness check — resolving
+ * `--env constructor` to a nonsense config instead of erroring.
+ */
+function ownEnv(config, env) {
+    return Object.prototype.hasOwnProperty.call(config.env ?? {}, env)
+        ? config.env?.[env]
+        : undefined;
+}
+/**
+ * Strip comments and trailing commas from JSONC so JSON.parse accepts it.
+ *
+ * String-aware: a `//` or block-comment opener inside a quoted value is left
+ * alone, as is an escaped quote. Written by hand rather than pulling in a parser
+ * because this is the only JSONC we read and the input is our own.
+ *
+ * The complexity is suppressed rather than refactored. This is a character
+ * scanner: four mutually-exclusive states over one cursor, sharing `out`, `i`
+ * and three flags. Extracting the branches means threading all of that through
+ * helpers or hoisting it into an object, which trades a shape every reader
+ * recognises for one nobody does — and a state machine you have to reassemble
+ * across functions is exactly where an off-by-one hides. The 31 cases in
+ * `__tests__/wrangler-config.test.ts` are what keeps it honest instead.
+ */
+// fallow-ignore-next-line complexity
+export function stripJsonc(source) {
+    let out = '';
+    let inString = false;
+    let inLine = false;
+    let inBlock = false;
+    for (let i = 0; i < source.length; i++) {
+        const c = source[i];
+        const next = source[i + 1];
+        if (inLine) {
+            if (c === '\n') {
+                inLine = false;
+                out += c;
+            }
+            continue;
+        }
+        if (inBlock) {
+            if (c === '*' && next === '/') {
+                inBlock = false;
+                i++;
+            }
+            continue;
+        }
+        if (inString) {
+            out += c;
+            if (c === '\\') {
+                // Copy the escaped character verbatim so \" doesn't end the string.
+                out += next ?? '';
+                i++;
+            }
+            else if (c === '"') {
+                inString = false;
+            }
+            continue;
+        }
+        if (c === '"') {
+            inString = true;
+            out += c;
+            continue;
+        }
+        if (c === '/' && next === '/') {
+            inLine = true;
+            i++;
+            continue;
+        }
+        if (c === '/' && next === '*') {
+            inBlock = true;
+            i++;
+            continue;
+        }
+        // Trailing comma before a closing brace/bracket. Done here rather than with
+        // a regex over the finished string so a quoted value containing ",}" or
+        // ",]" is left alone — at this point we know we are outside a string.
+        if (c === '}' || c === ']') {
+            out = out.replace(/,\s*$/, '');
+        }
+        out += c;
+    }
+    return out;
+}
+export function parseWranglerConfig(source) {
+    return JSON.parse(stripJsonc(source));
+}
+/**
+ * Flatten a wrangler config for one environment.
+ *
+ * Inherited keys come from the top level unless the environment overrides them;
+ * the binding keys in NOT_INHERITED come from the environment alone, matching
+ * wrangler's own rule.
+ */
+export function resolveEnvConfig(config, env) {
+    const envConfig = ownEnv(config, env);
+    if (!envConfig) {
+        throw new Error(`wrangler.jsonc declares no env "${env}" (found: ${Object.keys(config.env ?? {}).join(', ') || 'none'}).`);
+    }
+    const resolved = { ...config, ...envConfig };
+    delete resolved.env;
+    for (const key of NOT_INHERITED) {
+        if (envConfig[key] === undefined) {
+            delete resolved[key];
+        }
+    }
+    return resolved;
+}
+/**
+ * The entry module's name as it appears in the dry-run output. wrangler compiles
+ * `./src/index.ts` to `dist/index.js`, so the extension is normalised.
+ */
+export function entryModuleName(main) {
+    // Both separators: a wrangler.jsonc authored on Windows can say
+    // "src\\index.ts", and the parts bundle() uploads are named by readdirSync —
+    // bare basenames. Leaving a backslash in would make main_module name a part
+    // that was never sent, and Cloudflare rejects the upload for a missing entry.
+    return main.replace(/^.*[/\\]/, '').replace(/\.(ts|tsx|mts|cts)$/, '.js');
+}
+/**
+ * Build the `metadata` part for the platform deploy endpoint.
+ *
+ * Store bindings are emitted **by name only**. The platform provisions the
+ * store and fills the id — sending one would make it adopt an existing store
+ * instead, and nothing would report that it had. Note the two are not
+ * symmetric: KV's id field is `namespace_id`, D1's is `id`, and neither is set
+ * here.
+ */
+export function buildMetadata(resolved) {
+    if (!resolved.main) {
+        throw new Error('wrangler.jsonc has no "main" entry point.');
+    }
+    if (!resolved.compatibility_date) {
+        throw new Error('wrangler.jsonc has no "compatibility_date".');
+    }
+    const unsupported = UNSUPPORTED_BINDINGS.filter((key) => resolved[key] !== undefined);
+    if (unsupported.length) {
+        throw new Error(`wrangler.jsonc declares bindings this deploy path cannot send: ${unsupported.join(', ')}.`);
+    }
+    const bindings = [];
+    for (const kv of resolved.kv_namespaces ?? []) {
+        bindings.push({ type: 'kv_namespace', name: kv.binding });
+    }
+    for (const d1 of resolved.d1_databases ?? []) {
+        bindings.push({ type: 'd1', name: d1.binding });
+    }
+    for (const [name, value] of Object.entries(resolved.vars ?? {})) {
+        // Every var ships as plain text, so an object or array would arrive as
+        // "[object Object]" or a comma-joined list — a binding that looks present in
+        // the metadata and is not the value the worker reads. `typeof null` is
+        // 'object' too, and "null" is no better. Refused rather than corrupted.
+        if (typeof value === 'object') {
+            throw new Error(`var "${name}" must be a string, number or boolean — this deploy path sends vars as plain text.`);
+        }
+        bindings.push({ type: 'plain_text', name, text: String(value) });
+    }
+    const metadata = {
+        main_module: entryModuleName(resolved.main),
+        compatibility_date: resolved.compatibility_date,
+    };
+    if (resolved.compatibility_flags?.length) {
+        metadata.compatibility_flags = resolved.compatibility_flags;
+    }
+    if (bindings.length) {
+        metadata.bindings = bindings;
+    }
+    return metadata;
+}
+/**
+ * The tenant script name wrangler will have built for this environment.
+ *
+ * Read off the raw config rather than the resolved one because the rule is not
+ * inheritance: an env that declares its own `name` uses it verbatim, and one
+ * that does not gets `<top-level-name>-<env>`. The merged config cannot tell the
+ * two apart, so reading it would address the upload to `google-reviews` for a
+ * bundle wrangler built as `google-reviews-prod` — refused as unregistered, or
+ * worse, landing on whichever tenant already holds that name.
+ */
+export function scriptName(config, env) {
+    const envName = ownEnv(config, env)?.name;
+    if (envName) {
+        return envName;
+    }
+    if (!config.name) {
+        throw new Error('wrangler.jsonc has no "name".');
+    }
+    return `${config.name}-${env}`;
+}
+/** Files in the dry-run output that belong in the upload. */
+export function isModuleFile(filename) {
+    // Anchored, which is what excludes sourcemaps: `index.js.map` ends in `.map`,
+    // so it never matches in the first place.
+    return /\.(js|mjs|wasm)$/.test(filename);
+}
+/**
+ * The Content-Type of a module part, which is how Cloudflare decides what kind
+ * of module it is — not a formality. `application/javascript+module` makes it an
+ * ES module and `application/wasm` a CompiledWasm one, so labelling a `.wasm`
+ * as JavaScript would have Cloudflare try to parse the binary as source and
+ * reject the upload. isModuleFile() already accepts `.wasm`, so the two have to
+ * agree about what that means.
+ */
+export function moduleContentType(filename) {
+    return filename.endsWith('.wasm')
+        ? 'application/wasm'
+        : 'application/javascript+module';
+}

package/dist/cli/src/utils/bin.js

@@ -0,0 +1,23 @@
+import crossSpawn from 'cross-spawn';
+/**
+ * Spawning a package-manager binary, portably.
+ *
+ * `npx`, `pnpm` and `yarn` are shell scripts on POSIX and `.cmd` shims on
+ * Windows, and neither Node nor libuv will run a `.cmd` from `spawn` without a
+ * shell — `CreateProcess` cannot execute one, and since the fix for
+ * CVE-2024-27980 Node refuses rather than silently routing through cmd.exe.
+ * Naming the shim (`npx.cmd`) fixes PATH resolution and not the spawn.
+ *
+ * Doing it correctly means invoking `cmd.exe /d /s /c` with the command and
+ * every argument escaped for cmd's parser, plus a second round of escaping for
+ * shims under `node_modules/.bin`, and `windowsVerbatimArguments` so Node does
+ * not re-quote what was just escaped. `shell: true` is the wrong shortcut: it
+ * hands the whole line to cmd.exe to re-parse, so a worker directory containing
+ * `&` or `^` becomes a command.
+ *
+ * cross-spawn already does all of it, is the ecosystem's answer to this exact
+ * problem, and was already in the tree transitively. Preferred over a local
+ * reimplementation, which is where the escaping bugs live.
+ */
+export const spawn = crossSpawn;
+export const spawnSync = crossSpawn.sync;