@kedge/cli 0.10.0 → 0.11.0

package/src/main.ts

@@ -37,7 +37,7 @@ import {
 } from "./commands";
 import { ComposeError, compose, type Lock } from "./compose";
 import { type Executor, wranglerExecute } from "./d1-batch";
-import { credentialsChecks, doctor, doctorRemote, formatReport } from "./doctor";
+import { credentialsChecks, doctor, doctorRemote, formatReport, readWrangler } from "./doctor";
 import { invariantsMarkdown, invariantsOf } from "./invariants";
 import { installedPackages } from "./manifest";
 import { emit, withJsonOutput } from "./output";
@@ -118,10 +118,18 @@ async function inviteOrigin(
 ): Promise<string | null> {
   const url = flag(args, "--url");
   if (url) return new URL(url).origin;
-  if (!remote) return null;
+  // Local: kedge dev's own origin, the port it binds (p0.10.1 §1, 5; §3).
+  if (!remote) {
+    try {
+      const { devPort } = await import("./target");
+      return `http://localhost:${devPort(cwd)}`;
+    } catch {
+      return null;
+    }
+  }
   try {
-    const worker = storeNames(cwd).names.worker;
-    return `https://${worker}.${await (cf ?? (await cloudflareFor(env, cwd))).workersSubdomain()}.workers.dev`;
+    // Only where it's served: elsewhere (salve hosting) the link needs --url, the address its host gives.
+    return await (cf ?? (await cloudflareFor(env, cwd))).workersDevUrl(storeNames(cwd).names.worker);
   } catch {
     return null;
   }
@@ -360,7 +368,12 @@ async function run(argv: string[], cwd: string, deps: RunDeps & { json: boolean
       if (auth) {
         const cf = restCloudflare(d.env, fetch, wranglerBin(), auth);
         const lock = JSON.parse(readFileSync(join(cwd, "kedge.lock.json"), "utf8")) as Lock;
-        const creds = await credentialsChecks({ cf, source: auth.source, base: cloudflareBase(d.env) });
+        const creds = await credentialsChecks({
+          cf,
+          source: auth.source,
+          base: cloudflareBase(d.env),
+          workersDev: readWrangler(cwd)?.config.workers_dev !== false,
+        });
         results.push(...creds);
         // Credentials that can't read the account would make every later check throw, not report (codex code r7).
         if (creds.some((c) => c.status === "fail"))
@@ -372,8 +385,17 @@ async function run(argv: string[], cwd: string, deps: RunDeps & { json: boolean
         else results.push(...(await doctorRemote({ cwd, cf, lock, logpushJobs: () => cf.logpushJobs() })));
       }
     }
-    console.log(flags.includes("--json") ? JSON.stringify({ checks: results }, null, 2) : formatReport(results));
     const handoff = results.find((r) => r.handoff)?.handoff;
+    // The same envelope as every --json command (p0.10.1 §1, 7): ok, the checks, and a handoff when there is one.
+    console.log(
+      flags.includes("--json")
+        ? JSON.stringify({
+            ok: !results.some((r) => r.status === "fail"),
+            checks: results,
+            ...(handoff ? { handoff } : {}),
+          })
+        : formatReport(results),
+    );
     if (handoff) {
       console.error(`for you: ${handoff}`);
       return 3;
@@ -463,7 +485,8 @@ export async function main(argv: string[], cwd: string, deps: RunDeps = {}): Pro
       const f = failureOf(e);
       if (!f) throw e;
       console.error(f.line);
-      if (json) (deps.emit ?? emit)(f.result);
+      // doctor keeps its own --json report, and a failure past it is still one object (p0.10.1, codex code r20).
+      if (json || (command === "doctor" && flags.includes("--json"))) (deps.emit ?? emit)(f.result);
       return f.code;
     }
   });

package/src/ops.ts

@@ -53,6 +53,15 @@ export const OPS_SCHEMA = [
     classes TEXT NOT NULL DEFAULT '[]', destroyed_at INTEGER NOT NULL)`,
 ];
 
+/** Every table and index OPS_SCHEMA makes, by name. */
+const OPS_OBJECTS = OPS_SCHEMA.map((s) => (/IF NOT EXISTS (\w+)/.exec(s) as RegExpExecArray)[1] as string);
+
+/**
+ * Rows per INSERT into `applied`: three bound parameters each, under D1's 100
+ * per query (https://developers.cloudflare.com/d1/platform/limits/).
+ */
+const APPLIED_ROWS = 33;
+
 export class OperationHeld extends Error {
   constructor(readonly held: OperationRow) {
     super(
@@ -128,7 +137,13 @@ export class OpsStore {
   ) {}
 
   async init(store: string): Promise<void> {
-    for (const s of OPS_SCHEMA) await this.q(s);
+    // Every object already there: the statements would change nothing, and a platform's rate limit counts
+    // each one (salve: 120 a minute per app, p0.11 row 16). The schema only ever gains objects, never columns.
+    const present = await this.q(
+      `SELECT name FROM sqlite_master WHERE name IN (${OPS_OBJECTS.map(() => "?").join(", ")})`,
+      OPS_OBJECTS,
+    );
+    if (present.length !== OPS_OBJECTS.length) for (const s of OPS_SCHEMA) await this.q(s);
     await this.q("INSERT INTO kedge_ops_meta (id, store, created_at) VALUES (1, ?, ?) ON CONFLICT (id) DO NOTHING", [
       store,
       this.now(),
@@ -344,12 +359,16 @@ export class OpsStore {
     return new Map((await this.q("SELECT file, sha256 FROM applied")).map((r) => [String(r.file), String(r.sha256)]));
   }
 
-  async recordApplied(file: string, sha256: string): Promise<void> {
-    await this.q("INSERT INTO applied (file, sha256, applied_at) VALUES (?, ?, ?) ON CONFLICT (file) DO NOTHING", [
-      file,
-      sha256,
-      this.now(),
-    ]);
+  /** Each applied file's hash, the first recorded kept: one statement per 33 files, not one per file (p0.11 row 16). */
+  async recordApplied(files: readonly (readonly [file: string, sha256: string])[]): Promise<void> {
+    const t = this.now();
+    for (let i = 0; i < files.length; i += APPLIED_ROWS) {
+      const chunk = files.slice(i, i + APPLIED_ROWS);
+      await this.q(
+        `INSERT INTO applied (file, sha256, applied_at) VALUES ${chunk.map(() => "(?, ?, ?)").join(", ")} ON CONFLICT (file) DO NOTHING`,
+        chunk.flatMap(([f, h]) => [f, h, t]),
+      );
+    }
   }
 
   // ---- the store's own resources (§6.1) ------------------------------------------------------------------

package/src/output.ts

@@ -1,9 +1,11 @@
 // `--json` (p0.10 §5): stdout carries one object when the command ends, and
-// nothing else, so an agent parses it whole. Progress still reaches a person,
-// on stderr: console.log is pointed there for the command's run, and every
-// child the CLI starts (Wrangler, the store's checks and scenarios) writes its
-// stdout there too, since a child's line on stdout would break the object.
-import type { StdioOptions } from "node:child_process";
+// nothing else, so an agent parses it whole. stderr carries only what the
+// agent must read: a refusal, a handoff's `for you:` line, or a child's failure.
+// Progress is dropped, and every child the CLI starts (Wrangler, the store's
+// checks and scenarios) is captured and shown, its last lines on stderr, only
+// when it fails: an agent's tool shows both streams as one, so anything chatty
+// there reads as part of the answer (p0.10.1 §1, 7).
+import type { SpawnSyncReturns, StdioOptions } from "node:child_process";
 
 let reserved = false;
 
@@ -13,8 +15,8 @@ export async function withJsonOutput<T>(on: boolean, work: () => Promise<T>): Pr
   const log = console.log;
   const info = console.info;
   reserved = true;
-  console.log = console.error;
-  console.info = console.error;
+  console.log = () => {};
+  console.info = () => {};
   try {
     return await work();
   } finally {
@@ -29,7 +31,14 @@ export function emit(result: Record<string, unknown>): void {
   process.stdout.write(`${JSON.stringify(result)}\n`);
 }
 
-/** A child's stdio: inherited, except that its stdout goes to stderr while stdout is reserved. */
+/** A child's stdio: inherited, or under `--json` captured, for `childFailed` to show if it fails. */
 export function childStdio(): StdioOptions {
-  return reserved ? ["inherit", 2, "inherit"] : "inherit";
+  return reserved ? ["ignore", "pipe", "pipe"] : "inherit";
+}
+
+/** Under `--json`, a captured child that failed shows its last lines on stderr; inherited output was already seen. */
+export function childFailed(r: Pick<SpawnSyncReturns<string | Buffer>, "status" | "stdout" | "stderr">): void {
+  if (!reserved || r.status === 0) return;
+  const out = `${r.stdout?.toString() ?? ""}${r.stderr?.toString() ?? ""}`.trim();
+  if (out) process.stderr.write(`${out.split("\n").slice(-40).join("\n")}\n`);
 }

package/src/preview.ts

@@ -33,7 +33,7 @@ import type { Lock } from "./compose";
 import { CORE_SECRETS, DeployRefused, openOps, stageAssets } from "./deploy";
 import { assetsShape, declaredClasses, readWrangler } from "./doctor";
 import { LostOwnership, OperationHeld, type OpsStore } from "./ops";
-import { childStdio } from "./output";
+import { childFailed, childStdio } from "./output";
 import { hashTree, type StoreNames, sha256, type WranglerJson } from "./store";
 import { readTar, type TarEntry, TarRefused, writeTar } from "./tar";
 
@@ -200,6 +200,7 @@ export function previewConfig(source: WranglerJson, p: PreviewWorker): Record<st
     workers_dev: true,
     observability: {
       ...observability,
+      redact_query_string: true,
       logs: { ...((observability.logs as object | undefined) ?? {}), invocation_logs: false },
     },
     vars: { ...vars, ADMIN_ORIGINS: [...origins].join(","), KEDGE_ENVIRONMENT: "preview" },
@@ -720,6 +721,10 @@ class PreviewRun {
         // recreates under a new nonce, where a late landing can't replace it, and the sweep removes
         // what lands on the old name (codex code r4).
         if (e instanceof UnknownOutcome) await this.write("state = 'destroying', lost_create = 1", []);
+        // A host that serves one Worker per store refuses this upload (salve hosting), after the preview's
+        // database and queue exist: the way out is named, never inferred from the platform's words (p0.11 row 8).
+        if (e instanceof Error)
+          e.message += `\nThe preview's database and queue exist: remove what it made with kedge preview destroy --name ${this.name}. A host that serves one Worker per store (salve hosting) has no previews: test on kedge dev instead.`;
         throw e;
       } finally {
         if (secretsFile) rmSync(secretsFile, { force: true });
@@ -1018,7 +1023,9 @@ export function runScenarios(cwd: string, credentials: StoreCredentials, env: No
       cwd,
       stdio: childStdio(),
       env: { ...env, KEDGE_PREVIEW_CREDENTIALS: JSON.stringify(credentials) },
+      maxBuffer: 1 << 26,
     });
+    childFailed(r);
     return r.status ?? 1;
   } finally {
     rmSync(tmp, { recursive: true, force: true });

package/src/smoke.ts

@@ -47,11 +47,25 @@ export interface SmokeResult {
   status: string;
 }
 
-const table = (db: DatabaseSync) =>
-  db.exec(`CREATE TABLE IF NOT EXISTS smoke_run (
-    name TEXT PRIMARY KEY, store TEXT NOT NULL, storefront_id TEXT NOT NULL,
+const COLUMNS = `store TEXT NOT NULL, name TEXT NOT NULL, storefront_id TEXT NOT NULL,
     cart_id TEXT, cart_token TEXT, completion TEXT, order_id TEXT, order_token TEXT, number TEXT, abandoned TEXT,
-    created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL)`);
+    created_at INTEGER NOT NULL, updated_at INTEGER NOT NULL`;
+
+/**
+ * Runs keyed by store and name (p0.10.1 §5): `first` on kedge dev and `first` on
+ * Cloudflare are two runs. A 0.10.0 checkout's `smoke_run`, keyed by name alone,
+ * is copied in whole the first time, every recorded moment with it, so a run it
+ * stopped resumes; the old table is left as it was.
+ */
+function table(db: DatabaseSync) {
+  db.exec(`CREATE TABLE IF NOT EXISTS smoke_runs (${COLUMNS}, PRIMARY KEY (store, name))`);
+  const legacy = db.prepare("SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = 'smoke_run'").get();
+  if (legacy)
+    db.exec(`INSERT OR IGNORE INTO smoke_runs (store, name, storefront_id, cart_id, cart_token, completion, order_id,
+      order_token, number, abandoned, created_at, updated_at)
+      SELECT store, name, storefront_id, cart_id, cart_token, completion, order_id, order_token, number, abandoned,
+      created_at, updated_at FROM smoke_run`);
+}
 
 /** The smoke run `name` on `target`: resumed, or answered again once it has its number. */
 export async function smoke(target: StoreTarget, name: string, d: SmokeDeps): Promise<SmokeResult> {
@@ -69,20 +83,18 @@ export async function smoke(target: StoreTarget, name: string, d: SmokeDeps): Pr
 async function run(db: DatabaseSync, target: StoreTarget, name: string, d: SmokeDeps): Promise<SmokeResult> {
   const now = d.now ?? Date.now;
   const store = identityOf(target);
-  const get = () => db.prepare("SELECT * FROM smoke_run WHERE name = ?").get(name) as unknown as Run | undefined;
+  const get = () =>
+    db.prepare("SELECT * FROM smoke_runs WHERE store = ? AND name = ?").get(store, name) as unknown as Run | undefined;
   const set = (a: Partial<Run>) => {
     const cols = Object.keys(a);
-    db.prepare(`UPDATE smoke_run SET ${cols.map((c) => `${c} = ?`).join(", ")}, updated_at = ? WHERE name = ?`).run(
-      ...cols.map((c) => (a as Record<string, string | null>)[c] ?? null),
-      now(),
-      name,
-    );
+    db.prepare(
+      `UPDATE smoke_runs SET ${cols.map((c) => `${c} = ?`).join(", ")}, updated_at = ? WHERE store = ? AND name = ?`,
+    ).run(...cols.map((c) => (a as Record<string, string | null>)[c] ?? null), now(), store, name);
   };
 
   let r = get();
   // A finished run answers its order again, sending nothing: a retried command can't place a second one.
   if (r?.number && r.order_id) {
-    if (r.store !== store) throw new DeployRefused(`smoke run ${name} belongs to another store (${r.store})`);
     return { run: name, order_id: r.order_id, number: r.number, status: "open" };
   }
   if (r?.abandoned)
@@ -106,19 +118,15 @@ async function run(db: DatabaseSync, target: StoreTarget, name: string, d: Smoke
 
   if (!r) {
     const t = now();
-    db.prepare("INSERT INTO smoke_run (name, store, storefront_id, created_at, updated_at) VALUES (?, ?, ?, ?, ?)").run(
-      name,
-      store,
-      storefront,
-      t,
-      t,
-    );
+    db.prepare(
+      "INSERT INTO smoke_runs (store, name, storefront_id, created_at, updated_at) VALUES (?, ?, ?, ?, ?)",
+    ).run(store, name, storefront, t, t);
     r = get() as Run;
   }
-  // A cart admits only its own storefront's key: a record for another store or storefront is refused, not reused.
-  if (r.store !== store || r.storefront_id !== storefront)
+  // A cart admits only its own storefront's key: a record for another storefront is refused, not reused.
+  if (r.storefront_id !== storefront)
     throw new DeployRefused(
-      `smoke run ${name} was made for ${r.store === store ? `storefront ${r.storefront_id}` : r.store}: start another with --run <new name>`,
+      `smoke run ${name} was made for storefront ${r.storefront_id}: start another with --run <new name>`,
     );
 
   const shop = { "x-kedge-key": key };

package/src/store-api.ts

@@ -18,11 +18,18 @@ export async function storeRequest(
   const write = (init.method ?? "GET") !== "GET";
   let r: Response;
   try {
-    r = await f(url, init);
+    // No redirect is followed (p0.11 §3): a session is bound to the origin it was sent to, and the
+    // person names the store's URL, not something in front of it that sends the request elsewhere.
+    r = await f(url, { ...init, redirect: "manual" });
   } catch {
     if (write) throw new UnknownOutcome(what, "the store");
     throw new DeployRefused(`${what}: the store didn't answer`);
   }
+  // Kedge's API never redirects, so this answer came from in front of the Worker, which ran nothing.
+  if (r.status >= 300 && r.status < 400)
+    throw new DeployRefused(
+      `${what} answered a redirect${r.headers.get("location") ? ` to ${r.headers.get("location")}` : ""}: the CLI follows none, so give the store's own URL`,
+    );
   let body: Record<string, unknown>;
   try {
     body = (await r.json()) as Record<string, unknown>;

package/src/store.ts

@@ -13,6 +13,17 @@ import { byCodePoint } from "./order";
 /** The starter's id until a first deploy writes the real one (§6.1). */
 export const PLACEHOLDER_ID = "00000000-0000-0000-0000-000000000000";
 
+/**
+ * wrangler.jsonc with `id` written over the placeholder `database_id`, and
+ * only there: `preview_database_id` keeps the zeros, because Wrangler keys the
+ * local database by it, and rewriting it would open an empty local store after
+ * the first deploy (p0.11 row 17). The opening quote keeps the pattern off
+ * `"preview_database_id"`, so the keys' order doesn't matter.
+ */
+export function withDatabaseId(text: string, id: string): string {
+  return text.replace(new RegExp(`("database_id"\\s*:\\s*")${PLACEHOLDER_ID}"`), `$1${id}"`);
+}
+
 export interface StoreNames {
   worker: string;
   database: string;
@@ -24,7 +35,13 @@ export interface StoreNames {
 export type WranglerJson = Record<string, unknown> & {
   name?: string;
   main?: string;
-  d1_databases?: { binding?: string; database_name?: string; database_id?: string; migrations_dir?: string }[];
+  d1_databases?: {
+    binding?: string;
+    database_name?: string;
+    database_id?: string;
+    preview_database_id?: string;
+    migrations_dir?: string;
+  }[];
   queues?: { producers?: { binding?: string; queue?: string }[]; consumers?: { queue?: string }[] };
   migrations?: Record<string, unknown>[];
   triggers?: { crons?: string[] };
@@ -75,14 +92,19 @@ export function git(cwd: string): Git {
       if (r.status !== 0) throw new Error("kedge deploy needs a Git repository with a commit");
       return r.stdout.trim();
     },
+    // A store may sit below its repository's root (create-kedge reuses a workspace's repository, p0.11
+    // row 12): status covers the store's own directory, and its paths are the store's, as `show` reads
+    // them (codex code r5).
     dirty() {
-      return run(["status", "--porcelain"])
+      const prefix = run(["rev-parse", "--show-prefix"]).stdout.trim();
+      return run(["status", "--porcelain", "--", "."])
         .stdout.split("\n")
         .filter(Boolean)
-        .map((l) => l.slice(3));
+        .map((l) => l.slice(3))
+        .map((p) => (p.startsWith(prefix) ? p.slice(prefix.length) : p));
     },
     show(path) {
-      const r = run(["show", `HEAD:${path}`]);
+      const r = run(["show", `HEAD:./${path}`]);
       return r.status === 0 ? r.stdout : null;
     },
     isAncestor(older, newer) {
@@ -100,7 +122,7 @@ export function dirtyBeyondId(cwd: string, g: Git, databaseId: string | null): s
   return g.dirty().filter((p) => {
     if (p !== "wrangler.jsonc" || !databaseId) return true;
     const head = g.show("wrangler.jsonc");
-    return head === null || head.replace(PLACEHOLDER_ID, databaseId) !== readFileSync(join(cwd, p), "utf8");
+    return head === null || withDatabaseId(head, databaseId) !== readFileSync(join(cwd, p), "utf8");
   });
 }
 

package/src/target.ts

@@ -1,11 +1,13 @@
 // Which store a URL is (docs/proposals/p0.10-agent-path.md §4, §6.2). The CLI
 // sends a session, a saved key or a run's record only to a target it can name
 // by identity: production or a preview this store's `<store>-ops` records, or
-// `kedge dev` on this machine. Anything else gets nothing, so an unknown
-// endpoint never receives a token. A store is its account, Worker and
+// `kedge dev` on this machine. Any other https URL may be production under
+// another name (salve hosting's, a custom domain), and is proved before it
+// gets anything but the proof's own session, bound to that URL's origin and so
+// useless anywhere else (p0.11 §3). A store is its account, Worker and
 // database, not its URL: the account's owner can change the workers.dev
 // subdomain, so the URL is computed from the current one on every run.
-import type { Cloudflare } from "./cf";
+import { type Cloudflare, NeedsPerson } from "./cf";
 import { openOps } from "./deploy";
 import { storeNames } from "./store";
 
@@ -17,6 +19,12 @@ export interface StoreTarget {
   identity: { account: string; worker: string; database: string };
   /** Where a CLI session's row is written: that target's own database, and no other. */
   database: { name: string; id: string | null };
+  /**
+   * A URL the person gave rather than one the CLI derived (salve's, a custom
+   * domain): it's proved to be this store before any other request goes there
+   * (p0.11 §3).
+   */
+  proof?: true;
 }
 
 /**
@@ -55,8 +63,7 @@ export async function resolveTarget(
   if (!(await cf.findD1(names.ops))) return null;
   const { ops } = await openOps(cf, names);
   const host = (worker: string, subdomain: string) => `https://${worker}.${subdomain}.workers.dev`;
-  const subdomain = await cf.workersSubdomain();
-  if (u.origin === host(names.worker, subdomain)) {
+  const production = async (proof: boolean): Promise<StoreTarget | null> => {
     const db = await ops.resource("d1", names.database);
     if (!db?.id) return null;
     return {
@@ -64,14 +71,35 @@ export async function resolveTarget(
       url: u.origin,
       identity: { account: cf.account, worker: names.worker, database: db.id },
       database: { name: names.database, id: db.id },
+      ...(proof ? { proof: true as const } : {}),
     };
+  };
+  // Derived only where the Worker is served at workers.dev: a platform's stand-in subdomain (salve's) names
+  // a host the store isn't on, which then gets the proof like any other URL (p0.11 row 2).
+  // A store served only at its own domain, on an account without a subdomain, still resolves (codex code r3).
+  const devUrl = await cf.workersDevUrl(names.worker).catch((e: unknown) => {
+    if (e instanceof NeedsPerson) return null;
+    throw e;
+  });
+  if (u.origin === devUrl) return production(false);
+  // A preview is only ever at workers.dev, so only such a host asks for the account's subdomain. The whole
+  // origin, as a preview's is made: a host that only begins with a preview's name isn't it.
+  let p: Record<string, unknown> | undefined;
+  if (u.hostname.endsWith(".workers.dev")) {
+    const subdomain = await cf.workersSubdomain().catch((e: unknown) => {
+      if (e instanceof NeedsPerson) return null;
+      throw e;
+    });
+    const rows = subdomain
+      ? await ops.query(
+          "SELECT worker, database_name, database_id FROM preview WHERE state = 'bootstrapped' AND database_id IS NOT NULL",
+        )
+      : [];
+    p = rows.find((r) => u.origin === host(String(r.worker), subdomain as string));
   }
-  // The whole origin, as a preview's is made: a host that only begins with a preview's name isn't it.
-  const rows = await ops.query(
-    "SELECT worker, database_name, database_id FROM preview WHERE state = 'bootstrapped' AND database_id IS NOT NULL",
-  );
-  const p = rows.find((r) => u.origin === host(String(r.worker), subdomain));
-  if (!p) return null;
+  // Any other https origin may be production under another name (salve hosting's, a custom domain):
+  // the proof decides, before a session's token goes there (p0.11 row 1).
+  if (!p) return production(true);
   return {
     kind: "preview",
     url: u.origin,