@moinulmoin/eden 0.11.2 → 0.11.3

package/README.md

@@ -12,15 +12,15 @@ If you already have an Eve project, start with `eden deploy`.
 Use any one of these package managers:
 
 ```sh
-npm install --global @moinulmoin/eden@0.11.2
+npm install --global @moinulmoin/eden@0.11.3
 ```
 
 ```sh
-pnpm add --global @moinulmoin/eden@0.11.2
+pnpm add --global @moinulmoin/eden@0.11.3
 ```
 
 ```sh
-bun add --global @moinulmoin/eden@0.11.2
+bun add --global @moinulmoin/eden@0.11.3
 ```
 
 Then confirm the CLI is available:

package/dist/eve-control-plane.js

@@ -583,14 +583,14 @@ function candidateMetadata(candidate, imageDigest) {
         ...(imageDigest === undefined ? {} : { imageDigest }),
     };
 }
-function safeWranglerEnvironment() {
+function safeWranglerEnvironment(cwd) {
     return {
-        PATH: process.env.PATH,
-        HOME: process.env.HOME,
-        TMPDIR: process.env.TMPDIR,
-        LANG: process.env.LANG,
-        LC_ALL: process.env.LC_ALL,
+        ...safeDockerEnvironment(),
         CLOUDFLARE_API_TOKEN: process.env.CLOUDFLARE_API_TOKEN,
+        CLOUDFLARE_ACCOUNT_ID: process.env.CLOUDFLARE_ACCOUNT_ID,
+        NODE_EXTRA_CA_CERTS: process.env.NODE_EXTRA_CA_CERTS,
+        XDG_CONFIG_HOME: process.env.XDG_CONFIG_HOME,
+        WRANGLER_CACHE_DIR: join(cwd, "cache"),
         CLOUDFLARE_API_BASE_URL: "https://api.cloudflare.com/client/v4",
         NODE_OPTIONS: undefined,
     };
@@ -604,11 +604,23 @@ function safeDockerEnvironment() {
         LC_ALL: process.env.LC_ALL,
         DOCKER_HOST: process.env.DOCKER_HOST,
         DOCKER_CONTEXT: process.env.DOCKER_CONTEXT,
+        DOCKER_CONFIG: process.env.DOCKER_CONFIG,
+        DOCKER_CERT_PATH: process.env.DOCKER_CERT_PATH,
+        DOCKER_TLS_VERIFY: process.env.DOCKER_TLS_VERIFY,
+        HTTP_PROXY: process.env.HTTP_PROXY,
+        HTTPS_PROXY: process.env.HTTPS_PROXY,
+        NO_PROXY: process.env.NO_PROXY,
+        http_proxy: process.env.http_proxy,
+        https_proxy: process.env.https_proxy,
+        no_proxy: process.env.no_proxy,
     };
 }
 async function withWranglerDirectory(operation) {
+    // An explicit --config and WRANGLER_CACHE_DIR inside this private folder
+    // stop Wrangler from searching its (possibly shared) parent directories.
     const cwd = await mkdtemp(join(tmpdir(), "eden-wrangler-"));
     try {
+        await writeFile(join(cwd, "wrangler.json"), "{}\n", { mode: 0o600 });
         return await operation(cwd);
     }
     finally {
@@ -617,8 +629,8 @@ async function withWranglerDirectory(operation) {
 }
 async function readWranglerJson(args, timeoutMs = 30_000) {
     try {
-        const result = await withWranglerDirectory((cwd) => execFileAsync(process.execPath, [wranglerEntrypoint, ...args], {
-            env: safeWranglerEnvironment(),
+        const result = await withWranglerDirectory((cwd) => execFileAsync(process.execPath, [wranglerEntrypoint, ...args, "--config", join(cwd, "wrangler.json")], {
+            env: safeWranglerEnvironment(cwd),
             cwd,
             maxBuffer: 2 * 1024 * 1024,
             timeout: timeoutMs,
@@ -648,7 +660,7 @@ function jsonCollection(value) {
     }
     return undefined;
 }
-function exactContainerEntries(value, name) {
+function exactContainerEntries(value, name, complete = false) {
     const collection = jsonCollection(value);
     if (collection === undefined)
         return undefined;
@@ -668,7 +680,8 @@ function exactContainerEntries(value, name) {
             });
         }
     }
-    if (entries.length === 0 && collection.length >= 100) {
+    // Without proven pagination, a full page that lacks the name proves nothing.
+    if (entries.length === 0 && !complete && collection.length >= 100) {
         return undefined;
     }
     return entries;
@@ -697,16 +710,25 @@ function authenticatedAccountId(value) {
     const account = accounts[0];
     if (typeof account !== "object" ||
         account === null ||
+        !("id" in account) ||
         typeof account.id !== "string") {
         return undefined;
     }
+    const selectedAccount = process.env.CLOUDFLARE_ACCOUNT_ID;
+    if (selectedAccount && selectedAccount !== account.id) {
+        return undefined;
+    }
     return account.id;
 }
 async function readWranglerOAuthToken() {
-    const root = process.env.WRANGLER_HOME ??
+    const legacyRoot = join(homedir(), ".wrangler");
+    const legacyExists = (await lstat(legacyRoot).catch(() => undefined))?.isDirectory();
+    const configHome = process.env.XDG_CONFIG_HOME ??
         (process.platform === "darwin"
-            ? join(homedir(), "Library", "Preferences", ".wrangler")
-            : join(homedir(), ".config", ".wrangler"));
+            ? join(homedir(), "Library", "Preferences")
+            : join(homedir(), ".config"));
+    const root = process.env.WRANGLER_HOME ??
+        (legacyExists ? legacyRoot : join(configHome, ".wrangler"));
     const raw = await readFile(join(root, "config", "default.toml"), "utf8")
         .catch(() => undefined);
     if (raw === undefined)
@@ -756,19 +778,71 @@ async function readWorkersDevSubdomain(accountId) {
 export function exactTargetContainerEntries(value, name) {
     return exactContainerEntries(value, boundedResourceName(name, "container"));
 }
+async function readTargetContainers(name) {
+    const account = await readWranglerJson(["whoami", "--json"]);
+    const accountId = authenticatedAccountId(account.value);
+    const token = process.env.CLOUDFLARE_API_TOKEN || await readWranglerOAuthToken();
+    if (accountId === undefined || !token)
+        return { failed: true };
+    // Unlike `containers list --json`, this endpoint supports an exact name
+    // filter and exposes result_info.next_page_token. No per_page means all.
+    const entries = [];
+    const seenTokens = new Set();
+    let pageToken;
+    try {
+        do {
+            const url = new URL(`https://api.cloudflare.com/client/v4/accounts/${encodeURIComponent(accountId)}/containers/applications`);
+            url.searchParams.set("name", name);
+            if (pageToken !== undefined)
+                url.searchParams.set("page_token", pageToken);
+            const response = await fetch(url, {
+                headers: { Authorization: `Bearer ${token}`, Accept: "application/json" },
+                signal: AbortSignal.timeout(30_000),
+            });
+            if (!response.ok)
+                return { failed: true };
+            const body = await response.json();
+            if (typeof body !== "object" || body === null ||
+                !("success" in body) || body.success !== true ||
+                !("result" in body) || !Array.isArray(body.result))
+                return { failed: true };
+            const info = "result_info" in body ? body.result_info : undefined;
+            if (info !== undefined &&
+                (typeof info !== "object" || info === null || Array.isArray(info))) {
+                return { failed: true };
+            }
+            const next = info !== undefined && "next_page_token" in info
+                ? info.next_page_token
+                : undefined;
+            if (next !== undefined && next !== null && typeof next !== "string") {
+                return { failed: true };
+            }
+            // Missing pagination metadata on a full page cannot prove absence.
+            if (info === undefined && body.result.length >= 100)
+                return { failed: true };
+            entries.push(...body.result);
+            pageToken = typeof next === "string" && next.length > 0 ? next : undefined;
+            if (pageToken !== undefined) {
+                if (seenTokens.has(pageToken))
+                    return { failed: true };
+                seenTokens.add(pageToken);
+            }
+        } while (pageToken !== undefined);
+        return { failed: false, value: entries };
+    }
+    catch {
+        return { failed: true };
+    }
+}
 async function readExactTargetInventory(workerName, containerApp) {
-    // Wrangler's JSON output does not expose a pagination cursor. A full page
-    // without the exact name remains indeterminate in exactContainerEntries.
-    const containers = await readWranglerJson([
-        "containers", "list", "--json", "--per-page", "100",
-    ]);
+    const containers = await readTargetContainers(containerApp);
     const deployments = await readWranglerJson([
         "deployments", "list", "--name", workerName, "--json",
     ]);
     return {
         containers,
         deployments,
-        containerEntries: containers.failed ? undefined : exactContainerEntries(containers.value, containerApp),
+        containerEntries: containers.failed ? undefined : exactContainerEntries(containers.value, containerApp, true),
         deploymentEntries: exactDeploymentEntries(deployments.value),
     };
 }
@@ -1282,9 +1356,11 @@ const WRANGLER_PUBLICATION_TIMEOUT_MS = 600_000;
 async function runWranglerWithInput(args, input, timeoutMs = WRANGLER_OPERATION_TIMEOUT_MS) {
     // The project's TypeScript lib predates Promise.withResolvers.
     return withWranglerDirectory((cwd) => new Promise((resolveResult) => {
-        const child = spawn(process.execPath, [wranglerEntrypoint, ...args], {
+        const child = spawn(process.execPath, [wranglerEntrypoint, ...args, ...(args.includes("--config")
+                ? []
+                : ["--config", join(cwd, "wrangler.json")])], {
             cwd,
-            env: safeWranglerEnvironment(),
+            env: safeWranglerEnvironment(cwd),
             stdio: ["pipe", "pipe", "pipe"],
         });
         let stdout = "";

package/dist/eve-packaging.js

@@ -363,6 +363,7 @@ const EVE_EXCLUDED_FILE_NAMES = new Set([
     ".pnpmrc",
     ".pypirc",
     ".bunfig.toml",
+    "bunfig.toml",
     ".yarnrc",
     ".yarnrc.yml",
     ".dev.vars",
@@ -372,6 +373,9 @@ const EVE_EXCLUDED_FILE_NAMES = new Set([
     "id_ecdsa",
     "id_ed25519",
     "id_dsa",
+    "id_ecdsa_sk",
+    "id_ed25519_sk",
+    "id_xmss",
     "secrets.json",
     "credentials.json",
     "service-account.json",
@@ -427,15 +431,23 @@ function isAllowedSystemAlias(path) {
     const normalized = resolve(path);
     return normalized === "/var" || normalized === "/tmp";
 }
+function isEnvironmentFile(name) {
+    const normalizedName = name.toLowerCase();
+    return normalizedName.startsWith(".env") || normalizedName.endsWith(".env");
+}
 function isCredentialPath(relativePath) {
     const parts = relativePath.split("/");
-    const name = parts[parts.length - 1];
-    return name !== undefined && (EVE_EXCLUDED_FILE_NAMES.has(name) ||
+    const originalName = parts[parts.length - 1];
+    if (originalName === undefined)
+        return false;
+    const name = originalName.toLowerCase();
+    return (EVE_EXCLUDED_FILE_NAMES.has(originalName) ||
+        EVE_EXCLUDED_FILE_NAMES.has(name) ||
         name.startsWith(".dev.vars.") ||
         name.endsWith(".pem") || name.endsWith(".key") ||
         name.endsWith(".p12") || name.endsWith(".pfx") ||
         name.endsWith(".tfvars") ||
-        (name === "credentials" && parts[parts.length - 2] === ".aws"));
+        (name === "credentials" && parts[parts.length - 2]?.toLowerCase() === ".aws"));
 }
 function isPathExcluded(relativePath, runtimeEnvRelativePath) {
     const parts = relativePath.split("/");
@@ -455,7 +467,7 @@ function isPathExcluded(relativePath, runtimeEnvRelativePath) {
     if (runtimeEnvRelativePath !== undefined && relativePath === runtimeEnvRelativePath) {
         return { excluded: true, category: "runtime-env" };
     }
-    if (name !== undefined && name.startsWith(".env")) {
+    if (name !== undefined && isEnvironmentFile(name)) {
         return { excluded: true, category: "runtime-env" };
     }
     if (isCredentialPath(relativePath)) {
@@ -1753,7 +1765,7 @@ async function assertGeneratedTreesExcludeSecrets(snapshotRoot) {
                 ? entry.name
                 : `${relativeDirectory}/${entry.name}`;
             const candidate = join(directory, entry.name);
-            if (entry.name.startsWith(".env") ||
+            if (isEnvironmentFile(entry.name) ||
                 isCredentialPath(relativePath)) {
                 throw new EvePackagingError({
                     code: "SECRET_EXCLUSION_FAILED",

package/dist/eve-runtime-config.js

@@ -195,7 +195,8 @@ function parseEnvironmentText(text) {
                 variableName: name,
             });
         }
-        if (EVE_RESERVED_HOST_VARIABLES.includes(name)) {
+        if (EVE_RESERVED_HOST_VARIABLES.includes(name) ||
+            /^(DOCKER_|BUILDKIT_|BUILDX_|COMPOSE_|LD_|DYLD_)/u.test(name)) {
             throw new EveRuntimeConfigError({
                 code: "EVE_ENV_RESERVED_VARIABLE",
                 message: `The explicit Eve environment file attempts to override reserved host variable ${name}.` +

package/dist/eve-runtime-image.js

@@ -556,6 +556,15 @@ function safeDockerEnvironment() {
         LC_ALL: process.env.LC_ALL,
         DOCKER_HOST: process.env.DOCKER_HOST,
         DOCKER_CONTEXT: process.env.DOCKER_CONTEXT,
+        DOCKER_CONFIG: process.env.DOCKER_CONFIG,
+        DOCKER_CERT_PATH: process.env.DOCKER_CERT_PATH,
+        DOCKER_TLS_VERIFY: process.env.DOCKER_TLS_VERIFY,
+        HTTP_PROXY: process.env.HTTP_PROXY,
+        HTTPS_PROXY: process.env.HTTPS_PROXY,
+        NO_PROXY: process.env.NO_PROXY,
+        http_proxy: process.env.http_proxy,
+        https_proxy: process.env.https_proxy,
+        no_proxy: process.env.no_proxy,
     };
 }
 /**
@@ -567,7 +576,7 @@ function safeDockerEnvironment() {
  */
 async function docker(state, args, options = {}) {
     return execFileAsync(state.command, [...args], {
-        env: { ...state.env, ...options.environment },
+        env: { ...options.environment, ...state.env },
         cwd: state.generationRoot,
         maxBuffer: options.maxBuffer ?? 4 * 1024 * 1024,
     });
@@ -987,7 +996,8 @@ export async function buildEveRuntimeImage(request) {
                 run: (startRequest) => startRequest.env,
             });
         if (request.runtimeInjection !== undefined) {
-            const collision = Object.keys(runtimeEnvironment).find((name) => DOCKER_CLI_OWNED_VARIABLES.includes(name));
+            const collision = Object.keys(runtimeEnvironment).find((name) => DOCKER_CLI_OWNED_VARIABLES.includes(name) ||
+                /^(DOCKER_|BUILDKIT_|BUILDX_|COMPOSE_|LD_|DYLD_)/u.test(name));
             if (collision !== undefined) {
                 throw packagingError("DOCKER_PLATFORM_BLOCKED", "runtime variable name", `The runtime variable ${collision} would replace the local Docker CLI's own ${collision}.`, `Rename ${collision} in --env-file; ${DOCKER_CLI_OWNED_VARIABLES.join(", ")} are reserved for the local Docker CLI.`);
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moinulmoin/eden",
-  "version": "0.11.2",
+  "version": "0.11.3",
   "description": "Deploy existing Eve projects to your own Cloudflare account.",
   "keywords": [
     "ai",
@@ -32,7 +32,7 @@
     "NOTICE"
   ],
   "dependencies": {
-    "@moinulmoin/eden-runtime-cloudflare": "0.11.2",
+    "@moinulmoin/eden-runtime-cloudflare": "0.11.3",
     "wrangler": "4.147.0"
   },
   "devDependencies": {