@moinulmoin/eden 0.2.1 → 0.3.0

package/README.md

@@ -12,15 +12,15 @@ If you already have an Eve project, start with `eden deploy`.
 Use any one of these package managers:
 
 ```sh
-npm install --global @moinulmoin/eden@0.2.1
+npm install --global @moinulmoin/eden@0.3.0
 ```
 
 ```sh
-pnpm add --global @moinulmoin/eden@0.2.1
+pnpm add --global @moinulmoin/eden@0.3.0
 ```
 
 ```sh
-bun add --global @moinulmoin/eden@0.2.1
+bun add --global @moinulmoin/eden@0.3.0
 ```
 
 Then confirm the CLI is available:

package/dist/eve-control-plane.d.ts

@@ -31,12 +31,18 @@ export interface EveDeploymentMetadata {
     readonly runtimeVariableNames: readonly string[];
     readonly evidenceRetained: true;
 }
+export interface EvePreflightWarning {
+    readonly id: string;
+    readonly message: string;
+    readonly remediation?: string;
+}
 export interface EvePreflightResult {
     readonly command: "eve preflight" | "eve deploy";
     readonly ok: boolean;
     readonly environment: EveCliEnvironment;
     readonly name: string;
     readonly checks: readonly EvePreflightCheck[];
+    readonly warnings: readonly EvePreflightWarning[];
     readonly candidate: EvePreflightCandidate | null;
     readonly deployment?: EveDeploymentMetadata;
 }
@@ -77,6 +83,7 @@ export interface EvePreflightRuntimeRunnerRequest {
     readonly publicOrigin?: string;
     readonly runtimeInjection?: EveRuntimeInjection;
     readonly retainImage?: boolean;
+    readonly workflowWorld?: string;
 }
 export type EvePreflightRuntimeRunner = (request: EvePreflightRuntimeRunnerRequest) => EvePreflightRuntimeEvidence | Promise<EvePreflightRuntimeEvidence>;
 export type EveRuntimeImageDiscardRunner = (request: EveRuntimeImageDiscardRequest) => boolean | Promise<boolean>;
@@ -237,6 +244,15 @@ export interface EveDestroyCloudflareReadRequest {
     /** Exact `repository:tag` image refs recorded for this target. */
     readonly registryImages?: readonly string[];
 }
+/**
+ * Container applications in the account that belong to this exact target.
+ * Eden names a target's Container application `<name>-container`; containers
+ * owned by anything else in the account never count.
+ */
+export declare function exactTargetContainerEntries(value: unknown, name: string): readonly {
+    readonly id: string;
+    readonly name: string;
+}[] | undefined;
 export declare function runEveControlPlane(request: EveCliExecutionRequest, options?: EvePreflightOptions): Promise<void>;
 export interface EveDestroyOutcome {
     readonly ok: boolean;

package/dist/eve-control-plane.js

@@ -75,6 +75,171 @@ function blockedAfterFailure(id, message) {
 function allChecksClear(checks) {
     return checks.every((value) => value.status === "passed" || value.status === "skipped");
 }
+/**
+ * Path, inside the built snapshot, of the manifest `eve build` writes with the
+ * resolved agent configuration. `config.experimental.workflow.world` is the
+ * field Eve itself resolves at build time; absent/`local`/
+ * `@workflow/world-local` mean Eve's container-local default World.
+ */
+const EVE_COMPILED_MANIFEST_PATH = ".output/.eve/compile/compiled-agent-manifest.json";
+async function readCompiledWorldSpecifier(candidate) {
+    try {
+        const manifest = JSON.parse(await readFile(join(candidate.snapshotRoot, EVE_COMPILED_MANIFEST_PATH), "utf8"));
+        const world = manifest?.config?.experimental?.workflow?.world;
+        return typeof world === "string" ? world : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Reads authored schedules out of the compiled manifest `eve build` writes.
+ * Root `schedules` covers file and extension-mounted schedules; declared
+ * subagents cannot carry schedules, so only the root array is consulted.
+ */
+async function readCompiledSchedules(candidate) {
+    try {
+        const manifest = JSON.parse(await readFile(join(candidate.snapshotRoot, EVE_COMPILED_MANIFEST_PATH), "utf8"));
+        const schedules = manifest?.schedules;
+        if (!Array.isArray(schedules))
+            return [];
+        return schedules.flatMap((schedule) => typeof schedule.name === "string" && typeof schedule.cron === "string"
+            ? [{ name: schedule.name, cron: schedule.cron }]
+            : []);
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * Mirrors Eve's own `assertWorkflowWorldCompatibility`
+ * (dist/src/internal/workflow/world-compatibility.js): Eve derives the
+ * expected Workflow line from its installed manifest's `@workflow/core`
+ * dependency, reads the selected World's manifest for a `@workflow/core` or
+ * `@workflow/world` dependency, and fails only on a definite line mismatch —
+ * different major, or both prerelease tags present and different.
+ */
+function parseWorkflowVersionLine(range) {
+    const match = /(\d+)\.(?:\d+|x|\*)(?:\.(?:\d+|x|\*))?(?:-([0-9A-Za-z.-]+))?/u.exec(range.trim());
+    if (match === null)
+        return undefined;
+    const major = Number(match[1]);
+    if (!Number.isInteger(major))
+        return undefined;
+    return {
+        major,
+        ...(match[2] === undefined
+            ? {}
+            : { prereleaseTag: match[2].split(".")[0] }),
+    };
+}
+async function readInstalledManifest(snapshotRoot, packageName) {
+    try {
+        return JSON.parse(await readFile(join(snapshotRoot, "node_modules", packageName, "package.json"), "utf8"));
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Fails deploy/preflight when the selected `@workflow/world-postgres` would
+ * trip Eve's runtime World-compatibility rejection. Unreadable manifests
+ * mirror Eve's own behavior (skip); Eve is the runtime authority.
+ */
+async function checkEveWorldPairing(candidate, world) {
+    if (world !== "@workflow/world-postgres")
+        return undefined;
+    const eveManifest = await readInstalledManifest(candidate.snapshotRoot, "eve");
+    const expectedRange = eveManifest === undefined
+        ? undefined
+        : [
+            eveManifest.devDependencies,
+            eveManifest.dependencies,
+            eveManifest.peerDependencies,
+        ]
+            .map((deps) => deps?.["@workflow/core"])
+            .find((value) => typeof value === "string" && value.trim().length > 0);
+    if (expectedRange === undefined)
+        return undefined;
+    const worldManifest = await readInstalledManifest(candidate.snapshotRoot, world);
+    const declared = worldManifest === undefined
+        ? undefined
+        : ["@workflow/core", "@workflow/world"]
+            .map((name) => ({
+            packageName: name,
+            range: worldManifest.dependencies?.[name] ??
+                worldManifest.peerDependencies?.[name],
+        }))
+            .find((entry) => typeof entry.range === "string" && entry.range.trim().length > 0);
+    if (declared === undefined)
+        return undefined;
+    const declaredLine = parseWorkflowVersionLine(declared.range);
+    const expectedLine = parseWorkflowVersionLine(expectedRange);
+    if (declaredLine === undefined || expectedLine === undefined) {
+        return undefined;
+    }
+    const mismatch = declaredLine.major !== expectedLine.major ||
+        (declaredLine.prereleaseTag !== undefined &&
+            expectedLine.prereleaseTag !== undefined &&
+            declaredLine.prereleaseTag !== expectedLine.prereleaseTag);
+    if (mismatch) {
+        return check("EVE_WORLD_PAIRING", "failed", `The installed @workflow/world-postgres targets ${declared.packageName} ${declared.range}, but the project's Eve bundles @workflow/core ${expectedRange}; Eve rejects this World at runtime.`, `Install the @workflow/world-postgres release whose ${declared.packageName} dependency matches the Eve-bundled @workflow/core ${expectedRange} line (e.g. \`pnpm add @workflow/world-postgres@<matching-version>\`); see docs/deploy.md#durable-state-postgres-world.`);
+    }
+    return check("EVE_WORLD_PAIRING", "passed", `The installed @workflow/world-postgres ${declared.packageName} dependency ${declared.range} pairs with the Eve-bundled @workflow/core ${expectedRange}.`);
+}
+/**
+ * Returns a generic reason when the URL targets a transaction-mode pooler.
+ * Never returns URL content; only a safe classification of the host/port.
+ */
+function pooledPostgresReason(connectionString) {
+    if (connectionString === undefined)
+        return undefined;
+    let url;
+    try {
+        url = new URL(connectionString);
+    }
+    catch {
+        return undefined;
+    }
+    if (url.hostname.includes("-pooler")) {
+        return "a transaction-mode pooler host";
+    }
+    if (url.port === "6543") {
+        return "a transaction-mode pooler port";
+    }
+    return undefined;
+}
+/**
+ * Non-blocking World warnings. The container wipes its disk on sleep, so the
+ * default local World loses pending approvals and sessions; and a pooled
+ * Postgres URL breaks the World streamer, which relies on LISTEN/NOTIFY.
+ */
+async function collectEveWorldWarnings(candidate, runtimeConfig) {
+    const warnings = [];
+    if (candidate !== undefined) {
+        const world = await readCompiledWorldSpecifier(candidate);
+        if (world === undefined ||
+            world === "local" ||
+            world === "@workflow/world-local") {
+            warnings.push({
+                id: "EVE_WORLD_LOCAL",
+                message: "This project uses Eve's default local Workflow World; workflow state lives on the container disk and is lost when the container sleeps.",
+                remediation: "Configure a durable Workflow World such as @workflow/world-postgres; see docs/deploy.md#durable-state-postgres-world.",
+            });
+        }
+    }
+    if (runtimeConfig !== undefined) {
+        const pooledReason = runtimeConfig.withProtectedValues((values) => pooledPostgresReason(values.WORKFLOW_POSTGRES_URL ?? values.DATABASE_URL));
+        if (pooledReason !== undefined) {
+            warnings.push({
+                id: "EVE_WORLD_POSTGRES_POOLED",
+                message: `The configured Postgres connection uses ${pooledReason}; transaction-mode poolers accept LISTEN but never deliver notifications, so live session streaming hangs.`,
+                remediation: "Use the direct, unpooled Postgres URL for WORKFLOW_POSTGRES_URL (on Neon, the unpooled host without -pooler); see docs/deploy.md#durable-state-postgres-world.",
+            });
+        }
+    }
+    return warnings;
+}
 /** True when the caller asked for the human progress/summary output. */
 function humanOutput(options) {
     return options.outputFormat === "human";
@@ -113,6 +278,12 @@ function formatEveElapsed(startedAt) {
  */
 function humanEveResultLines(result, startedAt, eveVersion) {
     const lines = [...eveCheckLines(result.checks)];
+    for (const warning of result.warnings) {
+        lines.push(`! ${warning.id} — ${safeText(warning.message)}`);
+        if (warning.remediation !== undefined) {
+            lines.push(`  → ${safeText(warning.remediation)}`);
+        }
+    }
     const elapsed = formatEveElapsed(startedAt);
     const commandLabel = result.command === "eve deploy" ? "deploy" : "preflight";
     if (result.ok) {
@@ -353,6 +524,14 @@ async function readWorkersDevSubdomain(accountId) {
         return undefined;
     }
 }
+/**
+ * Container applications in the account that belong to this exact target.
+ * Eden names a target's Container application `<name>-container`; containers
+ * owned by anything else in the account never count.
+ */
+export function exactTargetContainerEntries(value, name) {
+    return exactContainerEntries(value, boundedResourceName(name, "container"));
+}
 async function defaultCloudflareRead(request) {
     const account = await readWranglerJson(["whoami", "--json"]);
     const containers = await readWranglerJson([
@@ -362,7 +541,6 @@ async function defaultCloudflareRead(request) {
         "--per-page",
         "100",
     ]);
-    const containerCollection = jsonCollection(containers.value);
     const deployments = await readWranglerJson([
         "deployments",
         "list",
@@ -374,7 +552,7 @@ async function defaultCloudflareRead(request) {
     const accountAccess = account.failed || accountId === undefined
         ? "unavailable"
         : "available";
-    const containerEntries = exactContainerEntries(containers.value, request.name);
+    const containerEntries = exactTargetContainerEntries(containers.value, request.name);
     const containerAccess = containers.failed || containerEntries === undefined
         ? "unavailable"
         : "available";
@@ -403,7 +581,7 @@ async function defaultCloudflareRead(request) {
         };
     }
     if (deploymentEntries.length === 0 &&
-        containerCollection?.length === 0) {
+        containerEntries?.length === 0) {
         return {
             accountAccess,
             containerAccess,
@@ -490,6 +668,9 @@ async function defaultRuntimeRunner(request) {
             ...(request.runtimeInjection === undefined
                 ? {}
                 : { runtimeInjection: request.runtimeInjection }),
+            ...(request.workflowWorld === undefined
+                ? {}
+                : { workflowWorld: request.workflowWorld }),
             retainImage: request.retainImage ?? false,
         };
         result = await buildEveRuntimeImage(imageRequest);
@@ -1235,6 +1416,10 @@ async function runEveDeployment(request, options, collected) {
             ...(identity.runtimeRevisionHandle === undefined
                 ? {}
                 : { runtimeRevisionHandle: identity.runtimeRevisionHandle }),
+            schedules: collected.schedules ?? [],
+            ...(process.env.EDEN_EVE_CONTAINER_SLEEP_AFTER === undefined
+                ? {}
+                : { containerSleepAfter: process.env.EDEN_EVE_CONTAINER_SLEEP_AFTER }),
         });
     }
     catch (error) {
@@ -1488,6 +1673,7 @@ async function runEveDeployment(request, options, collected) {
 }
 async function collectEvePreflight(request, options) {
     let runtimeConfig;
+    const warnings = [];
     const checks = [];
     if (request.envFile !== undefined) {
         eveProgress(options, "validating environment file");
@@ -1502,6 +1688,7 @@ async function collectEvePreflight(request, options) {
         else {
             runtimeConfig = await options.runtimeConfigLoader(request.envFile, request.cwd);
             checks.push(check("VAL-SEC-001", "passed", "The explicit environment file passed the deployment-safety opaque UTF-8 KEY=VALUE grammar."), check("VAL-SEC-002", "passed", "The explicit environment file contains no reserved Eve host-variable collision."));
+            warnings.push(...(await collectEveWorldWarnings(undefined, runtimeConfig)));
         }
     }
     catch (error) {
@@ -1515,6 +1702,7 @@ async function collectEvePreflight(request, options) {
                 environment: request.environment,
                 name: request.name,
                 checks,
+                warnings,
                 candidate: null,
             },
             runtimeConfig,
@@ -1608,12 +1796,49 @@ async function collectEvePreflight(request, options) {
                 environment: request.environment,
                 name: request.name,
                 checks,
+                warnings,
                 candidate: null,
             },
             runtimeConfig,
         };
     }
     const candidate = packaging.candidate;
+    const workflowWorld = await readCompiledWorldSpecifier(candidate);
+    warnings.push(...(await collectEveWorldWarnings(candidate, undefined)));
+    const schedules = await readCompiledSchedules(candidate);
+    // The runtime package is imported lazily so `eden` commands that never
+    // reach deploy checks stay fast; the module specifier is fixed.
+    const { parseEveScheduleCron } = await import("@moinulmoin/eden-runtime-cloudflare");
+    const expressible = schedules.filter((schedule) => parseEveScheduleCron(schedule.cron) !== undefined);
+    const unexpressible = schedules.filter((schedule) => parseEveScheduleCron(schedule.cron) === undefined);
+    if (unexpressible.length > 0) {
+        warnings.push({
+            id: "EVE_SCHEDULE_UNSUPPORTED",
+            message: `Schedule ${unexpressible.map((schedule) => schedule.name).join(", ")} uses a cron expression Cloudflare wake triggers cannot evaluate, so it only fires while the Container is already awake.`,
+            remediation: "Use a standard 5-field cron expression (minute hour day-of-month month day-of-week) for schedules that must fire while the Container sleeps.",
+        });
+    }
+    if (expressible.length > 0) {
+        checks.push(check("EVE-SCHEDULES", "passed", `schedules: ${expressible.length} (wake via Cloudflare Cron)`));
+    }
+    const worldPairing = await checkEveWorldPairing(candidate, workflowWorld);
+    if (worldPairing !== undefined)
+        checks.push(worldPairing);
+    if (!allChecksClear(checks)) {
+        await discardPackagingImage();
+        return {
+            result: {
+                command: request.command === "deploy" ? "eve deploy" : "eve preflight",
+                ok: false,
+                environment: request.environment,
+                name: request.name,
+                checks,
+                warnings,
+                candidate: candidateMetadata(candidate, undefined),
+            },
+            runtimeConfig,
+        };
+    }
     let cloudflare;
     let publicOrigin;
     if (request.command === "deploy") {
@@ -1636,6 +1861,7 @@ async function collectEvePreflight(request, options) {
                     environment: request.environment,
                     name: request.name,
                     checks,
+                    warnings,
                     candidate: candidateMetadata(candidate, undefined),
                 },
                 runtimeConfig,
@@ -1655,6 +1881,7 @@ async function collectEvePreflight(request, options) {
                     environment: request.environment,
                     name: request.name,
                     checks,
+                    warnings,
                     candidate: candidateMetadata(candidate, undefined),
                 },
                 runtimeConfig,
@@ -1693,7 +1920,7 @@ async function collectEvePreflight(request, options) {
     if (hostRequirements !== undefined && hostRequirementsValid) {
         eveProgress(options, "building linux/amd64 runtime image, booting eve, checking health");
         try {
-            if (runtimeConfig !== undefined && request.command === "preflight") {
+            if (runtimeConfig !== undefined) {
                 runtimeInjection = await prepareEveRuntimeInjection(runtimeConfig, {
                     mode: "preflight",
                 });
@@ -1707,6 +1934,7 @@ async function collectEvePreflight(request, options) {
                 ...(publicOrigin === undefined ? {} : { publicOrigin }),
                 retainImage: request.command === "deploy",
                 ...(runtimeInjection === undefined ? {} : { runtimeInjection }),
+                ...(workflowWorld === undefined ? {} : { workflowWorld }),
             });
             checks.push(...runtimeEvidence.checks);
             const requiredRuntimeChecks = [
@@ -1759,6 +1987,7 @@ async function collectEvePreflight(request, options) {
                 environment: request.environment,
                 name: request.name,
                 checks,
+                warnings,
                 candidate: candidateResult,
             },
             runtimeConfig,
@@ -1784,6 +2013,7 @@ async function collectEvePreflight(request, options) {
                     environment: request.environment,
                     name: request.name,
                     checks,
+                    warnings,
                     candidate: candidateResult,
                 },
                 runtimeConfig,
@@ -1799,6 +2029,7 @@ async function collectEvePreflight(request, options) {
             environment: request.environment,
             name: request.name,
             checks,
+            warnings,
             candidate: candidateResult,
         },
         runtimeConfig,
@@ -1807,6 +2038,9 @@ async function collectEvePreflight(request, options) {
             ? {}
             : { projectId: packaging.project.projectId }),
         ...(runtimeEvidence === undefined ? {} : { runtimeEvidence }),
+        // Only expressible schedules are wired into wake triggers; the rest were
+        // reported as EVE_SCHEDULE_UNSUPPORTED and fire only while awake.
+        schedules: expressible,
         cloudflare,
     };
 }

package/dist/eve-packaging.d.ts

@@ -1,5 +1,5 @@
 import type { EveRuntimeInputIdentity } from "./eve-runtime-config.js";
-export type EvePackagingCode = "ROOT_INVALID" | "UNSUPPORTED_TOOLCHAIN" | "DEPENDENCY_AMBIGUITY" | "SOURCE_RACE" | "EVE_BUILD_FAILED" | "UNSUPPORTED_EVE_OUTPUT" | "RUNTIME_CLOSURE_INCOMPLETE" | "SECRET_EXCLUSION_FAILED" | "DOCKER_PLATFORM_BLOCKED" | "UNSUPPORTED_HOST_REQUIREMENT" | "EVE_HEALTH_FAILED" | "CLEANUP_UNVERIFIED" | "PACKAGE_VERIFICATION_FAILED";
+export type EvePackagingCode = "ROOT_INVALID" | "UNSUPPORTED_TOOLCHAIN" | "DEPENDENCY_AMBIGUITY" | "SOURCE_RACE" | "EVE_BUILD_FAILED" | "UNSUPPORTED_EVE_OUTPUT" | "RUNTIME_CLOSURE_INCOMPLETE" | "SECRET_EXCLUSION_FAILED" | "DOCKER_PLATFORM_BLOCKED" | "UNSUPPORTED_HOST_REQUIREMENT" | "EVE_HEALTH_FAILED" | "WORLD_MIGRATION_FAILED" | "CLEANUP_UNVERIFIED" | "PACKAGE_VERIFICATION_FAILED";
 export interface EveRuntimeConfigExclusion {
     /**
      * This path is opaque. The packaging worker only uses its lexical identity

package/dist/eve-packaging.js

@@ -16,6 +16,17 @@ export class EvePackagingError extends Error {
         this.remediation = options.remediation;
     }
 }
+// The Postgres World's `cbor-x` dependency declares `cbor-extract` as an
+// optional native accelerator whose prebuilt binary cannot load in the
+// runtime image. pnpm's CLI cannot exempt a single package from
+// strict-dep-builds, so the Dockerfile passes
+// `--config.strict-dep-builds=false` and then runs
+// IGNORED_BUILDS_GUARD, which restores the strict failure for every ignored
+// build script except cbor-extract. Eden never runs dependency build scripts
+// either way, `--frozen-lockfile` stays honest, cbor-extract's .node binary is
+// exempt from the ldd check, and the runtime stage sets
+// CBOR_NATIVE_ACCELERATION_DISABLED.
+const IGNORED_BUILDS_GUARD = `node -e 'const m=JSON.parse(require("fs").readFileSync("node_modules/.modules.yaml","utf8"));const b=(m.ignoredBuilds||[]).filter((p)=>!p.startsWith("cbor-extract@"));if(b.length){console.error("ERR_PNPM_IGNORED_BUILDS Ignored build scripts: "+b.join(", "));process.exit(1)}'`;
 const INSTALL_COMMAND = [
     "corepack",
     "pnpm",
@@ -943,7 +954,8 @@ RUN corepack enable \\
   && corepack prepare pnpm@${options.packageManagerVersion} --activate \\
   && test "$(corepack pnpm --version)" = "${options.packageManagerVersion}" \\
   && test "$(sha256sum pnpm-lock.yaml | cut -d ' ' -f1)" = "${options.lockfileSha256}" \\
-  && corepack pnpm install --frozen-lockfile --config.node-linker=hoisted
+  && corepack pnpm install --frozen-lockfile --config.node-linker=hoisted --config.strict-dep-builds=false \\
+  && ${IGNORED_BUILDS_GUARD}
 RUN test "$(sha256sum pnpm-lock.yaml | cut -d ' ' -f1)" = "${options.lockfileSha256}"
 COPY . ./
 RUN test -x ./node_modules/.bin/eve \\
@@ -951,7 +963,8 @@ RUN test -x ./node_modules/.bin/eve \\
 
 FROM builder AS runtime-deps
 RUN rm -rf node_modules \\
-  && corepack pnpm install --frozen-lockfile --prod --config.node-linker=hoisted \\
+  && corepack pnpm install --frozen-lockfile --prod --config.node-linker=hoisted --config.strict-dep-builds=false \\
+  && ${IGNORED_BUILDS_GUARD} \\
   && for l in node_modules/.bin/*; do t=$(readlink "$l") || continue; case "$t" in /*) ln -sfn "$(realpath --relative-to=node_modules/.bin "$t")" "$l" ;; esac; done
 
 FROM --platform=linux/amd64 ${image} AS runtime
@@ -1339,7 +1352,7 @@ function classifyPnpmInstallFailure(stderr) {
         return new EvePackagingError({
             code: "DEPENDENCY_AMBIGUITY",
             subject: "ERR_PNPM_IGNORED_BUILDS",
-            reason: "The isolated pinned pnpm install refused dependency build scripts that the project pnpm policy neither allows nor ignores.",
+            reason: "The isolated pinned pnpm install refused dependency build scripts that the project pnpm policy neither allows nor ignores (the known-optional cbor-extract addon is already exempted by Eden).",
             remediation: "Name the dependency under allowBuilds or ignoredBuiltDependencies in the project pnpm-workspace.yaml and retry.",
         });
     }

package/dist/eve-runtime-image.d.ts

@@ -86,6 +86,14 @@ export interface EveRuntimeImageRequest {
     readonly hostRequirements?: EveHostRequirements;
     readonly publicOrigin?: string;
     readonly runtimeInjection?: EveRuntimeInjection;
+    /**
+     * The Workflow World specifier resolved by `eve build`
+     * (`config.experimental.workflow.world`). When it selects a known durable
+     * World with a one-time schema setup, Eden runs that setup inside the boot
+     * probe — idempotently, before health — so the deployed container finds the
+     * schema already present.
+     */
+    readonly workflowWorld?: string;
     /**
      * Preflight must remove its disposable runtime image after health proof.
      * Deploy may retain the exact image for the publication handoff.

package/dist/eve-runtime-image.js

@@ -1,5 +1,5 @@
 import { createHash, } from "node:crypto";
-import { execFile, spawn, } from "node:child_process";
+import { execFile, } from "node:child_process";
 import { cp, lstat, mkdir, readFile, readlink, readdir, realpath, rm, symlink, writeFile, } from "node:fs/promises";
 import { dirname, join, relative, resolve, } from "node:path";
 import { promisify, } from "node:util";
@@ -448,7 +448,8 @@ ENV HOST=0.0.0.0 \\
     NITRO_HOST=0.0.0.0 \\
     PORT=8080 \\
     NITRO_PORT=8080 \\
-    NODE_ENV=production
+    NODE_ENV=production \
+    CBOR_NATIVE_ACCELERATION_DISABLED=true
 COPY --from=candidate /candidate/.output /workspace/.output
 COPY --from=candidate /candidate/node_modules /workspace/node_modules
 ${sourceCopyLines}
@@ -541,42 +542,22 @@ function safeDockerEnvironment() {
         DOCKER_CONTEXT: process.env.DOCKER_CONTEXT,
     };
 }
+/**
+ * Runs the Docker CLI. `environment` values reach the CLI process only, so
+ * `--env NAME` arguments (names, never values) can forward runtime secrets
+ * into a container without them touching argv, logs, or files. `--env-file
+ * /dev/stdin` is not used: on Linux, Node's spawned stdin is a socket that
+ * `/dev/stdin` cannot open.
+ */
 async function docker(state, args, options = {}) {
     return execFileAsync(state.command, [...args], {
-        env: state.env,
+        env: { ...state.env, ...options.environment },
         cwd: state.generationRoot,
         maxBuffer: options.maxBuffer ?? 4 * 1024 * 1024,
     });
 }
-async function dockerWithInput(state, args, input) {
-    return new Promise((resolveResult, rejectResult) => {
-        const child = spawn(state.command, [...args], {
-            cwd: state.generationRoot,
-            env: state.env,
-            stdio: ["pipe", "pipe", "pipe"],
-        });
-        let stdout = "";
-        let stderr = "";
-        child.stdout.on("data", (chunk) => {
-            stdout += chunk.toString();
-        });
-        child.stderr.on("data", (chunk) => {
-            stderr += chunk.toString();
-        });
-        child.once("error", rejectResult);
-        child.once("close", (code) => {
-            if (code === 0) {
-                resolveResult({ stdout, stderr });
-            }
-            else {
-                const error = new Error(stderr || "The Docker operation failed.");
-                Object.assign(error, { stdout, stderr, code });
-                rejectResult(error);
-            }
-        });
-        child.stdin.end(input);
-    });
-}
+/** Names that must keep the local Docker CLI's own values. */
+const DOCKER_CLI_OWNED_VARIABLES = ["PATH", "HOME", "DOCKER_HOST", "DOCKER_CONTEXT"];
 function runtimeContainerEnvironment(request) {
     return {
         ...HOST_ENVIRONMENT,
@@ -936,6 +917,12 @@ export async function buildEveRuntimeImage(request) {
                 hostEnvironment: runtimeContainerEnvironment(request),
                 run: (startRequest) => startRequest.env,
             });
+        if (request.runtimeInjection !== undefined) {
+            const collision = Object.keys(runtimeEnvironment).find((name) => DOCKER_CLI_OWNED_VARIABLES.includes(name));
+            if (collision !== undefined) {
+                throw packagingError("DOCKER_PLATFORM_BLOCKED", "runtime variable name", `The runtime variable ${collision} would replace the local Docker CLI's own ${collision}.`, `Rename ${collision} in --env-file; ${DOCKER_CLI_OWNED_VARIABLES.join(", ")} are reserved for the local Docker CLI.`);
+            }
+        }
         const bootArgs = [
             "run",
             "--detach",
@@ -950,14 +937,12 @@ export async function buildEveRuntimeImage(request) {
                     "--env",
                     `${name}=${value}`,
                 ])
-                : ["--env-file", "/dev/stdin"]),
+                : Object.keys(runtimeEnvironment).flatMap((name) => ["--env", name])),
             state.imageId,
         ];
-        const boot = request.runtimeInjection === undefined
-            ? await docker(state, bootArgs)
-            : await dockerWithInput(state, bootArgs, `${Object.entries(runtimeEnvironment)
-                .map(([name, value]) => `${name}=${value}`)
-                .join("\n")}\n`);
+        const boot = await docker(state, bootArgs, request.runtimeInjection === undefined
+            ? {}
+            : { environment: runtimeEnvironment });
         state.containerId = boot.stdout.trim();
         bootContainerId = state.containerId;
         if (state.containerId.length === 0) {
@@ -984,8 +969,35 @@ export async function buildEveRuntimeImage(request) {
             state.containerId,
             "sh",
             "-ceu",
-            "set -o noglob; status=0; for module in $(find /workspace/node_modules -type f -name '*.node'); do if ldd \"$module\" 2>&1 | grep -q 'not found'; then echo \"unloadable native module: $module\" >&2; status=1; fi; done; exit $status",
+            "set -o noglob; status=0; for module in $(find /workspace/node_modules -type f -name '*.node' -not -path '*cbor-extract*'); do if ldd \"$module\" 2>&1 | grep -q 'not found'; then echo \"unloadable native module: $module\" >&2; status=1; fi; done; exit $status",
         ]);
+        if (request.workflowWorld === "@workflow/world-postgres") {
+            // The Postgres World ships an idempotent setup binary (drizzle
+            // `migrate()` plus graphile-worker `workerUtils.migrate()`; both skip
+            // already-applied work) that must run once per database before Eve
+            // consumes the schema. Running it inside the disposable boot
+            // container, before health and publish, exercises the exact deployed
+            // node_modules against the env-file URL. `docker exec` inherits the
+            // environment the container booted with, so the URL never appears in
+            // argv, logs, or the image.
+            try {
+                await docker(state, [
+                    "exec",
+                    state.containerId,
+                    "./node_modules/.bin/bootstrap",
+                ]);
+                await docker(state, [
+                    "exec",
+                    state.containerId,
+                    "sh",
+                    "-ceu",
+                    "cd node_modules/@workflow/world-postgres && node -e \"const {encode,decode}=require('cbor-x');if(decode(encode({ok:true})).ok!==true)process.exit(1)\"",
+                ]);
+            }
+            catch {
+                throw packagingError("WORLD_MIGRATION_FAILED", "@workflow/world-postgres setup", "The Postgres World schema migration or cbor-x codec check failed inside the disposable Eve container.", "Confirm WORKFLOW_POSTGRES_URL in --env-file is the direct, unpooled database URL reachable from this machine, then retry; the migration is idempotent.");
+            }
+        }
         await pollEveHealth(healthPort, timeoutMs, pollIntervalMs, request.fetchHealth ?? fetch);
         await docker(state, [
             "exec",

package/dist/index.d.ts

@@ -10,7 +10,7 @@ export type { EveCliCommand, EveCliEnvironment, EveCliExecutionRequest, EveCliHe
 export type { EveNodeImage, EvePackagingCheck, EvePackagingCode, EveProjectBuilder, EveProjectBuilderRequest, EveProjectBuilderResult, EveProjectBuildCandidate, EveProjectFile, EveProjectImage, EveProjectInputManifest, EveProjectOutput, EveProjectPackagingResult, EveProjectRuntime, EveProjectSnapshot, EveProjectSnapshotOptions, EveProjectToolchain, EveRuntimeConfigExclusion, } from "./eve-packaging.js";
 export type { EveHostRequirements, EveRuntimeClosure, EveRuntimeClosureFile, EveRuntimeCleanup, EveRuntimeImage, EveRuntimeImageDiscardRequest, EveRuntimeImageMetadata, EveRuntimeImageRequest, EveRuntimeImageResult, EveRuntimeNativeModule, EveRuntimeStatus, } from "./eve-runtime-image.js";
 export { DEFAULT_EVE_HOST_REQUIREMENTS, DEFAULT_EVE_NODE_IMAGE, runEveControlPlane, runEveDestroy, } from "./eve-control-plane.js";
-export type { EveCloudflareReadRequest, EveCloudflareReadResult, EveCloudflareReadRunner, EveCloudflareTargetState, EveContainerDeleteRunner, EveDeploymentCompensationRequest, EveDeploymentCompensationRunner, EveDeploymentHealthRequest, EveDeploymentHealthResult, EveDeploymentHealthRunner, EveDeploymentIdentity, EveDeploymentIdentityProof, EveDeploymentMetadata, EveDeploymentPublicationRequest, EveDeploymentPublicationResult, EveDeploymentPublicationRunner, EveDeploymentStatus, EveDestroyCloudflareReadRequest, EveDestroyCloudflareReadRunner, EveDestroyOutcome, EveDestroyTargetRead, EveImagePublicationRequest, EveImagePublicationResult, EveImagePublicationRunner, EvePreflightCandidate, EvePreflightCheck, EvePreflightCheckStatus, EvePreflightOptions, EvePreflightResult, EvePreflightRuntimeEvidence, EvePreflightRuntimeRunner, EvePreflightRuntimeRunnerRequest, EveRuntimeConfigLoader, EveRuntimeImageDiscardRunner, EveWorkerDeleteRunner, } from "./eve-control-plane.js";
+export type { EveCloudflareReadRequest, EveCloudflareReadResult, EveCloudflareReadRunner, EveCloudflareTargetState, EveContainerDeleteRunner, EveDeploymentCompensationRequest, EveDeploymentCompensationRunner, EveDeploymentHealthRequest, EveDeploymentHealthResult, EveDeploymentHealthRunner, EveDeploymentIdentity, EveDeploymentIdentityProof, EveDeploymentMetadata, EveDeploymentPublicationRequest, EveDeploymentPublicationResult, EveDeploymentPublicationRunner, EveDeploymentStatus, EveDestroyCloudflareReadRequest, EveDestroyCloudflareReadRunner, EveDestroyOutcome, EveDestroyTargetRead, EveImagePublicationRequest, EveImagePublicationResult, EveImagePublicationRunner, EvePreflightCandidate, EvePreflightResult, EvePreflightRuntimeEvidence, EvePreflightWarning, EvePreflightRuntimeRunner, EvePreflightRuntimeRunnerRequest, EveRuntimeConfigLoader, EveRuntimeImageDiscardRunner, EveWorkerDeleteRunner, } from "./eve-control-plane.js";
 export declare const EDEN_CLI_COMMANDS: readonly ["preflight", "deploy", "destroy"];
 export type EdenCliCommand = (typeof EDEN_CLI_COMMANDS)[number];
 export interface EdenCliRunOptions {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@moinulmoin/eden",
-  "version": "0.2.1",
+  "version": "0.3.0",
   "description": "Deploy existing Eve projects to your own Cloudflare account.",
   "keywords": [
     "ai",
@@ -31,7 +31,7 @@
     "NOTICE"
   ],
   "dependencies": {
-    "@moinulmoin/eden-runtime-cloudflare": "0.2.1",
+    "@moinulmoin/eden-runtime-cloudflare": "0.3.0",
     "wrangler": "4.120.0"
   },
   "devDependencies": {