@moku-labs/worker 0.6.0 → 0.7.1

package/dist/cli.cjs

@@ -1,4 +1,4 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_cli = require("./cli-Dc0q0hIy.cjs");
+const require_cli = require("./cli-BBO_YNVC.cjs");
 exports.cliPlugin = require_cli.cliPlugin;
 exports.deployPlugin = require_cli.deployPlugin;

package/dist/cli.d.cts

@@ -1,2 +1,2 @@
-import { i as ResourceManifest, n as cliPlugin, r as ExternalManifest, t as deployPlugin } from "./index-VZ99IAMv.cjs";
+import { i as ResourceManifest, n as cliPlugin, r as ExternalManifest, t as deployPlugin } from "./index-Dse6wZJH.cjs";
 export { type ExternalManifest, type ResourceManifest, cliPlugin, deployPlugin };

package/dist/cli.d.mts

@@ -1,2 +1,2 @@
-import { i as ResourceManifest, n as cliPlugin, r as ExternalManifest, t as deployPlugin } from "./index-VZ99IAMv.mjs";
+import { i as ResourceManifest, n as cliPlugin, r as ExternalManifest, t as deployPlugin } from "./index-Dse6wZJH.mjs";
 export { type ExternalManifest, type ResourceManifest, cliPlugin, deployPlugin };

package/dist/cli.mjs

@@ -1,2 +1,2 @@
-import { n as deployPlugin, t as cliPlugin } from "./cli-DgZv5A0G.mjs";
+import { n as deployPlugin, t as cliPlugin } from "./cli-D67ea3Lu.mjs";
 export { cliPlugin, deployPlugin };

package/dist/{index-VZ99IAMv.d.cts → index-Dse6wZJH.d.cts}

@@ -109,6 +109,32 @@ type Config$1 = {
    * Also the file parsed in the universal/non-moku path.
    */
   configFile: string;
+  /**
+   * The Worker entry module → wrangler `main` (e.g. "src/cloudflare/worker.ts"). Required for any
+   * real Worker deploy (its absence is wrangler's "Missing entry-point" error).
+   */
+  entry?: string;
+  /**
+   * Enable Node.js compat → `compatibility_flags: ["nodejs_compat"]`. Needed when the Worker bundle
+   * pulls in Node-flavored code (e.g. composing the deploy/cli tooling into the runtime app).
+   */
+  nodeCompat?: boolean;
+  /**
+   * Static assets served via `env.<binding>` → the wrangler `assets` block. `spa: true` sets
+   * `not_found_handling: "single-page-application"` so client-routed deep links resolve to index.html.
+   */
+  assets?: {
+    binding: string;
+    directory: string;
+    spa?: boolean;
+  };
+  /**
+   * Escape hatch — extra top-level wrangler keys merged into the generated config for anything the
+   * typed fields above don't cover (`vars`, `routes`, `observability`, `triggers`, …). The
+   * deploy-managed resource keys (name, compatibility_date, kv_namespaces, r2_buckets, d1_databases,
+   * queues, durable_objects, and the auto-derived Durable Object `migrations`) always win over these.
+   */
+  wrangler?: Record<string, unknown>;
   /**
    * Standing CI/automated default for `run()`. When true (or when stdout is non-TTY) the deploy
    * never prompts and auto-confirms every gate; `run({ ci })` overrides it per call. CF credentials
@@ -127,24 +153,36 @@ type Config$1 = {
   migrateLocal: boolean; /** Debounce window (ms) coalescing rapid file changes into one rebuild. */
   debounceMs: number;
 };
-/** Discriminated union of resource descriptors returned by each plugin's deployManifest(). */
+/**
+ * Discriminated union of per-INSTANCE resource descriptors. Each resource plugin's `deployManifest()`
+ * returns an ARRAY of these (one per configured instance). `name` is the base Cloudflare resource
+ * name (stage-suffixed downstream via {@link stageName}); `binding` is the stable env var. Durable
+ * Objects carry no provisioned `name` — they ship with the Worker script — and declare the exported
+ * `className` instead.
+ */
 type ResourceManifest = {
   kind: "r2";
-  bucket: string;
+  name: string;
+  binding: string;
   upload?: string;
 } | {
   kind: "kv";
+  name: string;
   binding: string;
 } | {
   kind: "d1";
+  name: string;
   binding: string;
   migrations?: string;
 } | {
   kind: "queue";
-  producers: string[];
+  name: string;
+  binding: string;
+  consumer?: boolean;
 } | {
   kind: "do";
-  bindings: Record<string, string>;
+  binding: string;
+  className: string;
 };
 /**
  * The whole deploy manifest the pipeline consumes (assembled, or caller-supplied for the
@@ -174,12 +212,23 @@ type InfraPlan = {
   missing: ResourceManifest[];
 };
 /**
- * Outcome of acting on an {@link InfraPlan}: the resources just created, those skipped because
- * they already existed, and the merged id map (binding → Cloudflare id) for the config writer.
+ * A resource that failed to provision, with the (branded) error message captured so the guided flow
+ * can show WHICH resource failed and why — instead of aborting the whole run on the first failure.
+ */
+type ProvisionFailure = {
+  /** The resource descriptor that failed to create. */resource: ResourceManifest; /** The captured error message (e.g. the branded wrangler failure). */
+  error: string;
+};
+/**
+ * Outcome of acting on an {@link InfraPlan}: the resources just created, those skipped because they
+ * already existed, those that FAILED to create, and the merged id map (binding → Cloudflare id) for
+ * the config writer. Provisioning is resilient — a single resource failure is captured here, not
+ * thrown, so the guided flow can report a clear per-resource result.
  */
 type ProvisionResult = {
   /** Resources created during this run. */created: ProvisionedRef[]; /** Resources skipped because they already existed. */
-  skipped: ProvisionedRef[]; /** Merged binding → Cloudflare id map (existing + created) for writeWranglerConfig. */
+  skipped: ProvisionedRef[]; /** Resources that failed to create (captured, not thrown). */
+  failed: ProvisionFailure[]; /** Merged binding → Cloudflare id map (existing + created) for writeWranglerConfig. */
   ids: Record<string, string>;
 };
 /** Result of verifying the `.env` Cloudflare API token and resolving its account. */
@@ -204,30 +253,27 @@ type TokenRequirement = {
 };
 //#endregion
 //#region src/plugins/cli/types.d.ts
-/** Resolved configuration for the cli plugin. Flat; complete defaults so omission never yields undefined. */
-type Config = {
-  /**
-   * Default local dev port forwarded to deploy.dev when dev() gets no port.
-   * Passed through to `wrangler dev --port <n>`.
-   *
-   * @default 8787
-   */
-  readonly port: number;
-};
+/**
+ * Resolved configuration for the cli plugin. The cli surface is configuration-free: the dev port is
+ * NOT set here (it comes only from `dev({ port })`), so there are no keys to set under
+ * `pluginConfigs.cli`.
+ */
+type Config = Record<string, never>;
 /** Public api surface of the cli plugin, mounted at app.cli.*. */
 type Api = {
   /**
-   * Run the Worker locally via Wrangler (delegates to deploy.dev). Resolves the port from
-   * `opts.port`, else a `--port <n>` CLI flag, else the configured default (8787). A failure renders
-   * a branded `✗` line and sets a non-zero exit code rather than throwing a raw stack trace.
+   * Run the Worker locally via Wrangler (delegates to deploy.dev). The dev port comes only from
+   * `opts.port` — the consumer passes it (e.g. parsed from its own CLI flags); it defaults to 8787
+   * when omitted. A failure renders a branded `✗` line and sets a non-zero exit code rather than
+   * throwing a raw stack trace.
    *
-   * @param opts - Optional port override and web build hook.
-   * @param opts.port - Local dev port to bind (overrides the `--port` flag and the default).
+   * @param opts - Optional port and web build hook.
+   * @param opts.port - Local dev port to bind. Defaults to 8787 when omitted.
    * @param opts.webBuild - Rebuild the web site on change (e.g. `() => webApp.cli.build()`).
    * @returns Resolves when the dev session ends.
    * @example
    * ```ts
-   * await app.cli.dev({ webBuild: () => web.cli.build() }); // port from --port or 8787
+   * await app.cli.dev({ port: 7878, webBuild: () => web.cli.build() });
    * ```
    */
   dev(opts?: {
@@ -253,6 +299,26 @@ type Api = {
     ci?: boolean;
     webBuild?: WebBuild;
   }): Promise<void>;
+  /**
+   * Seed a configured D1 database from a SQL file (delegates to deploy.seed). Local by default
+   * (applies the database's migrations first so its tables exist, then executes the file);
+   * `opts.remote` seeds Cloudflare. A failure renders a branded `✗` line and sets a non-zero exit
+   * code rather than throwing.
+   *
+   * @param sqlFile - Path to the SQL file to execute (e.g. "db/seed.sql").
+   * @param opts - Optional options.
+   * @param opts.binding - The d1 binding to target when more than one is configured (e.g. "DB").
+   * @param opts.remote - Seed the remote (Cloudflare) D1 instead of the local one.
+   * @returns Resolves once the seed completes (or after a failure is rendered).
+   * @example
+   * ```ts
+   * await app.cli.seed("db/seed.sql"); // local; --stage honored
+   * ```
+   */
+  seed(sqlFile: string, opts?: {
+    binding?: string;
+    remote?: boolean;
+  }): Promise<void>;
   /**
    * Verify the `.env` Cloudflare token (no sub), or print the config-derived token-creation
    * guidance (`"setup"`). Delegates to deploy.verifyAuth() / deploy.tokenInstructions().
@@ -332,13 +398,20 @@ declare const cliPlugin: import("@moku-labs/core").PluginInstance<"cli", Config,
 declare const deployPlugin: import("@moku-labs/core").PluginInstance<"deploy", Config$1, Record<string, never>, {
   run(opts?: {
     ci?: boolean;
+    stage?: string;
     webBuild?: WebBuild;
     manifest?: ExternalManifest;
   }): Promise<void>;
-  dev: (opts?: {
+  dev(opts?: {
     port?: number;
+    stage?: string;
     webBuild?: WebBuild;
-  }) => Promise<void>;
+  }): Promise<void>;
+  seed(sqlFile: string, opts?: {
+    stage?: string;
+    binding?: string;
+    remote?: boolean;
+  }): Promise<void>;
   init: (opts?: {
     ci?: boolean;
   }) => Promise<void>;
@@ -346,6 +419,7 @@ declare const deployPlugin: import("@moku-labs/core").PluginInstance<"deploy", C
   provisionInfra: (plan: InfraPlan) => Promise<ProvisionResult>;
   verifyAuth: () => Promise<AuthStatus>;
   requiredToken: () => TokenRequirement;
+  ciToken: () => PermissionGroup[];
   tokenInstructions: () => string;
   wrangler: (args: string[]) => Promise<void>;
 }, {}> & Record<never, never>;

package/dist/{index-VZ99IAMv.d.mts → index-Dse6wZJH.d.mts}

@@ -109,6 +109,32 @@ type Config$1 = {
    * Also the file parsed in the universal/non-moku path.
    */
   configFile: string;
+  /**
+   * The Worker entry module → wrangler `main` (e.g. "src/cloudflare/worker.ts"). Required for any
+   * real Worker deploy (its absence is wrangler's "Missing entry-point" error).
+   */
+  entry?: string;
+  /**
+   * Enable Node.js compat → `compatibility_flags: ["nodejs_compat"]`. Needed when the Worker bundle
+   * pulls in Node-flavored code (e.g. composing the deploy/cli tooling into the runtime app).
+   */
+  nodeCompat?: boolean;
+  /**
+   * Static assets served via `env.<binding>` → the wrangler `assets` block. `spa: true` sets
+   * `not_found_handling: "single-page-application"` so client-routed deep links resolve to index.html.
+   */
+  assets?: {
+    binding: string;
+    directory: string;
+    spa?: boolean;
+  };
+  /**
+   * Escape hatch — extra top-level wrangler keys merged into the generated config for anything the
+   * typed fields above don't cover (`vars`, `routes`, `observability`, `triggers`, …). The
+   * deploy-managed resource keys (name, compatibility_date, kv_namespaces, r2_buckets, d1_databases,
+   * queues, durable_objects, and the auto-derived Durable Object `migrations`) always win over these.
+   */
+  wrangler?: Record<string, unknown>;
   /**
    * Standing CI/automated default for `run()`. When true (or when stdout is non-TTY) the deploy
    * never prompts and auto-confirms every gate; `run({ ci })` overrides it per call. CF credentials
@@ -127,24 +153,36 @@ type Config$1 = {
   migrateLocal: boolean; /** Debounce window (ms) coalescing rapid file changes into one rebuild. */
   debounceMs: number;
 };
-/** Discriminated union of resource descriptors returned by each plugin's deployManifest(). */
+/**
+ * Discriminated union of per-INSTANCE resource descriptors. Each resource plugin's `deployManifest()`
+ * returns an ARRAY of these (one per configured instance). `name` is the base Cloudflare resource
+ * name (stage-suffixed downstream via {@link stageName}); `binding` is the stable env var. Durable
+ * Objects carry no provisioned `name` — they ship with the Worker script — and declare the exported
+ * `className` instead.
+ */
 type ResourceManifest = {
   kind: "r2";
-  bucket: string;
+  name: string;
+  binding: string;
   upload?: string;
 } | {
   kind: "kv";
+  name: string;
   binding: string;
 } | {
   kind: "d1";
+  name: string;
   binding: string;
   migrations?: string;
 } | {
   kind: "queue";
-  producers: string[];
+  name: string;
+  binding: string;
+  consumer?: boolean;
 } | {
   kind: "do";
-  bindings: Record<string, string>;
+  binding: string;
+  className: string;
 };
 /**
  * The whole deploy manifest the pipeline consumes (assembled, or caller-supplied for the
@@ -174,12 +212,23 @@ type InfraPlan = {
   missing: ResourceManifest[];
 };
 /**
- * Outcome of acting on an {@link InfraPlan}: the resources just created, those skipped because
- * they already existed, and the merged id map (binding → Cloudflare id) for the config writer.
+ * A resource that failed to provision, with the (branded) error message captured so the guided flow
+ * can show WHICH resource failed and why — instead of aborting the whole run on the first failure.
+ */
+type ProvisionFailure = {
+  /** The resource descriptor that failed to create. */resource: ResourceManifest; /** The captured error message (e.g. the branded wrangler failure). */
+  error: string;
+};
+/**
+ * Outcome of acting on an {@link InfraPlan}: the resources just created, those skipped because they
+ * already existed, those that FAILED to create, and the merged id map (binding → Cloudflare id) for
+ * the config writer. Provisioning is resilient — a single resource failure is captured here, not
+ * thrown, so the guided flow can report a clear per-resource result.
  */
 type ProvisionResult = {
   /** Resources created during this run. */created: ProvisionedRef[]; /** Resources skipped because they already existed. */
-  skipped: ProvisionedRef[]; /** Merged binding → Cloudflare id map (existing + created) for writeWranglerConfig. */
+  skipped: ProvisionedRef[]; /** Resources that failed to create (captured, not thrown). */
+  failed: ProvisionFailure[]; /** Merged binding → Cloudflare id map (existing + created) for writeWranglerConfig. */
   ids: Record<string, string>;
 };
 /** Result of verifying the `.env` Cloudflare API token and resolving its account. */
@@ -204,30 +253,27 @@ type TokenRequirement = {
 };
 //#endregion
 //#region src/plugins/cli/types.d.ts
-/** Resolved configuration for the cli plugin. Flat; complete defaults so omission never yields undefined. */
-type Config = {
-  /**
-   * Default local dev port forwarded to deploy.dev when dev() gets no port.
-   * Passed through to `wrangler dev --port <n>`.
-   *
-   * @default 8787
-   */
-  readonly port: number;
-};
+/**
+ * Resolved configuration for the cli plugin. The cli surface is configuration-free: the dev port is
+ * NOT set here (it comes only from `dev({ port })`), so there are no keys to set under
+ * `pluginConfigs.cli`.
+ */
+type Config = Record<string, never>;
 /** Public api surface of the cli plugin, mounted at app.cli.*. */
 type Api = {
   /**
-   * Run the Worker locally via Wrangler (delegates to deploy.dev). Resolves the port from
-   * `opts.port`, else a `--port <n>` CLI flag, else the configured default (8787). A failure renders
-   * a branded `✗` line and sets a non-zero exit code rather than throwing a raw stack trace.
+   * Run the Worker locally via Wrangler (delegates to deploy.dev). The dev port comes only from
+   * `opts.port` — the consumer passes it (e.g. parsed from its own CLI flags); it defaults to 8787
+   * when omitted. A failure renders a branded `✗` line and sets a non-zero exit code rather than
+   * throwing a raw stack trace.
    *
-   * @param opts - Optional port override and web build hook.
-   * @param opts.port - Local dev port to bind (overrides the `--port` flag and the default).
+   * @param opts - Optional port and web build hook.
+   * @param opts.port - Local dev port to bind. Defaults to 8787 when omitted.
    * @param opts.webBuild - Rebuild the web site on change (e.g. `() => webApp.cli.build()`).
    * @returns Resolves when the dev session ends.
    * @example
    * ```ts
-   * await app.cli.dev({ webBuild: () => web.cli.build() }); // port from --port or 8787
+   * await app.cli.dev({ port: 7878, webBuild: () => web.cli.build() });
    * ```
    */
   dev(opts?: {
@@ -253,6 +299,26 @@ type Api = {
     ci?: boolean;
     webBuild?: WebBuild;
   }): Promise<void>;
+  /**
+   * Seed a configured D1 database from a SQL file (delegates to deploy.seed). Local by default
+   * (applies the database's migrations first so its tables exist, then executes the file);
+   * `opts.remote` seeds Cloudflare. A failure renders a branded `✗` line and sets a non-zero exit
+   * code rather than throwing.
+   *
+   * @param sqlFile - Path to the SQL file to execute (e.g. "db/seed.sql").
+   * @param opts - Optional options.
+   * @param opts.binding - The d1 binding to target when more than one is configured (e.g. "DB").
+   * @param opts.remote - Seed the remote (Cloudflare) D1 instead of the local one.
+   * @returns Resolves once the seed completes (or after a failure is rendered).
+   * @example
+   * ```ts
+   * await app.cli.seed("db/seed.sql"); // local; --stage honored
+   * ```
+   */
+  seed(sqlFile: string, opts?: {
+    binding?: string;
+    remote?: boolean;
+  }): Promise<void>;
   /**
    * Verify the `.env` Cloudflare token (no sub), or print the config-derived token-creation
    * guidance (`"setup"`). Delegates to deploy.verifyAuth() / deploy.tokenInstructions().
@@ -332,13 +398,20 @@ declare const cliPlugin: import("@moku-labs/core").PluginInstance<"cli", Config,
 declare const deployPlugin: import("@moku-labs/core").PluginInstance<"deploy", Config$1, Record<string, never>, {
   run(opts?: {
     ci?: boolean;
+    stage?: string;
     webBuild?: WebBuild;
     manifest?: ExternalManifest;
   }): Promise<void>;
-  dev: (opts?: {
+  dev(opts?: {
     port?: number;
+    stage?: string;
     webBuild?: WebBuild;
-  }) => Promise<void>;
+  }): Promise<void>;
+  seed(sqlFile: string, opts?: {
+    stage?: string;
+    binding?: string;
+    remote?: boolean;
+  }): Promise<void>;
   init: (opts?: {
     ci?: boolean;
   }) => Promise<void>;
@@ -346,6 +419,7 @@ declare const deployPlugin: import("@moku-labs/core").PluginInstance<"deploy", C
   provisionInfra: (plan: InfraPlan) => Promise<ProvisionResult>;
   verifyAuth: () => Promise<AuthStatus>;
   requiredToken: () => TokenRequirement;
+  ciToken: () => PermissionGroup[];
   tokenInstructions: () => string;
   wrangler: (args: string[]) => Promise<void>;
 }, {}> & Record<never, never>;

package/dist/index.cjs

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_cli = require("./cli-Dc0q0hIy.cjs");
+const require_cli = require("./cli-BBO_YNVC.cjs");
 let _moku_labs_common = require("@moku-labs/common");
 //#region src/env-provider.ts
 /**