@naviyra/cloud-panel 0.0.3-beta → 0.0.3-beta3

package/apps/agent/src/native.mjs

@@ -12,6 +12,8 @@ import { fileURLToPath } from "node:url";
 import path from "node:path";
 import os from "node:os";
 import net from "node:net";
+import { ensurePhpTools } from "./host-tools.mjs";
+import { reservedEnv } from "@naviyra/shared";
 const windows = process.platform === "win32";
 const binaries = {
   node: process.execPath,
@@ -45,11 +47,48 @@ export function safeEnvironment(extra = {}) {
     if (process.env[key]) env[key] = process.env[key];
   return { ...env, GIT_TERMINAL_PROMPT: "0", PYTHONUNBUFFERED: "1", ...extra };
 }
+export function applicationEnvironment(config) {
+  const env = {};
+  for (const [key, value] of Object.entries(config?.env || {})) {
+    if (!/^[A-Za-z_][A-Za-z0-9_]{0,63}$/.test(key)) continue;
+    if (reservedEnv.has(key.toUpperCase()) || key === "Path") continue;
+    if (typeof value !== "string") continue;
+    env[key] = value.slice(0, 4000);
+  }
+  return env;
+}
+export function pythonTarget(config) {
+  const file = String(config?.startup_file || "").replaceAll("\\", "/");
+  if (!file) return config?.entrypoint || "app:app";
+  const dir = String(config?.working_dir || ".")
+    .replaceAll("\\", "/")
+    .replace(/\/$/, "");
+  let relative = file;
+  if (dir && dir !== "." && (file === dir || file.startsWith(`${dir}/`)))
+    relative = file.slice(dir.length).replace(/^\//, "");
+  const mod = relative.replace(/\.py$/i, "").replaceAll("/", ".");
+  if (
+    !file.toLowerCase().endsWith(".py") ||
+    !/^[A-Za-z_]\w*(?:\.[A-Za-z_]\w*)*$/.test(mod)
+  )
+    throw Error("Python startup file must be a relative .py path such as app.py");
+  return `${mod}:app`;
+}
 export async function nativeCommand(name, args, options = {}) {
   const file = binaries[name];
   if (!file) throw Error("Native command is not allowed");
   return run(file, args, options);
 }
+export function parseCommandJson(text) {
+  const source = String(text ?? "");
+  try {
+    return JSON.parse(source);
+  } catch (error) {
+    const index = Number(String(error.message).match(/position (\d+)/)?.[1]);
+    if (!Number.isInteger(index) || index <= 0) throw error;
+    return JSON.parse(source.slice(0, index));
+  }
+}
 export function run(
   file,
   args,
@@ -61,19 +100,22 @@ export function run(
       [],
       { env: safeEnvironment(), silent: true, windowsHide: true },
     );
-    let output = "",
+    let stdout = "",
+      stderr = "",
       settled = false;
     const timer = setTimeout(() => {
       settled = true;
       worker.send({ stop: true });
       reject(Error("Native command timed out"));
     }, timeout);
-    const collect = (chunk) => {
-      output = (output + chunk.toString()).slice(-100000);
-      log(chunk.toString());
+    const collect = (target) => (chunk) => {
+      const text = chunk.toString();
+      if (target === "stdout") stdout = (stdout + text).slice(-100000);
+      else stderr = (stderr + text).slice(-100000);
+      log(text);
     };
-    worker.stdout.on("data", collect);
-    worker.stderr.on("data", collect);
+    worker.stdout.on("data", collect("stdout"));
+    worker.stderr.on("data", collect("stderr"));
     worker.on("error", (error) => {
       clearTimeout(timer);
       if (!settled) reject(error);
@@ -82,9 +124,11 @@ export function run(
       clearTimeout(timer);
       if (!settled) {
         code === 0
-          ? resolve(output)
+          ? resolve(stdout)
           : reject(
-              Error(`${path.basename(file)} failed: ${output.slice(-3000)}`),
+              Error(
+                `${path.basename(file)} failed: ${(stderr || stdout).slice(-3000)}`,
+              ),
             );
       }
     });
@@ -188,14 +232,44 @@ export function npmCommand(args) {
     args: [cli, ...args],
   };
 }
-export async function prepareNative(p, source, log = () => {}) {
+export function phpFpmPool(port, directory, uid = process.getuid?.()) {
+  const listen = Number(port);
+  if (!Number.isInteger(listen) || listen < 1 || listen > 65535)
+    throw Error("PHP port is invalid");
+  const lines = [
+    "[global]",
+    "daemonize = no",
+    `error_log = ${JSON.stringify(path.join(directory, "php-fpm.log"))}`,
+    `pid = ${JSON.stringify(path.join(directory, "php-fpm.pid"))}`,
+    "",
+    "[www]",
+    `listen = 127.0.0.1:${listen}`,
+    "listen.allowed_clients = 127.0.0.1",
+    "pm = ondemand",
+    "pm.max_children = 8",
+    "pm.process_idle_timeout = 10s",
+  ];
+  if (uid === 0) {
+    const user = process.env.PHP_FPM_USER || "";
+    const group = process.env.PHP_FPM_GROUP || user;
+    if (!/^[a-zA-Z0-9._-]+$/.test(user) || !/^[a-zA-Z0-9._-]+$/.test(group))
+      throw Error(
+        "PHP-FPM cannot run workers as root. Set PHP_FPM_USER and PHP_FPM_GROUP, or run the panel as a normal user.",
+      );
+    lines.push(`user = ${user}`, `group = ${group}`);
+  }
+  return `${lines.join("\n")}\n`;
+}
+export async function prepareNative(p, source, log = () => {}, toolsDir) {
   const config = p.runtime_config || {};
   const env = safeEnvironment({
     PORT: String(p.port),
     HOST: "127.0.0.1",
     HOSTNAME: "127.0.0.1",
     NODE_ENV: "production",
+    ...applicationEnvironment(config),
   });
+  const cwd = await containedDirectory(source, config.working_dir || ".");
   const execute = (file, args) => run(file, args, { cwd: source, env, log });
   const npm = async (args) => {
     const spec = npmCommand(args);
@@ -207,8 +281,10 @@ export async function prepareNative(p, source, log = () => {}) {
       const manifest = JSON.parse(
         await readFile(path.join(source, "package.json"), "utf8"),
       );
-      if (type === "nodejs" && !manifest.scripts?.start)
-        throw Error("Node.js projects require a package.json start script");
+      if (type === "nodejs" && !manifest.scripts?.start && !config.startup_file)
+        throw Error(
+          "Node.js projects require a package.json start script or a startup file",
+        );
       await npm([
         (await exists(path.join(source, "package-lock.json")))
           ? "ci"
@@ -218,12 +294,24 @@ export async function prepareNative(p, source, log = () => {}) {
         "--no-fund",
       ]);
       if (manifest.scripts?.build) await npm(["run", "build"]);
-    } else if (type === "nodejs")
+    } else if (type === "nodejs" && !config.startup_file)
       throw Error("package.json is missing at the source root");
-    if (type === "nodejs")
-      return [
-        { ...npmCommand(["run", "start"]), cwd: source, env, key: "app" },
-      ];
+    if (type === "nodejs") {
+      if (config.startup_file) {
+        let startFile;
+        try {
+          startFile = await containedDirectory(source, config.startup_file);
+        } catch (error) {
+          if (error.code === "ENOENT")
+            throw Error(`Startup file not found: ${config.startup_file}`);
+          throw error;
+        }
+        return [
+          { key: "app", file: process.execPath, args: [startFile], cwd, env },
+        ];
+      }
+      return [{ ...npmCommand(["run", "start"]), cwd, env, key: "app" }];
+    }
     const root = await containedDirectory(source, config.public_dir || ".");
     if (!(await exists(path.join(root, "index.html"))))
       throw Error("Static public directory must contain index.html");
@@ -250,6 +338,7 @@ export async function prepareNative(p, source, log = () => {}) {
     if (await exists(path.join(source, "requirements.txt")))
       await execute(python, ["-m", "pip", "install", "-r", "requirements.txt"]);
     const wsgi = config.python_server === "wsgi";
+    const entry = pythonTarget(config);
     await execute(python, [
       "-m",
       "pip",
@@ -265,18 +354,18 @@ export async function prepareNative(p, source, log = () => {}) {
               "-m",
               "waitress",
               `--listen=127.0.0.1:${p.port}`,
-              config.entrypoint || "app:app",
+              entry,
             ]
           : [
               "-m",
               "uvicorn",
-              config.entrypoint || "app:app",
+              entry,
               "--host",
               "127.0.0.1",
               "--port",
               String(p.port),
             ],
-        cwd: source,
+        cwd,
         env,
       },
     ];
@@ -286,14 +375,30 @@ export async function prepareNative(p, source, log = () => {}) {
       p.folder_path,
       windows ? "application.exe" : "application",
     );
-    await execute(binaries.go, ["build", "-o", target, "."]);
-    return [{ key: "app", file: target, args: [], cwd: source, env }];
+    await run(binaries.go, ["build", "-o", target, "."], { cwd, env, log });
+    return [{ key: "app", file: target, args: [], cwd, env }];
   }
   if (type === "php") {
+    const php = await ensurePhpTools(
+      toolsDir || path.resolve(".runtime", "host-tools"),
+      { log },
+    );
+    const fastcgi = php.fpm || php.phpcgi;
+    const phpDir = path.dirname(fastcgi);
+    const phpEnv = {
+      ...env,
+      Path: `${phpDir}${path.delimiter}${env.Path || env.PATH || ""}`,
+      PATH: `${phpDir}${path.delimiter}${env.PATH || env.Path || ""}`,
+      PHP_FCGI_MAX_REQUESTS: "0",
+    };
     if (await exists(path.join(source, "composer.json"))) {
       if (!process.env.COMPOSER_PHAR)
         throw Error("Set COMPOSER_PHAR to composer.phar for Composer projects");
-      await execute(binaries.php, [
+      if (php.fpm && path.resolve(php.php) === path.resolve(php.fpm))
+        throw Error(
+          "Set PHP_BIN to a PHP CLI binary before deploying a Composer project",
+        );
+      await execute(php.php, [
         process.env.COMPOSER_PHAR,
         "install",
         "--no-dev",
@@ -307,17 +412,34 @@ export async function prepareNative(p, source, log = () => {}) {
       caddy,
       `{\n admin off\n auto_https off\n}\nhttp://127.0.0.1:${p.port} {\n root * ${JSON.stringify(root.replaceAll("\\", "/"))}\n @private path /.git/* /.env /composer.json /composer.lock\n respond @private 404\n php_fastcgi 127.0.0.1:${p.php_port}\n file_server {\n hide .* composer.json composer.lock\n }\n}\n`,
     );
+    const phpProcess = php.fpm
+      ? {
+          key: "php",
+          file: php.fpm,
+          args: ["-F", "-y", path.join(p.folder_path, "php-fpm.conf")],
+          cwd: source,
+          env: phpEnv,
+        }
+      : {
+          key: "php",
+          file: php.phpcgi,
+          args: ["-b", `127.0.0.1:${p.php_port}`],
+          cwd: source,
+          env: phpEnv,
+        };
+    if (php.fpm) {
+      await writeFile(
+        path.join(p.folder_path, "php-fpm.conf"),
+        phpFpmPool(p.php_port, p.folder_path),
+      );
+      if (php.ini && (await exists(php.ini)))
+        phpProcess.args.push("-c", php.ini);
+    }
     return [
-      {
-        key: "php",
-        file: binaries.phpcgi,
-        args: ["-b", `127.0.0.1:${p.php_port}`],
-        cwd: source,
-        env: { ...env, PHP_FCGI_MAX_REQUESTS: "0" },
-      },
+      phpProcess,
       {
         key: "app",
-        file: binaries.caddy,
+        file: php.caddy,
         args: ["run", "--config", caddy, "--adapter", "caddyfile"],
         cwd: source,
         env,
@@ -338,7 +460,7 @@ export async function prepareNative(p, source, log = () => {}) {
         args: (config.args || []).map((arg) =>
           arg.replaceAll("{PORT}", String(p.port)),
         ),
-        cwd: source,
+        cwd,
         env,
       },
     ];
@@ -416,15 +538,18 @@ export async function provisionNativeTunnel(runtime, p) {
     `tunnel: ${credential.TunnelID}\ncredentials-file: ${JSON.stringify(credentials)}\ningress:\n  - hostname: ${p.subdomain}\n    service: http://127.0.0.1:${p.port}\n  - service: http_status:404\n`,
     { mode: 0o600 },
   );
+  runtime.log(p, `Updating DNS for ${p.subdomain}`);
   await nativeCommand("cloudflared", [
     "tunnel",
     "--origincert",
     cert,
     "route",
     "dns",
+    "--overwrite-dns",
     credential.TunnelID,
     p.subdomain,
   ]);
+  runtime.log(p, `DNS updated: ${p.subdomain} points at the tunnel`);
   const spec = {
     key: "tunnel",
     file: binaries.cloudflared,
@@ -445,7 +570,7 @@ export async function deleteNativeTunnel(p) {
     process.env.CLOUDFLARE_CERT ||
       path.join(os.homedir(), ".cloudflared", "cert.pem"),
   ];
-  const tunnels = JSON.parse(
+  const tunnels = parseCommandJson(
     await nativeCommand("cloudflared", [...prefix, "list", "--output", "json"]),
   );
   if (tunnels.some((t) => t.id === p.tunnel.tunnel_id))

package/apps/agent/src/runtime.mjs

@@ -1,4 +1,6 @@
 import { spawn } from "node:child_process";
+import { createWriteStream } from "node:fs";
+import { pipeline } from "node:stream/promises";
 import {
   mkdir,
   readFile,
@@ -16,6 +18,7 @@ import yauzl from "yauzl";
 import {
   NativeSupervisor,
   nativeCommand,
+  parseCommandJson,
   prepareNative,
   ready,
   provisionNativeTunnel,
@@ -41,7 +44,8 @@ export function command(name, args, options = {}) {
       stdio: ["ignore", "pipe", "pipe"],
       detached: process.platform !== "win32",
     });
-    let output = "";
+    let stdout = "";
+    let stderr = "";
     let timedOut = false;
     const stop = () => {
       try {
@@ -53,12 +57,14 @@ export function command(name, args, options = {}) {
       timedOut = true;
       stop();
     }, options.timeout || 120000);
-    const collect = (data) => {
-      output = (output + data.toString()).slice(-100000);
-      options.onOutput?.(data.toString());
+    const collect = (target) => (data) => {
+      const text = data.toString();
+      if (target === "stdout") stdout = (stdout + text).slice(-100000);
+      else stderr = (stderr + text).slice(-100000);
+      options.onOutput?.(text);
     };
-    child.stdout.on("data", collect);
-    child.stderr.on("data", collect);
+    child.stdout.on("data", collect("stdout"));
+    child.stderr.on("data", collect("stderr"));
     child.on("error", (error) => {
       clearTimeout(timer);
       reject(error);
@@ -66,26 +72,22 @@ export function command(name, args, options = {}) {
     child.on("close", (code) => {
       clearTimeout(timer);
       code === 0 && !timedOut
-        ? resolve(output)
+        ? resolve(stdout)
         : reject(
             Error(
-              `${name} ${timedOut ? "timed out" : `exited ${code}`}: ${output.slice(-3000)}`,
+              `${name} ${timedOut ? "timed out" : `exited ${code}`}: ${(stderr || stdout).slice(-3000)}`,
             ),
           );
     });
   });
 }
 
-export async function extractZip(buffer, destination) {
+export async function extractZip(source, destination) {
   await mkdir(destination, { recursive: true });
   return new Promise((resolve, reject) => {
-    yauzl.fromBuffer(
-      buffer,
-      { lazyEntries: true, validateEntrySizes: true },
-      (error, zip) => {
+    const options = { lazyEntries: true, validateEntrySizes: true };
+    const opened = (error, zip) => {
         if (error) return reject(error);
-        let total = 0,
-          count = 0;
         const fail = (error) => {
           zip.close();
           reject(error);
@@ -112,11 +114,6 @@ export async function extractZip(buffer, destination) {
                 .some((p) => ["node_modules", ".git"].includes(p))
             )
               throw Error("Remove node_modules and .git from the archive");
-            if (
-              ++count > 10000 ||
-              (total += entry.uncompressedSize) > 200 * 1024 * 1024
-            )
-              throw Error("ZIP exceeds extraction limit");
             if (filename.endsWith("/")) {
               await mkdir(target, { recursive: true });
               zip.readEntry();
@@ -142,8 +139,9 @@ export async function extractZip(buffer, destination) {
           }
         });
         zip.readEntry();
-      },
-    );
+    };
+    if (Buffer.isBuffer(source)) yauzl.fromBuffer(source, options, opened);
+    else yauzl.open(source, options, opened);
   });
 }
 
@@ -223,10 +221,22 @@ export class Runtime {
               ))
                 await this.supervisor.start(`${p.id}:${spec.key}`, spec);
               await ready(p.port, this.supervisor, `${p.id}:app`);
+              if (
+                process.env.NATIVE_TUNNELS !== "false" &&
+                !p.native_specs.some((spec) => spec.key === "tunnel")
+              ) {
+                await provisionNativeTunnel(this, p);
+                p.error = null;
+              }
             } catch (error) {
-              p.status = "failed";
-              p.error = error.message;
-              await this.supervisor.stopProject(p.id);
+              if (this.supervisor.active(`${p.id}:app`)) {
+                this.log(p, `Cloudflare DNS was not updated: ${error.message}`);
+                p.error = error.message;
+              } else {
+                p.status = "failed";
+                p.error = error.message;
+                await this.supervisor.stopProject(p.id);
+              }
             }
             await this.save();
           });
@@ -261,7 +271,13 @@ export class Runtime {
     ).slice(-100000);
   }
   async create(id, input) {
-    if (this.state.projects[id]) return this.get(id);
+    if (this.state.projects[id]) {
+      const current = this.get(id);
+      if (input.type) current.type = input.type;
+      if (input.runtime_config) current.runtime_config = input.runtime_config;
+      await this.save();
+      return current;
+    }
     if (
       Object.values(this.state.projects).some(
         (p) => p.name === input.name || p.subdomain === input.subdomain,
@@ -308,6 +324,23 @@ export class Runtime {
     p.has_upload = true;
     await this.save();
   }
+  async uploadStream(id, source) {
+    const p = this.get(id);
+    if (["queued", "deploying"].includes(p.status))
+      throw Object.assign(Error("Deployment in progress"), { status: 409 });
+    const file = path.join(this.root, `${id}.zip`);
+    const temporary = `${file}.${process.pid}.partial`;
+    try {
+      await pipeline(source, createWriteStream(temporary, { mode: 0o600 }));
+      await rm(file, { force: true });
+      await rename(temporary, file);
+    } catch (error) {
+      await rm(temporary, { force: true });
+      throw error;
+    }
+    p.has_upload = true;
+    await this.save();
+  }
   async deploy(id, deploymentId) {
     const p = this.get(id);
     if (this.mode === "host" && p.type && p.type !== "nodejs")
@@ -394,10 +427,7 @@ export class Runtime {
     await rm(source, { recursive: true, force: true });
     await mkdir(source, { recursive: true });
     if (p.source_type === "zip")
-      await extractZip(
-        await readFile(path.join(this.root, `${p.id}.zip`)),
-        source,
-      );
+      await extractZip(path.join(this.root, `${p.id}.zip`), source);
     else
       await nativeCommand(
         "git",
@@ -418,8 +448,11 @@ export class Runtime {
       p,
       `Preparing native ${p.type || "nodejs"} runtime on ${process.platform}`,
     );
-    p.native_specs = await prepareNative(p, source, (message) =>
-      this.log(p, message),
+    p.native_specs = await prepareNative(
+      p,
+      source,
+      (message) => this.log(p, message),
+      path.join(this.root, "host-tools"),
     );
     for (const spec of p.native_specs)
       await this.supervisor.start(`${p.id}:${spec.key}`, spec);
@@ -475,10 +508,7 @@ export class Runtime {
         folder,
       );
     else {
-      await extractZip(
-        await readFile(path.join(this.root, `${p.id}.zip`)),
-        release,
-      );
+      await extractZip(path.join(this.root, `${p.id}.zip`), release);
       await command("chown", ["-R", `${user}:${group}`, release]);
     }
     const manifest = JSON.parse(
@@ -541,15 +571,18 @@ export class Runtime {
       `tunnel: ${p.tunnel.tunnel_id}\ncredentials-file: ${credentials}\ningress:\n  - hostname: ${p.subdomain}\n    service: http://127.0.0.1:${p.port}\n  - service: http_status:404\n`,
       { mode: 0o600 },
     );
+    this.log(p, `Updating DNS for ${p.subdomain}`);
     await command("cloudflared", [
       "tunnel",
       "--origincert",
       cert,
       "route",
       "dns",
+      "--overwrite-dns",
       p.tunnel.tunnel_id,
       p.subdomain,
     ]);
+    this.log(p, `DNS updated: ${p.subdomain} points at the tunnel`);
     const tunnelUnit = `[Unit]\nDescription=Naviyra tunnel ${p.name}\nAfter=network-online.target\nWants=network-online.target\n[Service]\nExecStart=${binaries.cloudflared} tunnel --config ${config} run ${p.tunnel.tunnel_id}\nRestart=on-failure\nRestartSec=5\n[Install]\nWantedBy=multi-user.target\n`;
     await writeFile(`/etc/systemd/system/${this.unit(p, true)}`, tunnelUnit);
     await command("systemctl", ["daemon-reload"]);
@@ -653,7 +686,7 @@ export class Runtime {
           "--origincert",
           process.env.CLOUDFLARE_CERT || "/root/.cloudflared/cert.pem",
         ];
-        const tunnels = JSON.parse(
+        const tunnels = parseCommandJson(
           await command("cloudflared", [...prefix, "list", "--output", "json"]),
         );
         if (tunnels.some((t) => t.id === p.tunnel.tunnel_id))

package/apps/agent/src/server.mjs

@@ -1,12 +1,22 @@
 import http from "node:http";
+import { createReadStream } from "node:fs";
 import { timingSafeEqual, createHash } from "node:crypto";
 import { pathToFileURL } from "node:url";
 import { Runtime } from "./runtime.mjs";
+import {
+  projectAppRoot,
+  listFiles,
+  readFileText,
+  writeFileText,
+  createDirectory,
+  removePath,
+  saveUpload,
+  openDownload,
+} from "./files.mjs";
 import {
   projectInput,
   idSchema,
   deploymentInput,
-  MAX_ZIP_BYTES,
 } from "@naviyra/shared";
 import {
   cloudflareStatus,
@@ -26,6 +36,17 @@ import {
   deleteDestination,
 } from "./cloudflare.mjs";
 
+async function readBody(req, limit) {
+  let size = 0;
+  const chunks = [];
+  for await (const chunk of req) {
+    size += chunk.length;
+    if (size > limit)
+      throw Object.assign(Error("Payload too large"), { status: 413 });
+    chunks.push(chunk);
+  }
+  return Buffer.concat(chunks);
+}
 export function createServer(runtime, token) {
   if (!token || token.length < 32)
     throw Error("AGENT_TOKEN must contain at least 32 characters");
@@ -114,6 +135,40 @@ export function createServer(runtime, token) {
           return send(200, await deleteDestination(emailId));
         return send(405, { error: "Method not allowed" });
       }
+      const fileMatch = url.pathname.match(/^\/projects\/([^/]+)\/files$/);
+      if (fileMatch) {
+        const id = idSchema.parse(fileMatch[1]);
+        const root = await projectAppRoot(runtime.get(id).folder_path);
+        const queryPath = url.searchParams.get("path") || "";
+        if (req.method === "GET" && url.searchParams.get("download") === "1") {
+          const file = await openDownload(root, queryPath);
+          res.writeHead(200, {
+            "Content-Type": "application/octet-stream",
+            "Content-Disposition": `attachment; filename="${file.name}"`,
+            "Cache-Control": "no-store",
+          });
+          createReadStream(file.file).pipe(res);
+          return;
+        }
+        if (req.method === "GET")
+          return send(
+            200,
+            url.searchParams.get("read") === "1"
+              ? await readFileText(root, queryPath)
+              : await listFiles(root, queryPath),
+          );
+        if (req.method === "POST")
+          return send(200, await saveUpload(root, queryPath, req));
+        const body = await readBody(req, 2 * 1024 * 1024);
+        const input = body.length ? JSON.parse(body.toString()) : {};
+        if (req.method === "PUT" && input.action === "mkdir")
+          return send(200, await createDirectory(root, input.path));
+        if (req.method === "PUT")
+          return send(200, await writeFileText(root, input.path, input.content));
+        if (req.method === "DELETE")
+          return send(200, await removePath(root, queryPath));
+        return send(405, { error: "Method not allowed" });
+      }
       const match = url.pathname.match(
         /^\/projects(?:\/([^/]+))?(?:\/(deploy|source|restart|logs|metrics))?$/,
       );
@@ -125,9 +180,13 @@ export function createServer(runtime, token) {
         if (action === "metrics") return send(200, await runtime.metrics(id));
         if (!action) return send(200, runtime.get(id));
       }
+      if (req.method === "PUT" && action === "source") {
+        await runtime.serial(() => runtime.uploadStream(id, req));
+        return send(200, { ok: true });
+      }
       let size = 0;
       const chunks = [];
-      const limit = action === "source" ? MAX_ZIP_BYTES : 8192;
+      const limit = 8192;
       for await (const chunk of req) {
         size += chunk.length;
         if (size > limit) return send(413, { error: "Payload too large" });
@@ -143,10 +202,6 @@ export function createServer(runtime, token) {
           ),
         );
       }
-      if (req.method === "PUT" && action === "source") {
-        await runtime.serial(() => runtime.upload(id, body));
-        return send(200, { ok: true });
-      }
       if (req.method === "POST" && action === "deploy") {
         const input = deploymentInput.parse(JSON.parse(body.toString()));
         return send(