@pithy-sh/core 0.6.0 → 0.6.2

package/dist/seed/devLogin.js

@@ -11,10 +11,16 @@ import { z } from "zod";
 * the seam they already share, so the shape is stated once instead of being duplicated (and drifting) at
 * both ends.
 *
-* **The file holds a live credential.** A signed session cookie for a local database is a way in for
-* anyone who can read it, which is why it is written under `logs/` — gitignored by the starter template,
-* so it can never be committed — and why nothing here is ever put in a `PithyError` (the payload reaches
-* logs verbatim).
+* **The file holds a live credential.** A signed claim for a local database is a way in for anyone who
+* can read it, which is why it is written under `logs/` — gitignored by the starter template, so it can
+* never be committed — and why nothing here is ever put in a `PithyError` (the payload reaches logs
+* verbatim).
+*
+* **It used to hold a session cookie, and now it holds a claim — `#572`.** The difference is what
+* survives: a cookie names a row in `pithy_auth_sessions`, so signing out of the app revoked it and the
+* dev login 404'd until somebody reseeded. A claim names a *user*, signed with the session secret, and
+* the route exchanges it for a fresh session on every open. Sign-out then revokes the session it should
+* revoke and leaves the way back in alone.
 */
 /** The directory seed artifacts are written to, relative to the project root. Gitignored, so transient. */
 const SEED_ARTIFACT_DIR = "logs";
@@ -34,21 +40,22 @@ const DEV_LOGIN_PATH = `${SEED_ARTIFACT_DIR}/${DEV_LOGIN_FILE}`;
 * anything the kit serves that is not part of a capability's public surface lives under this prefix, so
 * a route added here can never collide with an application path someone already shipped.
 *
-* Registered **only** in a `dev` composition, and never under CI. It mints an authenticated session with
-* no credential presented, which is the whole risk of the feature and the reason its gates live at
-* registration rather than inside the handler.
+* Registered **only** in a `dev` composition, and never under CI. It mints an authenticated session for
+* whoever presents a claim this project's own secret signed, which is the whole risk of the feature and
+* the reason its gates live at registration rather than inside the handler.
 */
 const DEV_LOGIN_ROUTE = "/__pithy/dev-login";
+/** The query parameter {@link DEV_LOGIN_ROUTE} takes the claim in. Spelled once, read by both ends. */
+const DEV_LOGIN_CLAIM_PARAM = "t";
 /**
 * A seeded dev login — everything a browser needs to be signed in as a seeded user, and nothing else.
 * `z.input` is the JSON on disk (dates as ISO-8601 strings); `z.output` is the app shape.
 */
 const DevLogin = z.object({
-	email: z.string().describe("The seeded user this cookie signs in as. Shown on the `pithy dev` ready banner."),
-	userId: z.string().describe("The seeded user's id, so a tool can correlate the cookie with the seeded rows."),
-	cookieName: z.string().describe("The cookie name the auth capability's session is read from, e.g. `better-auth.session_token`."),
-	cookieValue: z.string().describe("The signed, URI-encoded cookie value. A live credential for the local database — never logged, never committed, never in an error payload."),
-	expiresAt: JsonDate.describe("When the seeded session expires. ISO-8601 text on disk; a `Date` in app code.")
-}).describe("A seeded dev login: the signed session cookie for one seeded user, written to `logs/dev-login.json`.");
+	email: z.string().describe("The seeded user this claim signs in as. Shown on the `pithy dev` ready banner."),
+	userId: z.string().describe("The seeded user's id, so a tool can correlate the login with the seeded rows."),
+	claim: z.string().describe("The signed, URI-encoded claim naming the user to sign in as. A live credential for the local database — never logged, never committed, never in an error payload. **Not a session:** it names a user and the route mints a session against it, so revoking a session leaves it working."),
+	expiresAt: JsonDate.describe("When the claim stops being accepted. ISO-8601 text on disk; a `Date` in app code.")
+}).describe("A seeded dev login: the signed claim for one seeded user, written to `logs/dev-login.json`.");
 //#endregion
-export { DEV_LOGIN_FILE, DEV_LOGIN_PATH, DEV_LOGIN_ROUTE, DevLogin, SEED_ARTIFACT_DIR };
+export { DEV_LOGIN_CLAIM_PARAM, DEV_LOGIN_FILE, DEV_LOGIN_PATH, DEV_LOGIN_ROUTE, DevLogin, SEED_ARTIFACT_DIR };

package/dist/version.generated.d.ts

@@ -3,5 +3,5 @@
 /** This package's npm name — the join key against a release feed. */
 export declare const PACKAGE_NAME = "@pithy-sh/core";
 /** This package's version, stamped from its own package.json at generation time. */
-export declare const PACKAGE_VERSION = "0.5.0";
+export declare const PACKAGE_VERSION = "0.6.2";
 //# sourceMappingURL=version.generated.d.ts.map

package/dist/version.generated.js

@@ -4,6 +4,6 @@
 /** This package's npm name — the join key against a release feed. */
 const PACKAGE_NAME = "@pithy-sh/core";
 /** This package's version, stamped from its own package.json at generation time. */
-const PACKAGE_VERSION = "0.5.0";
+const PACKAGE_VERSION = "0.6.2";
 //#endregion
 export { PACKAGE_NAME, PACKAGE_VERSION };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pithy-sh/core",
-  "version": "0.6.0",
+  "version": "0.6.2",
   "license": "MIT",
   "repository": {
     "type": "git",

package/src/naming/provisionScope.ts

@@ -133,8 +133,14 @@ export interface ProvisionScope {
    * is created, judged to be the project's, kept out of the teardown record, and orphaned.
    */
   readonly honorsGlobal: boolean;
-  /** The script name a Worker deploys under in this scope. */
-  worker(worker: string): string;
+  /**
+   * The script name a Worker deploys under in this scope.
+   *
+   * `declared` is the name that scope's stanza already carries, when it carries one. A scope may honor it
+   * or compose its own; see {@link environmentScope} and {@link featureScope}, which answer differently
+   * and say why. Passing it is how a caller asks the scope rather than deciding for itself.
+   */
+  worker(worker: string, declared?: string): string;
   /**
    * This scope's CF Secrets Store entry name for a declared secret.
    *
@@ -228,13 +234,25 @@ export function bindingResourceName(
  * every name below, so an illegal one must fail before anything is created rather than at the fourth
  * getter that happened to use it.
  *
- * **A Worker's script name is wrangler's own, `<script>-<env>`, deliberately.** It is the one name here
- * that is not `<project>-<env>-<thing>`, because `wrangler deploy --env staging` has always appended the
- * environment to the top-level `name` — so every project that ever deployed is already at that address.
- * A Worker script is a `refuse`-policy namespace precisely because renaming one orphans the deployment
- * and every `service` binding pointing at it; composing a "more correct" name here would do exactly
- * that, silently, on the next deploy. The name is written out rather than left implicit so a service
- * binding and a deploy agree on one string that is in the file.
+ * **A declared name wins; the fallback is wrangler's own, `<script>-<env>`.**
+ *
+ * This reverses the rule that stood here until #580, and the reversal is worth reading rather than
+ * assuming. The old rule *recomputed* `<script>-<env>` on every provision and wrote it over whatever the
+ * stanza said, on the argument that wrangler has always appended the environment to the top-level `name`,
+ * so every project that ever deployed is already at that address.
+ *
+ * That argument is still true about the **fallback**, and the fallback is unchanged: a stanza that names
+ * nothing gets `<script>-<env>` and every existing adopter deploys exactly where they always did. What was
+ * wrong was recomputing over a name somebody wrote down. Since #580 the starter template writes one —
+ * `<project>-<env>-<worker>`, the shape every other resource here takes — so recompute would have made the
+ * template's stamp pointless, and worse: it would have silently renamed the Worker of every project that
+ * had taken the new shape, on their next `pithy provision`. A Worker script is a `refuse`-policy namespace
+ * precisely because renaming one orphans the deployment, its routes, and every `service` binding pointing
+ * at it. Doing that as a side effect of provisioning is the failure the old rule was written to prevent,
+ * arriving from the other direction.
+ *
+ * So the name is read, not composed, when the file already holds one — and written out when it does not,
+ * so a service binding and a deploy still agree on one string that is in the file.
  */
 export function environmentScope(project: string, environment: string): ProvisionScope {
   assertValidEnvironment(environment);
@@ -247,7 +265,7 @@ export function environmentScope(project: string, environment: string): Provisio
     honorsGlobal: true,
     resource: (binding, kind, naming) =>
       bindingResourceName(project, binding, kind, naming, (thing) => names[KIND_NAMER[kind]](thing)),
-    worker: (worker) => `${worker}-${environment}`,
+    worker: (worker, declared) => declared ?? `${worker}-${environment}`,
     secretEntry: (secret, secretScope) =>
       secretEntryName(project, secret, secretScope, () => names.secretEntry(secret)),
   };
@@ -272,6 +290,12 @@ export function environmentScope(project: string, environment: string): Provisio
  * `resource` is ignored for the same reason it is moot: a feature's `<thing>` segment is the binding plus
  * the kind, and the whole name is recomputed on teardown rather than looked up, so nothing outside the
  * feature reads the string.
+ *
+ * **And a declared Worker name is ignored here too — the other half of the #580 asymmetry.** A declared
+ * environment's script name is the adopter's, written in a tracked file, and provisioning reads it. A
+ * feature's is the kit's: it is composed from the branch, written into a generated config nobody commits,
+ * and **recomputed on teardown**. Honoring a declared one would leave `pithy feature destroy` computing a
+ * name the deployment does not answer to, which is a Worker nothing deletes.
  */
 export function featureScope(identity: FeatureIdentity): ProvisionScope {
   return {

package/src/version.generated.ts

@@ -13,4 +13,4 @@
 export const PACKAGE_NAME = "@pithy-sh/core";
 
 /** This package's version, stamped from its own package.json at generation time. */
-export const PACKAGE_VERSION = "0.6.0";
+export const PACKAGE_VERSION = "0.6.2";