@somewhere-tech/cli 0.28.5 → 0.29.1

package/runtime/sw-init.mjs

@@ -1,10 +1,40 @@
-// VENDORED from worker/src/utils/function-bundle.ts (SW_INIT_JS) @ e8da46e
+// VENDORED from worker/src/utils/function-bundle.ts (SW_INIT_JS) @ 3326a8d8
 // — the exact runtime deployed functions run against. Do not edit by hand;
 // re-sync with: node scripts/extract-runtime.mjs <monorepo>
 // Generated by somewhere.tech deploy pipeline. Sets up the global
 // surfaces user modules need at module-load time.
 globalThis.sw = globalThis.sw || {};
 
+// USER_ENV is the canonical, deploy-baked source behind each request's
+// sw.env. Capture this initializer in index.mjs before customer modules load,
+// then remove it from the public global surface. This intentionally restores
+// only customer-owned values after workerd denies automatic raw env reflection.
+globalThis.sw.__wireProcessEnv = function __sw_wireProcessEnv(runtimeEnv) {
+  if (typeof process !== 'object' || process === null ||
+      typeof process.env !== 'object' || process.env === null) {
+    const error = new Error('process.env could not be initialized from project environment variables.');
+    error.code = 'PROCESS_ENV_INIT_FAILED';
+    throw error;
+  }
+
+  let userEnv;
+  try {
+    userEnv = runtimeEnv && runtimeEnv.USER_ENV ? JSON.parse(runtimeEnv.USER_ENV) : {};
+  } catch (_) {
+    const error = new Error('process.env could not be initialized from project environment variables.');
+    error.code = 'PROCESS_ENV_INIT_FAILED';
+    throw error;
+  }
+  if (!userEnv || typeof userEnv !== 'object' || Array.isArray(userEnv)) {
+    const error = new Error('process.env could not be initialized from project environment variables.');
+    error.code = 'PROCESS_ENV_INIT_FAILED';
+    throw error;
+  }
+
+  for (const key of Object.keys(process.env)) delete process.env[key];
+  for (const key of Object.keys(userEnv)) process.env[key] = String(userEnv[key]);
+};
+
 /** Parse "10/minute" / "60/hour" / "1000/day" into { max, windowSeconds }. */
 function __sw_parseRateLimit(spec) {
   if (typeof spec !== 'string') return null;
@@ -85,7 +115,10 @@ function __sw_corsHeaders(corsCfg, request) {
   return {
     'Access-Control-Allow-Origin': allowed,
     'Access-Control-Allow-Methods': 'GET, POST, PUT, PATCH, DELETE, OPTIONS',
-    'Access-Control-Allow-Headers': 'Content-Type, Authorization',
+    // Pragma/Cache-Control: headless browsers + CI automation attach
+    // "Pragma: no-cache" to every fetch; omitting them fails the preflight
+    // for those clients only (tsk_abbfd574).
+    'Access-Control-Allow-Headers': 'Content-Type, Authorization, Pragma, Cache-Control',
     'Vary': 'Origin',
   };
 }
@@ -183,20 +216,33 @@ globalThis.sw.endpoint = function (config) {
       try {
         var r = await sw.rateLimit.check(rlKey, rateLimit.max, rateLimit.windowSeconds);
         if (!r || r.allowed === false) {
-          var retry = (r && r.reset) || rateLimit.windowSeconds;
+          var retry = rateLimit.windowSeconds;
+          if (r && (r.retry_after || r.retry_after_s)) retry = r.retry_after || r.retry_after_s;
+          else if (r && r.reset) retry = Math.max(1, Math.ceil(r.reset - (Date.now() / 1000)));
+          var code = (r && r.error) || 'RATE_LIMITED';
+          var message = (r && r.message) || 'Too many requests.';
           return __sw_mergeHeaders(
             new Response(
-              JSON.stringify({ ok: false, error: 'RATE_LIMITED', message: 'Too many requests.', retry_after: retry }),
+              JSON.stringify({ ok: false, error: code, message: message, retry_after: retry }),
               { status: 429, headers: { 'Content-Type': 'application/json', 'Retry-After': String(retry) } }
             ),
             corsHeaders
           );
         }
-      } catch (_) {
+      } catch (rlErr) {
         // fail-loudly + fail-CLOSED (tsk_9f22): if the rate-limit check
         // itself errors we used to let the request through — silently
         // disabling the limiter. Block instead. A rate-limited endpoint
         // must never serve unthrottled just because the limiter hiccuped.
+        // Log the underlying failure — swallowing it hid a 403
+        // capability denial behind "temporarily unavailable" for 9 days
+        // (tsk_8fec0de9). A 403 here means the runtime key was minted
+        // without project:rate-limit; that is permanent until redeploy,
+        // not transient.
+        console.error(
+          'sw.endpoint rate-limit check failed (failing closed with 503 RATE_LIMIT_UNAVAILABLE):',
+          rlErr && rlErr.code, rlErr && rlErr.status, rlErr && rlErr.message
+        );
         return __sw_mergeHeaders(
           new Response(
             JSON.stringify({ ok: false, error: 'RATE_LIMIT_UNAVAILABLE', message: 'Rate limiting is temporarily unavailable; this request was blocked. Retry shortly.' }),