@yolo-labs/yolo-cli 0.23.0

package/dist/context.js

@@ -0,0 +1,58 @@
+/**
+ * Container ambient context resolver for the substrate CLI.
+ *
+ * Reads `SESSION_ID`, `YOLO_COMMON_API_URL`, and the user access JWT
+ * (`~/.config/yolo/token` → `YOLO_API_TOKEN`) and exposes a typed result.
+ * Exits with `session-required` (exit code 78 = EX_CONFIG) if `SESSION_ID` is
+ * missing — outside-container invocation is out of scope for v1.
+ *
+ * `WORKSPACE_ID` is read for display purposes (operators want a
+ * fast "what workspace is this" answer in `yolo context`).
+ * The authoritative workspaceId for any *write* still comes from
+ * the session record at token-mint time — that's what the CLI's
+ * `--workspace` sanity check is comparing against. So
+ * `WORKSPACE_ID` is best-effort env state, not the source of
+ * truth, but in practice the session container sets both
+ * consistently from the same source.
+ */
+import { resolveUserToken } from './auth-context.js';
+export class ContextResolutionError extends Error {
+    exitCode;
+    constructor(message, exitCode) {
+        super(message);
+        this.name = 'ContextResolutionError';
+        this.exitCode = exitCode;
+    }
+}
+export function readSessionContext() {
+    const sessionId = process.env.SESSION_ID;
+    if (!sessionId || sessionId.length === 0) {
+        throw new ContextResolutionError('session-required: SESSION_ID env var is empty or missing. The substrate CLI requires a Studio container session; outside-container invocation is out of scope for v1.', 78);
+    }
+    const commonApiUrl = process.env.YOLO_COMMON_API_URL || process.env.YOLO_API_URL;
+    if (!commonApiUrl || commonApiUrl.length === 0) {
+        throw new ContextResolutionError('session-required: YOLO_COMMON_API_URL env var is empty or missing.', 78);
+    }
+    const userToken = resolveUserToken(process.env);
+    return {
+        sessionId,
+        commonApiUrl,
+        userTokenPresent: !!userToken && userToken.length > 0,
+        workspaceIdHint: process.env.WORKSPACE_ID ?? null,
+    };
+}
+export function formatContext(ctx) {
+    // The "(unset)" branch is for the rare-but-possible case where
+    // SESSION_ID is set but WORKSPACE_ID isn't — substrate ops will
+    // still work (mint resolves workspace from the session record),
+    // they just can't be sanity-checked against ambient env.
+    const workspace = ctx.workspaceIdHint ?? '(unset — will resolve from session at mint time)';
+    return [
+        'yolo substrate CLI — context',
+        `  sessionId          ${ctx.sessionId}`,
+        `  commonApiUrl       ${ctx.commonApiUrl}`,
+        `  userToken          ${ctx.userTokenPresent ? '(set)' : '(missing)'}`,
+        `  workspaceId        ${workspace}`,
+        '',
+    ].join('\n');
+}

package/dist/deploy-bundle.js

@@ -0,0 +1,394 @@
+/**
+ * Local bundling for `yolo deploy` (spec
+ * `docs/MANAGED_HOSTING_CLI_SPEC.md` §2, `deploy-bundle`).
+ *
+ * Fully OFFLINE: every ceiling is enforced here, before any network —
+ * `--dry-run` stops after this module. Outputs:
+ *
+ *   - **Worker module** — esbuild ESM bundle of the entry
+ *     (`{bundle, format:'esm', platform:'browser',
+ *     conditions:['workerd','worker'], target:'es2022', write:false,
+ *     minify:true}`). If the entry already points at a BUILT `.js`/`.mjs`
+ *     module (vinext/OpenNext output, skill-directed), esbuild is
+ *     SKIPPED and the module ships byte-for-byte as-is — the size
+ *     ceilings still apply. esbuild is lazy-imported so `yolo plan`
+ *     startup never pays for it (the `serve.ts` lazy-load precedent).
+ *   - **Asset manifest** — walk `assetsDir` (skip dotfiles +
+ *     node_modules), URL-style path → `{hash: sha256hex, size}`.
+ *     Pure-static ships NO module; common-api attaches the canonical
+ *     assets-only shim server-side.
+ *   - **`bundleDigest`** — sha256 over module bytes + the sorted
+ *     manifest; becomes `hosting_releases.bundleDigest` and binds T3
+ *     approvals to exactly these bytes.
+ *
+ * Ceilings (defaults per spec; the server returns authoritative tier
+ * caps at ship/start and re-checks — overrides below are for that and
+ * for tests):
+ *   - per-file 25 MiB (CF hard limit)        → `file-too-large`
+ *   - 20,000 files                            → `too-many-files`
+ *   - total assets 256 MiB                    → `bundle-too-large`
+ *   - worker module >10 MiB                   → `bundle-too-large`
+ *     (plus a warning when the gzipped module exceeds 1 MiB)
+ */
+import { createHash } from 'node:crypto';
+import { existsSync, readdirSync, readFileSync, realpathSync, statSync } from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { gzipSync } from 'node:zlib';
+// ─── Vendored @yolo-labs/flexdb ─────────────────────────────────────────────
+//
+// FlexDB is not published to npm yet (it will be). Until then, the deploy
+// bundler resolves `import { FlexDB } from '@yolo-labs/flexdb'` to a copy
+// vendored into the CLI's dist (built by scripts/build-vendored-flexdb.mjs), so
+// a customer Worker can use FlexDB without installing it. A real installed copy
+// is preferred once the package is published — see vendoredFlexdbPlugin.
+let cachedFlexdbSource;
+/** The vendored FlexDB bundle shipped in the CLI's dist, or null if absent (unbuilt dev tree). */
+function readVendoredFlexdb() {
+    if (cachedFlexdbSource !== undefined)
+        return cachedFlexdbSource;
+    try {
+        const p = fileURLToPath(new URL('./vendored/flexdb.mjs', import.meta.url));
+        cachedFlexdbSource = existsSync(p) ? readFileSync(p, 'utf8') : null;
+    }
+    catch {
+        cachedFlexdbSource = null;
+    }
+    return cachedFlexdbSource;
+}
+/**
+ * esbuild plugin that supplies `@yolo-labs/flexdb` from the CLI's vendored copy
+ * when the project hasn't installed it. A real installed copy (post-publish) is
+ * preferred. Returns null when no vendored bundle is present, leaving esbuild's
+ * default resolution untouched.
+ */
+function vendoredFlexdbPlugin() {
+    const source = readVendoredFlexdb();
+    if (source === null)
+        return null;
+    const NS = 'yolo-vendored-flexdb';
+    const SPECIFIER = '@yolo-labs/flexdb';
+    return {
+        name: 'yolo-vendored-flexdb',
+        setup(build) {
+            build.onResolve({ filter: /^@yolo-labs\/flexdb$/ }, async (args) => {
+                // Re-entry guard: our build.resolve() below re-fires this same filter.
+                if (args.pluginData?.vendored)
+                    return null;
+                // Prefer a real installed copy if the project has one (post-publish).
+                const real = await build.resolve(args.path, {
+                    importer: args.importer,
+                    resolveDir: args.resolveDir,
+                    kind: args.kind,
+                    pluginData: { vendored: true },
+                });
+                if (real.errors.length === 0 && real.path)
+                    return real;
+                // Otherwise route to the vendored virtual module.
+                return { path: SPECIFIER, namespace: NS };
+            });
+            build.onLoad({ filter: /.*/, namespace: NS }, () => ({
+                contents: source,
+                loader: 'js',
+                resolveDir: '/',
+            }));
+        },
+    };
+}
+// ─── Public types ─────────────────────────────────────────────────────────
+export const DEPLOY_CEILINGS = {
+    /** CF hard per-file limit. */
+    maxFileBytes: 25 * 1024 * 1024,
+    maxFiles: 20_000,
+    /** Local default; the server's tier cap is authoritative at ship/start. */
+    maxTotalBytes: 256 * 1024 * 1024,
+    /** Worker module hard cap. */
+    maxModuleBytes: 10 * 1024 * 1024,
+    /** Gzipped-module size that triggers a warning (not a failure). */
+    warnModuleGzipBytes: 1 * 1024 * 1024,
+};
+// ─── Public entry ─────────────────────────────────────────────────────────
+export async function bundleProject(shape, cwd, ceilings = {}) {
+    const caps = { ...DEPLOY_CEILINGS, ...definedOnly(ceilings) };
+    const warnings = [];
+    // ── Worker module (esbuild, or as-is for pre-built entries) ────────────
+    let module = null;
+    let moduleSource = null;
+    if (shape.type === 'worker') {
+        const built = await buildWorkerModule(shape.entry, cwd, shape.prebuilt === true, caps, warnings);
+        if (!built.ok)
+            return built;
+        module = built.module;
+        moduleSource = built.source;
+    }
+    // ── Asset walk + manifest + ceilings ────────────────────────────────────
+    const manifest = {};
+    const assetPaths = {};
+    const assets = [];
+    let fileCount = 0;
+    let totalAssetBytes = 0;
+    // Both arms carry assetsDir (required on static, optional on worker).
+    const assetsDir = shape.assetsDir;
+    if (assetsDir !== undefined) {
+        const rootAbs = path.resolve(cwd, assetsDir);
+        let rootStat;
+        try {
+            rootStat = statSync(rootAbs);
+        }
+        catch {
+            rootStat = undefined;
+        }
+        if (rootStat === undefined || !rootStat.isDirectory()) {
+            return {
+                ok: false,
+                kind: 'build-failed',
+                message: `assets directory not found: ${assetsDir} (resolved ${rootAbs})`,
+                hint: 'run the build first, or fix build.outputDir / worker.assetsDir in .yolo/deploy.json',
+            };
+        }
+        for (const relPosix of walkAssetFiles(rootAbs)) {
+            const absPath = path.join(rootAbs, ...relPosix.split('/'));
+            const size = statSync(absPath).size;
+            if (size > caps.maxFileBytes) {
+                return {
+                    ok: false,
+                    kind: 'file-too-large',
+                    message: `${relPosix} is ${formatBytes(size)} — per-file limit is ${formatBytes(caps.maxFileBytes)}`,
+                    hint: 'host large media in the project R2 bucket or external storage',
+                };
+            }
+            fileCount += 1;
+            if (fileCount > caps.maxFiles) {
+                return {
+                    ok: false,
+                    kind: 'too-many-files',
+                    message: `more than ${caps.maxFiles} files under ${assetsDir}`,
+                    hint: 'exclude generated/vendored trees from the assets dir',
+                };
+            }
+            totalAssetBytes += size;
+            if (totalAssetBytes > caps.maxTotalBytes) {
+                return {
+                    ok: false,
+                    kind: 'bundle-too-large',
+                    message: `total assets exceed ${formatBytes(caps.maxTotalBytes)} (at ${relPosix})`,
+                    hint: 'host large media in the project R2 bucket or external storage',
+                };
+            }
+            const manifestPath = '/' + relPosix;
+            const hash = cfAssetHash(readFileSync(absPath), manifestPath);
+            manifest[manifestPath] = { hash, size };
+            assetPaths[manifestPath] = absPath;
+            assets.push({ path: manifestPath, hash, size, absPath });
+        }
+    }
+    else if (shape.type === 'static') {
+        // Type system prevents this (static requires assetsDir), but guard anyway.
+        return { ok: false, kind: 'build-failed', message: 'static project has no assetsDir' };
+    }
+    return {
+        ok: true,
+        type: shape.type,
+        manifest,
+        assetPaths,
+        assets,
+        module,
+        workerModules: module === null ? [] : [module],
+        moduleSource,
+        fileCount,
+        totalAssetBytes,
+        bundleDigest: computeBundleDigest(module === null ? [] : [module], manifest),
+        warnings,
+    };
+}
+/**
+ * `sha256:<hex>` over name-framed module bytes + the sorted manifest.
+ *
+ * ⚠️ MIRROR — the CANONICAL implementation is the server verifier
+ * (`common-api/src/services/hosting/release-service.ts` computeBundleDigest);
+ * finalize recomputes with this exact recipe and refuses on mismatch
+ * (`bundle-digest-mismatch`). Recipe: modules sorted by name, each hashed as
+ * `name‖0x00‖bytes‖0x00`; then `JSON.stringify` of path-sorted entries shaped
+ * `[path, {hash, size}]`. The golden-vector test pins all three copies
+ * (this, the server, yolo-studio-mcp/src/lib/static-bundle.ts) to the same
+ * output — change one, change all.
+ */
+export function computeBundleDigest(modules, manifest) {
+    const hash = createHash('sha256');
+    const sorted = [...modules].sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
+    for (const mod of sorted) {
+        hash.update(mod.name, 'utf8');
+        hash.update(Buffer.from([0]));
+        hash.update(mod.contents);
+        hash.update(Buffer.from([0]));
+    }
+    const entries = Object.keys(manifest)
+        .sort()
+        .map((path) => [path, { hash: manifest[path].hash, size: manifest[path].size }]);
+    hash.update(JSON.stringify(entries), 'utf8');
+    return `sha256:${hash.digest('hex')}`;
+}
+async function buildWorkerModule(entry, cwd, prebuilt, caps, warnings) {
+    const entryAbs = path.resolve(cwd, entry);
+    let contents;
+    let name;
+    let source;
+    // Ship as-is ONLY for an explicitly-configured built output (deploy.json
+    // worker.entry → .js/.mjs). Auto-detected `src/index.js` is SOURCE and must
+    // be bundled or its imports are dropped (codex P2 r6).
+    if (prebuilt) {
+        try {
+            contents = readFileSync(entryAbs);
+        }
+        catch {
+            return {
+                ok: false,
+                kind: 'build-failed',
+                message: `worker entry not found: ${entry} (resolved ${entryAbs})`,
+                hint: 'run the framework build first, or fix worker.entry in .yolo/deploy.json',
+            };
+        }
+        name = path.basename(entryAbs);
+        source = 'prebuilt';
+    }
+    else {
+        // Lazy-load so non-deploy verbs never pay esbuild's startup cost.
+        const esbuild = await import('esbuild');
+        // Vendor @yolo-labs/flexdb (not yet published) so a customer Worker can
+        // `import { FlexDB } from '@yolo-labs/flexdb'` without installing it.
+        const flexdbPlugin = vendoredFlexdbPlugin();
+        let result;
+        try {
+            result = await esbuild.build({
+                entryPoints: [entryAbs],
+                bundle: true,
+                format: 'esm',
+                platform: 'browser',
+                conditions: ['workerd', 'worker'],
+                target: 'es2022',
+                write: false,
+                minify: true,
+                absWorkingDir: path.resolve(cwd),
+                logLevel: 'silent',
+                plugins: flexdbPlugin ? [flexdbPlugin] : [],
+            });
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            return {
+                ok: false,
+                kind: 'build-failed',
+                message: `esbuild failed for ${entry}: ${msg}`,
+            };
+        }
+        const out = result.outputFiles?.[0];
+        if (out === undefined) {
+            return { ok: false, kind: 'build-failed', message: `esbuild produced no output for ${entry}` };
+        }
+        contents = out.contents;
+        name = 'index.js';
+        source = 'esbuild';
+    }
+    if (contents.byteLength > caps.maxModuleBytes) {
+        return {
+            ok: false,
+            kind: 'bundle-too-large',
+            message: `worker module is ${formatBytes(contents.byteLength)} — limit is ${formatBytes(caps.maxModuleBytes)}`,
+            hint: 'split vendored data out of the module (assets or R2), or trim dependencies',
+        };
+    }
+    const gzipBytes = gzipSync(contents).byteLength;
+    if (gzipBytes > caps.warnModuleGzipBytes) {
+        warnings.push(`worker module is ${formatBytes(gzipBytes)} gzipped (> ${formatBytes(caps.warnModuleGzipBytes)}) — cold starts will suffer`);
+    }
+    return { ok: true, module: { name, contents }, source };
+}
+/**
+ * Depth-first walk returning sorted posix-relative file paths. Skips
+ * dotfiles/dot-dirs and node_modules at every level. Symlinked DIRS are
+ * skipped (cycle safety). Symlinked FILES are included only when their
+ * realpath stays INSIDE the asset root (codex P1 r12) — a
+ * `public/token.txt -> ~/.config/yolo/token` link would otherwise publish a
+ * credential as a public asset.
+ */
+function walkAssetFiles(rootAbs) {
+    // Resolve the root once (it may itself be reached through a symlink) so the
+    // containment check compares real paths on both sides.
+    let rootReal;
+    try {
+        rootReal = realpathSync(rootAbs);
+    }
+    catch {
+        rootReal = rootAbs;
+    }
+    const within = (abs) => {
+        try {
+            const real = realpathSync(abs);
+            return real === rootReal || real.startsWith(rootReal + path.sep);
+        }
+        catch {
+            return false; // dangling / unreadable → don't include
+        }
+    };
+    const files = [];
+    const walk = (relPosix) => {
+        const dirAbs = relPosix === '' ? rootAbs : path.join(rootAbs, ...relPosix.split('/'));
+        const entries = readdirSync(dirAbs, { withFileTypes: true })
+            .filter((e) => !e.name.startsWith('.') && e.name !== 'node_modules')
+            .sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
+        for (const entry of entries) {
+            const childRel = relPosix === '' ? entry.name : `${relPosix}/${entry.name}`;
+            if (entry.isDirectory()) {
+                walk(childRel);
+            }
+            else if (entry.isFile()) {
+                files.push(childRel);
+            }
+            else if (entry.isSymbolicLink()) {
+                // Follow file symlinks ONLY when they resolve to a regular file that
+                // stays under the asset root.
+                const abs = path.join(dirAbs, entry.name);
+                try {
+                    if (statSync(abs).isFile() && within(abs))
+                        files.push(childRel);
+                }
+                catch {
+                    // dangling symlink — skip
+                }
+            }
+        }
+    };
+    walk('');
+    return files;
+}
+/**
+ * Cloudflare Workers-Assets manifest hash (wrangler's scheme, verified against
+ * the CF assets-upload-session API 2026-06-13): `sha256(base64(contents) +
+ * extension-without-dot)` hex-encoded, truncated to 32 chars. CF rejects a
+ * full 64-hex sha256 ("file hash size of 64 is too large", code 10304) and
+ * content-addresses uploaded assets by THIS value — it must match exactly or
+ * the bucket upload / serve fails. The server keeps this value verbatim in the
+ * manifest (it never recomputes asset hashes), so the CLI is canonical here.
+ */
+function cfAssetHash(bytes, manifestPath) {
+    const ext = path.extname(manifestPath).slice(1); // 'html', 'css', '' …
+    return createHash('sha256')
+        .update(Buffer.from(bytes).toString('base64') + ext)
+        .digest('hex')
+        .slice(0, 32);
+}
+function formatBytes(n) {
+    if (n >= 1024 * 1024)
+        return `${(n / (1024 * 1024)).toFixed(1)} MiB`;
+    if (n >= 1024)
+        return `${(n / 1024).toFixed(1)} KiB`;
+    return `${n} B`;
+}
+function definedOnly(obj) {
+    const out = {};
+    for (const [k, v] of Object.entries(obj)) {
+        if (v !== undefined)
+            out[k] = v;
+    }
+    return out;
+}