connectbase-client 6.3.3 → 6.4.0

package/CHANGELOG.md

@@ -3,6 +3,38 @@
 본 SDK 의 모든 주요 변경사항을 [Keep a Changelog](https://keepachangelog.com/ko/1.1.0/) 형식으로 기록합니다.
 버전은 [Semantic Versioning](https://semver.org/lang/ko/) 을 따릅니다.
 
+## [6.4.0] - 2026-10-01
+
+### Added — 웹 배포에 브라우저 ML 모델 확장자 허용 (`.onnx` `.tflite` `.task` `.safetensors`)
+
+onnxruntime-web / TensorFlow Lite / MediaPipe Tasks / transformers.js 가 fetch 로 읽는 모델 파일을
+`deploy` 가 허용목록에 없다는 이유로 빠뜨렸습니다. 배포는 성공으로 끝나는데 사이트에서는 404 였습니다.
+이제 네 확장자 모두 바이너리로 수집되며, 웹 스토리지 파일당 한도(약 6 MB)를 넘는 모델은 다른 대용량
+바이너리와 똑같이 presigned URL 로 오브젝트 스토리지에 직접 올라갑니다. `.bin` 으로 이름을 바꾸는
+우회는 더 이상 필요 없습니다.
+
+### Changed — 허용되지 않는 파일이 있으면 배포 때 알려줍니다
+
+허용되지 않는 확장자의 파일은 여전히 배포에서 제외되지만, 이제 조용히 넘어가지 않습니다. 파일 수집
+직후 제외된 파일 목록(앞 10개 + 외 N개), 확장자별 개수, 허용 확장자 목록을 경고로 보여주고, 배포 성공
+메시지 뒤에도 "N개는 포함되지 않았습니다" 를 한 번 더 찍습니다. 숨김 파일/폴더(`.env`, `.git/` 등)는
+의도적 제외라 목록에 넣지 않습니다. 배포 결과(종료 코드)는 바뀌지 않습니다.
+
+## [6.3.4] - 2026-09-08
+
+### Fixed — deploy 스크립트가 `npx` 로 CLI 를 부르면 6.3.3 의 "스크립트 안" 판정이 빠지던 문제
+
+6.3.3 은 `npm_lifecycle_event` 가 package.json scripts 의 이름이면 스크립트 안으로 봤습니다. 그런데
+`"deploy": "vite build && npx -y -p connectbase-client@latest connectbase deploy ./dist"` 처럼 npx 로
+CLI 를 부르는 스크립트(예전 init 이 만들던 형태)에서는 npx 가 `npm_lifecycle_event` 를 "npx" 로,
+`npm_lifecycle_script` 도 덮어써 `npm run deploy → npx` 와 직접 `npx` 의 환경변수가 완전히 같아집니다.
+그래서 여전히 "deploy 스크립트를 쓰세요" 안내가 그 스크립트 안에서 찍혔습니다.
+
+이제 (1) pnpm 은 npx 가 덮어쓰지 않는 `PNPM_SCRIPT_SRC_DIR` 로, (2) npm / yarn / bun 은 부모 프로세스
+명령줄(Linux `/proc`, macOS `ps`)에서 `<pm> run <스크립트>` 를 찾아 스크립트 안임을 판정합니다.
+`npm-cli.js exec …` 나 스크립트 본문 자체에는 맞지 않는 패턴이라 직접 `npx connectbase-client deploy`
+를 친 경우엔 종전대로 안내합니다. 판정에 실패해도 안내 한 줄이 더 나올 뿐 배포에는 영향이 없습니다.
+
 ## [6.3.3] - 2026-09-08
 
 ### Fixed — `deploy` 가 방금 빌드한 직후에도 "배포 전 빌드를 먼저 실행하세요" 를 찍던 문제

package/README.md

@@ -294,7 +294,9 @@ In CI, read the Secret Key from a repository secret:
 ### Requirements
 
 - `index.html` must exist in the root of the deploy directory
-- Supported file types: `.html`, `.css`, `.js`, `.json`, `.svg`, `.png`, `.jpg`, `.gif`, `.webp`, `.woff`, `.woff2`, `.ttf`, `.mp3`, `.mp4`, `.pdf`, `.wasm`, etc.
+- Supported file types: `.html`, `.css`, `.js`, `.json`, `.svg`, `.png`, `.jpg`, `.gif`, `.webp`, `.woff`, `.woff2`, `.ttf`, `.mp3`, `.mp4`, `.pdf`, `.wasm`, 3D assets (`.glb`, `.gltf`, `.bin`), browser ML models (`.onnx`, `.tflite`, `.task`, `.safetensors`), etc.
+- Files with other extensions are skipped, and `deploy` prints the skipped list as a warning. Hidden files and folders (`.env`, `.git/`) are skipped silently.
+- Binary files over the per-file limit (~6 MB) are uploaded directly to object storage via presigned URLs.
 
 ### SPA Mode
 

package/dist/cli.js

@@ -32,10 +32,13 @@ var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: tru
 var cli_exports = {};
 __export(cli_exports, {
   TunnelConnectSelector: () => TunnelConnectSelector,
+  ancestorCommandLines: () => ancestorCommandLines,
   apiErrorMessage: () => apiErrorMessage,
   buildFirstHint: () => buildFirstHint,
+  collectDeployFiles: () => collectDeployFiles,
   computeDeployDiff: () => computeDeployDiff,
   detectPackageManager: () => detectPackageManager,
+  formatSkippedFilesReport: () => formatSkippedFilesReport,
   getTunnelConnectCandidates: () => getTunnelConnectCandidates,
   guessMimeType: () => guessMimeType,
   isAllowedDeployExt: () => isAllowedDeployExt,
@@ -43,8 +46,10 @@ __export(cli_exports, {
   makeRequest: () => makeRequest,
   normalizeRelativePath: () => normalizeRelativePath,
   packageManagerCommands: () => packageManagerCommands,
+  packageScriptInvocationPattern: () => packageScriptInvocationPattern,
   parseArgs: () => parseArgs,
   registerEndpointBinding: () => registerEndpointBinding,
+  runningInsidePackageScript: () => runningInsidePackageScript,
   sha256Hex: () => sha256Hex,
   storageAdminHeaders: () => storageAdminHeaders
 });
@@ -151,7 +156,7 @@ function handleTunnelError(msg, appId, localPort) {
 }
 
 // src/cli.ts
-var VERSION = "6.3.3" ? "6.3.3" : getPackageVersion();
+var VERSION = "6.4.0" ? "6.4.0" : getPackageVersion();
 var DEFAULT_BASE_URL = "https://api.connectbase.world";
 var colors = {
   reset: "\x1B[0m",
@@ -212,7 +217,17 @@ var ALLOWED_EXTENSIONS = /* @__PURE__ */ new Set([
   // 3D 에셋: .glb/.bin 은 바이너리, .gltf 는 JSON(텍스트)
   ".glb",
   ".gltf",
-  ".bin"
+  ".bin",
+  // 브라우저 추론용 ML 모델 (platform-issue 01a0f660). 전부 바이너리다.
+  //   .onnx        — onnxruntime-web
+  //   .tflite      — TensorFlow Lite (tfjs-tflite 등)
+  //   .task        — MediaPipe Tasks 번들
+  //   .safetensors — transformers.js 등의 가중치
+  // 수 MB~수십 MB 가 흔하므로 BINARY_EXTENSIONS 에도 넣어 대용량 오프로드(presign) 대상으로 만든다.
+  ".onnx",
+  ".tflite",
+  ".task",
+  ".safetensors"
 ]);
 var ALLOWED_EXTENSIONLESS_FILES = /* @__PURE__ */ new Set(["_redirects", "_headers"]);
 var BINARY_EXTENSIONS = /* @__PURE__ */ new Set([
@@ -237,7 +252,11 @@ var BINARY_EXTENSIONS = /* @__PURE__ */ new Set([
   ".zip",
   ".wasm",
   ".glb",
-  ".bin"
+  ".bin",
+  ".onnx",
+  ".tflite",
+  ".task",
+  ".safetensors"
 ]);
 var MIME_BY_EXT = {
   ".png": "image/png",
@@ -263,7 +282,13 @@ var MIME_BY_EXT = {
   ".wasm": "application/wasm",
   ".glb": "model/gltf-binary",
   ".gltf": "model/gltf+json",
-  ".bin": "application/octet-stream"
+  ".bin": "application/octet-stream",
+  // ML 모델은 등록된 표준 MIME 이 없다. 로더(onnxruntime-web/MediaPipe/transformers.js)는
+  // fetch → ArrayBuffer 로 읽으므로 octet-stream 이면 충분하다.
+  ".onnx": "application/octet-stream",
+  ".tflite": "application/octet-stream",
+  ".task": "application/octet-stream",
+  ".safetensors": "application/octet-stream"
 };
 function guessMimeType(filePath) {
   if (ALLOWED_EXTENSIONLESS_FILES.has(path2.basename(filePath))) {
@@ -346,7 +371,13 @@ function loadConfig() {
   }
   return config;
 }
-function collectFiles(dir, baseDir = dir) {
+function collectDeployFiles(dir) {
+  const skipped = [];
+  const files = collectFiles(dir, dir, skipped);
+  skipped.sort();
+  return { files, skipped };
+}
+function collectFiles(dir, baseDir, skipped) {
   const files = [];
   const entries = fs2.readdirSync(dir, { withFileTypes: true });
   for (const entry of entries) {
@@ -354,14 +385,15 @@ function collectFiles(dir, baseDir = dir) {
     const relativePath = path2.relative(baseDir, fullPath);
     if (entry.isDirectory()) {
       if (!entry.name.startsWith(".")) {
-        files.push(...collectFiles(fullPath, baseDir));
+        files.push(...collectFiles(fullPath, baseDir, skipped));
       }
     } else if (entry.isFile()) {
       const ext = path2.extname(entry.name).toLowerCase();
-      if (!isAllowedDeployExt(entry.name)) {
+      if (entry.name.startsWith(".")) {
         continue;
       }
-      if (entry.name.startsWith(".")) {
+      if (!isAllowedDeployExt(entry.name)) {
+        skipped.push(normalizeRelativePath(relativePath));
         continue;
       }
       const isBinary = BINARY_EXTENSIONS.has(ext);
@@ -382,6 +414,44 @@ function collectFiles(dir, baseDir = dir) {
   }
   return files;
 }
+var SKIPPED_FILES_LIST_LIMIT = 10;
+function formatSkippedFilesReport(skipped, limit = SKIPPED_FILES_LIST_LIMIT) {
+  if (skipped.length === 0) return [];
+  const lines = [];
+  lines.push(
+    `\uD5C8\uC6A9\uB418\uC9C0 \uC54A\uB294 \uD655\uC7A5\uC790\uB77C \uBC30\uD3EC\uC5D0\uC11C \uC81C\uC678\uB41C \uD30C\uC77C ${skipped.length}\uAC1C \u2014 \uC0AC\uC774\uD2B8\uC5D0\uC11C 404 \uAC00 \uB429\uB2C8\uB2E4:`
+  );
+  for (const p of skipped.slice(0, limit)) lines.push(`  \u2022 ${p}`);
+  if (skipped.length > limit) {
+    lines.push(`  \u2026 \uC678 ${skipped.length - limit}\uAC1C`);
+  }
+  const byExt = /* @__PURE__ */ new Map();
+  for (const p of skipped) {
+    const ext = path2.extname(p).toLowerCase() || "(\uD655\uC7A5\uC790 \uC5C6\uC74C)";
+    byExt.set(ext, (byExt.get(ext) ?? 0) + 1);
+  }
+  const extSummary = [...byExt.entries()].sort((a, b) => b[1] - a[1] || a[0].localeCompare(b[0])).map(([ext, n]) => `${ext} ${n}\uAC1C`).join(", ");
+  lines.push(`  \uD655\uC7A5\uC790\uBCC4: ${extSummary}`);
+  lines.push(
+    `  \uD5C8\uC6A9 \uD655\uC7A5\uC790: ${[...ALLOWED_EXTENSIONS].join(" ")} (+ \uD655\uC7A5\uC790 \uC5C6\uB294 ${[...ALLOWED_EXTENSIONLESS_FILES].join(", ")})`
+  );
+  lines.push(
+    "  \uD544\uC694\uD55C \uD30C\uC77C\uC774\uBA74 \uD5C8\uC6A9 \uD655\uC7A5\uC790\uB85C \uBC14\uAFB8\uAC70\uB098, \uD30C\uC77C \uC2A4\uD1A0\uB9AC\uC9C0(cb.storage)\uC5D0 \uC62C\uB824 URL \uB85C \uCC38\uC870\uD558\uC138\uC694."
+  );
+  return lines;
+}
+function reportSkippedFiles(skipped) {
+  const lines = formatSkippedFilesReport(skipped);
+  if (lines.length === 0) return;
+  warn(`${colors.yellow}${lines[0]}${colors.reset}`);
+  for (const line of lines.slice(1)) log(line);
+}
+function remindSkippedFiles(skipped) {
+  if (skipped.length === 0) return;
+  warn(
+    `\uB2E8, \uD5C8\uC6A9\uB418\uC9C0 \uC54A\uB294 \uD655\uC7A5\uC790 \uD30C\uC77C ${skipped.length}\uAC1C\uB294 \uBC30\uD3EC\uC5D0 \uD3EC\uD568\uB418\uC9C0 \uC54A\uC558\uC2B5\uB2C8\uB2E4 (\uC704 \uBAA9\uB85D \uCC38\uACE0).`
+  );
+}
 function formatSize(bytes) {
   if (bytes >= 1024 * 1024) return `${(bytes / 1024 / 1024).toFixed(1)} MB`;
   return `${(bytes / 1024).toFixed(1)} KB`;
@@ -680,7 +750,8 @@ async function deploy(directory, config, isDev = false, deployOpts = {}) {
     try {
       const pkg = JSON.parse(fs2.readFileSync(pkgPath, "utf-8"));
       const pm = packageManagerCommands(detectPackageManager(process.cwd()));
-      for (const line of buildFirstHint(pkg, pm)) warn(line);
+      const inside = runningInsidePackageScript(pkg.scripts ?? {});
+      for (const line of buildFirstHint(pkg, pm, inside)) warn(line);
     } catch {
     }
   }
@@ -695,17 +766,19 @@ async function deploy(directory, config, isDev = false, deployOpts = {}) {
   }
   info(`\uBC30\uD3EC \uC900\uBE44 \uC911... ${dir}`);
   process.stdout.write(`${colors.dim}\uD30C\uC77C \uC218\uC9D1 \uC911...${colors.reset}`);
-  const files = collectFiles(dir);
+  const { files, skipped } = collectDeployFiles(dir);
   process.stdout.write(`\r${colors.dim}                    \r${colors.reset}`);
   if (files.length === 0) {
+    reportSkippedFiles(skipped);
     error("\uBC30\uD3EC\uD560 \uD30C\uC77C\uC774 \uC5C6\uC2B5\uB2C8\uB2E4");
     process.exit(1);
   }
   const totalSize = files.reduce((sum, f) => sum + f.content.length, 0);
   const sizeKB = (totalSize / 1024).toFixed(1);
   log(
-    `${colors.green}\u2713${colors.reset} ${files.length}\uAC1C \uD30C\uC77C \uBC1C\uACAC (${sizeKB} KB)`
+    `${colors.green}\u2713${colors.reset} ${files.length}\uAC1C \uD30C\uC77C \uBC1C\uACAC (${sizeKB} KB)${skipped.length > 0 ? ` ${colors.yellow}\u2014 ${skipped.length}\uAC1C \uC81C\uC678${colors.reset}` : ""}`
   );
+  reportSkippedFiles(skipped);
   const target = isDev ? "qa" : void 0;
   const envLabel = isDev ? "QA" : "Prod";
   if (isDev) {
@@ -732,6 +805,7 @@ async function deploy(directory, config, isDev = false, deployOpts = {}) {
         timeoutMs,
         target
       );
+      remindSkippedFiles(skipped);
       return;
     }
     const diff = computeDeployDiff(files, manifest);
@@ -750,6 +824,7 @@ ${colors.cyan}URL: https://${config.storageId}.web.connectbase.world${colors.res
 `
         );
       }
+      remindSkippedFiles(skipped);
       return;
     }
     await offloadLargeBinaries(
@@ -773,6 +848,7 @@ ${colors.cyan}URL: https://${config.storageId}.web.connectbase.world${colors.res
       timeoutMs,
       target
     );
+    remindSkippedFiles(skipped);
   } catch (err) {
     process.stdout.write("\r                    \r");
     error(`\uB124\uD2B8\uC6CC\uD06C \uC624\uB958: ${err instanceof Error ? err.message : err}`);
@@ -1642,12 +1718,63 @@ ${entry}
     success(".gitignore \uC0DD\uC131 \uC644\uB8CC");
   }
 }
-function buildFirstHint(pkg, pm, lifecycleEvent = process.env.npm_lifecycle_event) {
+function runningInsidePackageScript(scripts, env = process.env, ancestors = ancestorCommandLines) {
+  const names = Object.keys(scripts);
+  if (names.length === 0) return false;
+  if (env.npm_lifecycle_event && names.includes(env.npm_lifecycle_event)) {
+    return true;
+  }
+  if (env.PNPM_SCRIPT_SRC_DIR) return true;
+  if (env.npm_lifecycle_event !== "npx") return false;
+  const pattern = packageScriptInvocationPattern(names);
+  return ancestors().some((cmd) => pattern.test(cmd));
+}
+function packageScriptInvocationPattern(names) {
+  const alt = names.map((n) => n.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")).join("|");
+  return new RegExp(
+    `^(?:\\S*node(?:\\.exe)?\\s+)?\\S*(?:npm(?:-cli)?|pnpm|yarn|bun)(?:\\.c?js)?\\s+(?:run(?:-script)?\\s+)?(?:-\\S+\\s+)*(?:${alt})(?:\\s|$)`
+  );
+}
+function ancestorCommandLines(maxDepth = 8) {
+  const lines = [];
+  let pid = process.ppid;
+  for (let i = 0; i < maxDepth && pid > 1; i++) {
+    let cmd = "";
+    let ppid = 0;
+    try {
+      if (process.platform === "linux") {
+        cmd = fs2.readFileSync(`/proc/${pid}/cmdline`).toString("utf8").replace(/\0/g, " ").trim();
+        const stat = fs2.readFileSync(`/proc/${pid}/stat`, "utf8");
+        ppid = parseInt(
+          stat.slice(stat.lastIndexOf(")") + 2).split(" ")[1],
+          10
+        );
+      } else if (process.platform === "darwin") {
+        const { execSync } = require("child_process");
+        const out = execSync(`ps -o ppid=,args= -p ${pid}`, {
+          encoding: "utf-8",
+          stdio: ["ignore", "pipe", "ignore"]
+        }).trim();
+        const m = out.match(/^\s*(\d+)\s+(.*)$/);
+        if (!m) break;
+        ppid = parseInt(m[1], 10);
+        cmd = m[2];
+      } else {
+        break;
+      }
+    } catch {
+      break;
+    }
+    lines.push(cmd);
+    if (!Number.isFinite(ppid)) break;
+    pid = ppid;
+  }
+  return lines;
+}
+function buildFirstHint(pkg, pm, insideScript) {
   const scripts = pkg?.scripts ?? {};
   if (!scripts.build) return [];
-  if (lifecycleEvent && Object.keys(scripts).includes(lifecycleEvent)) {
-    return [];
-  }
+  if (insideScript) return [];
   if (typeof scripts.deploy === "string" && scripts.deploy.includes("build")) {
     return [
       `\uBE4C\uB4DC\uAE4C\uC9C0 \uD55C \uBC88\uC5D0 \uD558\uB824\uBA74 deploy \uC2A4\uD06C\uB9BD\uD2B8\uB97C \uC4F0\uC138\uC694: ${pm.run("deploy")}`
@@ -3822,10 +3949,13 @@ main().catch((err) => {
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   TunnelConnectSelector,
+  ancestorCommandLines,
   apiErrorMessage,
   buildFirstHint,
+  collectDeployFiles,
   computeDeployDiff,
   detectPackageManager,
+  formatSkippedFilesReport,
   getTunnelConnectCandidates,
   guessMimeType,
   isAllowedDeployExt,
@@ -3833,8 +3963,10 @@ main().catch((err) => {
   makeRequest,
   normalizeRelativePath,
   packageManagerCommands,
+  packageScriptInvocationPattern,
   parseArgs,
   registerEndpointBinding,
+  runningInsidePackageScript,
   sha256Hex,
   storageAdminHeaders
 });

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "connectbase-client",
-	"version": "6.3.3",
+	"version": "6.4.0",
 	"description": "Connect Base JavaScript/TypeScript SDK for browser and Node.js",
 	"repository": {
 		"type": "git",