deepspace 0.2.8 → 0.3.3

package/dist/cli.js

@@ -75,12 +75,127 @@ async function mintAppOwnerJwt(authUrl, callerJwt, appName) {
   }
   return body.token;
 }
+var SDK_MANAGED_KEYS = /* @__PURE__ */ new Set([
+  "AUTH_JWT_PUBLIC_KEY",
+  "AUTH_JWT_ISSUER",
+  "AUTH_WORKER_URL",
+  "API_WORKER_URL",
+  "PLATFORM_WORKER_URL",
+  "OWNER_USER_ID",
+  "APP_OWNER_JWT",
+  "INTERNAL_STORAGE_HMAC_SECRET",
+  "ALLOW_DEBUG_ROUTES"
+]);
+var DEV_VARS_DIVIDER = "# --- not managed by the SDK; preserved across dev/test runs ---";
+function extractCustomDevVars(content) {
+  const lines = content.split("\n");
+  const out = [];
+  let i = 0;
+  while (i < lines.length) {
+    const line = lines[i];
+    if (line.trim() === DEV_VARS_DIVIDER.trim()) {
+      i++;
+      continue;
+    }
+    const eq = line.indexOf("=");
+    const keyMatch = eq >= 0 ? line.slice(0, eq).match(/^\s*([A-Za-z_][A-Za-z0-9_]*)\s*$/) : null;
+    if (!keyMatch) {
+      out.push(line);
+      i++;
+      continue;
+    }
+    const key = keyMatch[1];
+    const valStart = line.slice(eq + 1);
+    const block = [line];
+    if (valStart.startsWith('"') && !hasUnescapedQuote(valStart.slice(1))) {
+      i++;
+      while (i < lines.length) {
+        block.push(lines[i]);
+        const closed = hasUnescapedQuote(lines[i]);
+        i++;
+        if (closed) break;
+      }
+    } else {
+      i++;
+    }
+    if (!SDK_MANAGED_KEYS.has(key)) {
+      out.push(...block);
+    }
+  }
+  while (out.length && out[out.length - 1].trim() === "") out.pop();
+  return out.join("\n");
+}
+function hasUnescapedQuote(s) {
+  let escaped = false;
+  for (const ch of s) {
+    if (escaped) {
+      escaped = false;
+      continue;
+    }
+    if (ch === "\\") {
+      escaped = true;
+      continue;
+    }
+    if (ch === '"') return true;
+  }
+  return false;
+}
+function parseDevVars(content) {
+  const result = {};
+  const lines = content.split("\n");
+  let i = 0;
+  while (i < lines.length) {
+    const line = lines[i];
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#")) {
+      i++;
+      continue;
+    }
+    const eq = line.indexOf("=");
+    if (eq < 0) {
+      i++;
+      continue;
+    }
+    const keyMatch = line.slice(0, eq).match(/^\s*([A-Za-z_][A-Za-z0-9_]*)\s*$/);
+    if (!keyMatch) {
+      i++;
+      continue;
+    }
+    const key = keyMatch[1];
+    let value = line.slice(eq + 1);
+    let closed = !value.startsWith('"') || hasUnescapedQuote(value.slice(1));
+    if (!closed) {
+      i++;
+      while (i < lines.length) {
+        value += "\n" + lines[i];
+        if (hasUnescapedQuote(lines[i])) {
+          closed = true;
+          i++;
+          break;
+        }
+        i++;
+      }
+    } else {
+      i++;
+    }
+    if (value.startsWith('"') && !closed) {
+      throw new Error(
+        `parseDevVars: unterminated quoted value for key "${key}" \u2014 check your .dev.vars file for a missing closing quote.`
+      );
+    }
+    if (value.startsWith('"') && value.endsWith('"') && value.length >= 2) {
+      value = value.slice(1, -1).replace(/\\"/g, '"');
+    }
+    result[key] = value;
+  }
+  return result;
+}
 async function writeDevVars(appDir, env, ownerId, callerJwt) {
   const urls = ENVS[env];
   const publicKey = await fetchPublicKey(urls.auth);
   const appName = readAppName(appDir);
   const appOwnerJwt = await mintAppOwnerJwt(urls.auth, callerJwt, appName);
-  const devVars = [
+  const sdkVars = [
     `AUTH_JWT_PUBLIC_KEY="${publicKey}"`,
     `AUTH_JWT_ISSUER=${urls.auth}/api/auth`,
     `AUTH_WORKER_URL=${urls.auth}`,
@@ -93,7 +208,16 @@ async function writeDevVars(appDir, env, ownerId, callerJwt) {
     // Production secrets never set this, so deployed apps 404 the route.
     `ALLOW_DEBUG_ROUTES=true`
   ].join("\n");
-  writeFileSync(join(appDir, ".dev.vars"), devVars + "\n");
+  const devVarsPath = join(appDir, ".dev.vars");
+  const existing = existsSync(devVarsPath) ? readFileSync(devVarsPath, "utf-8") : "";
+  const custom = extractCustomDevVars(existing);
+  const body = custom ? `${sdkVars}
+
+${DEV_VARS_DIVIDER}
+${custom}
+` : `${sdkVars}
+`;
+  writeFileSync(devVarsPath, body);
 }
 
 // src/cli/session.ts
@@ -976,6 +1100,264 @@ import { readFileSync as readFileSync5, readdirSync, existsSync as existsSync7 }
 import { parse as parseToml2 } from "smol-toml";
 import { join as join8, resolve as resolve3, dirname } from "path";
 import * as p3 from "@clack/prompts";
+
+// src/server/rooms/binding-manifest.ts
+var AUTO_PROVISION_SENTINEL = "auto";
+var VECTORIZE_METRICS = /* @__PURE__ */ new Set(["cosine", "euclidean", "dot-product"]);
+var ALLOWED_BINDING_TYPES = /* @__PURE__ */ new Set([
+  "vectorize",
+  "ai",
+  "r2_bucket",
+  "kv_namespace",
+  "d1",
+  "queue",
+  "browser_rendering",
+  "analytics_engine",
+  "hyperdrive"
+]);
+var RESERVED_BINDING_NAMES = /* @__PURE__ */ new Set([
+  "ASSETS",
+  "PLATFORM_WORKER",
+  "API_WORKER",
+  "APP_NAME",
+  "OWNER_USER_ID",
+  "AUTH_JWT_PUBLIC_KEY",
+  "AUTH_JWT_ISSUER",
+  "AUTH_WORKER_URL",
+  "APP_IDENTITY_TOKEN",
+  "APP_OWNER_JWT",
+  "INTERNAL_STORAGE_HMAC_SECRET",
+  "USAGE_EVENTS"
+]);
+function validateBindingManifest(manifest) {
+  if (!Array.isArray(manifest)) {
+    return { valid: false, errors: [{ reason: "Manifest must be an array" }] };
+  }
+  const errors = [];
+  const seenNames = /* @__PURE__ */ new Set();
+  for (const entry of manifest) {
+    if (!entry || typeof entry !== "object") {
+      errors.push({ reason: `Entry must be an object (got ${entry === null ? "null" : typeof entry})` });
+      continue;
+    }
+    const e = entry;
+    const type = e.type;
+    const name = e.name;
+    if (typeof type !== "string" || !ALLOWED_BINDING_TYPES.has(type)) {
+      errors.push({
+        reason: `Disallowed binding type: ${typeof type === "string" ? type : `(${typeof type})`}. Allowed: ${[...ALLOWED_BINDING_TYPES].sort().join(", ")}`
+      });
+      continue;
+    }
+    if (typeof name !== "string" || !name) {
+      errors.push({ reason: `Binding of type "${type}" missing 'name' (string)` });
+      continue;
+    }
+    if (RESERVED_BINDING_NAMES.has(name)) {
+      errors.push({ reason: `Binding name "${name}" is reserved by the SDK` });
+      continue;
+    }
+    if (seenNames.has(name)) {
+      errors.push({ reason: `Duplicate binding name "${name}"` });
+      continue;
+    }
+    seenNames.add(name);
+    const binding = entry;
+    const fieldErr = requiredFieldError(binding);
+    if (fieldErr) errors.push({ binding, reason: fieldErr });
+  }
+  if (errors.length) return { valid: false, errors };
+  return { valid: true, bindings: manifest };
+}
+function requiredFieldError(b) {
+  switch (b.type) {
+    case "vectorize": {
+      if (!b.index_name) return `vectorize binding "${b.name}" missing index_name (or "auto")`;
+      if (b.index_name === AUTO_PROVISION_SENTINEL) {
+        if (typeof b.dimensions !== "number" || b.dimensions <= 0) {
+          return `vectorize binding "${b.name}" with index_name="auto" requires "dimensions" (positive number)`;
+        }
+        if (!b.metric || !VECTORIZE_METRICS.has(b.metric)) {
+          return `vectorize binding "${b.name}" with index_name="auto" requires "metric" (one of: ${[...VECTORIZE_METRICS].join(", ")})`;
+        }
+      }
+      return null;
+    }
+    case "r2_bucket":
+      return b.bucket_name ? null : `r2_bucket binding "${b.name}" missing bucket_name (or "auto")`;
+    case "kv_namespace": {
+      if (!b.namespace_id) return `kv_namespace binding "${b.name}" missing namespace_id (or "auto")`;
+      if (b.namespace_id === AUTO_PROVISION_SENTINEL && !b.title) {
+        return `kv_namespace binding "${b.name}" with namespace_id="auto" requires "title"`;
+      }
+      return null;
+    }
+    case "d1": {
+      if (!b.id) return `d1 binding "${b.name}" missing id (or "auto")`;
+      if (b.id === AUTO_PROVISION_SENTINEL && !b.database_name) {
+        return `d1 binding "${b.name}" with id="auto" requires "database_name"`;
+      }
+      return null;
+    }
+    case "queue":
+      return b.queue_name ? null : `queue binding "${b.name}" missing queue_name (or "auto")`;
+    case "hyperdrive":
+      if (!b.id) return `hyperdrive binding "${b.name}" missing id`;
+      if (b.id === AUTO_PROVISION_SENTINEL) {
+        return `hyperdrive binding "${b.name}": auto-provisioning not yet supported (provide a real id)`;
+      }
+      return null;
+    case "ai":
+    case "browser_rendering":
+    case "analytics_engine":
+      return null;
+    // no required fields beyond `name`
+    default: {
+      const _exhaustive = b;
+      void _exhaustive;
+      return null;
+    }
+  }
+}
+function bindingManifestFromOutputConfig(outputConfig) {
+  const out = [];
+  const aiBinding = pluckString(outputConfig.ai, "binding");
+  if (aiBinding) out.push({ type: "ai", name: aiBinding });
+  for (const v of asObjectArray(outputConfig.vectorize)) {
+    const name = pluckString(v, "binding");
+    const index_name = pluckString(v, "index_name");
+    if (!name || !index_name) continue;
+    const dimensions = pluckNumber(v, "dimensions");
+    const metric = pluckString(v, "metric");
+    out.push({
+      type: "vectorize",
+      name,
+      index_name,
+      ...dimensions != null && { dimensions },
+      ...metric && (metric === "cosine" || metric === "euclidean" || metric === "dot-product") && { metric }
+    });
+  }
+  for (const r of asObjectArray(outputConfig.r2_buckets)) {
+    const name = pluckString(r, "binding");
+    const bucket_name = pluckString(r, "bucket_name");
+    if (name && bucket_name) out.push({ type: "r2_bucket", name, bucket_name });
+  }
+  for (const k of asObjectArray(outputConfig.kv_namespaces)) {
+    const name = pluckString(k, "binding");
+    const namespace_id = pluckString(k, "id");
+    if (!name || !namespace_id) continue;
+    const title = pluckString(k, "title");
+    out.push({
+      type: "kv_namespace",
+      name,
+      namespace_id,
+      ...title && { title }
+    });
+  }
+  for (const d of asObjectArray(outputConfig.d1_databases)) {
+    const name = pluckString(d, "binding");
+    const id = pluckString(d, "database_id");
+    if (!name || !id) continue;
+    const database_name = pluckString(d, "database_name");
+    out.push({
+      type: "d1",
+      name,
+      id,
+      ...database_name && { database_name }
+    });
+  }
+  const queues = isObject(outputConfig.queues) ? outputConfig.queues : null;
+  for (const q of asObjectArray(queues?.producers)) {
+    const name = pluckString(q, "binding");
+    const queue_name = pluckString(q, "queue");
+    if (name && queue_name) out.push({ type: "queue", name, queue_name });
+  }
+  const browserBinding = pluckString(outputConfig.browser, "binding");
+  if (browserBinding) out.push({ type: "browser_rendering", name: browserBinding });
+  for (const a of asObjectArray(outputConfig.analytics_engine_datasets)) {
+    const name = pluckString(a, "binding");
+    const dataset = pluckString(a, "dataset");
+    if (name) out.push({ type: "analytics_engine", name, dataset: dataset ?? void 0 });
+  }
+  for (const h of asObjectArray(outputConfig.hyperdrive)) {
+    const name = pluckString(h, "binding");
+    const id = pluckString(h, "id");
+    if (name && id) out.push({ type: "hyperdrive", name, id });
+  }
+  return out;
+}
+function isObject(v) {
+  return v !== null && typeof v === "object" && !Array.isArray(v);
+}
+function pluckString(v, key) {
+  if (!isObject(v)) return null;
+  const val = v[key];
+  return typeof val === "string" && val.length > 0 ? val : null;
+}
+function pluckNumber(v, key) {
+  if (!isObject(v)) return null;
+  const val = v[key];
+  return typeof val === "number" && Number.isFinite(val) ? val : null;
+}
+function asObjectArray(v) {
+  if (!Array.isArray(v)) return [];
+  return v.filter(isObject);
+}
+
+// src/server/rooms/app-name.ts
+var APP_NAME_RULES = {
+  /** ^[a-z0-9](-?[a-z0-9])+$ — RFC 1035 host label, no consecutive dashes. */
+  pattern: /^[a-z0-9](?:-?[a-z0-9])+$/,
+  minLength: 2,
+  maxLength: 63
+};
+function validateAppName(raw) {
+  if (typeof raw !== "string") {
+    return { valid: false, reason: "App name must be a string" };
+  }
+  const name = raw.trim();
+  if (!name) {
+    return { valid: false, reason: "App name is required" };
+  }
+  if (name.length < APP_NAME_RULES.minLength) {
+    return { valid: false, reason: `App name "${name}" is too short (min ${APP_NAME_RULES.minLength} chars)` };
+  }
+  if (name.length > APP_NAME_RULES.maxLength) {
+    return { valid: false, reason: `App name "${name}" is too long (max ${APP_NAME_RULES.maxLength} chars)` };
+  }
+  if (!APP_NAME_RULES.pattern.test(name)) {
+    return {
+      valid: false,
+      reason: `App name "${name}" is invalid. Use lowercase letters, digits, and single hyphens only (must start + end with alphanumeric). Examples: my-app, search-v2, unison-search.`
+    };
+  }
+  return { valid: true, name };
+}
+function resolveAppName(raw) {
+  const strict = validateAppName(raw);
+  if (strict.valid) return { ok: true, name: strict.name };
+  if (typeof raw !== "string") return { ok: false, reason: strict.reason };
+  const trimmed = raw.trim();
+  if (!trimmed) return { ok: false, reason: "App name is required" };
+  const sanitized = sanitizeAppName(trimmed);
+  const sanitizedStrict = validateAppName(sanitized);
+  if (!sanitizedStrict.valid) {
+    return {
+      ok: false,
+      reason: `App name "${trimmed}" can't be sanitized into a valid name (${sanitizedStrict.reason}). Pick something matching: lowercase letters, digits, single hyphens, ${APP_NAME_RULES.minLength}-${APP_NAME_RULES.maxLength} chars.`
+    };
+  }
+  return {
+    ok: true,
+    name: sanitized,
+    warning: `App name "${trimmed}" doesn't conform to deploy rules \u2014 using "${sanitized}" instead. Update wrangler.toml's \`name\` to silence this warning.`
+  };
+}
+function sanitizeAppName(raw) {
+  return raw.toLowerCase().replace(/[^a-z0-9-]/g, "-").replace(/-{2,}/g, "-").replace(/^-+|-+$/g, "");
+}
+
+// src/cli/commands/deploy.ts
 var DEPLOY_URL = process.env.DEEPSPACE_DEPLOY_URL ?? ENVS.prod.deploy;
 var deploy_default = defineCommand7({
   meta: {
@@ -998,11 +1380,13 @@ var deploy_default = defineCommand7({
       process.exit(1);
     }
     const wranglerConfig = parseToml2(readFileSync5(wranglerPath, "utf-8"));
-    const appName = wranglerConfig.name;
-    if (!appName) {
-      p3.cancel("Could not find app name in wrangler.toml");
+    const nameRes = resolveAppName(wranglerConfig.name);
+    if (!nameRes.ok) {
+      p3.cancel(`wrangler.toml: ${nameRes.reason}`);
       process.exit(1);
     }
+    if (nameRes.warning) p3.log.warn(nameRes.warning);
+    const appName = nameRes.name;
     p3.log.info(`App: ${appName}`);
     let token;
     try {
@@ -1060,6 +1444,55 @@ var deploy_default = defineCommand7({
     if (doManifest?.length) {
       p3.log.info(`DO manifest: ${doManifest.length} binding(s)`);
     }
+    const customBindings = bindingManifestFromOutputConfig(outputConfig);
+    const validation = validateBindingManifest(customBindings);
+    if (!validation.valid) {
+      p3.cancel(
+        `Invalid binding(s) in wrangler.toml:
+` + validation.errors.map((e) => `  \u2022 ${e.reason}`).join("\n")
+      );
+      process.exit(1);
+    }
+    if (customBindings.length) {
+      p3.log.info(
+        `Custom bindings: ${customBindings.map((b) => `${b.name} (${b.type})`).join(", ")}`
+      );
+    }
+    const devVarsPath = join8(appDir, ".dev.vars");
+    let userSecrets = {};
+    if (existsSync7(devVarsPath)) {
+      const customSection = extractCustomDevVars(readFileSync5(devVarsPath, "utf-8"));
+      if (customSection) {
+        try {
+          userSecrets = parseDevVars(customSection);
+        } catch (err) {
+          p3.cancel(`.dev.vars: ${err.message}`);
+          process.exit(1);
+        }
+      }
+    }
+    const userSecretNames = Object.keys(userSecrets);
+    const declaredBindingNames = /* @__PURE__ */ new Set([
+      ...customBindings.map((b) => b.name),
+      ...(doManifest ?? []).map((d) => d.binding)
+    ]);
+    for (const name of userSecretNames) {
+      if (RESERVED_BINDING_NAMES.has(name)) {
+        p3.cancel(
+          `.dev.vars: "${name}" is a reserved binding name and cannot be used as an app secret.`
+        );
+        process.exit(1);
+      }
+      if (declaredBindingNames.has(name)) {
+        p3.cancel(
+          `.dev.vars: "${name}" collides with a binding declared in wrangler.toml \u2014 rename one or the other.`
+        );
+        process.exit(1);
+      }
+    }
+    if (userSecretNames.length) {
+      p3.log.info(`App secrets (from .dev.vars): ${userSecretNames.join(", ")}`);
+    }
     s.start(`Deploying to ${appName}.app.space...`);
     const form = new FormData();
     form.append("worker", new Blob([workerJs], { type: "application/javascript" }), "worker.js");
@@ -1067,6 +1500,12 @@ var deploy_default = defineCommand7({
     if (doManifest) {
       form.append("doManifest", JSON.stringify(doManifest));
     }
+    if (customBindings.length) {
+      form.append("bindingManifest", JSON.stringify(customBindings));
+    }
+    if (userSecretNames.length) {
+      form.append("userSecrets", JSON.stringify(userSecrets));
+    }
     const res = await fetch(`${DEPLOY_URL}/api/deploy/${appName}`, {
       method: "POST",
       headers: { Authorization: `Bearer ${token}` },
@@ -1078,11 +1517,40 @@ var deploy_default = defineCommand7({
       p3.cancel(body.error ?? `Deployment error (${res.status})`);
       process.exit(1);
     }
+    if (body.url) {
+      s.message("Waiting for edge propagation...");
+      const ok = await waitForAssetsReady(body.url, 9e4);
+      if (!ok) {
+        s.stop("Deployed (edge propagation still in progress after 90s)");
+        p3.log.warn("First requests may briefly hit the assets transitional page; retry in a minute.");
+        p3.log.success(`Live at: ${body.url}`);
+        p3.outro("Done");
+        return;
+      }
+    }
     s.stop("Deployed!");
     p3.log.success(`Live at: ${body.url}`);
     p3.outro("Done");
   }
 });
+async function waitForAssetsReady(url, timeoutMs) {
+  const deadline = Date.now() + timeoutMs;
+  let attempt = 0;
+  while (Date.now() < deadline) {
+    attempt++;
+    try {
+      const res = await fetch(url, { redirect: "manual" });
+      const body = await res.text();
+      if (!body.includes("Assets have not yet deployed")) {
+        return true;
+      }
+    } catch {
+    }
+    const wait2 = Math.min(8e3, 1e3 * 2 ** (attempt - 1));
+    await new Promise((r) => setTimeout(r, wait2));
+  }
+  return false;
+}
 function collectAssets(dir) {
   const assets = [];
   function walk(d, prefix) {