lopata 0.20.0 → 0.20.1

package/dist/types/vite-plugin/dev-server-plugin.d.ts

@@ -28,4 +28,12 @@ interface DevServerPluginOptions {
  * via link:), so dynamic imports here run through Bun's native loader.
  */
 export declare function devServerPlugin(options: DevServerPluginOptions): Plugin;
+/**
+ * Convert Response headers to a node writeHead record. `set-cookie` must go
+ * through `getSetCookie()`: Headers iteration yields it once per cookie (and a
+ * keyed record would keep only the last one), so a multi-cookie response —
+ * e.g. better-auth's session_token + session_data — would silently lose
+ * cookies. Exported for tests.
+ */
+export declare function buildNodeHeaders(response: Response): Record<string, string | string[]>;
 export {};

package/dist/types/worker-thread/executor.d.ts

@@ -24,6 +24,8 @@ export interface WorkerThreadExecutorOptions {
         executablePath?: string;
         headless?: boolean;
     };
+    /** Base URL for the Artifacts git remote (main's `/__artifacts/git` endpoint). */
+    artifactsBaseUrl?: string;
     /** Main-thread env holding the stateful binding instances the worker calls into via RPC. */
     mainEnv: Record<string, unknown>;
 }

package/dist/types/worker-thread/protocol.d.ts

@@ -92,6 +92,8 @@ export interface WorkerInitConfig {
         executablePath?: string;
         headless?: boolean;
     };
+    /** Base URL for the Artifacts git remote (main's `/__artifacts/git` endpoint). */
+    artifactsBaseUrl?: string;
 }
 /** Names of the worker handlers we know how to invoke via RPC. */
 export type WorkerHandlerName = 'fetch' | 'scheduled' | 'email' | 'queue';

package/dist/types/worker-thread/thread-env.d.ts

@@ -26,6 +26,8 @@ export interface ThreadEnvOptions {
         executablePath?: string;
         headless?: boolean;
     };
+    /** Base URL for the Artifacts git remote (main's `/__artifacts/git` endpoint). */
+    artifactsBaseUrl?: string;
 }
 export interface ThreadEnvBuilt {
     env: Record<string, unknown>;
@@ -39,4 +41,4 @@ export interface ThreadEnvBuilt {
         binding: SqliteWorkflowBinding;
     }[];
 }
-export declare function buildThreadEnv({ config, baseDir, dataDir, rpc, envWsBridge, browserConfig }: ThreadEnvOptions): ThreadEnvBuilt;
+export declare function buildThreadEnv({ config, baseDir, dataDir, rpc, envWsBridge, browserConfig, artifactsBaseUrl }: ThreadEnvOptions): ThreadEnvBuilt;

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "lopata",
-	"version": "0.20.0",
+	"version": "0.20.1",
 	"type": "module",
 	"license": "MIT",
 	"repository": {

package/src/bindings/ai-search.ts

@@ -0,0 +1,185 @@
+/**
+ * Local implementation of the Cloudflare AI Search namespace binding
+ * (`ai_search_namespaces`).
+ *
+ * Running vector search + RAG locally is impractical, so this binding
+ * proxies to the real Cloudflare AI Search REST API — same strategy as
+ * `AiBinding`. Every proxied call is logged to SQLite for the dashboard.
+ *
+ * Requires `CLOUDFLARE_ACCOUNT_ID` and `CLOUDFLARE_API_TOKEN` in `.dev.vars`
+ * or the environment.
+ */
+import { randomUUIDv7 } from 'bun'
+import type { Database } from 'bun:sqlite'
+
+const MAX_LOG_SIZE = 1024
+
+function truncate(value: unknown): string {
+	const str = typeof value === 'string' ? value : JSON.stringify(value)
+	if (!str) return ''
+	return str.length > MAX_LOG_SIZE ? str.slice(0, MAX_LOG_SIZE) + '…' : str
+}
+
+interface CreateInstanceOptions {
+	id: string
+	type?: string
+	source?: unknown
+}
+
+interface SearchOptions {
+	messages: { role: string; content: string }[]
+	ai_search_options?: {
+		instance_ids?: string[]
+		[key: string]: unknown
+	}
+	stream?: boolean
+	[key: string]: unknown
+}
+
+export class AiSearchInstance {
+	private readonly binding: AiSearchNamespaceBinding
+	readonly id: string
+	readonly metadata: Record<string, unknown>
+
+	constructor(binding: AiSearchNamespaceBinding, id: string, metadata: Record<string, unknown> = {}) {
+		this.binding = binding
+		this.id = id
+		this.metadata = metadata
+	}
+
+	async search(options: SearchOptions): Promise<unknown> {
+		return this.binding._proxyInstance('search', this.id, options)
+	}
+
+	async chatCompletions(options: SearchOptions): Promise<unknown> {
+		return this.binding._proxyInstance('chatCompletions', this.id, options)
+	}
+}
+
+export class AiSearchNamespaceBinding {
+	private readonly db: Database
+	private readonly namespace: string
+	private readonly accountId?: string
+	private readonly apiToken?: string
+
+	constructor(db: Database, namespace: string, accountId?: string, apiToken?: string) {
+		this.db = db
+		this.namespace = namespace
+		this.accountId = accountId
+		this.apiToken = apiToken
+	}
+
+	private ensureCredentials(): { accountId: string; apiToken: string } {
+		if (!this.accountId || !this.apiToken) {
+			throw new Error(
+				'AI Search requires CLOUDFLARE_ACCOUNT_ID and CLOUDFLARE_API_TOKEN in .dev.vars',
+			)
+		}
+		return { accountId: this.accountId, apiToken: this.apiToken }
+	}
+
+	async create(opts: CreateInstanceOptions): Promise<AiSearchInstance> {
+		const body = await this.proxy('POST', '/ai-search/instances', opts, 'create')
+		const result = (body as { result?: Record<string, unknown> }).result ?? {}
+		return new AiSearchInstance(this, opts.id, result)
+	}
+
+	async get(id: string): Promise<AiSearchInstance> {
+		const body = await this.proxy('GET', `/ai-search/instances/${encodeURIComponent(id)}`, undefined, 'get')
+		const result = (body as { result?: Record<string, unknown> }).result ?? {}
+		return new AiSearchInstance(this, id, result)
+	}
+
+	async list(opts?: Record<string, string>): Promise<unknown> {
+		const query = opts ? '?' + new URLSearchParams(opts).toString() : ''
+		return this.proxy('GET', `/ai-search/instances${query}`, undefined, 'list')
+	}
+
+	async delete(id: string): Promise<boolean> {
+		await this.proxy('DELETE', `/ai-search/instances/${encodeURIComponent(id)}`, undefined, 'delete')
+		return true
+	}
+
+	async search(options: SearchOptions): Promise<unknown> {
+		return this.proxy('POST', `/ai-search/namespaces/${encodeURIComponent(this.namespace)}/search`, options, 'search')
+	}
+
+	async chatCompletions(options: SearchOptions): Promise<unknown> {
+		return this.proxy(
+			'POST',
+			`/ai-search/namespaces/${encodeURIComponent(this.namespace)}/chat/completions`,
+			options,
+			'chatCompletions',
+		)
+	}
+
+	/** @internal — called by AiSearchInstance */
+	async _proxyInstance(method: 'search' | 'chatCompletions', instanceId: string, options: SearchOptions): Promise<unknown> {
+		const path = method === 'search'
+			? `/ai-search/instances/${encodeURIComponent(instanceId)}/search`
+			: `/ai-search/instances/${encodeURIComponent(instanceId)}/chat/completions`
+		return this.proxy('POST', path, options, `instance.${method}`)
+	}
+
+	private async proxy(
+		httpMethod: string,
+		apiPath: string,
+		body: unknown,
+		operation: string,
+	): Promise<unknown> {
+		const { accountId, apiToken } = this.ensureCredentials()
+		const id = randomUUIDv7()
+		const start = Date.now()
+		let status = 'ok'
+		let error: string | undefined
+		let outputSummary = ''
+
+		try {
+			const url = `https://api.cloudflare.com/client/v4/accounts/${accountId}${apiPath}`
+			const response = await fetch(url, {
+				method: httpMethod,
+				headers: {
+					Authorization: `Bearer ${apiToken}`,
+					'Content-Type': 'application/json',
+				},
+				body: body === undefined ? undefined : JSON.stringify(body),
+			})
+
+			if (!response.ok) {
+				const text = await response.text()
+				status = 'error'
+				error = `HTTP ${response.status}: ${text}`
+				throw new Error(error)
+			}
+
+			if ((body as SearchOptions | undefined)?.stream) {
+				outputSummary = '<streaming>'
+				return response.body
+			}
+
+			const ct = response.headers.get('content-type') ?? ''
+			if (ct.includes('application/json')) {
+				const json = await response.json()
+				outputSummary = truncate(json)
+				return json
+			}
+			const text = await response.text()
+			outputSummary = truncate(text)
+			return text
+		} catch (err) {
+			if (status !== 'error') {
+				status = 'error'
+				error = err instanceof Error ? err.message : String(err)
+			}
+			throw err
+		} finally {
+			const duration = Date.now() - start
+			this.db
+				.prepare(
+					`INSERT INTO ai_search_requests (id, namespace, operation, input_summary, output_summary, duration_ms, status, error, created_at)
+					 VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+				)
+				.run(id, this.namespace, operation, truncate(body), outputSummary, duration, status, error ?? null, start)
+		}
+	}
+}

package/src/bindings/artifacts-git-http.ts

@@ -0,0 +1,249 @@
+/**
+ * Git HTTP protocol handler for the Artifacts binding.
+ *
+ * Proxies `/__artifacts/git/<repo-id>.git/<path>` requests to the `git http-backend`
+ * CGI binary. Authentication is via HTTP Basic (username ignored, password = token
+ * from `artifacts_tokens`). Read operations (`git-upload-pack`) accept any non-revoked
+ * token; write operations (`git-receive-pack`) require a `write`-scoped token.
+ *
+ * Repos marked read-only (`read_only = 1`) reject write requests regardless of scope.
+ */
+import type { Database } from 'bun:sqlite'
+import { existsSync } from 'node:fs'
+import { join } from 'node:path'
+
+interface RepoRow {
+	id: string
+	read_only: number
+}
+
+interface TokenRow {
+	scope: string
+	expires_at: number | null
+	revoked_at: number | null
+}
+
+const GIT_PATH_RE = /^\/__artifacts\/git\/([^/]+)\.git(\/.*)?$/
+
+export interface ArtifactsGitHandlerOptions {
+	db: Database
+	artifactsDir: string
+	gitBinary?: string
+	/** When true (tests), skip token validation. */
+	skipAuth?: boolean
+}
+
+export async function handleArtifactsGitRequest(
+	request: Request,
+	opts: ArtifactsGitHandlerOptions,
+): Promise<Response | null> {
+	const url = new URL(request.url)
+	const match = url.pathname.match(GIT_PATH_RE)
+	if (!match) return null
+
+	const repoId = match[1]!
+	const subPath = match[2] ?? '/'
+	const repo = opts.db
+		.query<RepoRow, [string]>('SELECT id, read_only FROM artifacts_repos WHERE id = ?')
+		.get(repoId)
+	if (!repo) {
+		return new Response('Not found', { status: 404 })
+	}
+
+	const repoDir = join(opts.artifactsDir, `${repoId}.git`)
+	if (!existsSync(repoDir)) {
+		return new Response('Repo directory missing', { status: 500 })
+	}
+
+	// Decide if this is a write request
+	const isWrite = isWriteRequest(request.method, subPath, url.searchParams.get('service'))
+	if (isWrite && repo.read_only) {
+		return new Response('Repo is read-only', { status: 403 })
+	}
+
+	if (!opts.skipAuth) {
+		const authResult = authenticate(request, opts.db, repoId, isWrite)
+		if (!authResult.ok) {
+			return new Response(authResult.message, {
+				status: 401,
+				headers: {
+					'WWW-Authenticate': 'Basic realm="Artifacts"',
+				},
+			})
+		}
+	}
+
+	return proxyToGitHttpBackend(request, subPath, repoDir, opts.gitBinary ?? 'git')
+}
+
+function isWriteRequest(method: string, subPath: string, service: string | null): boolean {
+	if (method === 'POST' && subPath === '/git-receive-pack') return true
+	if (method === 'GET' && subPath === '/info/refs' && service === 'git-receive-pack') return true
+	return false
+}
+
+interface AuthResult {
+	ok: boolean
+	message: string
+}
+
+function authenticate(request: Request, db: Database, repoId: string, writeNeeded: boolean): AuthResult {
+	const authHeader = request.headers.get('authorization')
+	if (!authHeader) {
+		return { ok: false, message: 'Authentication required' }
+	}
+	let token: string | null = null
+	if (authHeader.startsWith('Bearer ')) {
+		token = authHeader.slice(7).trim()
+	} else if (authHeader.startsWith('Basic ')) {
+		try {
+			const decoded = atob(authHeader.slice(6).trim())
+			const colonIdx = decoded.indexOf(':')
+			token = colonIdx === -1 ? decoded : decoded.slice(colonIdx + 1)
+		} catch {
+			return { ok: false, message: 'Invalid Basic auth encoding' }
+		}
+	}
+	if (!token) {
+		return { ok: false, message: 'Missing token' }
+	}
+	const row = db
+		.query<TokenRow, [string, string]>(
+			'SELECT scope, expires_at, revoked_at FROM artifacts_tokens WHERE repo_id = ? AND plaintext = ?',
+		)
+		.get(repoId, token)
+	if (!row) {
+		return { ok: false, message: 'Invalid token' }
+	}
+	if (row.revoked_at != null) {
+		return { ok: false, message: 'Token revoked' }
+	}
+	if (row.expires_at != null && row.expires_at < Date.now()) {
+		return { ok: false, message: 'Token expired' }
+	}
+	if (writeNeeded && row.scope !== 'write') {
+		return { ok: false, message: 'Token lacks write scope' }
+	}
+	return { ok: true, message: 'ok' }
+}
+
+async function proxyToGitHttpBackend(
+	request: Request,
+	subPath: string,
+	repoDir: string,
+	gitBinary: string,
+): Promise<Response> {
+	const url = new URL(request.url)
+
+	// CGI env variables required by git http-backend
+	const env: Record<string, string> = {
+		// Point GIT_PROJECT_ROOT at the repo parent so PATH_INFO can be "/<id>.git/..."
+		// But easier: point directly and use PATH_TRANSLATED + GIT_HTTP_EXPORT_ALL.
+		// We use PATH_TRANSLATED which tells http-backend exactly which repo dir to serve.
+		PATH_TRANSLATED: `${repoDir}${subPath}`,
+		GIT_HTTP_EXPORT_ALL: '1',
+		REQUEST_METHOD: request.method,
+		QUERY_STRING: url.search.startsWith('?') ? url.search.slice(1) : url.search,
+		CONTENT_TYPE: request.headers.get('content-type') ?? '',
+		REMOTE_USER: 'artifacts',
+		REMOTE_ADDR: '127.0.0.1',
+		// Let git detect encoding
+		HTTP_CONTENT_ENCODING: request.headers.get('content-encoding') ?? '',
+		HTTP_USER_AGENT: request.headers.get('user-agent') ?? 'lopata-artifacts',
+	}
+
+	const proc = Bun.spawn([gitBinary, 'http-backend'], {
+		env,
+		stdin: 'pipe',
+		stdout: 'pipe',
+		stderr: 'pipe',
+	})
+
+	// Pipe request body into the CGI's stdin (if any)
+	if (request.body) {
+		request.body.pipeTo(
+			new WritableStream({
+				async write(chunk) {
+					proc.stdin.write(chunk)
+				},
+				close() {
+					proc.stdin.end()
+				},
+				abort() {
+					proc.stdin.end()
+				},
+			}),
+		).catch(() => {})
+	} else {
+		proc.stdin.end()
+	}
+
+	// Read full stdout (git http-backend writes CGI-formatted response: headers + body)
+	const stdoutBytes = new Uint8Array(await new Response(proc.stdout).arrayBuffer())
+	const exitCode = await proc.exited
+	if (exitCode !== 0) {
+		const stderr = await new Response(proc.stderr).text()
+		return new Response(`git http-backend failed (${exitCode}): ${stderr}`, { status: 500 })
+	}
+
+	return parseCgiResponse(stdoutBytes)
+}
+
+function parseCgiResponse(raw: Uint8Array): Response {
+	// Find header/body separator: \r\n\r\n or \n\n
+	let headerEnd = indexOfDouble(raw, 0x0d, 0x0a) // \r\n\r\n
+	let separatorLen = 4
+	if (headerEnd === -1) {
+		headerEnd = indexOfDouble(raw, 0x0a, 0x0a) // \n\n
+		separatorLen = 2
+	}
+
+	let headerBytes: Uint8Array
+	let body: Uint8Array
+	if (headerEnd === -1) {
+		headerBytes = new Uint8Array(0)
+		body = raw
+	} else {
+		headerBytes = raw.slice(0, headerEnd)
+		body = raw.slice(headerEnd + separatorLen)
+	}
+
+	const headers = new Headers()
+	let status = 200
+	let statusText = 'OK'
+	const headerText = new TextDecoder().decode(headerBytes)
+	for (const line of headerText.split(/\r?\n/)) {
+		if (!line) continue
+		const colon = line.indexOf(':')
+		if (colon === -1) continue
+		const key = line.slice(0, colon).trim().toLowerCase()
+		const value = line.slice(colon + 1).trim()
+		if (key === 'status') {
+			const m = value.match(/^(\d+)\s*(.*)$/)
+			if (m) {
+				status = Number.parseInt(m[1]!, 10)
+				statusText = m[2] ?? ''
+			}
+		} else {
+			headers.append(key, value)
+		}
+	}
+
+	return new Response(body, { status, statusText, headers })
+}
+
+function indexOfDouble(buf: Uint8Array, a: number, b: number): number {
+	// Find position of a,b,a,b (4-byte) or a,a (2-byte) pattern — caller chose pattern length.
+	// For \r\n\r\n: a=\r=0x0d, b=\n=0x0a, need 4 bytes
+	// For \n\n: a=\n=0x0a, b=\n=0x0a, need 2 bytes; simpler to special-case
+	if (a === b) {
+		for (let i = 0; i + 1 < buf.length; i++) {
+			if (buf[i] === a && buf[i + 1] === b) return i
+		}
+		return -1
+	}
+	for (let i = 0; i + 3 < buf.length; i++) {
+		if (buf[i] === a && buf[i + 1] === b && buf[i + 2] === a && buf[i + 3] === b) return i
+	}
+	return -1
+}