ninepm 0.56.0 → 0.58.0

package/README.md

@@ -76,6 +76,7 @@ Attach an optional short description to the deploy (shown next to the version in
 
 ```sh
 9pm deploy ./dist --name my-app --slug my-app --description "Fix login redirect"
+9pm deploy ./dist --name my-app --slug my-app --owner acme   # into an organisation you are an admin of
 ```
 
 The CLI prints the public app URL after upload and finalization.

package/dist/index.d.ts

@@ -7,6 +7,7 @@ export interface DeployOptions {
     token: string;
     name?: string;
     slug?: string;
+    owner?: string;
     description?: string;
     environment?: string;
     withDatabase?: boolean;
@@ -50,6 +51,7 @@ export interface SiteAccessOptions extends ApiOptions {
 }
 export interface DeleteSiteOptions extends SiteAccessOptions {
     confirmSlug: string;
+    owner?: string;
     keepRecord?: boolean;
 }
 export interface AccessState {
@@ -114,7 +116,7 @@ export interface CreatedServiceToken {
     clientSecret: string;
 }
 export type FetchLike = (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
-export declare const CLI_VERSION = "0.56.0";
+export declare const CLI_VERSION = "0.58.0";
 type CredentialBackend = "macos-keychain" | "windows-dpapi" | "linux-secret-service" | "file-plaintext" | "none";
 export interface StoredCredentialEntry {
     token: string;
@@ -218,7 +220,7 @@ export declare function measureWorkerEntry(source: Uint8Array): {
     rawBytes: number;
     compressedBytes: number;
 };
-export declare function measureWorkerModuleFiles(root: string, modulePaths: readonly string[]): Promise<{
+export declare function measureWorkerModuleFiles(root: string, modulePaths: readonly string[], onSource?: (source: string) => void): Promise<{
     rawBytes: number;
     compressedBytes: number;
 }>;
@@ -321,7 +323,9 @@ export declare function checkSkillFreshness(options?: {
 export interface ListSitesResult {
     projects: Project[];
 }
-export declare function listSites(options: ApiOptions): Promise<ListSitesResult>;
+export declare function listSites(options: ApiOptions & {
+    owner?: string;
+}): Promise<ListSitesResult>;
 export declare function deleteSite(options: DeleteSiteOptions): Promise<DeletedSiteResult>;
 export interface DeviceAuthFeedbackOptions {
     progressStream?: NodeJS.WriteStream;
@@ -430,6 +434,7 @@ type CliCommand = {
     apiUrl: string;
     token: string;
     json: boolean;
+    owner?: string;
 } | {
     kind: "logs";
     site: string;

package/dist/index.js

@@ -11,10 +11,11 @@ import { once } from "node:events";
 import { createGzip, gzipSync } from "node:zlib";
 import { Agent, fetch as undiciFetch } from "undici";
 import { MAX_DEPLOY_DESCRIPTION_LENGTH, normalizeDeployDescription } from "./deploy-description.js";
+import { managedHostnamesIn, siblingCallWarning, siblingsOf } from "./sibling-hostnames.js";
 import { MAX_STATIC_ASSET_FILE_BYTES, MAX_WORKER_ENTRY_COMPRESSED_BYTES, MAX_WORKER_SCRIPT_COMPRESSED_BYTES, WORKER_ENTRY_COMPRESSED_WARN_BYTES, assetFileTooLargeMessage, formatMebibytes, formatMegabytes, oversizedAssets, workerBundleNearLimitMessage, workerBundleTooLargeMessage, workerEntryNearLimitMessage, workerEntryTooLargeMessage, } from "./deploy-limits.js";
 import { buildFileManifest, readManifestFile } from "./manifest.js";
 import { API_KEY_HELP, API_URL_HELP, CLI_CLIENT_ID, DEFAULT_API_URL, reportCliError } from "./cli-config.js";
-export const CLI_VERSION = "0.56.0";
+export const CLI_VERSION = "0.58.0";
 const PUBLIC_DASHBOARD_URL = "https://9pm.ai/dashboard";
 const TOKEN_SERVICE = "9pm";
 const TOKEN_ACCOUNT = "default";
@@ -269,6 +270,7 @@ export async function deployDirectory(initialOptions) {
                     ...(initialOptions.fetchFn ? { fetchFn: initialOptions.fetchFn } : {}),
                     site: slugHolder.slug,
                     confirmSlug: slugHolder.slug,
+                    ...(initialOptions.owner ? { owner: initialOptions.owner } : {}),
                     ...(slugHolder.retain ? { keepRecord: true } : {}),
                 });
             }
@@ -339,8 +341,8 @@ async function runDeploy(initialOptions, slugHolder) {
         }
         const image = buildContainerImage(options.directory);
         try {
-            const projectInput = { name: options.name ?? path.basename(path.resolve(options.directory)) };
-            const { project, created: projectCreated } = await createProject(fetchFn, apiUrl, options.token, options.slug ? { ...projectInput, slug: options.slug } : projectInput);
+            const projectInput = { name: options.name ?? path.basename(path.resolve(options.directory)), ...(options.slug ? { slug: options.slug } : {}), ...(options.owner ? { owner: options.owner } : {}) };
+            const { project, created: projectCreated } = await createProject(fetchFn, apiUrl, options.token, projectInput);
             slugHolder.slug = project.slug;
             slugHolder.created = projectCreated;
             slugHolder.neverActive = project.activeDeploymentId === null;
@@ -490,13 +492,22 @@ async function runDeploy(initialOptions, slugHolder) {
             console.warn(`Warning: ${workerEntryNearLimitMessage(serverEntry, rawBytes, compressedBytes)}`);
         }
     }
+    // Managed app hostnames written into this app's server code (#1332), filled from the
+    // size passes above and below - the only passes that hold every server module's text -
+    // and read once the project id exists. A bundle is streamed through gzip precisely so it
+    // is never all in memory at once, so the matches are what gets carried, not the sources.
+    const managedHostnames = new Set();
     // Bundles carry the same budget, applied to all their server modules together (#660).
     // Without this the `--bundle` path — the one the hosted skill's size guidance is about —
     // was the only worker shape with no local size check at all, so an over-budget framework
     // build failed at publish instead, after the project and slug existed.
     if (bundle) {
         const modulePaths = bundleModulePaths(bundle);
-        const { rawBytes, compressedBytes } = await measureWorkerModuleFiles(contentRoot, modulePaths);
+        const { rawBytes, compressedBytes } = await measureWorkerModuleFiles(contentRoot, modulePaths, (source) => {
+            for (const hostname of managedHostnamesIn(source)) {
+                managedHostnames.add(hostname);
+            }
+        });
         if (compressedBytes > MAX_WORKER_ENTRY_COMPRESSED_BYTES) {
             throw new Error(workerBundleTooLargeMessage(modulePaths.length, rawBytes, compressedBytes));
         }
@@ -504,10 +515,30 @@ async function runDeploy(initialOptions, slugHolder) {
             console.warn(`Warning: ${workerBundleNearLimitMessage(modulePaths.length, rawBytes, compressedBytes)}`);
         }
     }
-    const projectInput = { name: options.name ?? path.basename(path.resolve(options.directory)) };
-    const { project, created: projectCreated } = await createProject(fetchFn, apiUrl, options.token, options.slug ? { ...projectInput, slug: options.slug } : projectInput);
+    const projectInput = { name: options.name ?? path.basename(path.resolve(options.directory)), ...(options.slug ? { slug: options.slug } : {}), ...(options.owner ? { owner: options.owner } : {}) };
+    const { project, created: projectCreated } = await createProject(fetchFn, apiUrl, options.token, projectInput);
     slugHolder.slug = project.slug;
     slugHolder.created = projectCreated;
+    // #1332: a worker-runtime app cannot reach a sibling over its public hostname - the
+    // request never leaves the platform's network - and nothing else would tell the author,
+    // because the callee answers 200 to everyone outside. Both worker shapes are scanned
+    // off bytes the size preflight above already read: the entry from the copy it holds for
+    // the upload, a bundle from the stream it was measured on.
+    //
+    // After the project resolves, not beside those size checks, because the exclusion that
+    // makes this warning readable needs the project id: an app's own hostname is the
+    // reference the #1237 audit found most of, so without it this fires on nearly every
+    // worker deploy. Unlike those checks it refuses nothing, so it has no reason to run
+    // before the slug is claimed.
+    if (serverEntryBytes) {
+        for (const hostname of managedHostnamesIn(new TextDecoder().decode(serverEntryBytes))) {
+            managedHostnames.add(hostname);
+        }
+    }
+    const siblings = siblingsOf(managedHostnames, { ownProjectId: project.id });
+    if (siblings.length > 0) {
+        console.warn(`Warning: ${siblingCallWarning(siblings)}`);
+    }
     const database = options.withDatabase
         ? await createDatabase(fetchFn, apiUrl, options.token, project.id, {
             name: options.databaseName ?? `${project.slug}-db`,
@@ -592,7 +623,10 @@ export function measureWorkerEntry(source) {
 // It deliberately does not stop early once the limit is passed. The messages report exact
 // byte counts — that precision is what keeps them unambiguous at the boundary — and a floor
 // like "at least N bytes" would give that up to save a second on an already-failing deploy.
-export async function measureWorkerModuleFiles(root, modulePaths) {
+export async function measureWorkerModuleFiles(root, modulePaths, 
+// Handed each module's text as the pass streams it. Optional, and skipped entirely when
+// absent, so `--check` still never decodes a bundle it only needs the size of.
+onSource) {
     const gzip = createGzip();
     let rawBytes = 0;
     let compressedBytes = 0;
@@ -613,6 +647,7 @@ export async function measureWorkerModuleFiles(root, modulePaths) {
         for (const modulePath of modulePaths) {
             const bytes = await readManifestFile(root, modulePath);
             rawBytes += bytes.byteLength;
+            onSource?.(new TextDecoder().decode(bytes));
             if (!gzip.write(bytes)) {
                 // Respect backpressure so a large bundle cannot balloon the stream's internal queue.
                 await once(gzip, "drain");
@@ -717,6 +752,12 @@ export async function checkDeployDirectory(options) {
             const entrySource = await validateWorkerEntrySource(source, serverEntry);
             warnings.push(...entrySource.warnings);
             errors.push(...entrySource.errors);
+            // The sibling-hostname warning (#1332) deliberately does NOT run here, though this
+            // has the source in hand and #645 otherwise wants the two paths agreeing. It needs
+            // the project id to tell a sibling's hostname from the app's own, and `--check` runs
+            // against a directory, before any project exists - so here it could only report
+            // every app's reference to ITSELF, which is the false positive that would teach
+            // people to stop reading it.
         }
     }
     // Same server-code budget the real deploy applies to a bundle (#660), measured the same
@@ -1199,11 +1240,13 @@ function readUpdateCheckCache(cachePath) {
     }
 }
 export async function listSites(options) {
-    const payload = await apiRequest(options, "/v1/sites", { method: "GET" });
+    const route = options.owner ? `/v1/sites?owner=${encodeURIComponent(options.owner)}` : "/v1/sites";
+    const payload = await apiRequest(options, route, { method: "GET" });
     return { projects: payload.projects };
 }
 export async function deleteSite(options) {
-    const payload = await apiRequest(options, `/v1/sites/${encodeURIComponent(options.site)}`, {
+    const route = `/v1/sites/${encodeURIComponent(options.site)}${options.owner ? `?owner=${encodeURIComponent(options.owner)}` : ""}`;
+    const payload = await apiRequest(options, route, {
         method: "DELETE",
         body: JSON.stringify({ confirmSlug: options.confirmSlug, ...(options.keepRecord ? { keepRecord: true } : {}) }),
     });
@@ -2154,6 +2197,7 @@ const VALID_DEPLOY_FLAGS = new Set([
     "email",
     "name",
     "slug",
+    "owner",
     "description",
     "environment",
     "database-name",
@@ -2231,7 +2275,8 @@ export function parseArgs(argv) {
     }
     if (command === "apps" || command === "list" || command === "ls" || command === "sites" || command === "projects") {
         const flags = parseFlags(argv);
-        return { kind: "apps", ...readBaseApiOptions(flags), json: flags.has("json") };
+        const owner = readStringFlag(flags, "owner");
+        return { kind: "apps", ...readBaseApiOptions(flags), json: flags.has("json"), ...(owner ? { owner } : {}) };
     }
     if (command === "latest" || command === "upgrade" || command === "update") {
         const flags = parseFlags(argv);
@@ -2292,6 +2337,7 @@ export function parseArgs(argv) {
     };
     const name = readStringFlag(flags, "name");
     const slug = readStringFlag(flags, "slug");
+    const owner = readStringFlag(flags, "owner");
     const description = readStringFlag(flags, "description");
     const environment = readStringFlag(flags, "environment");
     const databaseName = readStringFlag(flags, "database-name");
@@ -2307,6 +2353,9 @@ export function parseArgs(argv) {
     if (slug) {
         options.slug = slug;
     }
+    if (owner) {
+        options.owner = owner;
+    }
     let normalizedDescription;
     try {
         normalizedDescription = normalizeDeployDescription(description);
@@ -3944,7 +3993,7 @@ async function main() {
             if (queued) {
                 console.log(`Status: ${result.deployment.status}. Run 9pm apps to check when it becomes active.`);
             }
-            console.log(`Manage: ${PUBLIC_DASHBOARD_URL}`);
+            console.log(`Manage: ${PUBLIC_DASHBOARD_URL}${command.options.owner ? `?owner=${encodeURIComponent(command.options.owner)}` : ""}`);
             // Gated the same way as the reachability probe above: a programmatic
             // caller injecting fetchFn opted out of the CLI's own network side trips.
             if (!command.options.fetchFn) {
@@ -4144,7 +4193,7 @@ async function main() {
             return;
         }
         if (command.kind === "apps") {
-            const result = await listSites({ apiUrl: command.apiUrl, token: command.token });
+            const result = await listSites({ apiUrl: command.apiUrl, token: command.token, ...(command.owner ? { owner: command.owner } : {}) });
             if (command.json) {
                 console.log(JSON.stringify(result, null, 2));
                 return;
@@ -4395,7 +4444,7 @@ async function runFilesCommand(command) {
 function printUsage() {
     console.log(`Usage:
   9pm --version
-  9pm deploy [directory] --name <site-name> [--slug <slug>] [--description "<note>"] [--with-db] [--with-auth] [--with-email]
+  9pm deploy [directory] --name <site-name> [--slug <slug>] [--owner <organisation>] [--description "<note>"] [--with-db] [--with-auth] [--with-email]
   9pm deploy [directory] --runtime worker --entry src/index.js [--with-db]
   9pm deploy [directory] --runtime container --port 8080 [--health-path /health] [--region auto] [--with-db] [--always-on] [--volume <gb> | --no-volume] [--cpus <n>] [--memory <size>]
   9pm deploy [directory]                   framework projects (Next.js, Vite) are detected and built automatically; --no-build skips
@@ -4407,7 +4456,7 @@ function printUsage() {
   9pm logout [--api-url <url>] [--local]   revokes the credential server-side, then removes it from this machine (--local skips the revoke)
   9pm doctor [--json]
   9pm whoami [--json]
-  9pm apps [--json]
+  9pm apps [--owner <organisation>] [--json]
   9pm latest [--json]
   9pm support -m "<what happened>" [--subject <subject>] [--site <app>]
   9pm files list [--project <site>]

package/dist/sibling-hostnames.d.ts

@@ -0,0 +1,34 @@
+export declare const DEFAULT_APP_HOST_BASE = "9pm.ai";
+/**
+ * Every managed app hostname appearing in `source`, the deploying app's own included.
+ *
+ * Matched on the HOST portion only - a bare hostname, or one inside a URL - so a path or
+ * query string that happens to contain the base domain does not register.
+ *
+ * Separate from the own-app filter below because the deploy path learns the two at
+ * different moments: a `--bundle` build is scanned module by module as the size pass
+ * streams it, which happens before the project (and so the id that identifies the app's
+ * own hostname) exists. Collecting the handful of matches costs nothing to carry; holding
+ * the sources until the project resolves would mean holding the whole bundle.
+ */
+export declare function managedHostnamesIn(source: string, options?: {
+    appHostBase?: string;
+}): string[];
+/**
+ * Of `hostnames`, the ones belonging to some OTHER app.
+ *
+ * `ownProjectId` is the id of the project being deployed; without it every reference an
+ * app makes to ITSELF is reported, which the #1237 audit found to be most of the
+ * references on the estate - so the deploy path must not call this before the project
+ * resolves.
+ */
+export declare function siblingsOf(hostnames: Iterable<string>, options?: {
+    appHostBase?: string;
+    ownProjectId?: string | null;
+}): string[];
+/** `managedHostnamesIn` and `siblingsOf` in one, for a caller holding the whole source. */
+export declare function siblingHostnamesIn(source: string, options?: {
+    appHostBase?: string;
+    ownProjectId?: string | null;
+}): string[];
+export declare function siblingCallWarning(hostnames: string[]): string;

package/dist/sibling-hostnames.js

@@ -0,0 +1,128 @@
+// AUTO-GENERATED by scripts/generate-cli-package.mjs from the in-repo CLI source -- do not edit.
+// Edit src/cli or src/shared instead; this is regenerated on typecheck/test/build/pack.
+// #1332: a Worker-runtime app must not call a sibling app by its public hostname.
+//
+// A same-zone Worker `fetch()` bypasses Worker routes, so once an app is served only by
+// the `*.9pm.ai/*` wildcard - which, as of 2026-09-21, every app is, none of them holding
+// a Custom Domain any more - such a call gets Cloudflare `1016` while both apps still
+// answer `200` to anyone outside. No external probe sees it, and the app that breaks is
+// not the app that changed.
+//
+// A request from a container's own runtime, or from a browser, is unaffected: those reach
+// the edge like any other client. So this is specifically about server code inside a
+// worker-runtime bundle.
+//
+// A WARNING rather than a refusal, deliberately. A managed hostname has legitimate uses in
+// a bundle - a link handed to the browser, a string in copy, a CSP entry - and refusing on
+// the first false positive teaches people to route around the check rather than read it.
+// The audit on #1237 found every real reference to be a literal, so this catches the
+// mechanically findable case and knowingly misses a hostname arriving from an env var.
+// The platform's own hostnames under the app host base. Server code may call these
+// normally - they are Custom Domains, reached through the edge like any other client - so
+// none of them is a sibling call. Listed explicitly, and checked BEFORE the label pattern,
+// because `custom-origin` satisfies that pattern ("origin" being six alphanumerics): the
+// zone's custom-domain fallback origin would otherwise read as a tester's app, and an app
+// documenting its own domain setup embeds it. The rest escape the pattern only because
+// "staging" is seven characters, which is arithmetic rather than a rule. The apex carries
+// no label at all, so it needs no entry. Kept honest by a test that feeds every hostname
+// the wrangler configs declare through the matcher.
+const PLATFORM_LABELS = new Set([
+    "admin",
+    "admin-staging",
+    "api",
+    "api-staging",
+    "custom-origin",
+    "custom-origin.staging",
+    "files",
+    "files-staging",
+    "staging",
+    "www",
+]);
+// `<slug>-<suffix>[-<marker>]` where the suffix is the last six alphanumerics of the
+// project id, lowercased, and the marker is the environment's label marker - `stg` on
+// staging (`appScriptLabelForProject`). The slug is at least one character and may carry
+// dashes. The suffix is CAPTURED rather than merely matched: it is what tells one app's
+// label from another's, and so what identifies the deploying app's own hostname below.
+const MANAGED_LABEL = /^(?:[a-z0-9]+-)+([a-z0-9]{6})(?:-[a-z0-9]{1,8})?$/;
+// The app host base in production. Declared here rather than taken from cli-config so the
+// tarball needs no new hand-maintained export; callers that serve another base (staging,
+// local) pass it explicitly.
+export const DEFAULT_APP_HOST_BASE = "9pm.ai";
+function normalizeBase(appHostBase) {
+    return (appHostBase ?? DEFAULT_APP_HOST_BASE).trim().toLowerCase();
+}
+// The six-character id suffix an app's own label carries (`appScriptLabelForProject`).
+// The own-app exclusion keys on this rather than on the whole hostname because a caller
+// generally cannot build the whole hostname: the slug half is truncated to fit a
+// 63-character DNS label, and by the marker's length again on an environment that adds
+// one - so reproducing it would mean reproducing that arithmetic for an environment the
+// CLI cannot tell it is talking to. Two projects whose ids end in the same six characters
+// would hide one app's warning from the other, which is the cheap direction to be wrong.
+function labelIdSuffix(projectId) {
+    return projectId.replace(/[^a-z0-9]/gi, "").slice(-6).toLowerCase();
+}
+/**
+ * Every managed app hostname appearing in `source`, the deploying app's own included.
+ *
+ * Matched on the HOST portion only - a bare hostname, or one inside a URL - so a path or
+ * query string that happens to contain the base domain does not register.
+ *
+ * Separate from the own-app filter below because the deploy path learns the two at
+ * different moments: a `--bundle` build is scanned module by module as the size pass
+ * streams it, which happens before the project (and so the id that identifies the app's
+ * own hostname) exists. Collecting the handful of matches costs nothing to carry; holding
+ * the sources until the project resolves would mean holding the whole bundle.
+ */
+export function managedHostnamesIn(source, options = {}) {
+    const base = normalizeBase(options.appHostBase);
+    if (!base) {
+        return [];
+    }
+    // Bounded on both sides by characters that cannot continue a hostname. The right-hand
+    // lookahead excludes a DOT as well, so `example.com/my-app-abc123.9pm.ai.txt` - a file
+    // on somebody else's domain that happens to contain our base - does not read as a call.
+    const pattern = new RegExp(`(?:^|[^a-z0-9.-])([a-z0-9][a-z0-9.-]*)\\.${base.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}(?![a-z0-9.-])`, "gi");
+    const found = new Set();
+    for (const match of source.toLowerCase().matchAll(pattern)) {
+        const label = match[1];
+        if (label && !PLATFORM_LABELS.has(label) && MANAGED_LABEL.test(label)) {
+            found.add(`${label}.${base}`);
+        }
+    }
+    return [...found].sort();
+}
+/**
+ * Of `hostnames`, the ones belonging to some OTHER app.
+ *
+ * `ownProjectId` is the id of the project being deployed; without it every reference an
+ * app makes to ITSELF is reported, which the #1237 audit found to be most of the
+ * references on the estate - so the deploy path must not call this before the project
+ * resolves.
+ */
+export function siblingsOf(hostnames, options = {}) {
+    const base = normalizeBase(options.appHostBase);
+    const ownSuffix = options.ownProjectId ? labelIdSuffix(options.ownProjectId) : "";
+    if (!base || !ownSuffix) {
+        return [...new Set(hostnames)].sort();
+    }
+    const siblings = new Set();
+    for (const hostname of hostnames) {
+        const label = hostname.toLowerCase().endsWith(`.${base}`) ? hostname.slice(0, -(base.length + 1)) : hostname;
+        if (MANAGED_LABEL.exec(label)?.[1] !== ownSuffix) {
+            siblings.add(hostname);
+        }
+    }
+    return [...siblings].sort();
+}
+/** `managedHostnamesIn` and `siblingsOf` in one, for a caller holding the whole source. */
+export function siblingHostnamesIn(source, options = {}) {
+    return siblingsOf(managedHostnamesIn(source, options), options);
+}
+export function siblingCallWarning(hostnames) {
+    const named = hostnames.slice(0, 3).join(", ");
+    const rest = hostnames.length > 3 ? ` (and ${hostnames.length - 3} more)` : "";
+    return (`Server code references another app's hostname (${named}${rest}). ` +
+        "A worker-runtime app cannot reach a sibling app over its public hostname - the request " +
+        "does not leave the platform's network and fails with an edge error, even though the " +
+        "other app is up. Call it from the browser instead, or from a container's own runtime.");
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ninepm",
-  "version": "0.56.0",
+  "version": "0.58.0",
   "description": "CLI for deploying built apps to 9pm.ai.",
   "homepage": "https://9pm.ai",
   "keywords": [