ninepm 0.65.0 → 0.68.0

package/README.md

@@ -106,7 +106,7 @@ Deploy a first-class Worker runtime app:
 
 The `--runtime worker` entry must be a bundled fetch-compatible JavaScript module with a default export. With `--with-db`, the app receives `env.DB` and should use SQLite-compatible prepared statements.
 
-Choose which files are public with `--assets <dir>`: only the files under that directory are served, from the app's root (`public/index.html` answers on `/`), and nothing else in the deploy directory is uploaded. Use `--no-assets` when the entry serves every response itself. The app remembers the choice, so later deploys need not repeat the flag; pass the other flag, or another directory, to change it — there is no way back to publishing everything. A worker app that has never chosen serves **every file in the deploy directory except the entry** publicly, server helpers and leftovers like `index.js.orig` included; every deploy of such an app prints a warning naming those files, and `9pm deploy --check` lists every file a deploy would make public.
+Choose which files are public with `--assets <dir>`: only the files under that directory are served, from the app's root (`public/index.html` answers on `/`), and nothing else in the deploy directory is uploaded. Use `--no-assets` when the entry serves every response itself. The app remembers the choice, so later deploys need not repeat the flag; pass the other flag, or another directory, to change it — there is no way back to publishing everything. A worker app that has never chosen serves **every file in the deploy directory except the entry** publicly, server helpers and leftovers like `index.js.orig` included; every deploy of such an app prints a warning naming those files, and `9pm deploy --check` lists every file a deploy would make public. Its summary counts the files scanned apart from the files selected for upload (the entry and the public files); `--check` itself uploads nothing.
 
 Deploy a container app from a local Docker build:
 
@@ -221,6 +221,7 @@ Options:
 - `--name <name>` sets the app display name
 - `--slug <slug>` sets the URL-safe app slug
 - `--with-db` requests managed storage for the app
+- `--with-auth` gives the app 9pm-managed end-user sign-in (email one-time codes) and implies `--with-db`. Once enabled it stays on for every later deploy of the app, with or without the flag; it can't be turned off
 - `--database-name <name>` customizes the requested database name
 - `--binding <name>` customizes the database binding name
 - `--environment <name>` sets deployment environment metadata

package/dist/index.d.ts

@@ -38,10 +38,17 @@ export interface DeployResult {
     project: Project;
     deployment: Deployment;
     database: AppDatabase | null;
+    databases: BoundDatabase[];
     uploaded: number;
     url: string;
     containerImageBytes?: number;
 }
+export interface BoundDatabase {
+    bindingName: string;
+    name: string | null;
+}
+export declare function boundDatabasesForDeployment(deployment: Deployment, provisioned: AppDatabase | null): BoundDatabase[];
+export declare function deployDatabaseClause(databases: readonly BoundDatabase[]): string | null;
 export interface ApiOptions {
     apiUrl: string;
     token: string;
@@ -117,7 +124,7 @@ export interface CreatedServiceToken {
     clientSecret: string;
 }
 export type FetchLike = (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
-export declare const CLI_VERSION = "0.65.0";
+export declare const CLI_VERSION = "0.68.0";
 type CredentialBackend = "macos-keychain" | "windows-dpapi" | "linux-secret-service" | "file-plaintext" | "none";
 export interface StoredCredentialEntry {
     token: string;
@@ -191,6 +198,10 @@ export interface DeployCheckResult {
         path: string;
         url: string;
     }>;
+    upload?: {
+        files: number;
+        bytes: number;
+    };
 }
 export type DetectedFramework = "nextjs" | "astro" | "sveltekit" | "vite";
 export declare function detectFramework(directory: string): DetectedFramework | null;
@@ -230,6 +241,7 @@ export declare function measureWorkerModuleFiles(root: string, modulePaths: read
     compressedBytes: number;
 }>;
 export declare function checkDeployDirectory(options: DeployOptions): Promise<DeployCheckResult>;
+export declare function deployCheckSummary(check: DeployCheckResult, publicAssets: string | undefined): string;
 export declare function whoami(options: ApiOptions): Promise<WhoamiResult>;
 export declare function publicWhoamiResult(result: WhoamiResult): PublicWhoamiResult;
 export type CredentialRevocation = {

package/dist/index.js

@@ -16,7 +16,40 @@ import { MAX_STATIC_ASSET_FILE_BYTES, MAX_WORKER_ENTRY_COMPRESSED_BYTES, MAX_WOR
 import { buildFileManifest, readManifestFile } from "./manifest.js";
 import { NO_PUBLIC_ASSETS, normalizeAssetsDirectory, privateLookingPaths, publicAssetPath } from "./public-assets.js";
 import { API_KEY_HELP, API_URL_HELP, CLI_CLIENT_ID, DEFAULT_API_URL, reportCliError } from "./cli-config.js";
-export const CLI_VERSION = "0.65.0";
+// What the deployment binds, read from the deployment the server returned (#1949). The
+// server binds every provisioned database of the app on each publish whatever flags were
+// passed, so `--with-db` says nothing about the result. Only a deployment carrying no
+// `databases` record at all - the local mock target, or a server that predates recording
+// it for this runtime - falls back to what this run itself provisioned.
+export function boundDatabasesForDeployment(deployment, provisioned) {
+    const recorded = deployment.metadata["databases"];
+    if (!Array.isArray(recorded)) {
+        return provisioned ? [{ bindingName: provisioned.bindingName, name: provisioned.name }] : [];
+    }
+    const bound = [];
+    for (const entry of recorded) {
+        if (!entry || typeof entry !== "object") {
+            continue;
+        }
+        const record = entry;
+        if (typeof record["bindingName"] !== "string") {
+            continue;
+        }
+        const name = typeof record["name"] === "string" ? record["name"] : provisioned && record["id"] === provisioned.id ? provisioned.name : null;
+        bound.push({ bindingName: record["bindingName"], name });
+    }
+    return bound;
+}
+// The database clause of the deploy summary, or null when nothing is bound - the summary
+// then says nothing about a database rather than "no database".
+export function deployDatabaseClause(databases) {
+    if (databases.length === 0) {
+        return null;
+    }
+    const listed = databases.map((database) => (database.name ? `${database.bindingName}:${database.name}` : database.bindingName)).join(", ");
+    return `${databases.length === 1 ? "database" : "databases"} ${listed}`;
+}
+export const CLI_VERSION = "0.68.0";
 const PUBLIC_DASHBOARD_URL = "https://9pm.ai/dashboard";
 const TOKEN_SERVICE = "9pm";
 const TOKEN_ACCOUNT = "default";
@@ -442,6 +475,7 @@ async function runDeploy(initialOptions, slugHolder) {
                 project,
                 deployment: finalized,
                 database,
+                databases: boundDatabasesForDeployment(finalized, database),
                 uploaded: 1,
                 url: finalized.url,
                 containerImageBytes: image.size,
@@ -637,6 +671,7 @@ async function runDeploy(initialOptions, slugHolder) {
         project,
         deployment: finalized,
         database,
+        databases: boundDatabasesForDeployment(finalized, database),
         uploaded,
         url: finalized.url,
     };
@@ -812,9 +847,12 @@ export async function checkDeployDirectory(options) {
     // #1847: `--check` has no project, so it cannot see a choice made on an earlier deploy;
     // it reports what this invocation's flags would publish, and says so for the legacy case.
     let publicFiles;
+    let upload;
     if (serverEntry) {
         const selection = options.publicAssets ?? null;
         publicFiles = workerPublicFiles(manifest.map((file) => file.path), serverEntry, selection);
+        const selected = uploadedFiles(manifest, serverEntry, selection);
+        upload = { files: selected.length, bytes: selected.reduce((sum, file) => sum + file.size, 0) };
         if (selection !== null && selection !== NO_PUBLIC_ASSETS && publicFiles.length === 0) {
             errors.push(missingAssetsDirectoryMessage(selection));
         }
@@ -847,8 +885,26 @@ export async function checkDeployDirectory(options) {
         bytes: totalBytes,
         ...(serverCode ? { serverCode } : {}),
         ...(publicFiles ? { publicFiles } : {}),
+        ...(upload ? { upload } : {}),
     };
 }
+// The `--check` success line. Static and bundle deploys upload every file they scan, so one
+// count is the whole story there. An entry-based worker deploy uploads only the entry and
+// its public files, so it reports both counts; with no --assets/--no-assets, a choice the
+// app saved on an earlier deploy applies on the server, which a local check cannot see.
+export function deployCheckSummary(check, publicAssets) {
+    if (!check.upload) {
+        return `Deploy check passed: ${check.files} file(s), ${check.bytes} byte(s).`;
+    }
+    const publicCount = check.publicFiles?.length ?? 0;
+    const breakdown = publicAssets === NO_PUBLIC_ASSETS ? "the entry only" : `the entry + ${publicCount} public file(s)`;
+    const summary = `Deploy check passed: ${check.files} file(s) scanned, ${check.upload.files} selected for upload (${breakdown}), ` +
+        `${check.upload.bytes.toLocaleString("en-US")} byte(s) selected.`;
+    if (publicAssets !== undefined) {
+        return summary;
+    }
+    return `${summary}\n  Counted from the flags supplied (no --assets or --no-assets). If this app saved a public-assets choice on an earlier deploy, that choice applies on deploy and only the entry and the files it makes public are uploaded.`;
+}
 export async function whoami(options) {
     return apiRequest(options, "/v1/me", { method: "GET" });
 }
@@ -2305,7 +2361,14 @@ function buildContainerImage(directory) {
     const tempDir = mkdtempSync(path.join(os.tmpdir(), "9pm-container-"));
     const tag = `9pm-local-${Date.now()}-${process.pid}`;
     const imagePath = path.join(tempDir, "image.tar");
-    runDocker(["build", "--platform", "linux/amd64", "-t", tag, root], "build container image");
+    // Build without Buildx's default provenance attestation. With it, Docker Desktop saves the
+    // image as an index carrying an attestation manifest, and the push to Cloudflare's registry
+    // through `wrangler containers push` fails with "blob unknown to registry"; the same image
+    // without the attestation pushes (#1906: two of two attempts each way). The environment
+    // variable rather than `--provenance=false`: it is what that test pushed, and a builder that
+    // has no attestations - the legacy non-Buildx `docker build` - ignores an unknown variable
+    // where it would reject an unknown flag. SBOM generation is untouched: it is off by default.
+    runDocker(["build", "--platform", "linux/amd64", "-t", tag, root], "build container image", { BUILDX_NO_DEFAULT_ATTESTATIONS: "1" });
     const inspected = spawnSync("docker", ["image", "inspect", tag, "--format", "{{.Os}}/{{.Architecture}}"], { encoding: "utf8" });
     if (inspected.status !== 0) {
         throw new Error(`Failed to inspect container image: ${inspected.stderr || inspected.stdout}`.trim());
@@ -2318,8 +2381,8 @@ function buildContainerImage(directory) {
     const sha256 = createHash("sha256").update(readFileSync(imagePath)).digest("hex");
     return { tag, path: imagePath, size, sha256 };
 }
-function runDocker(args, action) {
-    const result = spawnSync("docker", args, { stdio: "inherit" });
+function runDocker(args, action, extraEnv = {}) {
+    const result = spawnSync("docker", args, { stdio: "inherit", env: { ...process.env, ...extraEnv } });
     if (result.status !== 0) {
         throw new Error(`Failed to ${action}.`);
     }
@@ -4389,7 +4452,7 @@ async function main() {
                     console.log("Deploy check passed: Dockerfile found and Docker is available.");
                 }
                 else {
-                    console.log(`Deploy check passed: ${check.files} file(s), ${check.bytes} byte(s).`);
+                    console.log(deployCheckSummary(check, command.options.publicAssets));
                     if (check.serverCode) {
                         // The compressed server-code figure, printed on success as well as on
                         // warning/rejection, so the number the size limit is enforced on is always
@@ -4438,10 +4501,10 @@ async function main() {
                 const siteFlag = slug ? ` --site ${quoteSiteArg(slug)}` : "";
                 throw new Error(`${base}\n\nStuck? Report it with context: 9pm support${siteFlag} -m "<what happened>"`);
             }
-            const databaseLine = result.database ? `database ${result.database.bindingName}:${result.database.name}` : "no database";
+            const databaseClause = deployDatabaseClause(result.databases);
             const queued = result.deployment.status === "queued" || result.deployment.status === "publishing";
             console.log(`${queued ? "Queued" : "Deployed"} ${result.project.slug} -> ${result.url}`);
-            console.log(`Deployment ${result.deployment.id} ${result.containerImageBytes ? `uploaded ${formatBytesForCli(result.containerImageBytes)} image` : `uploaded ${result.uploaded} file(s)`}, ${databaseLine}.`);
+            console.log(`Deployment ${result.deployment.id} ${result.containerImageBytes ? `uploaded ${formatBytesForCli(result.containerImageBytes)} image` : `uploaded ${result.uploaded} file(s)`}${databaseClause ? `, ${databaseClause}` : ""}.`);
             if (queued) {
                 console.log(`Status: ${result.deployment.status}. Run 9pm apps to check when it becomes active.`);
             }
@@ -5028,7 +5091,7 @@ Container deploys:
   Requires Docker locally. The CLI builds linux/amd64, exports the image, uploads it through a short-lived session, then finalizes a queued deployment.
   The app must listen on 0.0.0.0:$PORT - always read the PORT env var; on some placements the platform holds the selected --port and hands the app a different one. Use --health-path for a cheap readiness endpoint.
   With --with-db, containers receive NINEPM_SQL_URL and NINEPM_DB_BINDINGS for the managed SQL bridge, plus NINEPM_SQL_TOKEN where that bridge requires one - send it as "Authorization: Bearer <token>" or every query is refused.
-  With --with-auth, the app gets 9pm-managed end-user accounts (email one-time codes); it implies --with-db and is one-way (enable-only).
+  With --with-auth, the app gets 9pm-managed end-user accounts (email one-time codes); it implies --with-db and is one-way: once enabled it stays on for every later deploy of the app, with or without the flag.
   With --with-email, a signed-in end user can send app invitation emails; it implies --with-auth and works on public apps only.
   9pm env set <app> KEY=value [KEY2=value2 ...] [--var]   (secret by default; --var = readable config)
   9pm env set <app> --from-file <path> [--var]            (KEY=value lines; # comments, export prefix, quotes ok)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ninepm",
-  "version": "0.65.0",
+  "version": "0.68.0",
   "description": "CLI for deploying built apps to 9pm.ai.",
   "homepage": "https://9pm.ai",
   "keywords": [