ninepm 0.65.0 → 0.69.0

package/README.md

@@ -62,6 +62,15 @@ Deploy a static directory:
 9pm deploy . --name my-app --slug my-app
 ```
 
+### How long an app's address stays the same
+
+Check this before printing a link or QR code. The live URL is `<slug>-<suffix>.9pm.ai`, and the suffix comes from the app's internal id, not from the slug:
+
+- Redeploying under the same slug keeps the address.
+- Deleting the app and creating it again under the same slug gives it a **new** address, because the new app gets a new id. Anything printed with the old one stops working.
+- There is no rename: a different address means a different app.
+- A custom domain you own, added on the dashboard's Domains page, gives the app an address of your own. Not every plan includes custom domains.
+
 Deploy a built framework output directory:
 
 ```sh
@@ -106,7 +115,7 @@ Deploy a first-class Worker runtime app:
 
 The `--runtime worker` entry must be a bundled fetch-compatible JavaScript module with a default export. With `--with-db`, the app receives `env.DB` and should use SQLite-compatible prepared statements.
 
-Choose which files are public with `--assets <dir>`: only the files under that directory are served, from the app's root (`public/index.html` answers on `/`), and nothing else in the deploy directory is uploaded. Use `--no-assets` when the entry serves every response itself. The app remembers the choice, so later deploys need not repeat the flag; pass the other flag, or another directory, to change it — there is no way back to publishing everything. A worker app that has never chosen serves **every file in the deploy directory except the entry** publicly, server helpers and leftovers like `index.js.orig` included; every deploy of such an app prints a warning naming those files, and `9pm deploy --check` lists every file a deploy would make public.
+Choose which files are public with `--assets <dir>`: only the files under that directory are served, from the app's root (`public/index.html` answers on `/`), and nothing else in the deploy directory is uploaded. Use `--no-assets` when the entry serves every response itself. The app remembers the choice, so later deploys need not repeat the flag; pass the other flag, or another directory, to change it — there is no way back to publishing everything. A worker app that has never chosen serves **every file in the deploy directory except the entry** publicly, server helpers and leftovers like `index.js.orig` included; every deploy of such an app prints a warning naming those files, and `9pm deploy --check` lists every file a deploy would make public. Its summary counts the files scanned apart from the files selected for upload (the entry and the public files); `--check` itself uploads nothing.
 
 Deploy a container app from a local Docker build:
 
@@ -137,6 +146,8 @@ Delete an app, its managed database, managed container app, and retained image:
 9pm delete my-app --confirm my-app
 ```
 
+The app's address goes with it: creating an app again under the same slug gives it a new address, so printed links and QR codes stop working. `9pm delete` prints this warning before it deletes anything.
+
 ## Access Modes
 
 Apps are public by default.
@@ -221,6 +232,7 @@ Options:
 - `--name <name>` sets the app display name
 - `--slug <slug>` sets the URL-safe app slug
 - `--with-db` requests managed storage for the app
+- `--with-auth` gives the app 9pm-managed end-user sign-in (email one-time codes) and implies `--with-db`. Once enabled it stays on for every later deploy of the app, with or without the flag; it can't be turned off
 - `--database-name <name>` customizes the requested database name
 - `--binding <name>` customizes the database binding name
 - `--environment <name>` sets deployment environment metadata

package/dist/index.d.ts

@@ -38,10 +38,17 @@ export interface DeployResult {
     project: Project;
     deployment: Deployment;
     database: AppDatabase | null;
+    databases: BoundDatabase[];
     uploaded: number;
     url: string;
     containerImageBytes?: number;
 }
+export interface BoundDatabase {
+    bindingName: string;
+    name: string | null;
+}
+export declare function boundDatabasesForDeployment(deployment: Deployment, provisioned: AppDatabase | null): BoundDatabase[];
+export declare function deployDatabaseClause(databases: readonly BoundDatabase[]): string | null;
 export interface ApiOptions {
     apiUrl: string;
     token: string;
@@ -117,7 +124,7 @@ export interface CreatedServiceToken {
     clientSecret: string;
 }
 export type FetchLike = (input: string | URL | Request, init?: RequestInit) => Promise<Response>;
-export declare const CLI_VERSION = "0.65.0";
+export declare const CLI_VERSION = "0.69.0";
 type CredentialBackend = "macos-keychain" | "windows-dpapi" | "linux-secret-service" | "file-plaintext" | "none";
 export interface StoredCredentialEntry {
     token: string;
@@ -191,6 +198,10 @@ export interface DeployCheckResult {
         path: string;
         url: string;
     }>;
+    upload?: {
+        files: number;
+        bytes: number;
+    };
 }
 export type DetectedFramework = "nextjs" | "astro" | "sveltekit" | "vite";
 export declare function detectFramework(directory: string): DetectedFramework | null;
@@ -230,6 +241,7 @@ export declare function measureWorkerModuleFiles(root: string, modulePaths: read
     compressedBytes: number;
 }>;
 export declare function checkDeployDirectory(options: DeployOptions): Promise<DeployCheckResult>;
+export declare function deployCheckSummary(check: DeployCheckResult, publicAssets: string | undefined): string;
 export declare function whoami(options: ApiOptions): Promise<WhoamiResult>;
 export declare function publicWhoamiResult(result: WhoamiResult): PublicWhoamiResult;
 export type CredentialRevocation = {
@@ -331,6 +343,7 @@ export interface ListSitesResult {
 export declare function listSites(options: ApiOptions & {
     owner?: string;
 }): Promise<ListSitesResult>;
+export declare function deleteWarningLines(slug: string): string[];
 export declare function deleteSite(options: DeleteSiteOptions): Promise<DeletedSiteResult>;
 export interface DeviceAuthFeedbackOptions {
     progressStream?: NodeJS.WriteStream;
@@ -664,6 +677,17 @@ export declare function parseEnvFileEntries(content: string, kind: "secret" | "v
     value: string;
     kind: "secret" | "var";
 }>;
+export type ListedDeployment = Pick<Deployment, "id" | "version" | "status" | "createdAt"> & {
+    active: boolean;
+};
+export declare function deploymentStatusLabel(deployment: ListedDeployment): string;
+export declare function formatDeploymentsList(deployments: ListedDeployment[]): string[];
+export declare function deploymentsListJson<T extends ListedDeployment>(deployments: T[]): {
+    servingDeploymentId: string | null;
+    deployments: Array<T & {
+        serving: boolean;
+    }>;
+};
 export declare function healthWithReason(status: string | null | undefined, reason: string | null | undefined): string;
 export declare function workerPublicFiles(paths: readonly string[], serverEntry: string, selection: string | null): Array<{
     path: string;

package/dist/index.js

@@ -16,7 +16,40 @@ import { MAX_STATIC_ASSET_FILE_BYTES, MAX_WORKER_ENTRY_COMPRESSED_BYTES, MAX_WOR
 import { buildFileManifest, readManifestFile } from "./manifest.js";
 import { NO_PUBLIC_ASSETS, normalizeAssetsDirectory, privateLookingPaths, publicAssetPath } from "./public-assets.js";
 import { API_KEY_HELP, API_URL_HELP, CLI_CLIENT_ID, DEFAULT_API_URL, reportCliError } from "./cli-config.js";
-export const CLI_VERSION = "0.65.0";
+// What the deployment binds, read from the deployment the server returned (#1949). The
+// server binds every provisioned database of the app on each publish whatever flags were
+// passed, so `--with-db` says nothing about the result. Only a deployment carrying no
+// `databases` record at all - the local mock target, or a server that predates recording
+// it for this runtime - falls back to what this run itself provisioned.
+export function boundDatabasesForDeployment(deployment, provisioned) {
+    const recorded = deployment.metadata["databases"];
+    if (!Array.isArray(recorded)) {
+        return provisioned ? [{ bindingName: provisioned.bindingName, name: provisioned.name }] : [];
+    }
+    const bound = [];
+    for (const entry of recorded) {
+        if (!entry || typeof entry !== "object") {
+            continue;
+        }
+        const record = entry;
+        if (typeof record["bindingName"] !== "string") {
+            continue;
+        }
+        const name = typeof record["name"] === "string" ? record["name"] : provisioned && record["id"] === provisioned.id ? provisioned.name : null;
+        bound.push({ bindingName: record["bindingName"], name });
+    }
+    return bound;
+}
+// The database clause of the deploy summary, or null when nothing is bound - the summary
+// then says nothing about a database rather than "no database".
+export function deployDatabaseClause(databases) {
+    if (databases.length === 0) {
+        return null;
+    }
+    const listed = databases.map((database) => (database.name ? `${database.bindingName}:${database.name}` : database.bindingName)).join(", ");
+    return `${databases.length === 1 ? "database" : "databases"} ${listed}`;
+}
+export const CLI_VERSION = "0.69.0";
 const PUBLIC_DASHBOARD_URL = "https://9pm.ai/dashboard";
 const TOKEN_SERVICE = "9pm";
 const TOKEN_ACCOUNT = "default";
@@ -442,6 +475,7 @@ async function runDeploy(initialOptions, slugHolder) {
                 project,
                 deployment: finalized,
                 database,
+                databases: boundDatabasesForDeployment(finalized, database),
                 uploaded: 1,
                 url: finalized.url,
                 containerImageBytes: image.size,
@@ -637,6 +671,7 @@ async function runDeploy(initialOptions, slugHolder) {
         project,
         deployment: finalized,
         database,
+        databases: boundDatabasesForDeployment(finalized, database),
         uploaded,
         url: finalized.url,
     };
@@ -812,9 +847,12 @@ export async function checkDeployDirectory(options) {
     // #1847: `--check` has no project, so it cannot see a choice made on an earlier deploy;
     // it reports what this invocation's flags would publish, and says so for the legacy case.
     let publicFiles;
+    let upload;
     if (serverEntry) {
         const selection = options.publicAssets ?? null;
         publicFiles = workerPublicFiles(manifest.map((file) => file.path), serverEntry, selection);
+        const selected = uploadedFiles(manifest, serverEntry, selection);
+        upload = { files: selected.length, bytes: selected.reduce((sum, file) => sum + file.size, 0) };
         if (selection !== null && selection !== NO_PUBLIC_ASSETS && publicFiles.length === 0) {
             errors.push(missingAssetsDirectoryMessage(selection));
         }
@@ -847,8 +885,26 @@ export async function checkDeployDirectory(options) {
         bytes: totalBytes,
         ...(serverCode ? { serverCode } : {}),
         ...(publicFiles ? { publicFiles } : {}),
+        ...(upload ? { upload } : {}),
     };
 }
+// The `--check` success line. Static and bundle deploys upload every file they scan, so one
+// count is the whole story there. An entry-based worker deploy uploads only the entry and
+// its public files, so it reports both counts; with no --assets/--no-assets, a choice the
+// app saved on an earlier deploy applies on the server, which a local check cannot see.
+export function deployCheckSummary(check, publicAssets) {
+    if (!check.upload) {
+        return `Deploy check passed: ${check.files} file(s), ${check.bytes} byte(s).`;
+    }
+    const publicCount = check.publicFiles?.length ?? 0;
+    const breakdown = publicAssets === NO_PUBLIC_ASSETS ? "the entry only" : `the entry + ${publicCount} public file(s)`;
+    const summary = `Deploy check passed: ${check.files} file(s) scanned, ${check.upload.files} selected for upload (${breakdown}), ` +
+        `${check.upload.bytes.toLocaleString("en-US")} byte(s) selected.`;
+    if (publicAssets !== undefined) {
+        return summary;
+    }
+    return `${summary}\n  Counted from the flags supplied (no --assets or --no-assets). If this app saved a public-assets choice on an earlier deploy, that choice applies on deploy and only the entry and the files it makes public are uploaded.`;
+}
 export async function whoami(options) {
     return apiRequest(options, "/v1/me", { method: "GET" });
 }
@@ -1324,6 +1380,16 @@ export async function listSites(options) {
     const payload = await apiRequest(options, route, { method: "GET" });
     return { projects: payload.projects };
 }
+// Printed before the delete request, never as a prompt: agents run this non-interactively
+// and `--confirm` is already the consent. The address part is the one nobody expects:
+// the hostname's suffix comes from the project id (appHostnameForProject), a new app gets
+// a new random id, and no route renames a project, so the same slug never gets it back.
+export function deleteWarningLines(slug) {
+    return [
+        `Warning: deleting ${slug} also gives up its address for good. An app created again under the same slug gets a new address, so links, bookmarks and printed QR codes pointing at the current one will stop working.`,
+        "Its deployments, files and managed database (if it has one) are deleted with it and cannot be recovered.",
+    ];
+}
 export async function deleteSite(options) {
     const route = `/v1/sites/${encodeURIComponent(options.site)}${options.owner ? `?owner=${encodeURIComponent(options.owner)}` : ""}`;
     const payload = await apiRequest(options, route, {
@@ -2305,7 +2371,14 @@ function buildContainerImage(directory) {
     const tempDir = mkdtempSync(path.join(os.tmpdir(), "9pm-container-"));
     const tag = `9pm-local-${Date.now()}-${process.pid}`;
     const imagePath = path.join(tempDir, "image.tar");
-    runDocker(["build", "--platform", "linux/amd64", "-t", tag, root], "build container image");
+    // Build without Buildx's default provenance attestation. With it, Docker Desktop saves the
+    // image as an index carrying an attestation manifest, and the push to Cloudflare's registry
+    // through `wrangler containers push` fails with "blob unknown to registry"; the same image
+    // without the attestation pushes (#1906: two of two attempts each way). The environment
+    // variable rather than `--provenance=false`: it is what that test pushed, and a builder that
+    // has no attestations - the legacy non-Buildx `docker build` - ignores an unknown variable
+    // where it would reject an unknown flag. SBOM generation is untouched: it is off by default.
+    runDocker(["build", "--platform", "linux/amd64", "-t", tag, root], "build container image", { BUILDX_NO_DEFAULT_ATTESTATIONS: "1" });
     const inspected = spawnSync("docker", ["image", "inspect", tag, "--format", "{{.Os}}/{{.Architecture}}"], { encoding: "utf8" });
     if (inspected.status !== 0) {
         throw new Error(`Failed to inspect container image: ${inspected.stderr || inspected.stdout}`.trim());
@@ -2318,8 +2391,8 @@ function buildContainerImage(directory) {
     const sha256 = createHash("sha256").update(readFileSync(imagePath)).digest("hex");
     return { tag, path: imagePath, size, sha256 };
 }
-function runDocker(args, action) {
-    const result = spawnSync("docker", args, { stdio: "inherit" });
+function runDocker(args, action, extraEnv = {}) {
+    const result = spawnSync("docker", args, { stdio: "inherit", env: { ...process.env, ...extraEnv } });
     if (result.status !== 0) {
         throw new Error(`Failed to ${action}.`);
     }
@@ -3053,21 +3126,45 @@ function parseDeploymentsArgs(argv) {
     }
     throw new Error(`Unknown deployments subcommand: ${subcommand}`);
 }
+export function deploymentStatusLabel(deployment) {
+    if (deployment.active) {
+        return "serving";
+    }
+    return deployment.status === "active" ? "active, not serving" : deployment.status;
+}
+export function formatDeploymentsList(deployments) {
+    if (deployments.length === 0) {
+        return ["No deployments."];
+    }
+    const header = ["ID", "VERSION", "STATUS", "CREATED"];
+    const rows = deployments.map((deployment) => [deployment.id, `v${deployment.version}`, deploymentStatusLabel(deployment), deployment.createdAt]);
+    const widths = header.map((title, column) => Math.max(title.length, ...rows.map((row) => (row[column] ?? "").length)));
+    const render = (cells) => cells.map((cell, column) => (column === cells.length - 1 ? cell : cell.padEnd(widths[column] ?? 0))).join("  ");
+    const lines = [render(header), ...rows.map(render), ""];
+    const serving = deployments.find((deployment) => deployment.active);
+    lines.push(serving ? `Serving: v${serving.version} (${serving.id}).` : "No deployment is serving this app.");
+    if (deployments.some((deployment) => !deployment.active && deployment.status === "active")) {
+        lines.push('Rows marked "active, not serving" are earlier deploys that finished; they no longer receive traffic.');
+    }
+    return lines;
+}
+export function deploymentsListJson(deployments) {
+    return {
+        servingDeploymentId: deployments.find((deployment) => deployment.active)?.id ?? null,
+        deployments: deployments.map((deployment) => ({ ...deployment, serving: deployment.active })),
+    };
+}
 async function runDeploymentsCommand(command) {
     const base = { apiUrl: command.apiUrl, token: command.token };
     const action = command.action;
     if (action.kind === "ls") {
         const result = await apiRequest(base, `/v1/sites/${encodeURIComponent(action.site)}/deployments`, { method: "GET" });
         if (action.json) {
-            console.log(JSON.stringify(result, null, 2));
+            console.log(JSON.stringify({ ...result, ...deploymentsListJson(result.deployments) }, null, 2));
             return;
         }
-        if (result.deployments.length === 0) {
-            console.log("No deployments.");
-            return;
-        }
-        for (const deployment of result.deployments) {
-            console.log(`${deployment.active ? "*" : " "} ${deployment.id}\tv${deployment.version}\t${deployment.status}\t${deployment.createdAt}`);
+        for (const line of formatDeploymentsList(result.deployments)) {
+            console.log(line);
         }
         return;
     }
@@ -4389,7 +4486,7 @@ async function main() {
                     console.log("Deploy check passed: Dockerfile found and Docker is available.");
                 }
                 else {
-                    console.log(`Deploy check passed: ${check.files} file(s), ${check.bytes} byte(s).`);
+                    console.log(deployCheckSummary(check, command.options.publicAssets));
                     if (check.serverCode) {
                         // The compressed server-code figure, printed on success as well as on
                         // warning/rejection, so the number the size limit is enforced on is always
@@ -4438,10 +4535,10 @@ async function main() {
                 const siteFlag = slug ? ` --site ${quoteSiteArg(slug)}` : "";
                 throw new Error(`${base}\n\nStuck? Report it with context: 9pm support${siteFlag} -m "<what happened>"`);
             }
-            const databaseLine = result.database ? `database ${result.database.bindingName}:${result.database.name}` : "no database";
+            const databaseClause = deployDatabaseClause(result.databases);
             const queued = result.deployment.status === "queued" || result.deployment.status === "publishing";
             console.log(`${queued ? "Queued" : "Deployed"} ${result.project.slug} -> ${result.url}`);
-            console.log(`Deployment ${result.deployment.id} ${result.containerImageBytes ? `uploaded ${formatBytesForCli(result.containerImageBytes)} image` : `uploaded ${result.uploaded} file(s)`}, ${databaseLine}.`);
+            console.log(`Deployment ${result.deployment.id} ${result.containerImageBytes ? `uploaded ${formatBytesForCli(result.containerImageBytes)} image` : `uploaded ${result.uploaded} file(s)`}${databaseClause ? `, ${databaseClause}` : ""}.`);
             if (queued) {
                 console.log(`Status: ${result.deployment.status}. Run 9pm apps to check when it becomes active.`);
             }
@@ -4637,6 +4734,9 @@ async function main() {
             return;
         }
         if (command.kind === "delete") {
+            for (const line of deleteWarningLines(command.confirmSlug)) {
+                console.warn(line);
+            }
             const deleted = await deleteSite({
                 apiUrl: command.apiUrl,
                 token: command.token,
@@ -5028,7 +5128,7 @@ Container deploys:
   Requires Docker locally. The CLI builds linux/amd64, exports the image, uploads it through a short-lived session, then finalizes a queued deployment.
   The app must listen on 0.0.0.0:$PORT - always read the PORT env var; on some placements the platform holds the selected --port and hands the app a different one. Use --health-path for a cheap readiness endpoint.
   With --with-db, containers receive NINEPM_SQL_URL and NINEPM_DB_BINDINGS for the managed SQL bridge, plus NINEPM_SQL_TOKEN where that bridge requires one - send it as "Authorization: Bearer <token>" or every query is refused.
-  With --with-auth, the app gets 9pm-managed end-user accounts (email one-time codes); it implies --with-db and is one-way (enable-only).
+  With --with-auth, the app gets 9pm-managed end-user accounts (email one-time codes); it implies --with-db and is one-way: once enabled it stays on for every later deploy of the app, with or without the flag.
   With --with-email, a signed-in end user can send app invitation emails; it implies --with-auth and works on public apps only.
   9pm env set <app> KEY=value [KEY2=value2 ...] [--var]   (secret by default; --var = readable config)
   9pm env set <app> --from-file <path> [--var]            (KEY=value lines; # comments, export prefix, quotes ok)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ninepm",
-  "version": "0.65.0",
+  "version": "0.69.0",
   "description": "CLI for deploying built apps to 9pm.ai.",
   "homepage": "https://9pm.ai",
   "keywords": [