railcode 0.1.18 → 0.1.19

package/dist/index.js

@@ -4382,8 +4382,9 @@ class CliError extends Error {
 // dev — local development server (`railcode dev`)
 //
 // Serves the app on a single loopback origin and emulates the /_api/* data plane:
-// identity is synthetic, KV + files live on local disk. llm/sql/connections proxy
-// to the real instance (added in a later milestone). Mirrors railcode-core's dev.
+// identity is synthetic, KV + files live on local disk. llm/sql/queries/connectors/email
+// proxy to the real instance as the signed-in user (their token + org grants) via the
+// org/user-scoped routes — no deploy needed. Mirrors railcode-core's dev.
 // ---------------------------------------------------------------------------
 const DEFAULT_DEV_PORT = 7331;
 const DEFAULT_ASSET_PORT = 5173;
@@ -4922,8 +4923,10 @@ async function handleLocalApi(ctx, req, res, url) {
         path === "/llm/generate" ||
         path === "/llm/stream" ||
         path === "/llm/providers" ||
+        path === "/email" ||
+        path === "/email/send" ||
         path === "/service-connectors" ||
-        path === "/service-connectors/request") {
+        path.startsWith("/service-connectors/")) {
         await forwardCompute(ctx, req, res, path, url);
         return;
     }
@@ -5113,27 +5116,29 @@ function devCreds(config) {
         return null;
     return { apiUrl: normalizeApiOrigin(apiUrl), token, orgUuid };
 }
-// Resolve the server-side app for proxying — lazily and memoized. Local dev must
-// not create product apps: an app becomes real on first successful deploy, not on
-// a dev-time SQL/LLM/connector call.
-function resolveDevAppUuid(ctx, creds) {
-    const base = `${creds.apiUrl}/api/organizations/${creds.orgUuid}/apps`;
-    const authed = { Authorization: `Bearer ${creds.token}` };
-    if (!ctx.appUuidPromise) {
-        ctx.appUuidPromise = (async () => {
-            try {
-                const resp = await fetch(base, { headers: authed });
-                if (!resp.ok)
-                    return null;
-                const apps = (await resp.json());
-                return apps.find((a) => a.app_slug === ctx.app && a.status === "active")?.uuid ?? null;
-            }
-            catch {
-                return null;
-            }
-        })();
-    }
-    return ctx.appUuidPromise;
+// Map a local-dev /_api compute path to the real org/user-scoped upstream URL. Local
+// dev invokes compute as the signed-in user (their personal token + org grants), NOT
+// as a deployed app — so no `railcode deploy` is needed first. The app slug still
+// namespaces local KV/files, but plays no part here. Deployed apps keep their own
+// bearer app-scoped routes (.../apps/{app}/...); this is deliberately the user plane.
+export function devComputeTarget(creds, path, search) {
+    const org = `${creds.apiUrl}/api/organizations/${creds.orgUuid}`;
+    if (path === "/connections")
+        return `${org}/data/connections${search}`;
+    if (path === "/sql")
+        return `${org}/data/sql${search}`;
+    if (path === "/queries" || path.startsWith("/queries/"))
+        return `${org}/data${path}${search}`;
+    if (path === "/service-connectors" || path.startsWith("/service-connectors/")) {
+        return `${org}/data${path}${search}`;
+    }
+    if (path === "/llm/providers" || path === "/llm/generate" || path === "/llm/stream") {
+        return `${org}${path}${search}`;
+    }
+    if (path === "/email" || path === "/email/send") {
+        return `${org}${path}${search}`;
+    }
+    return null;
 }
 export function devUpstreamAuthFallback(status, degradeOk) {
     if (status !== 401)
@@ -5164,19 +5169,13 @@ async function forwardCompute(ctx, req, res, path, url) {
             return sendJson(res, 200, []);
         return sendJson(res, 503, {
             error: "not_logged_in",
-            message: "Run `railcode login` to use LLM and connectors in dev.",
+            message: "Run `railcode login` to use LLM, SQL, saved queries, connectors, and email in dev.",
         });
     }
-    const appUuid = await resolveDevAppUuid(ctx, creds);
-    if (!appUuid) {
-        if (degradeOk)
-            return sendJson(res, 200, []);
-        return sendJson(res, 503, {
-            error: "app_unavailable",
-            message: "Deploy this app once before using LLM, SQL, saved queries, or connectors in dev.",
-        });
+    const target = devComputeTarget(creds, path, url.search);
+    if (!target) {
+        return sendJson(res, 404, { detail: "not found" });
     }
-    const target = `${creds.apiUrl}/api/organizations/${creds.orgUuid}/apps/${appUuid}${path}${url.search}`;
     const body = req.method === "POST" ? await readBody(req) : undefined;
     const headers = {
         Authorization: `Bearer ${creds.token}`,
@@ -5409,10 +5408,11 @@ function printDevBanner(ctx, config) {
     const creds = devCreds(config);
     if (creds) {
         console.log(`  account:   ${config.email ?? "?"} @ ${creds.apiUrl}`);
-        console.log(`  proxied:   llm/sql/connectors → real instance (REAL spend + data)`);
+        console.log(`  compute:   llm/sql/queries/connectors/email → real instance (REAL spend + data)`);
+        console.log(`  runs as:   you — your saved token + org permissions (no deploy needed)`);
     }
     else {
-        console.log(`  account:   not logged in — llm/sql return 503, connectors empty`);
+        console.log(`  account:   not logged in — llm/sql/email return 503, connectors empty`);
     }
     console.log("");
     console.log("  Ctrl-C to stop.");

package/dist/manifest.js

@@ -13,6 +13,7 @@
 //       - GET /v1/balance
 //       - GET /v1/customers/*
 //   llm: true
+//   email: true
 //   adhoc_sql:
 //     - warehouse
 //
@@ -30,7 +31,7 @@
 // test/manifest-fixtures.json (also run by
 // backend/tests/test_manifest_parse_fixtures.py) keeps the two parsers pinned.
 export const APP_MANIFEST_NAME = "manifest.yaml";
-const ALLOWED_KEYS = ["run_as", "saved_queries", "connectors", "llm", "adhoc_sql"];
+const ALLOWED_KEYS = ["run_as", "saved_queries", "connectors", "llm", "email", "adhoc_sql"];
 const HTTP_METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"];
 const SAVED_QUERY_NAME = /^[a-z0-9_]{1,80}$/;
 // PyYAML's YAML 1.1 plain-scalar resolver: a bare (unquoted) scalar matching one
@@ -322,7 +323,7 @@ function listString(s, key, num) {
         throw new ManifestParseError(`Empty list item under "${key}"`, num);
     return value;
 }
-function parseBool(s, num) {
+function parseBool(s, key, num) {
     // A quoted scalar is a STRING even if it spells a boolean — as on the server.
     if (!s.quoted) {
         if (YAML_TRUE.test(s.value))
@@ -330,7 +331,7 @@ function parseBool(s, num) {
         if (YAML_FALSE.test(s.value))
             return false;
     }
-    throw new ManifestParseError(`"llm" must be true or false (got "${s.value}")`, num);
+    throw new ManifestParseError(`"${key}" must be true or false (got "${s.value}")`, num);
 }
 // Strip the optional document markers: one leading "---" and one trailing "..."
 // are no-ops. Anything more is a multi-document stream, which the server
@@ -382,6 +383,7 @@ export function parseManifestYaml(source) {
         saved_queries: [],
         connectors: {},
         llm: false,
+        email: false,
         adhoc_sql: [],
     };
     for (const [key, entry] of entries) {
@@ -393,7 +395,10 @@ export function parseManifestYaml(source) {
             doc.run_as = value;
         }
         else if (key === "llm") {
-            doc.llm = parseBool(inlineScalar(entry, key), entry.keyLine.num);
+            doc.llm = parseBool(inlineScalar(entry, key), key, entry.keyLine.num);
+        }
+        else if (key === "email") {
+            doc.email = parseBool(inlineScalar(entry, key), key, entry.keyLine.num);
         }
         else if (key === "connectors") {
             doc.connectors = parseConnectors(entry);
@@ -644,6 +649,8 @@ export function documentOperations(doc) {
     }
     if (doc.llm)
         ops.push({ type: "llm", id: "*", label: "LLM access" });
+    if (doc.email)
+        ops.push({ type: "email", id: "*", label: "email sending" });
     for (const name of doc.adhoc_sql) {
         ops.push({ type: "connector", id: name, label: `ad-hoc SQL on "${name}"` });
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "railcode",
-  "version": "0.1.18",
+  "version": "0.1.19",
   "description": "Developer CLI for the multi-tenant Railcode platform: log in, scaffold, and deploy static apps.",
   "license": "MIT",
   "type": "module",

package/static/sdk.js

@@ -175,8 +175,8 @@
     }
     return shorten(String(res), 48);
   }
-  function track(kind, label2, thunk) {
-    const entry = { kind, label: label2, status: "pending", t0: performance.now() };
+  function track(kind, label3, thunk) {
+    const entry = { kind, label: label3, status: "pending", t0: performance.now() };
     Inspector.add(entry);
     return thunk().then(
       (res) => {
@@ -195,8 +195,8 @@
       }
     );
   }
-  function trackStream(kind, label2, streamFactory) {
-    const entry = { kind, label: label2, status: "pending", t0: performance.now() };
+  function trackStream(kind, label3, streamFactory) {
+    const entry = { kind, label: label3, status: "pending", t0: performance.now() };
     Inspector.add(entry);
     return async function* () {
       let textLen = 0;
@@ -234,10 +234,10 @@
   };
   var runSQL = (engine, connection, query2, params) => {
     const trimmed = shorten(query2.replace(/\s+/g, " ").trim(), QUERY_LABEL_MAX);
-    const label2 = `${engine ?? "data"}(${q(connection)}).runSQL(${q(trimmed)}${params && params.length ? `, ${shorten(JSON.stringify(params), PARAMS_LABEL_MAX)}` : ""})`;
+    const label3 = `${engine ?? "data"}(${q(connection)}).runSQL(${q(trimmed)}${params && params.length ? `, ${shorten(JSON.stringify(params), PARAMS_LABEL_MAX)}` : ""})`;
     return track(
       "sql",
-      label2,
+      label3,
       () => call("POST", "/sql", {
         // engine is advisory; omit it for the generic data() namespace so the backend
         // dispatches on the connection's stored kind. postgres() pins engine="postgres".
@@ -387,6 +387,32 @@
     return resp.markdown;
   });
 
+  // ../sdk/src/email.ts
+  function label(opts) {
+    const to = Array.isArray(opts.to) ? `${opts.to.length} recipients` : opts.to;
+    return `email.send(${q(shorten(`${to}: ${opts.subject}`, 70))})`;
+  }
+  function body(opts) {
+    const out = {
+      to: opts.to,
+      subject: opts.subject
+    };
+    if (opts.html !== void 0) out.html = opts.html;
+    if (opts.text !== void 0) out.text = opts.text;
+    if (opts.cc !== void 0) out.cc = opts.cc;
+    if (opts.bcc !== void 0) out.bcc = opts.bcc;
+    if (opts.replyTo !== void 0) out.replyTo = opts.replyTo;
+    return out;
+  }
+  function send2(opts) {
+    return track(
+      "email",
+      label(opts),
+      () => call("POST", "/email/send", { body: body(opts) })
+    );
+  }
+  var email = { send: send2 };
+
   // ../sdk/src/files.ts
   function contentTypeOf(data2, explicit) {
     if (explicit) return explicit;
@@ -431,12 +457,12 @@
   var appUsers = () => track("app-users", "appUsers()", () => call("GET", "/app-users"));
 
   // ../sdk/src/llm.ts
-  function label(method, input, opts = {}) {
+  function label2(method, input, opts = {}) {
     const preview = typeof input === "string" ? shorten(input.replace(/\s+/g, " ").trim(), 70) : `${input.length} message${input.length === 1 ? "" : "s"}`;
     const output = opts.output?.type === "json" ? " \u2192 json" : "";
     return `llm.${method}(${q(preview)})${output}`;
   }
-  function body(input, opts = {}) {
+  function body2(input, opts = {}) {
     const out = Array.isArray(input) ? { messages: input } : { input };
     if (opts.model !== void 0) out.model = opts.model;
     if (opts.provider !== void 0) out.provider = opts.provider;
@@ -452,7 +478,7 @@
       method: "POST",
       credentials: "include",
       headers: { "Content-Type": "application/json" },
-      body: JSON.stringify(body(input, opts))
+      body: JSON.stringify(body2(input, opts))
     });
     if (!resp.ok) throw new ApiError(resp.status, await resp.text());
     return await resp.json();
@@ -465,7 +491,7 @@
       method: "POST",
       credentials: "include",
       headers: { "Content-Type": "application/json" },
-      body: JSON.stringify(body(input, opts))
+      body: JSON.stringify(body2(input, opts))
     });
     if (!resp.ok) throw new ApiError(resp.status, await resp.text());
     if (!resp.body) throw new Error("LLM stream response has no body.");
@@ -493,10 +519,10 @@
     }
   }
   function generate(input, opts = {}) {
-    return track("llm", label("generate", input, opts), () => doGenerate(input, opts));
+    return track("llm", label2("generate", input, opts), () => doGenerate(input, opts));
   }
   function stream(input, opts = {}) {
-    return trackStream("llm", label("stream", input, opts), () => doStream(input, opts));
+    return trackStream("llm", label2("stream", input, opts), () => doStream(input, opts));
   }
   var llm = { generate, stream };
   var llmProviders = () => track("llm", "llmProviders()", () => call("GET", "/llm/providers"));
@@ -504,10 +530,10 @@
   // ../sdk/src/queries.ts
   var PARAMS_LABEL_MAX2 = 40;
   var query = (name, params) => {
-    const label2 = `query(${q(name)}${params && Object.keys(params).length ? `, ${shorten(JSON.stringify(params), PARAMS_LABEL_MAX2)}` : ""})`;
+    const label3 = `query(${q(name)}${params && Object.keys(params).length ? `, ${shorten(JSON.stringify(params), PARAMS_LABEL_MAX2)}` : ""})`;
     return track(
       "sql",
-      label2,
+      label3,
       () => call("POST", `/queries/${encPath(name)}`, {
         body: { params: params || {} }
       }).then(toSqlRows)
@@ -518,22 +544,22 @@
   // ../sdk/src/service-connectors.ts
   var PATH_LABEL_MAX = 60;
   var toResponse = (env) => {
-    const body2 = env.body ?? "";
+    const body3 = env.body ?? "";
     return {
       status: env.status,
       ok: env.ok,
       headers: env.headers || {},
       truncated: Boolean(env.truncated),
-      text: () => Promise.resolve(body2),
-      json: () => Promise.resolve(JSON.parse(body2))
+      text: () => Promise.resolve(body3),
+      json: () => Promise.resolve(JSON.parse(body3))
     };
   };
   var request = (name, path, opts) => {
     const method = (opts?.method || "GET").toUpperCase();
-    const label2 = `connector(${q(name)}).fetch(${q(method)} ${q(shorten(path, PATH_LABEL_MAX))})`;
+    const label3 = `connector(${q(name)}).fetch(${q(method)} ${q(shorten(path, PATH_LABEL_MAX))})`;
     return track(
       "connector",
-      label2,
+      label3,
       () => call("POST", "/service-connectors/request", {
         body: { connector: name, method, path, body: opts?.body }
       }).then(toResponse)
@@ -555,6 +581,7 @@
   target.me = me;
   target.appUsers = appUsers;
   target.designSystem = designSystem;
+  target.email = email;
   target.llm = llm;
   target.llmProviders = llmProviders;
   target.data = data;