wawesome 0.9.0 → 0.10.0

package/README.md

@@ -501,6 +501,41 @@ That is deliberate — the line that keeps a job off the internet is one line, a
 quietly honoured its deletion would put the job back on the open internet with nothing said. Every
 deploy prints the visibility it landed, beside the URL or in place of it.
 
+### A domain of your own
+
+Add `"domain"` and your App answers at a name you own, beside the address it already has:
+
+```json
+{
+  "app": "my-app",
+  "function": "api",
+  "entry": "src/index.ts",
+  "domain": "shop.client.com"
+}
+```
+
+The deploy attaches it and prints two DNS records to add at your registrar. The TXT record proves you
+own the name, which is what issues the certificate. The CNAME points traffic here, and you add that
+one once the certificate is issued, so a site that is already live never spends a minute answering on
+a certificate that is not there yet.
+
+Your deploy waits for neither. It attaches the domain, prints the records and finishes, and every
+later deploy states where the domain got to: not verified, ownership verified, certificate issued, or
+serving. A domain that is already serving is a line saying so and nothing else.
+
+A custom domain is granted from the Solo plan upwards, one per App. On a plan that grants none, the
+deploy prints the refusal and lands everything else it was doing.
+
+The address derived from your workspace slug keeps serving after you attach a domain. Both names
+answer, so webhooks and integrations already pointed at the old one keep working.
+
+An apex domain — `client.com` with no `www` — attaches like any other name. Whether a CNAME may sit at
+your zone root is your DNS provider's rule, and where it cannot, attach `www.client.com` and configure
+the redirect at the provider.
+
+Deleting the line detaches nothing. Detaching takes a live site dark, which is not something a deploy
+should infer from a deleted line.
+
 ### Reserved headers
 
 `x-wawesome-*` belongs to the platform in both directions. It is stripped off the request before your

package/dist/index.mjs

@@ -883,7 +883,7 @@ async function buildJs(entryInput, options) {
 * that has to name this version — `--version`, the dependency a scaffolded
 * project pins — reads it here, so a release bumps one file.
 */
-const CLI_VERSION = "0.9.0";
+const CLI_VERSION = "0.10.0";
 //#endregion
 //#region src/prompt.ts
 /**
@@ -1481,6 +1481,187 @@ function scheduleLines(schedules) {
 	return ["  Schedules:", ...[...schedules].sort((a, b) => a.name.localeCompare(b.name)).map((schedule) => `    ${schedule.name.padEnd(nameWidth)}  ${schedule.expression.padEnd(expressionWidth)}  ${whenItRuns(schedule)}`)];
 }
 //#endregion
+//#region src/billing.ts
+function billingPageUrl() {
+	const base = getDashboardUrl().replace(/\/+$/, "");
+	try {
+		return new URL("billing", `${base}/`).toString();
+	} catch {
+		return `${base}/billing`;
+	}
+}
+/** Refusals whose remedy is on the billing page and nowhere else. */
+const PLAN_LIMITS = [
+	"app-slots-exhausted",
+	"storage-exhausted",
+	"paid-plan-required",
+	"payment-required",
+	"schedule-suspended"
+];
+/** The rule itself is the gateway's prose, and is deliberately not restated here. */
+function planLimitAdvice(reason) {
+	if (!reason || !PLAN_LIMITS.includes(reason)) return "";
+	return `Where to resolve it: ${billingPageUrl()}`;
+}
+//#endregion
+//#region src/domains.ts
+/**
+* The domain this project declares, refused here rather than at the gateway so
+* a value of the wrong shape is a message at the keyboard. What makes a legal
+* hostname is the platform's rule and is deliberately not restated: a name it
+* turns down is reported by the deploy that asked, without failing it.
+*/
+function declaredDomain(value) {
+	if (value === void 0 || value === null) return void 0;
+	if (typeof value === "string" && value.trim()) return value.trim();
+	console.error(`[wawesome] Error: 'domain' in wawesome-function.json is '${String(value)}'.`);
+	console.error("[wawesome] It must be one hostname, e.g. \"shop.client.com\".");
+	process.exit(1);
+}
+/**
+* Attach the declared domain to the App unless it is already attached.
+*
+* Never throws, and never blocks on a domain coming up: by the time this runs
+* the code is deployed, and a certificate nobody has issued yet must not turn a
+* landed deploy into a failed one. Whatever the platform refuses is carried
+* back as prose to print rather than raised.
+*/
+async function applyDeclaredDomain(creds, app, hostname) {
+	let held;
+	try {
+		held = await listDomains(creds, app);
+	} catch (err) {
+		return {
+			kind: "unread",
+			hostname,
+			said: whatWentWrong(err)
+		};
+	}
+	const attached = held.find((domain) => isSameHostname(domain.hostname, hostname));
+	if (attached) return {
+		kind: "unchanged",
+		domain: attached
+	};
+	try {
+		return {
+			kind: "attached",
+			domain: await attachDomain(creds, app, hostname)
+		};
+	} catch (err) {
+		const refusal = err instanceof GatewayError ? err : void 0;
+		return {
+			kind: "refused",
+			hostname,
+			said: whatWentWrong(err),
+			advice: planLimitAdvice(refusal?.reason)
+		};
+	}
+}
+/**
+* The platform's own words where it has any. A credential refusal is read
+* through the same reading every other command gives one, so a CI runner is
+* told what its credential lacks rather than to sign in again.
+*/
+function whatWentWrong(err) {
+	if (err instanceof GatewayError && (err.status === 401 || err.status === 403)) return unauthorizedMessage(err.status, err.body);
+	return errorText(err);
+}
+/**
+* The comparison the platform makes: a name is held lowercase without its
+* trailing dot, so `shop.client.com.` in the file is the domain already
+* attached rather than a second one to ask for on every deploy.
+*/
+function isSameHostname(held, declared) {
+	const same = (name) => name.trim().replace(/\.+$/, "").toLowerCase();
+	return same(held) === same(declared);
+}
+async function listDomains(creds, app) {
+	const res = await authorizedFetch(domainsUrl(creds, app), {
+		method: "GET",
+		headers: { Authorization: `Bearer ${creds.tenant_jwt}` }
+	});
+	if (!res.ok) throw await asGatewayError(res, `The App's domains could not be read (HTTP ${res.status}).`);
+	const { domains = [] } = await res.json();
+	return domains;
+}
+async function attachDomain(creds, app, hostname) {
+	const res = await authorizedFetch(domainsUrl(creds, app), {
+		method: "POST",
+		headers: {
+			Authorization: `Bearer ${creds.tenant_jwt}`,
+			"Content-Type": "application/json"
+		},
+		body: JSON.stringify({ hostname })
+	});
+	if (!res.ok) throw await asGatewayError(res, `'${hostname}' could not be attached (HTTP ${res.status}).`);
+	const { domain } = await res.json();
+	return domain;
+}
+function domainsUrl(creds, app) {
+	return `${creds.gateway_url}/v1/apps/${encodeURIComponent(app)}/domains`;
+}
+/**
+* Where a domain got to, said beside the name itself.
+*
+* Each state names the one record that is outstanding, because the two are
+* added a day apart: the TXT issues the certificate, and the CNAME is pointed
+* here afterwards so a site that is already live never answers on a
+* certificate that is not there yet.
+*/
+function whereItGotTo(state) {
+	if (state.serving) return "serving";
+	if (state.certificate_active) return "certificate issued, so point the CNAME here to cut over";
+	if (state.ownership_verified) return "ownership verified, and the certificate is being issued";
+	return "not verified yet, so add the TXT record below";
+}
+function whatItIsFor(record) {
+	return record.purpose === "certificate" ? "Proves you own the name, and issues the certificate" : "Points traffic here, once the certificate is issued";
+}
+const VALUE_COLUMN = " ".repeat(14);
+/**
+* The block a deploy prints for the domain its configuration declares, in the
+* columns the visibility and URL lines above it already use.
+*/
+function domainLines(outcome) {
+	if (outcome.kind === "unread") return [
+		"",
+		`  Domain:     \x1b[33m${outcome.hostname} — could not be read\x1b[0m`,
+		...wrapped(outcome.said).map((line) => `${VALUE_COLUMN}${line}`),
+		`${VALUE_COLUMN}Nothing about the domain changed, and the deploy landed.`
+	];
+	if (outcome.kind === "refused") return [
+		"",
+		`  Domain:     \x1b[33m${outcome.hostname} — not attached\x1b[0m`,
+		...wrapped(outcome.said).map((line) => `${VALUE_COLUMN}${line}`),
+		...outcome.advice ? [`${VALUE_COLUMN}${outcome.advice}`] : [],
+		`${VALUE_COLUMN}The deploy landed, and this App's other address still answers.`
+	];
+	const { hostname, records, state, last_checked_at } = outcome.domain;
+	const lines = ["", `  Domain:     \x1b[36m${hostname}\x1b[0m — ${whereItGotTo(state)}`];
+	if (state.serving) {
+		lines.push(`${VALUE_COLUMN}The address above answers too, so nothing pointed at it breaks.`);
+		return lines;
+	}
+	if (last_checked_at) lines.push(`${VALUE_COLUMN}Last checked ${asUtc$1(last_checked_at)}.`);
+	const nameWidth = Math.max(...records.map((record) => record.name.length));
+	lines.push("", "  DNS records to add at your registrar:");
+	for (const record of records) lines.push("", `    ${whatItIsFor(record)}:`, `      ${record.type.padEnd(5)}  ${record.name.padEnd(nameWidth)}  ${record.value}`);
+	lines.push("", `${VALUE_COLUMN}The deploy is finished. This domain comes up on its own`, `${VALUE_COLUMN}once the records resolve.`);
+	return lines;
+}
+/** The platform's own prose, kept inside the block it is printed in. */
+function wrapped(said) {
+	const width = 64;
+	const lines = [];
+	let line = "";
+	for (const word of said.split(/\s+/).filter(Boolean)) if (line && `${line} ${word}`.length > width) {
+		lines.push(line);
+		line = word;
+	} else line = line ? `${line} ${word}` : word;
+	if (line) lines.push(line);
+	return lines;
+}
+//#endregion
 //#region src/usage.ts
 const USAGE_TIMEOUT_MS = 2e3;
 /**
@@ -1640,29 +1821,6 @@ function widest(values) {
 	return values.reduce((longest, value) => Math.max(longest, value.length), 0);
 }
 //#endregion
-//#region src/billing.ts
-function billingPageUrl() {
-	const base = getDashboardUrl().replace(/\/+$/, "");
-	try {
-		return new URL("billing", `${base}/`).toString();
-	} catch {
-		return `${base}/billing`;
-	}
-}
-/** Refusals whose remedy is on the billing page and nowhere else. */
-const PLAN_LIMITS = [
-	"app-slots-exhausted",
-	"storage-exhausted",
-	"paid-plan-required",
-	"payment-required",
-	"schedule-suspended"
-];
-/** The rule itself is the gateway's prose, and is deliberately not restated here. */
-function planLimitAdvice(reason) {
-	if (!reason || !PLAN_LIMITS.includes(reason)) return "";
-	return `Where to resolve it: ${billingPageUrl()}`;
-}
-//#endregion
 //#region src/assets.ts
 /**
 * The files under `dir`, hashed.
@@ -1943,6 +2101,7 @@ async function deploy(entryInput, options) {
 		visibility: declaredVisibility(config.visibility),
 		confirmPublish: Boolean(options.publish)
 	};
+	const domainName = declaredDomain(config.domain);
 	if (isVerbose) {
 		console.log(`[wawesome:verbose] Deploying to app=${app}, function=${funcName}`);
 		console.log(`[wawesome:verbose] Gateway: ${creds.gateway_url}`);
@@ -2077,6 +2236,7 @@ async function deploy(entryInput, options) {
 	} catch (err) {
 		if (isVerbose) console.log(`[wawesome:verbose] Could not resolve the workspace address: ${err instanceof Error ? err.message : err}`);
 	}
+	const domain = domainName ? await applyDeclaredDomain(creds, app, domainName) : null;
 	let headroom = null;
 	try {
 		headroom = headroomLines(await fetchTenantUsage(creds));
@@ -2106,6 +2266,7 @@ async function deploy(entryInput, options) {
 		console.log("              Set CONTENT_ORIGIN on it, or ALLOW_PATH_INVOCATION_FORM");
 		console.log("              for local development.");
 	}
+	if (domain) for (const line of domainLines(domain)) console.log(line);
 	if (headroom) {
 		console.log("");
 		for (const line of headroom) console.log(line);
@@ -2116,7 +2277,8 @@ async function deploy(entryInput, options) {
 		functionName: funcName,
 		version,
 		address,
-		schedules
+		schedules,
+		domain
 	};
 }
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wawesome",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "CLI tool for building and deploying serverless functions on wawesome.io platform",
   "type": "module",
   "bin": {