feat: add durable asset synchronization worker

2026-09-19 22:15:23 -04:00
parent 2675ea8114
commit fe7d218195
36 changed files with 2218 additions and 189 deletions
@@ -0,0 +1,42 @@
+import { existsSync } from 'node:fs';
+import { rm } from 'node:fs/promises';
+import { join } from 'node:path';
+
+const forbidden = ['CONVEX_BRIDGE_SECRET', 'CONVEX_SELF_HOSTED_ADMIN_KEY', 'APP_AUTH_PRIVATE_KEY', 'APP_AUTH_JWKS', 'TYPESAFE_API_KEY'];
+const workerEnvironmentKeys = [
+  'PATH', 'HOME', 'TMPDIR', 'NODE_ENV', 'LANG', 'LC_ALL', 'TZ', 'NODE_EXTRA_CA_CERTS',
+  'CONVEX_URL', 'CONVEX_SYNC_WORKER_SECRET', 'TOKEN_ENCRYPTION_KEY',
+  'EVE_CLIENT_ID', 'EVE_CLIENT_SECRET', 'EVE_CALLBACK_URL', 'ESI_USER_AGENT',
+  'SYNC_WORKER_ID', 'SYNC_WORKER_LEASE_MS', 'SYNC_WORKER_HEARTBEAT_MS', 'SYNC_WORKER_POLL_MS', 'SYNC_WORKER_STARTUP_CHECK',
+] as const;
+export function workerEnvironment(base: Record<string, string | undefined>): Record<string, string> {
+  return Object.fromEntries(workerEnvironmentKeys.flatMap((key) => base[key] === undefined ? [] : [[key, base[key] as string]]));
+}
+
+export async function runSyncWorkerLauncher(): Promise<void> {
+for (const name of forbidden) {
+  if (process.env[name]) throw new Error(`Sync worker refuses forbidden runtime credential: ${name}`);
+}
+if (!process.env.CONVEX_SYNC_WORKER_SECRET) throw new Error('CONVEX_SYNC_WORKER_SECRET is required for the sync worker');
+
+const bundled = join(process.cwd(), 'build', 'sync-worker.js');
+let entry = bundled;
+let temporary = false;
+if (!existsSync(entry)) {
+  entry = join('/tmp', `eve-sync-worker-${process.pid}.js`);
+  const result = await Bun.build({ entrypoints: ['workers/sync.ts'], target: 'bun', outdir: '/tmp', naming: `eve-sync-worker-${process.pid}.js`, minify: false });
+  if (!result.success) throw new Error('Could not bundle the sync worker');
+  temporary = true;
+}
+const child = Bun.spawn(['bun', entry], { env: workerEnvironment(process.env), stdin: 'inherit', stdout: 'inherit', stderr: 'inherit' });
+const interrupt = () => child.kill('SIGINT');
+const terminate = () => child.kill('SIGTERM');
+process.on('SIGINT', interrupt); process.on('SIGTERM', terminate);
+try { process.exitCode = await child.exited; }
+finally {
+  process.off('SIGINT', interrupt); process.off('SIGTERM', terminate);
+  if (temporary) await rm(entry, { force: true });
+}
+}
+
+if (import.meta.main) await runSyncWorkerLauncher();