Deploy - Add 'Made with Kilo' banner for app-builder deployments

[eshurakov]

Summary

• Adds an injectable "Made with Kilo App Builder" badge that appears on deployed sites created via App Builder. The banner is injected server-side using HTMLRewriter with CSP nonce support.
• Introduces banner management API routes on the dispatcher (GET/PUT/DELETE /api/app-builder-banner/:worker) backed by KV storage, along with corresponding tRPC endpoints and a UI toggle in the deployment details panel.
• Auto-enables the banner when creating app-builder deployments. Adds a created_from column to the deployments table to distinguish app-builder vs regular deployments.
• Cleans up dispatcher client: replaces manual type assertions with zod schema validation for all API responses.

Changes

Dispatcher worker (cloudflare-deploy-infra/dispatcher/):

• banner/banner-store.ts - KV-backed banner state (enable/disable/check)
• banner/inject-banner.ts - HTMLRewriter-based script injection with CSP nonce handling
• routes/api.ts - Banner CRUD routes
• index.ts - Intercepts HTML responses to inject banner when enabled
• schemas.ts - Shared schema cleanup (removed deletePasswordResponseSchema, added successResponseSchema, getBannerResponseSchema)

Backend (src/):

• db/schema.ts + migration - Adds created_from column to deployments
• lib/user-deployments/dispatcher-client.ts - Banner API methods + zod validation for all responses
• lib/user-deployments/deployments-service.ts - Auto-enable banner on app-builder deploy, clean up banner on delete
• routers/deployments-router.ts + organization-deployments-router.ts - getBannerStatus/setBanner tRPC endpoints

Demo:

https://rotating-unicorn.d.kiloapps.io

[kiloconnect]

Code Review Summary

Status: 7 Issues Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	1
WARNING	4
SUGGESTION	2

Fix these issues in Kilo Cloud

Issue Details (click to expand)

CRITICAL

File	Line	Issue
src/lib/user-deployments/deployments-service.ts	662	Payment gating can be bypassed if createdFrom is incorrect

WARNING

File	Line	Issue
cloudflare-deploy-infra/dispatcher/src/banner/banner-store.ts	9	KV cacheTtl=60 delays banner enable/disable propagation
cloudflare-deploy-infra/dispatcher/src/banner/inject-banner.ts	41	CSP parsing assumes a literal space separator, can mis-parse directives
cloudflare-deploy-infra/dispatcher/src/banner/inject-banner.ts	103	Response body rewrite should clear validators like etag/last-modified
src/db/schema.ts	1401	deployments.created_from has no DB-level constraint / nullability

SUGGESTION

File	Line	Issue
cloudflare-deploy-infra/dispatcher/src/index.ts	113	content-type detection is case-sensitive (may miss Text/Html variants)
cloudflare-deploy-infra/dispatcher/src/banner/inject-banner.ts	24	addNonceToDirective can emit leading whitespace when directive value is empty

Other Observations (not in diff)

Issues found in unchanged code that cannot receive inline comments:

File	Line	Issue
N/A	N/A	None

Files Reviewed (11 files)

• cloudflare-deploy-infra/dispatcher/src/banner/banner-store.ts - 1 issue
• cloudflare-deploy-infra/dispatcher/src/banner/inject-banner.ts - 3 issues
• cloudflare-deploy-infra/dispatcher/src/index.ts - 1 issue
• cloudflare-deploy-infra/dispatcher/src/routes/api.ts - 0 issues
• cloudflare-deploy-infra/dispatcher/src/schemas.ts - 0 issues
• src/lib/user-deployments/deployments-service.ts - 1 issue
• src/lib/user-deployments/dispatcher-client.ts - 0 issues
• src/lib/app-builder/app-builder-service.ts - 0 issues
• src/db/schema.ts - 1 issue
• src/routers/deployments-router.ts - 0 issues
• src/routers/organizations/organization-deployments-router.ts - 0 issues

[vercel]

Deployment failed with the following error:

The value for maxDuration must be between 1 second and 300 seconds, in order to increase this limit upgrade your plan: https://vercel.com/pricing

Learn More: https://vercel.com/docs/functions/limitations