feat(deploy): notify clients of new releases

lib/events/sse.test.ts

@@ -38,10 +38,22 @@ describe("SSE stream", () => {
     expect(decoder.decode((await reader.read()).value)).toBe(
       'event: invalidation\ndata: {"type":"page.updated","id":"opaque","version":7}\n\n',
     );
+    channel.sendNamed("deployment", "release-2");
+    expect(decoder.decode((await reader.read()).value)).toBe(
+      "event: deployment\ndata: release-2\n\n",
+    );
     await vi.advanceTimersByTimeAsync(50);
     expect(decoder.decode((await reader.read()).value)).toMatch(/^: heartbeat /u);
     await vi.advanceTimersByTimeAsync(49);
     expect((await reader.read()).done).toBe(true);
     expect(onClose).toHaveBeenCalledTimes(1);
   });
+
+  it("rejects event names that could inject another SSE field", () => {
+    const channel = createEventStream();
+    expect(() => channel.sendNamed("deployment\ndata", "release-2")).toThrow(
+      "SSE event names",
+    );
+    channel.close();
+  });
 });