react_on_rails_pro 17.0.1 → 17.1.0.rc.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 06ec910f84772d46edd2e91e28078de7bdbb3b4819251130bb4b70774429b545
-  data.tar.gz: fb97eae8a07604947973de8b65c2f0a73bb63cd46c84e36d6ea113431041672e
+  metadata.gz: 17f3b1f4dbed1f84fc13ee3f3a34720bdbd3dd32d04d758584e4fd1d8d90dd1d
+  data.tar.gz: 2708693a5d1cb985b18a5620955000b4b5e9491f84cdaa8a19c00441e411e0a2
 SHA512:
-  metadata.gz: c843929a0ec6a3e1193dcac3da081666f8a2176a3ae7e0f0e23751e3bacfda89066423349c72b56d63753e4b07eb5044018825079762e1248efbbfa66a029e81
-  data.tar.gz: d50cd4919cc961c7384bf79a74b5b3bd345866d1fabaaaf94d196436a71a1eb7752b76e6727191c2fb9d59ecd0070c7451ca98b693563071da53c47da1688423
+  metadata.gz: 59c9879ece288731279d23dee866571cf7c370512e60d189b55767d3b780bb976d5f5125a2bf654fbf2a1fb3fc469395d3354e8b23f6b7db1bb9571f56c651d6
+  data.tar.gz: 275bd2a78f52a9a5557ad6e72790d645b44aee7b95ce7678fdca725acacc494943da1b1b531343a3b494b92898fa78834278b85f0c97ac5ee9e06a5d16090579

data/CLAUDE.md

@@ -88,10 +88,11 @@ Order matters. If the base package isn't published first, the chain breaks.
 
 ### License Validation
 
-`ReactOnRailsPro::LicenseValidator` runs on engine startup via JWT validation.
+`ReactOnRailsPro::LicenseValidator` runs after Rails initialization via JWT validation.
 
-- License key: `REACT_ON_RAILS_PRO_LICENSE` environment variable
-- Expired licenses cause startup failures in dummy app
+- Rails token sources: `config.license_token`, then `REACT_ON_RAILS_PRO_LICENSE`
+- Node renderer token sources: `licenseToken`, then `REACT_ON_RAILS_PRO_LICENSE`
+- Missing, invalid, and expired licenses are logged without blocking startup
 - License is checked in Pro engine initializer (`lib/react_on_rails_pro/engine.rb`)
 
 ## Pro CI Workflows

data/CONTEXT.md

@@ -35,22 +35,31 @@ environment's config and a _snapshot_ of its then-live bundle. Frozen into the
 image layer.
 
 **Release-time seed** (a.k.a. **boot seed**):
-Pre-seed run by the _target_ environment's renderer container at container boot
-via `rake react_on_rails_pro:pre_seed_renderer_cache`, resolving that
-environment's _actually-live_ bundle at that moment. Readiness-gated.
+Pre-seed run by a Ruby-capable release, init, or startup step via
+`bundle exec rake react_on_rails_pro:pre_seed_renderer_cache`, resolving the target
+environment's _actually-live_ bundle. A combined Ruby+Node image can run it
+before Node; a Node-only renderer needs a Ruby-capable step with the promoted
+app artifact/config. That step and the renderer must mount the same writable
+shared volume at `RENDERER_SERVER_BUNDLE_CACHE_PATH`, or copy/sync the completed
+cache into the renderer before it starts. Renderer start/readiness waits for
+completion. Without a Ruby-capable step that makes the completed cache available
+to the renderer, use multi-source fallback plus 410 recovery or a combined
+shape.
 _Avoid_: "runtime seed" (ambiguous with the per-request 410 path).
 
 **Multi-source seed**:
 A build-time seed whose **pre-seed source** is a _list_ of endpoints (the
 built-in HTTP adapter's `rolling_deploy_previous_urls` accepts more than one).
-Staging seeds from both staging and production so the promoted image is born
-prod-ready.
+Staging can carry bundles then advertised by both staging and production, which
+improves fallback warmth but cannot determine a later production drain.
 
 **Promotion model**:
 Production is deployed by promoting the _exact staging image_, not by building a
 fresh production image. Consequence: the image's **build-time seed** used the
-_staging_ pipeline's config and a snapshot taken at staging-build time — never
-production's.
+_staging_ pipeline's config and snapshots taken at staging-build time. A
+multi-source configuration can include production's then-live bundle, but it
+still cannot know the production bundle that will be draining at a later
+promotion.
 
 **410 fallback**:
 The self-healing but slow per-request cold path: cache miss → `410 Gone` → Rails
@@ -75,35 +84,33 @@ called **renderer-before-Rails**.
 - **Seed correctness (R1)** and **Deploy ordering (R2)** are independent and
   _both_ required. R2 alone (a delay) cannot rescue a wrong seed; R1 alone
   cannot rescue Rails cutting over before the renderer is warm.
-- Under the **promotion model**, a **build-time seed** _cannot_ satisfy R1: it
-  runs in the staging pipeline against a staging snapshot, but production's
-  **draining bundle** is only known at the (later, sometimes-skipped) promotion.
-- Fix: set staging's **pre-seed source** to **production**, so the promoted
-  image is born prod-ready (build-time seed = prod's live bundle). This bounds
-  the blast radius but goes stale across _two pending promotions_.
+- Under the **promotion model**, a **build-time seed** cannot satisfy R1 for
+  every promotion: it runs against snapshots taken in the staging pipeline, but
+  production's **draining bundle** is only known at the later promotion.
+- Set staging's **pre-seed source** to both **staging and production**, so the
+  image carries each environment's then-live bundle. This keeps staging's own
+  rolling deploys warm and improves fallback warmth, but still goes stale across
+  _two pending promotions_.
 - The residual staleness window (two images built before either is promoted) is
   closed by a **release-time seed** at promotion, which resolves production's
   actually-live **draining bundle**.
-- Staging seeding prod bundles means staging's _own_ rolling deploys cold-miss
-  (staging drains staging's-previous, which is not seeded). Accepted: staging
-  SSR performance during deploys is not a goal.
 
 ### Three layers of defense
 
 Correctness is layered; each layer bounds the failure the prior one leaves open.
 
-1. **Multi-source build-time seed** — the image is born prod-ready; failure floor
-   if the boot seed can't reach the live endpoint. (Correct for a single pending
-   promotion.)
+1. **Multi-source build-time seed** — carries then-advertised bundles as a
+   failure floor if the boot seed cannot reach the live endpoint.
 2. **Boot seed (release-time)** — the correctness path: pulls the _actually-live_
-   **draining bundle** at container start, closing the two-pending-promotions
-   window. Subsumes layer 1's correctness; layer 1 remains only as a fallback.
+   **draining bundle** before renderer readiness, closing the
+   two-pending-promotions window. Layer 1 remains only as a fallback.
 3. **Deploy ordering (R2)** — renderer live+warm before Rails; readiness gates on
    the boot seed _completing_ (not succeeding — a failed seed degrades to the 410
    fallback rather than wedging the deploy).
 
 **Interdependency:** the **boot seed** returns the correct **draining bundle**
-_only because_ the renderer boots before Rails (R2). Before new Rails is live,
+only when its release-time step completes before renderer readiness and Rails
+cutover (R2). Before new Rails is live,
 the environment's live endpoint is still served by the draining old pods, so it
 advertises the draining hash. If Rails cut over first, the live endpoint would
 advertise the _new_ hash and the boot seed would miss the very bundle it needs.
@@ -116,11 +123,11 @@ Layer 2 depends on Layer 3.
 > **Domain expert:** "Because the **build-time seed** ran in the staging
 > pipeline — the image holds staging's previous bundle, not prod's **draining
 > bundle**. The seed was correct for the wrong environment."
-> **Dev:** "So if staging's **pre-seed source** points at production, the
-> promoted image is already prod-ready?"
-> **Domain expert:** "For a single pending promotion, yes. Two pending
-> promotions still go stale — that's why promotion also runs a **release-time
-> seed** against prod's live bundle."
+> **Dev:** "So does staging's **pre-seed source** including staging and
+> production guarantee the promoted image has prod's draining bundle?"
+> **Domain expert:** "No. It carries then-advertised bundles and improves the
+> fallback, but two pending promotions can still go stale. The **release-time
+> seed** against prod's live bundle establishes correctness."
 > **Dev:** "And that's enough?"
 > **Domain expert:** "That's **R1**. You still need **R2** — the new renderer
 > fleet live and warm before Rails cuts over — or you get the 410 storm anyway."

data/Gemfile.development_dependencies

@@ -89,6 +89,7 @@ group :test do
   gem "equivalent-xml"
   gem "generator_spec"
   gem "launchy"
+  gem "opentelemetry-sdk", require: false
   gem "rspec_junit_formatter"
   gem "rspec-rails"
   gem "rspec-retry"

data/Gemfile.lock

@@ -9,7 +9,7 @@ GIT
 PATH
   remote: ..
   specs:
-    react_on_rails (17.0.1)
+    react_on_rails (17.1.0.rc.0)
       addressable
       connection_pool
       execjs (~> 2.5)
@@ -20,14 +20,14 @@ PATH
 PATH
   remote: .
   specs:
-    react_on_rails_pro (17.0.1)
+    react_on_rails_pro (17.1.0.rc.0)
       async (>= 2.29)
       async-http (~> 0.95)
       execjs (~> 2.9)
       io-endpoint (~> 0.17.0)
       jwt (>= 2.5, < 4)
       nokogiri (>= 1.12, < 2)
-      react_on_rails (= 17.0.1)
+      react_on_rails (= 17.1.0.rc.0)
 
 GEM
   remote: https://rubygems.org/
@@ -256,6 +256,20 @@ GEM
       racc (~> 1.4)
     nokogiri (1.19.4-x86_64-linux-gnu)
       racc (~> 1.4)
+    opentelemetry-api (1.11.0)
+      logger
+    opentelemetry-common (0.25.1)
+      opentelemetry-api (~> 1.0)
+    opentelemetry-registry (0.6.3)
+      opentelemetry-api (~> 1.1)
+    opentelemetry-sdk (1.13.0)
+      logger
+      opentelemetry-api (~> 1.1)
+      opentelemetry-common (~> 0.20)
+      opentelemetry-registry (~> 0.2)
+      opentelemetry-semantic_conventions
+    opentelemetry-semantic_conventions (1.43.0)
+      opentelemetry-api (~> 1.0)
     ostruct (0.6.3)
     package_json (0.2.0)
     pg (1.5.6)
@@ -481,6 +495,7 @@ DEPENDENCIES
   net-http
   net-imap
   net-smtp
+  opentelemetry-sdk
   ostruct
   pg
   pry (>= 0.14.1)

data/LICENSE_SETUP.md

@@ -51,7 +51,21 @@ This change allows your application to start even with license issues, giving yo
 
 ## Installation
 
-### Environment Variable (Required)
+### Rails Application Configuration
+
+Rails applications can read the token from Rails credentials or another application-owned secret provider:
+
+```ruby
+# config/initializers/react_on_rails_pro.rb
+ReactOnRailsPro.configure do |config|
+  config.license_token = Rails.application.credentials.dig(:react_on_rails_pro, :license_token)
+end
+```
+
+Explicit nonblank configuration takes precedence over `REACT_ON_RAILS_PRO_LICENSE`. Blank configured values fall
+through to the environment variable.
+
+### Environment Variable Alternative
 
 Set the `REACT_ON_RAILS_PRO_LICENSE` environment variable:
 
@@ -72,8 +86,23 @@ heroku config:set REACT_ON_RAILS_PRO_LICENSE="your_token"
 # Add to your CI environment variables if needed
 ```
 
-Configure your license token via the `REACT_ON_RAILS_PRO_LICENSE` environment variable.
-Never commit license tokens to version control.
+Never commit license tokens to version control. Use Rails credentials, environment variables, or another secure secret
+manager.
+
+### Standalone Node Renderer Configuration
+
+The standalone Node renderer is a separate process and cannot read Rails credentials. Configure it independently using
+its `licenseToken` option or the same environment-variable fallback:
+
+```js
+reactOnRailsProNodeRenderer({
+  // Application-defined secret-manager integration:
+  licenseToken: loadLicenseTokenFromYourSecretManager(),
+});
+```
+
+Explicit nonblank `licenseToken` configuration takes precedence over `REACT_ON_RAILS_PRO_LICENSE`; blank or omitted
+configuration falls back to the environment. Token values are masked in the renderer's sanitized configuration logs.
 
 ## License Validation and Signals
 
@@ -94,10 +123,12 @@ When no license is present, the application runs in **unlicensed mode**. This is
 
 No license setup is needed for development. Developers can install and use React on Rails Pro immediately.
 
-For production deployments, configure a paid license via the `REACT_ON_RAILS_PRO_LICENSE` environment variable.
+For production deployments, configure a paid license through `config.license_token` or
+`REACT_ON_RAILS_PRO_LICENSE`. Configure a standalone Node renderer separately when you use one.
 
 > Migration note: `config/react_on_rails_pro_license.key` is no longer read.
-> If you used that file previously, move the token to `REACT_ON_RAILS_PRO_LICENSE`.
+> If you used that file previously, move the token to `config.license_token` or
+> `REACT_ON_RAILS_PRO_LICENSE`.
 
 ### For CI/CD
 
@@ -259,7 +290,9 @@ window.railsContext.rorPro;
 
 ### Warning: "No license found"
 
-This is expected behavior in development, test, and CI environments. The application will run in unlicensed mode. For production, ensure the `REACT_ON_RAILS_PRO_LICENSE` environment variable is set.
+This is expected behavior in development, test, and CI environments. The application will run in unlicensed mode. For
+production, ensure the license is available through application configuration or `REACT_ON_RAILS_PRO_LICENSE` in each
+process that validates it.
 
 ### Error: "Invalid license signature"
 
@@ -279,7 +312,7 @@ This is expected behavior in development, test, and CI environments. The applica
 **Solutions:**
 
 1. Contact [support@shakacode.com](mailto:support@shakacode.com) to renew your paid license
-2. Update the `REACT_ON_RAILS_PRO_LICENSE` environment variable with the new token
+2. Update `config.license_token`, the Node renderer's `licenseToken`, or `REACT_ON_RAILS_PRO_LICENSE` with the new token
 
 ### Error: "License plan is not valid for production use"
 
@@ -333,8 +366,8 @@ Need help?
 
 ## Security Best Practices
 
-1. ✅ **Never commit licenses to Git** — Keep license tokens in environment variables or secret managers
-2. ✅ **Use environment variables in production**
+1. ✅ **Never commit licenses to Git** — Keep license tokens in Rails credentials, environment variables, or secret managers
+2. ✅ **Give each validating process access to the token through its own configuration**
 3. ✅ **Use CI secrets for production deployment pipelines**
 4. ✅ **Don't share licenses publicly**
 

data/README.md

@@ -78,12 +78,23 @@ React on Rails Pro works **without a license token** for evaluation, development
 
 ### License Setup
 
-Once you have a paid license, set the environment variable:
+Once you have a paid license, configure it through Rails credentials:
+
+```ruby
+ReactOnRailsPro.configure do |config|
+  config.license_token = Rails.application.credentials.dig(:react_on_rails_pro, :license_token)
+end
+```
+
+Or set the environment variable:
 
 ```bash
 export REACT_ON_RAILS_PRO_LICENSE="eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9..."
 ```
 
+A standalone Node renderer cannot read Rails credentials, so pass the same token through its `licenseToken` option or
+environment when you use that deployment mode.
+
 **📖 Detailed setup instructions**: See [LICENSE_SETUP.md](./LICENSE_SETUP.md) for complete configuration guide, team setup, and troubleshooting.
 
 ---

data/app/controllers/react_on_rails_pro/rolling_deploy/bundles_controller.rb

@@ -93,10 +93,12 @@ module ReactOnRailsPro
         # mount) must pass distinct prefixes so the Rails route registry
         # doesn't raise on duplicate names.
         def draw_routes(mapper, path:, as_prefix: DEFAULT_ROUTE_PREFIX)
-          mapper.get("#{path}/manifest",
+          route_prefix = path.to_s.dup
+          route_prefix.delete_suffix!("/") while route_prefix.end_with?("/")
+          mapper.get("#{route_prefix}/manifest",
                      to: "react_on_rails_pro/rolling_deploy/bundles#manifest",
                      as: :"#{as_prefix}_manifest")
-          mapper.get("#{path}/bundles/:hash",
+          mapper.get("#{route_prefix}/bundles/:hash",
                      to: "react_on_rails_pro/rolling_deploy/bundles#show",
                      constraints: { hash: ROUTE_HASH_PATTERN },
                      as: :"#{as_prefix}_bundle")
@@ -118,15 +120,17 @@ module ReactOnRailsPro
       # bundle file.
       BUNDLE_ENTRY_NAME = "bundle.js"
 
-      PROTOCOL_VERSION = 1
+      PROTOCOL_VERSION = 2
+      ARTIFACT_IDENTITY = { scheme: "rorp-v2-sha256", version: 2 }.freeze
 
       def manifest
-        sources = safe_current_bundle_sources
+        artifacts = safe_current_artifacts
         render json: {
-          hashes: sources.map { |_, hash| hash },
+          hashes: artifacts.map(&:id),
           rsc_enabled: ReactOnRailsPro.configuration.enable_rsc_support,
           generated_at: Time.now.utc.iso8601,
-          protocol_version: PROTOCOL_VERSION
+          protocol_version: PROTOCOL_VERSION,
+          artifact_identity: ARTIFACT_IDENTITY
         }
       end
 
@@ -137,12 +141,10 @@ module ReactOnRailsPro
         # filesystem operation looks at it.
         return head(:not_found) unless SAFE_HASH_PATTERN.match?(hash)
 
-        sources = safe_current_bundle_sources
-        match = sources.find { |_, h| h == hash }
-        return head(:not_found) unless match
+        artifact = safe_current_artifacts.find { |candidate| candidate.id == hash }
+        return head(:not_found) unless artifact
 
-        bundle_path, _matched_hash = match
-        serve_bundle_tarball(bundle_path)
+        serve_bundle_tarball(artifact)
       end
 
       private
@@ -188,13 +190,7 @@ module ReactOnRailsPro
         response.headers["X-Content-Type-Options"] = "nosniff"
       end
 
-      # Wraps bundle_sources to absorb the "bundle file not present yet" case
-      # so the manifest endpoint can still 200 with an empty hashes list during
-      # the brief window after Rails boots but before assets:precompile has
-      # produced the bundle on this dyno. Returns `[]` rather than raising so
-      # the build-CI side sees "this server has nothing to seed" instead of a
-      # 500 that would otherwise show up as a noisy deploy alert.
-      def safe_current_bundle_sources
+      def safe_current_artifacts
         unless ReactOnRailsPro.configuration.node_renderer?
           Rails.logger.warn(
             "[ReactOnRailsPro::RollingDeploy::BundlesController] " \
@@ -205,103 +201,81 @@ module ReactOnRailsPro
           return []
         end
 
-        pool = ReactOnRailsPro::ServerRenderingPool::NodeRenderingPool
-        ReactOnRailsPro::RendererCacheHelpers.bundle_sources(pool, "serving rolling-deploy tarball")
+        artifacts = ReactOnRailsPro::Utils.renderer_artifacts(action_description: "serving rolling-deploy tarball")
+        artifacts.select { |artifact| artifact_servable?(artifact) }
       rescue StandardError => e
         Rails.logger.warn(
           "[ReactOnRailsPro::RollingDeploy::BundlesController] " \
-          "bundle source discovery failed: #{e.class}: #{e.message}. " \
+          "artifact discovery failed: #{e.class}: #{e.message}. " \
           "Returning empty manifest — verify bundles have been precompiled."
         )
         []
       end
 
-      def serve_bundle_tarball(bundle_path)
-        entries = tarball_entries(bundle_path)
-
-        ReactOnRailsPro::RollingDeploy::Tarball.compose_to_tempfile(entries) do |io|
-          # We've already buffered the tarball to a Tempfile inside
-          # compose_to_tempfile; send_data reads the contents once. For very
-          # large bundles a streaming send via ActionController::Live would
-          # save memory; that's deferred to a follow-up PR — the current
-          # default ceiling (200 MB) fits comfortably in memory on every
-          # Rails app instance we'd expect to deploy.
-          send_data io.read,
-                    type: "application/gzip",
-                    disposition: "inline",
-                    filename: "#{params[:hash]}.tar.gz"
+      def serve_bundle_tarball(artifact)
+        # artifact_servable? validates the original source provenance before
+        # this point. Materialize only the bytes captured by that validated
+        # artifact, then compose and consume the tarball before both bounded
+        # temp scopes close. Live webpack paths are never read under a stale ID.
+        artifact.with_materialized_files(bundle_name: BUNDLE_ENTRY_NAME) do |bundle, companions|
+          entries = { BUNDLE_ENTRY_NAME => bundle }.merge(companions)
+          ReactOnRailsPro::RollingDeploy::Tarball.compose_to_tempfile(entries) do |io|
+            # Identity correctness requires the operation-scoped artifact byte
+            # snapshots above. `send_data` adds one compressed response String;
+            # none of these bodies are memoized after this request. This is an
+            # explicit peak-memory tradeoff for a simple authenticated endpoint.
+            # Tarball::DEFAULT_MAX_SIZE is an extraction-side safety cap, not a
+            # compose-side memory limit; a future streaming response can lower
+            # peak memory without weakening the immutable-byte contract.
+            send_data io.read,
+                      type: "application/gzip",
+                      disposition: "inline",
+                      filename: "#{params[:hash]}.tar.gz"
+          end
         end
       end
 
-      # Pairs the bundle file (renamed to `bundle.js` on the wire) with the
-      # current build's companion assets. Each tarball carries the full
-      # companion set so the receiver can stage a complete cache entry without
-      # a second round-trip — matching the rolling_deploy_adapter contract
-      # that `fetch(hash)` returns bundle + assets together.
-      #
-      # Companions are skipped (with a warning) when they would shadow the
-      # bundle entry, collide with another companion's basename, or carry a
-      # name that the tarball helper would reject during compose. This
-      # matches the publish-side behavior in AssetsPrecompile where missing
-      # or unsafe assets degrade rather than fail the build.
-      def tarball_entries(bundle_path)
-        entries = { BUNDLE_ENTRY_NAME => bundle_path }
-        companion_assets.each do |asset_path|
-          name = File.basename(asset_path)
-          next if skip_companion?(name, asset_path, entries)
-
-          entries[name] = asset_path
-        end
-        entries
-      end
-
-      def skip_companion?(name, asset_path, entries)
-        if name == BUNDLE_ENTRY_NAME
-          warn_companion_skipped(
-            "companion #{asset_path.inspect} basename collides with bundle entry #{BUNDLE_ENTRY_NAME.inspect}"
-          )
-          return true
-        end
-        unless ReactOnRailsPro::RollingDeploy::Tarball::ENTRY_NAME_PATTERN.match?(name)
-          warn_companion_skipped(
-            "companion #{asset_path.inspect} basename #{name.inspect} is not a safe tarball entry name"
+      def artifact_servable?(artifact)
+        rails_root = File.realpath(File.expand_path(Rails.root.to_s))
+        if artifact.companions.each_key.any? { |name| name.casecmp?(BUNDLE_ENTRY_NAME) }
+          Rails.logger.warn(
+            "[ReactOnRailsPro::RollingDeploy::BundlesController] artifact #{artifact.id} cannot be served as a " \
+            "complete artifact because a companion collides with #{BUNDLE_ENTRY_NAME.inspect}."
           )
-          return true
+          return false
         end
-        if entries.key?(name)
-          warn_companion_skipped(
-            "duplicate companion basename #{name.inspect}; " \
-            "keeping #{entries[name].inspect}, dropping #{asset_path.inspect}"
-          )
-          return true
+        return false unless bundle_source_servable?(artifact)
+
+        invalid = artifact.companions.find do |name, source|
+          source.is_a?(RendererArtifact::InlineCompanion) ||
+            !ReactOnRailsPro::RollingDeploy::Tarball.safe_entry_name?(name) ||
+            !safe_companion_asset_path(source.to_s, rails_root, rails_root)
         end
+        return true unless invalid
+
+        name, source = invalid
+        Rails.logger.warn(
+          "[ReactOnRailsPro::RollingDeploy::BundlesController] artifact #{artifact.id} cannot be served as a " \
+          "complete artifact because #{name.inspect} resolves to unsupported source #{source_label(source)}."
+        )
         false
       end
 
-      def warn_companion_skipped(message)
-        Rails.logger.warn("[ReactOnRailsPro::RollingDeploy::BundlesController] #{message}.")
-      end
+      def bundle_source_servable?(artifact)
+        return true if File.file?(artifact.bundle)
 
-      def companion_assets
-        rails_root = File.expand_path(Rails.root.to_s)
-        rails_root_realpath = File.realpath(rails_root)
-
-        # `collect_assets` returns the live build's loadable-stats + RSC
-        # manifests; missing assets are silently dropped to match the
-        # publish-side behavior in AssetsPrecompile.
-        ReactOnRailsPro::RendererCacheHelpers.collect_assets
-                                             .map(&:to_s)
-                                             .reject { |p| ReactOnRailsPro::RendererCacheHelpers.http_url?(p) }
-                                             .filter_map do |path|
-                                               safe_companion_asset_path(path, rails_root, rails_root_realpath)
-                                             end
-      rescue StandardError => e
         Rails.logger.warn(
-          "[ReactOnRailsPro::RollingDeploy::BundlesController] " \
-          "companion asset discovery failed: #{e.class}: #{e.message}. " \
-          "Serving bundle without companion assets — RSC clients may fall back to runtime 410-retry."
+          "[ReactOnRailsPro::RollingDeploy::BundlesController] artifact #{artifact.id} cannot be served as a " \
+          "complete artifact because #{BUNDLE_ENTRY_NAME.inspect} resolves to unsupported source " \
+          "#{source_label(artifact.bundle)}."
         )
-        []
+        false
+      end
+
+      def source_label(source)
+        return "redacted inline URL" if source.is_a?(RendererArtifact::InlineCompanion)
+
+        source.to_s.inspect
       end
 
       def safe_companion_asset_path(path, rails_root, rails_root_realpath)