@caelo-cms/provisioning 0.10.40 → 0.10.42

package/stacks/azure/index.ts

@@ -8,18 +8,16 @@
  *  2. Azure Database for PostgreSQL flexible server, zone-redundant in
  *     production. Two databases (cms_admin + cms_public) created via
  *     post-create Container Apps job (bootstrap.sh).
- *  3. Storage account + two containers (`media` + `static`); the
- *     `static` container is `$web`-enabled for static-website hosting.
- *  4. Azure Front Door Standard with two origins (static blob + Container
- *     Apps fronting admin/gateway). Rules engine handles A/B split
- *     (matches `pageSlug` from the routing manifest, rewrites to the
- *     variant blob path) and redirects (per-row from the redirects table
- *     emitted via emitRedirectsAzureFrontDoor).
- *  5. Azure Container Apps (admin/gateway/orchestrator/runner + edge-router),
+ *  3. Storage account with a private `media` container and static-website
+ *     hosting (the `$web` container the static generator publishes to).
+ *  4. Azure Front Door Standard serving the static website on the primary
+ *     domain with a managed certificate — files served as files, no compute
+ *     on the request path (CLAUDE.md §11.B Tier 1).
+ *  5. Azure Container Apps (admin/gateway/orchestrator/runner),
  *     mounted with Key Vault secrets via managed identity.
  *  6. Key Vault entries (postgres-password, csrf-secret, cookie-secret,
  *     anthropic-api-key, resend-api-key).
- *  7. Log Analytics workspace receives Front Door + Container Apps logs;
+ *  7. Log Analytics workspace receives Container Apps logs;
  *     P12A analytics plugin's Azure adapter queries via monitor-query.
  *  8. Azure DNS zone for the primary domain (operator may opt out via
  *     config + manage at their existing registrar).
@@ -39,6 +37,7 @@
 import * as azure from "@pulumi/azure-native";
 import * as pulumi from "@pulumi/pulumi";
 import type { CloudAdapterOutputs, DnsRecord } from "../../dist/adapter.js";
+import { azureFrontDoorDnsRecords } from "../../dist/azure-front-door.js";
 import { generateBootstrapToken } from "../../dist/bootstrap-token.js";
 import { ADMIN_MEMORY_DEFAULT, azureContainerAppResources } from "../../dist/stack-contract.js";
 
@@ -190,13 +189,124 @@ const _mediaContainer = new azure.storage.BlobContainer(`${namePrefix}-media`, {
   publicAccess: "None",
 });
 
-const _staticContainer = new azure.storage.BlobContainer(`${namePrefix}-static`, {
+// The container the static generator publishes to. Managed explicitly (not
+// left to static-website hosting, which would create it implicitly) so a
+// stack created before Front Door keeps owning it — changing the resource
+// type would make Pulumi delete the container and every published page.
+const staticContainer = new azure.storage.BlobContainer(`${namePrefix}-static`, {
   resourceGroupName: rg.name,
   accountName: storage.name,
   containerName: "$web",
   publicAccess: "Blob",
 });
 
+// Static-website hosting serves `$web` on the account's web endpoint, which
+// resolves `/path/` to `/path/index.html` — the URL shape the static
+// generator emits. Front Door fronts that endpoint.
+const staticWebsite = new azure.storage.StorageAccountStaticWebsite(
+  `${namePrefix}-static-website`,
+  {
+    resourceGroupName: rg.name,
+    accountName: storage.name,
+    indexDocument: "index.html",
+    error404Document: "404.html",
+  },
+  { dependsOn: [staticContainer] },
+);
+
+// === 4b. Front Door (static site on the primary domain) ===
+const frontDoor = new azure.cdn.Profile(`${namePrefix}-fd`, {
+  resourceGroupName: rg.name,
+  profileName: `${namePrefix}-fd`,
+  location: "Global",
+  sku: { name: "Standard_AzureFrontDoor" },
+});
+
+const frontDoorEndpoint = new azure.cdn.AFDEndpoint(`${namePrefix}-fd-endpoint`, {
+  resourceGroupName: rg.name,
+  profileName: frontDoor.name,
+  endpointName: `${namePrefix}-site`,
+  location: "Global",
+  enabledState: "Enabled",
+});
+
+const staticOriginGroup = new azure.cdn.AFDOriginGroup(`${namePrefix}-fd-static`, {
+  resourceGroupName: rg.name,
+  profileName: frontDoor.name,
+  originGroupName: "static",
+  loadBalancingSettings: { sampleSize: 4, successfulSamplesRequired: 3 },
+  healthProbeSettings: {
+    probePath: "/",
+    probeProtocol: "Https",
+    probeRequestType: "HEAD",
+    probeIntervalInSeconds: 100,
+  },
+});
+
+// `primaryEndpoints.web` is `https://<account>.z<n>.web.core.windows.net/`;
+// Front Door wants the bare host.
+const staticWebHost = storage.primaryEndpoints.apply((e) => new URL(e.web).host);
+const staticOrigin = new azure.cdn.AFDOrigin(
+  `${namePrefix}-fd-static-origin`,
+  {
+    resourceGroupName: rg.name,
+    profileName: frontDoor.name,
+    originGroupName: staticOriginGroup.name,
+    originName: "static-website",
+    hostName: staticWebHost,
+    originHostHeader: staticWebHost,
+    httpsPort: 443,
+    enabledState: "Enabled",
+  },
+  { dependsOn: [staticWebsite] },
+);
+
+const siteDomain = new azure.cdn.AFDCustomDomain(`${namePrefix}-fd-domain`, {
+  resourceGroupName: rg.name,
+  profileName: frontDoor.name,
+  customDomainName: domain.replace(/\./g, "-"),
+  hostName: domain,
+  tlsSettings: { certificateType: "ManagedCertificate", minimumTlsVersion: "TLS12" },
+});
+
+new azure.cdn.Route(
+  `${namePrefix}-fd-route`,
+  {
+    resourceGroupName: rg.name,
+    profileName: frontDoor.name,
+    endpointName: frontDoorEndpoint.name,
+    routeName: "static",
+    originGroup: { id: staticOriginGroup.id },
+    customDomains: [{ id: siteDomain.id }],
+    patternsToMatch: ["/*"],
+    // Without a cache configuration Front Door does not cache the route at
+    // all; static files are edge-cached per their Cache-Control (§11.B
+    // Tier 1). The generated site has no query-string-dependent content.
+    cacheConfiguration: {
+      queryStringCachingBehavior: "IgnoreQueryString",
+      compressionSettings: {
+        isCompressionEnabled: true,
+        contentTypesToCompress: [
+          "text/html",
+          "text/css",
+          "text/plain",
+          "text/xml",
+          "application/javascript",
+          "application/json",
+          "application/xml",
+          "image/svg+xml",
+        ],
+      },
+    },
+    supportedProtocols: ["Http", "Https"],
+    forwardingProtocol: "HttpsOnly",
+    httpsRedirect: "Enabled",
+    linkToDefaultDomain: "Enabled",
+  },
+  // A route needs an origin in its group before Front Door accepts it.
+  { dependsOn: [staticOrigin] },
+);
+
 // === 5. Log Analytics workspace ===
 const logWorkspace = new azure.operationalinsights.Workspace(`${namePrefix}-logs`, {
   resourceGroupName: rg.name,
@@ -251,7 +361,7 @@ function containerApp(args: ContainerAppArgs): azure.app.ContainerApp {
     configuration: {
       activeRevisionsMode: "Single",
       ingress: {
-        external: args.serviceName === "edge-router",
+        external: false,
         targetPort: 8080,
         transport: "Auto",
       },
@@ -306,37 +416,19 @@ const _orchestratorApp = containerApp({
   databaseEnv: adminDatabaseEnv,
 });
 const _runnerApp = containerApp({ serviceName: "runner", databaseEnv: adminDatabaseEnv });
-const edgeRouterApp = containerApp({
-  serviceName: "edge-router",
-  // Serves the static site and the A/B routing manifest; no database.
-  databaseEnv: [],
-  extraEnv: [
-    {
-      name: "STATIC_BUCKET_URL",
-      value: pulumi.interpolate`https://${storage.name}.blob.core.windows.net/$web`,
-    },
-    { name: "MANIFEST_OBJECT", value: "ab-routing.json" },
-  ],
-});
-
 // === 7. Bootstrap token ===
 const tokenInfo = generateBootstrapToken();
 
 // === 8. CloudAdapterOutputs ===
-const dnsRecordsRequired: DnsRecord[] = [
-  {
-    hostname: domain,
-    type: "CNAME",
-    // Front Door domain comes from the resource (P15.4 review-pass adds
-    // the actual Front Door + custom-domain bindings; v1 surfaces the
-    // edge-router Container App FQDN as the temporary target).
-    value: edgeRouterApp.configuration.apply(
-      (c) => c?.ingress?.fqdn ?? "<edge-router-fqdn-pending>",
-    ) as unknown as string,
-    purpose:
-      "Primary domain → edge-router Container App (P15.4 review-pass moves this behind Front Door)",
-  },
-];
+const dnsRecordsRequired = pulumi
+  .all([frontDoorEndpoint.hostName, siteDomain.validationProperties])
+  .apply(([endpointHostName, validation]) =>
+    azureFrontDoorDnsRecords({
+      domain,
+      endpointHostName,
+      validationToken: validation.validationToken,
+    }),
+  );
 
 const out: CloudAdapterOutputs = {
   adminDatabaseUrl: adminDatabaseUrl as unknown as string,
@@ -347,7 +439,7 @@ const out: CloudAdapterOutputs = {
   mediaCdnBaseUrl: pulumi.interpolate`https://${domain}/media` as unknown as string,
   bootstrapUrl:
     pulumi.interpolate`https://${domain}/setup?token=${tokenInfo.token}` as unknown as string,
-  dnsRecordsRequired,
+  dnsRecordsRequired: dnsRecordsRequired as unknown as DnsRecord[],
   edgeLogSinkUrl: pulumi.interpolate`loganalytics://${logWorkspace.name}` as unknown as string,
   provider: "azure",
   environment: env,
@@ -366,7 +458,5 @@ export const environmentOut = out.environment;
 export const pgServerFqdnOut = pgServer.fullyQualifiedDomainName;
 export const storageAccountNameOut = storage.name;
 export const adminContainerAppFqdnOut = adminApp.configuration.apply((c) => c?.ingress?.fqdn);
-export const edgeRouterContainerAppFqdnOut = edgeRouterApp.configuration.apply(
-  (c) => c?.ingress?.fqdn,
-);
+export const frontDoorEndpointHostNameOut = frontDoorEndpoint.hostName;
 export const bootstrapTokenExpiresAtOut = tokenInfo.expiresAt;

package/stacks/gcp/Pulumi.yaml

@@ -1,9 +1,9 @@
 # SPDX-License-Identifier: MPL-2.0
 #
 # Caelo GCP provider stack. Provisions Cloud SQL HA + GCS (media + static
-# output) + Cloud CDN + Cloud Run (admin/gateway/orchestrator/runner +
-# edge-router) + Secret Manager + Cloud Logging → BigQuery sink for
-# A/B assignment logs. Implements the shared CloudAdapterInputs /
+# output) + Cloud CDN + Cloud Run (admin/gateway/orchestrator/runner) +
+# Secret Manager + Cloud Logging → BigQuery sink for gateway request
+# logs. Implements the shared CloudAdapterInputs /
 # CloudAdapterOutputs contract from packages/provisioning/src/adapter.ts.
 name: caelo-gcp
 runtime:

package/stacks/gcp/README.md

@@ -8,8 +8,7 @@ Pulumi stack provisioning Caelo on GCP managed services. Implements the shared `
 |---|---|
 | Managed Postgres | Cloud SQL Postgres 16 (REGIONAL HA in production, ZONAL elsewhere) + automated backups + PITR + private IP only |
 | Blob storage | Two GCS buckets (`<project>-caelo-<env>-media`, `<project>-caelo-<env>-static`) with uniform bucket-level access |
-| CDN | Cloud CDN backend bucket (operator wires the URL map + load balancer for v1; full LB in P15 review-pass) |
-| Edge compute (A/B + redirects) | Cloud Run service `<env>-edge-router` running `edge-handler.ts` with `@caelo-cms/edge-router` |
+| CDN | Global HTTPS load balancer + Cloud CDN backend bucket: `<domain>` serves the static bucket as files, `/api/*` goes to the gateway, `admin.<domain>` to the IAP-gated admin |
 | Container runtime | Four Cloud Run services (admin / gateway / orchestrator / runner) |
 | Secret store | Secret Manager: postgres-password (admin_role) + secret-kek (Pulumi); internal-secret, tool-approval-secret, public-role-password and gateway-role-password (created by the CLI before `pulumi up`, see `src/runtime-secrets.ts`). Cloud Run reads each as a `secretKeyRef`; database URLs carry no password. The gateway's service account reads only the two gateway role passwords (#613); `gateway_role` itself is created by migration 0248 and gets its password from the CLI after migrations. |
 | Edge-log sink | Cloud Logging project sink → BigQuery dataset `<env>_edge_logs` (queryable by P12A analytics plugin) |
@@ -36,7 +35,7 @@ pulumi config set caelo-gcp:region europe-west1
 # Build + push images. Operator does this once + on every release.
 gcloud auth configure-docker us-central1-docker.pkg.dev
 gcloud builds submit ... --tag us-central1-docker.pkg.dev/$PROJECT/caelo/admin:latest
-# Repeat for gateway, orchestrator, runner, edge-router.
+# Repeat for gateway, orchestrator, runner.
 
 # The stack references two secrets it does not create (the CLI wizard and
 # `upgrade` create them; a direct `pulumi up` needs them first). Values go
@@ -65,28 +64,14 @@ pulumi stack output bootstrapUrlOut
 # → https://example.com/setup?token=<64-hex>
 ```
 
-Open after the operator has wired the GCP HTTPS load balancer to the edge-router Cloud Run service + the admin's DNS A record points at the LB IP.
-
-## Edge-router behaviour
-
-This stack's `edge-handler.ts` imports `routeRequest` from `@caelo-cms/edge-router` — same function the AWS Lambda@Edge function and the P13 self-hosted Caddy gateway use. Differences from AWS L@E:
-
-- **Manifest lives in GCS, not bundled in the binary.** The handler fetches `gs://<static-bucket>/routing-manifest.json` on a 30s TTL cache. A new manifest takes effect within 30s without a Cloud Run redeploy.
-- **Returns 307 redirects** (instead of L@E's request-mutation rewrite) so the browser hits the variant URL directly + the static origin's cache respects the variant cache key.
-- **Sets the `caelo_visitor_id` cookie directly** in the response (Cloud Run handlers control headers; L@E's viewer-request cannot).
-- **Cloud Logging → BigQuery**, not CloudWatch → Athena. Same `{kind: "ab_assignment", ...}` JSON shape.
+Open after the domain's and the admin's DNS A records point at the load balancer IP and the managed certificate is active.
 
 ## v1 limitations (P15 review-pass items)
 
-- **GCP HTTPS load balancer + URL map** not auto-provisioned. Operator wires the LB to point `/api/*` → gateway, `/admin/*` → admin, `/_caelo-variant/*` → static bucket directly, and everything else → edge-router. Auto-provisioning lands when telemetry shows operators want it.
 - **Container image build pipeline** — operators push via `gcloud builds submit` for v1. A unified `cms-provision build-images --provider gcp` lands later.
 - **Per-locale managed SSL certs** — operator creates via `gcloud compute ssl-certificates create` per locale subdomain for v1. Auto-provisioning lands alongside the LB.
 - **DNS records** — `dnsRecordsRequired` includes a `<gcp-load-balancer-ip>` placeholder; the DNS UI shows the right hostname/type for the operator to fill in once the LB IP exists.
 
-## Edge-router byte-identity
-
-The byte-identity test in `packages/edge-router/src/index.test.ts` asserts a fixed corpus of (visitorId, manifestVersion, experimentId) tuples produces identical variant labels across every runtime — a visitor sees the same variant whether they hit the self-hosted Caddy in dev, the AWS CloudFront in staging, or the GCP Cloud Run in production.
-
 ## Destroy
 
 ```bash

package/stacks/aws/build-edge.ts

@@ -1,80 +0,0 @@
-#!/usr/bin/env bun
-// SPDX-License-Identifier: MPL-2.0
-
-/**
- * Bundle Caelo's Lambda@Edge handler + the latest routing-manifest.json
- * into a single CommonJS file Pulumi uploads as the L@E function source.
- *
- * Run BEFORE every `pulumi up` against the AWS stack:
- *   bun run packages/provisioning/stacks/aws/build-edge.ts \
- *     --manifest /path/to/routing-manifest.json
- *
- * The manifest path defaults to the static-output bucket's local
- * mirror (apps/static-generator/dist/routing-manifest.json) if the
- * --manifest flag is omitted.
- *
- * Why bundle the manifest IN: Lambda@Edge has no IAM role for RDS,
- * no network egress to non-AWS endpoints, no SSM access. The function
- * is pure code + bundled config. A new manifest = a new bundle = a
- * new Pulumi `update` of the Lambda function (versioned by L@E).
- */
-
-import { existsSync, readFileSync, writeFileSync } from "node:fs";
-import { resolve } from "node:path";
-
-function arg(name: string): string | undefined {
-  const idx = process.argv.indexOf(`--${name}`);
-  if (idx === -1) return undefined;
-  return process.argv[idx + 1];
-}
-
-// P15 hot-fix #1 — bundle the edge-router-shaped `ab-routing.json`,
-// not the deploy manifest `routing-manifest.json`. The two live
-// alongside each other in the static-output bucket; only the AB one
-// matches @caelo-cms/edge-router's RoutingManifest shape.
-const manifestPath =
-  arg("manifest") ??
-  resolve(import.meta.dir, "../../../..", "apps/static-generator/dist/ab-routing.json");
-
-const manifest = existsSync(manifestPath)
-  ? JSON.parse(readFileSync(manifestPath, "utf8"))
-  : { manifestVersion: "0", experiments: [] };
-
-console.log(`Manifest:  ${manifestPath}`);
-console.log(`Version:   ${manifest.manifestVersion}`);
-console.log(`Experiments: ${manifest.experiments.length}`);
-
-const entry = resolve(import.meta.dir, "edge-handler.ts");
-const out = resolve(import.meta.dir, "edge-handler-bundle.js");
-
-// Bun's bundler: target=node, format=cjs (Lambda@Edge wants CJS),
-// inline the manifest via `--define`, externalize nothing (pure JS).
-const proc = Bun.spawn(
-  [
-    "bun",
-    "build",
-    entry,
-    "--target=node",
-    "--format=cjs",
-    "--outfile",
-    out,
-    "--define",
-    `__INLINE_MANIFEST__=${JSON.stringify(manifest)}`,
-  ],
-  { stdout: "inherit", stderr: "inherit" },
-);
-await proc.exited;
-if (proc.exitCode !== 0) {
-  console.error("bun build failed");
-  process.exit(proc.exitCode ?? 1);
-}
-
-const sizeKb = Math.round(readFileSync(out).byteLength / 1024);
-console.log(`Wrote ${out} (${sizeKb} KB)`);
-if (sizeKb > 1024) {
-  console.warn(
-    `Lambda@Edge has a 1 MB unzipped limit; bundle is ${sizeKb} KB. Strip dependencies before next deploy.`,
-  );
-}
-writeFileSync(`${out}.manifest-version.txt`, String(manifest.manifestVersion));
-console.log("Next: cd packages/provisioning/stacks/aws && pulumi up");

package/stacks/aws/edge-handler-bundle.js

@@ -1,20 +0,0 @@
-// SPDX-License-Identifier: MPL-2.0
-//
-// PLACEHOLDER. Replaced at deploy time by `bun run build:edge-aws`
-// which bundles edge-handler.ts + the latest routing-manifest.json
-// into a single Lambda@Edge deployment artifact.
-//
-// Until the build step runs, this stub returns the request unchanged
-// so a fresh `pulumi up` doesn't emit a broken Lambda. Operator MUST
-// run the build step before the first real deploy.
-exports.handler = async (event) => {
-  const req = event.Records[0].cf.request;
-  console.log(
-    JSON.stringify({
-      kind: "edge_handler_stub",
-      message: "edge-handler-bundle.js is the placeholder; run `bun run build:edge-aws`",
-      uri: req.uri,
-    }),
-  );
-  return req;
-};

package/stacks/aws/edge-handler.ts

@@ -1,86 +0,0 @@
-// SPDX-License-Identifier: MPL-2.0
-
-/**
- * Caelo AWS Lambda@Edge handler — viewer-request event.
- *
- * Imports the SAME `routeRequest` from `@caelo-cms/edge-router` that the
- * P13 self-hosted Caddy gateway uses, so the assignment hash is
- * byte-identical across all four runtimes (P13 Caddy + GCP + AWS + Azure).
- * The byte-identity test in packages/edge-router/src/index.test.ts
- * locks the contract.
- *
- * Bundled by `bun run build:edge-aws` (see this stack's README) into
- * `edge-handler-bundle.js` which Pulumi uploads as the Lambda code.
- * The routing manifest is embedded into the bundle at build time —
- * Lambda@Edge has no DB access (no IAM, no network egress to RDS), so
- * a fresh bundle is built + deployed on every routing-manifest bump.
- */
-
-import type { RoutingManifest } from "@caelo-cms/edge-router";
-import { routeRequest } from "@caelo-cms/edge-router";
-
-// Bundled at build time. The build script reads the latest
-// routing-manifest.json from the static-output bucket and inlines it.
-// Empty manifest = pass-through (no experiments active).
-declare const __INLINE_MANIFEST__: RoutingManifest;
-
-const MANIFEST: RoutingManifest = __INLINE_MANIFEST__;
-const COOKIE_NAME = "caelo_visitor_id";
-
-interface CloudFrontHeaderEntry {
-  readonly key: string;
-  readonly value: string;
-}
-
-interface CloudFrontRequest {
-  uri: string;
-  querystring: string;
-  headers: Record<string, ReadonlyArray<CloudFrontHeaderEntry>>;
-}
-
-interface CloudFrontEvent {
-  Records: Array<{ cf: { request: CloudFrontRequest } }>;
-}
-
-function readCookie(req: CloudFrontRequest, name: string): string | null {
-  const raw = req.headers.cookie?.[0]?.value ?? "";
-  for (const pair of raw.split(/;\s*/)) {
-    const eq = pair.indexOf("=");
-    if (eq < 0) continue;
-    if (pair.slice(0, eq) === name) return decodeURIComponent(pair.slice(eq + 1));
-  }
-  return null;
-}
-
-export const handler = async (event: CloudFrontEvent): Promise<CloudFrontRequest> => {
-  const req = event.Records[0]?.cf.request;
-  if (!req) throw new Error("edge-handler: malformed event");
-
-  const visitorIdCookie = readCookie(req, COOKIE_NAME);
-  const decision = routeRequest(MANIFEST, {
-    pathname: req.uri,
-    visitorIdCookie,
-  });
-
-  // Path rewrite — Lambda@Edge mutates request.uri in-place.
-  req.uri = decision.rewritePathname;
-
-  // Set the cookie for the response. L@E viewer-request can't set
-  // response headers directly; we have to rely on a complementary
-  // viewer-response function, OR (simpler) include the cookie in the
-  // forwarded request so the origin (S3 / ECS) can echo it. v1 takes
-  // the simpler path: bake the visitor id into a custom header that
-  // the static origin's Set-Cookie config picks up. CloudFront's
-  // "function" tier supports response-header rewrites without a
-  // second Lambda — that's the operator's setup step.
-  req.headers["x-caelo-visitor-id"] = [{ key: "X-Caelo-Visitor-Id", value: decision.setVisitorId }];
-
-  // Emit assignment log via console.log; CloudWatch picks it up,
-  // Kinesis Firehose ships to S3, Athena queries it, P12A analytics
-  // plugin's AWS adapter normalises into ab_assignment_aggregates.
-  if (decision.logEntry) {
-    console.log(JSON.stringify(decision.logEntry));
-  }
-
-  return req;
-};

package/stacks/azure/edge-handler.ts

@@ -1,87 +0,0 @@
-// SPDX-License-Identifier: MPL-2.0
-
-/**
- * Caelo Azure edge-router — Azure Container App HTTP handler.
- *
- * Imports the SAME `routeRequest` from `@caelo-cms/edge-router` that the
- * P13 self-hosted Caddy gateway, the AWS Lambda@Edge function, and the
- * GCP Cloud Run handler use. The byte-identity test in
- * packages/edge-router/src/index.test.ts asserts identical variant
- * labels across every runtime — same hash, same variant, every visitor.
- *
- * Differences from the GCP Cloud Run handler:
- *   - Logs go to stdout in JSON; Container Apps' Log Analytics integration
- *     ships them to the workspace; the P12A Azure adapter queries via
- *     Azure Monitor's Log Analytics API.
- *   - Manifest fetched from Blob storage (anonymous public read on the
- *     `$web` container's `ab-routing.json` blob).
- *
- * v1 ships the source; the build pipeline (`az acr build` per service,
- * pushing to ACR) lands in P17.0 release engineering.
- */
-
-import { EMPTY_MANIFEST, type RoutingManifest, routeRequest } from "@caelo-cms/edge-router";
-
-const STATIC_BUCKET_URL = process.env.STATIC_BUCKET_URL ?? "";
-const MANIFEST_OBJECT = process.env.MANIFEST_OBJECT ?? "ab-routing.json";
-const MANIFEST_REFRESH_MS = 30_000;
-const COOKIE_NAME = "caelo_visitor_id";
-
-let manifestCache: { value: RoutingManifest; loadedAt: number } = {
-  value: EMPTY_MANIFEST,
-  loadedAt: 0,
-};
-
-async function fetchManifest(): Promise<RoutingManifest> {
-  if (Date.now() - manifestCache.loadedAt < MANIFEST_REFRESH_MS) {
-    return manifestCache.value;
-  }
-  if (!STATIC_BUCKET_URL) return EMPTY_MANIFEST;
-  try {
-    const url = `${STATIC_BUCKET_URL}/${MANIFEST_OBJECT}`;
-    const r = await fetch(url, { signal: AbortSignal.timeout(2000) });
-    if (!r.ok) return manifestCache.value;
-    const m = (await r.json()) as RoutingManifest;
-    manifestCache = { value: m, loadedAt: Date.now() };
-    return m;
-  } catch {
-    return manifestCache.value;
-  }
-}
-
-function readCookie(header: string | null, name: string): string | null {
-  if (!header) return null;
-  for (const pair of header.split(/;\s*/)) {
-    const eq = pair.indexOf("=");
-    if (eq < 0) continue;
-    if (pair.slice(0, eq) === name) return decodeURIComponent(pair.slice(eq + 1));
-  }
-  return null;
-}
-
-const port = Number(process.env.PORT ?? 8080);
-Bun.serve({
-  port,
-  async fetch(req: Request): Promise<Response> {
-    const url = new URL(req.url);
-    const manifest = await fetchManifest();
-    const visitorIdCookie = readCookie(req.headers.get("cookie"), COOKIE_NAME);
-    const decision = routeRequest(manifest, {
-      pathname: url.pathname,
-      visitorIdCookie,
-    });
-
-    if (decision.logEntry) {
-      console.log(JSON.stringify(decision.logEntry));
-    }
-
-    const target = new URL(url.toString());
-    target.pathname = decision.rewritePathname;
-    const headers = new Headers({
-      Location: target.toString(),
-      "Cache-Control": "no-store, private",
-      "Set-Cookie": `${COOKIE_NAME}=${encodeURIComponent(decision.setVisitorId)}; Path=/; Max-Age=31536000; SameSite=Lax; Secure; HttpOnly`,
-    });
-    return new Response(null, { status: 307, headers });
-  },
-});