@caelo-cms/shared 0.10.55 → 0.10.57
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/auto-update.d.ts +15 -4
- package/dist/auto-update.d.ts.map +1 -1
- package/dist/auto-update.js +19 -14
- package/dist/auto-update.js.map +1 -1
- package/dist/platform-updates.d.ts +20 -3
- package/dist/platform-updates.d.ts.map +1 -1
- package/dist/platform-updates.js +24 -1
- package/dist/platform-updates.js.map +1 -1
- package/dist/proposal-status.d.ts +1 -1
- package/dist/redirect-emit-gcp.d.ts +11 -1
- package/dist/redirect-emit-gcp.d.ts.map +1 -1
- package/dist/redirect-emit-gcp.js +16 -2
- package/dist/redirect-emit-gcp.js.map +1 -1
- package/dist/release-manifest.d.ts +14 -4
- package/dist/release-manifest.d.ts.map +1 -1
- package/dist/release-manifest.js +19 -3
- package/dist/release-manifest.js.map +1 -1
- package/dist/version.d.ts +2 -2
- package/dist/version.js +1 -1
- package/package.json +1 -1
- package/src/auto-update.test.ts +47 -8
- package/src/auto-update.ts +29 -14
- package/src/platform-updates.ts +26 -1
- package/src/redirect-emit-gcp.ts +16 -2
- package/src/redirect-emit.test.ts +6 -4
- package/src/release-manifest.ts +39 -7
- package/src/version.ts +1 -1
package/dist/auto-update.d.ts
CHANGED
|
@@ -23,9 +23,11 @@
|
|
|
23
23
|
* 2. off the stable channel, or the policy only notifies → notify;
|
|
24
24
|
* 3. major → notify (never automatic before 1.0);
|
|
25
25
|
* 4. release information unreadable → blocked (fails loudly, no guess);
|
|
26
|
-
* 5. changes the cloud setup
|
|
27
|
-
*
|
|
28
|
-
*
|
|
26
|
+
* 5. changes the cloud setup (#819): with no converge job on this
|
|
27
|
+
* install → needs_cloud_shell (the terminal path); with one but
|
|
28
|
+
* `autoConverge` off → manual (the Owner installs it from Settings →
|
|
29
|
+
* Updates); with `autoConverge` on → on through the rules below, and
|
|
30
|
+
* an install it decides goes to the converge job (`route: converge`);
|
|
29
31
|
* 6. destructive database changes → manual (never automatic);
|
|
30
32
|
* 7. the kind is not switched on (security / patch / minor) → notify;
|
|
31
33
|
* 8. no upgrader on this install → blocked;
|
|
@@ -34,7 +36,7 @@
|
|
|
34
36
|
* 11. outside the maintenance window → wait until it opens;
|
|
35
37
|
* 12. otherwise → install.
|
|
36
38
|
*/
|
|
37
|
-
import { type StoredUpdatePolicy, type UpdateKind } from "./platform-updates.js";
|
|
39
|
+
import { type PlatformUpdateRoute, type StoredUpdatePolicy, type UpdateKind } from "./platform-updates.js";
|
|
38
40
|
/** Why the scheduler queued an automatic install (`platform_update_requests.auto_basis`). */
|
|
39
41
|
export declare const AUTO_UPDATE_BASES: readonly ["security", "patch", "minor"];
|
|
40
42
|
export type AutoUpdateBasis = (typeof AUTO_UPDATE_BASES)[number];
|
|
@@ -84,6 +86,11 @@ export interface AutoUpdateInput {
|
|
|
84
86
|
};
|
|
85
87
|
/** This install has an upgrader the admin can hand a request to. */
|
|
86
88
|
readonly upgraderAvailable: boolean;
|
|
89
|
+
/**
|
|
90
|
+
* This install has a converge job the admin can start (#819): releases
|
|
91
|
+
* that change the cloud setup can install from Caelo at all.
|
|
92
|
+
*/
|
|
93
|
+
readonly convergeAvailable: boolean;
|
|
87
94
|
/** Why it has none right now, in plain words (null: none set up at all). */
|
|
88
95
|
readonly upgraderProblem?: string | null;
|
|
89
96
|
readonly now: Date;
|
|
@@ -102,6 +109,8 @@ export type AutoUpdateDecision = {
|
|
|
102
109
|
readonly version: string;
|
|
103
110
|
readonly kind: UpdateKind;
|
|
104
111
|
readonly basis: AutoUpdateBasis;
|
|
112
|
+
/** Which job installs it once the wait is over. */
|
|
113
|
+
readonly route: PlatformUpdateRoute;
|
|
105
114
|
readonly reason: string;
|
|
106
115
|
/** When it becomes installable; null = until the Owner resumes. */
|
|
107
116
|
readonly until: Date | null;
|
|
@@ -112,6 +121,8 @@ export type AutoUpdateDecision = {
|
|
|
112
121
|
readonly version: string;
|
|
113
122
|
readonly kind: UpdateKind;
|
|
114
123
|
readonly basis: AutoUpdateBasis;
|
|
124
|
+
/** Which job installs it: the upgrader, or the converge job (#819). */
|
|
125
|
+
readonly route: PlatformUpdateRoute;
|
|
115
126
|
readonly reason: string;
|
|
116
127
|
};
|
|
117
128
|
/** Whether automatic installs are paused at `now` (an Owner pause may have ended). */
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"auto-update.d.ts","sourceRoot":"","sources":["../src/auto-update.ts"],"names":[],"mappings":"AAEA
|
|
1
|
+
{"version":3,"file":"auto-update.d.ts","sourceRoot":"","sources":["../src/auto-update.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,OAAO,EAEL,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EACvB,KAAK,UAAU,EAEhB,MAAM,uBAAuB,CAAC;AAE/B,6FAA6F;AAC7F,eAAO,MAAM,iBAAiB,yCAA0C,CAAC;AACzE,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEjE,6EAA6E;AAC7E,eAAO,MAAM,mBAAmB,0FAQtB,CAAC;AACX,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEpE,wEAAwE;AACxE,eAAO,MAAM,yBAAyB,iFAM5B,CAAC;AACX,MAAM,MAAM,sBAAsB,GAAG,CAAC,OAAO,yBAAyB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEhF;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE;IAC1C,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;CACxC,GAAG,OAAO,CAEV;AAED,2EAA2E;AAC3E,MAAM,WAAW,YAAY;IAC3B,iDAAiD;IACjD,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,+EAA+E;IAC/E,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;IACrC;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,EAAE,OAAO,GAAG,IAAI,CAAC;CACtC;AAED,oDAAoD;AACpD,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC;IACpC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,2DAA2D;IAC3D,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,CAAC;IAC3F,0DAA0D;IAC1D,QAAQ,CAAC,KAAK,EAAE,YAAY,GAAG;QAAE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAChE,oEAAoE;IACpE,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC;;;OAGG;IACH,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC,4EAA4E;IAC5E,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;CACpB;AAED,2DAA2D;AAC3D,MAAM,MAAM,kBAAkB,GAC1B;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACpD;IACE,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,mBAAmB,GAAG,SAAS,CAAC;IACvE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,GACD;IACE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IAChC,mDAAmD;IACnD,QAAQ,CAAC,KAAK,EAAE,mBAAmB,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,mEAAmE;IACnE,QAAQ,CAAC,KAAK,EAAE,IAAI,GAAG,IAAI,CAAC;IAC5B,uEAAuE;IACvE,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B,GACD;IACE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IAChC,uEAAuE;IACvE,QAAQ,CAAC,KAAK,EAAE,mBAAmB,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;AAEN,sFAAsF;AACtF,wBAAgB,UAAU,CACxB,MAAM,EAAE,IAAI,CAAC,kBAAkB,EAAE,QAAQ,GAAG,aAAa,CAAC,EAC1D,GAAG,EAAE,IAAI,GACR,OAAO,CAGT;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,MAAM,EAAE,IAAI,CAAC,kBAAkB,EAAE,aAAa,GAAG,WAAW,GAAG,gBAAgB,CAAC,EAChF,IAAI,EAAE,IAAI,GACT,IAAI,GAAG,IAAI,CAOb;AAqBD,8EAA8E;AAC9E,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,eAAe,GAAG,kBAAkB,CAsI3E"}
|
package/dist/auto-update.js
CHANGED
|
@@ -24,9 +24,11 @@
|
|
|
24
24
|
* 2. off the stable channel, or the policy only notifies → notify;
|
|
25
25
|
* 3. major → notify (never automatic before 1.0);
|
|
26
26
|
* 4. release information unreadable → blocked (fails loudly, no guess);
|
|
27
|
-
* 5. changes the cloud setup
|
|
28
|
-
*
|
|
29
|
-
*
|
|
27
|
+
* 5. changes the cloud setup (#819): with no converge job on this
|
|
28
|
+
* install → needs_cloud_shell (the terminal path); with one but
|
|
29
|
+
* `autoConverge` off → manual (the Owner installs it from Settings →
|
|
30
|
+
* Updates); with `autoConverge` on → on through the rules below, and
|
|
31
|
+
* an install it decides goes to the converge job (`route: converge`);
|
|
30
32
|
* 6. destructive database changes → manual (never automatic);
|
|
31
33
|
* 7. the kind is not switched on (security / patch / minor) → notify;
|
|
32
34
|
* 8. no upgrader on this install → blocked;
|
|
@@ -141,20 +143,22 @@ export function decideAutoUpdate(input) {
|
|
|
141
143
|
};
|
|
142
144
|
}
|
|
143
145
|
const facts = input.facts;
|
|
144
|
-
|
|
145
|
-
|
|
146
|
-
// Caelo, `policy.autoConverge` decides here like autoPatch does below.
|
|
147
|
-
// Until then the Owner's "install automatically" choice is stored but
|
|
148
|
-
// has no effect, and the reason says so.
|
|
149
|
-
const ownerChoice = policy.autoConverge
|
|
150
|
-
? " Your setting to install these automatically takes effect once Caelo can run them itself."
|
|
151
|
-
: "";
|
|
146
|
+
const converge = facts.infraChange === true;
|
|
147
|
+
if (converge && !input.convergeAvailable) {
|
|
152
148
|
return {
|
|
153
149
|
action: "needs_cloud_shell",
|
|
154
150
|
...base,
|
|
155
|
-
reason: `v${v} changes this install's cloud setup,
|
|
151
|
+
reason: `v${v} changes this install's cloud setup, and this install has no converge job to do that from Caelo. The Owner installs it once with their own account in Cloud Shell or from the computer they installed from.`,
|
|
156
152
|
};
|
|
157
153
|
}
|
|
154
|
+
if (converge && !policy.autoConverge) {
|
|
155
|
+
return {
|
|
156
|
+
action: "manual",
|
|
157
|
+
...base,
|
|
158
|
+
reason: `v${v} changes this install's cloud setup. The update policy does not install those automatically; the Owner installs it from Settings → Updates.`,
|
|
159
|
+
};
|
|
160
|
+
}
|
|
161
|
+
const route = converge ? "converge" : "app_roll";
|
|
158
162
|
if (facts.contractMigrations) {
|
|
159
163
|
return {
|
|
160
164
|
action: "manual",
|
|
@@ -177,7 +181,8 @@ export function decideAutoUpdate(input) {
|
|
|
177
181
|
reason: `v${v} is a ${what}; the update policy does not install those automatically. The Owner installs it.`,
|
|
178
182
|
};
|
|
179
183
|
}
|
|
180
|
-
|
|
184
|
+
// A converge-route install needs the converge job (checked above), not the upgrader.
|
|
185
|
+
if (!converge && !input.upgraderAvailable) {
|
|
181
186
|
return {
|
|
182
187
|
action: "blocked",
|
|
183
188
|
...base,
|
|
@@ -186,7 +191,7 @@ export function decideAutoUpdate(input) {
|
|
|
186
191
|
: `v${v} could install automatically, but this install has no upgrader the admin can start. Run the upgrade command from Settings → Updates once; it sets the upgrader up.`,
|
|
187
192
|
};
|
|
188
193
|
}
|
|
189
|
-
const auto = { ...base, basis };
|
|
194
|
+
const auto = { ...base, basis, route };
|
|
190
195
|
if (isPausedAt(policy, now)) {
|
|
191
196
|
const until = policy.pausedUntil === null ? null : new Date(policy.pausedUntil);
|
|
192
197
|
const who = policy.pausedByOwner ? "by the Owner" : "after a failed automatic install";
|
package/dist/auto-update.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"auto-update.js","sourceRoot":"","sources":["../src/auto-update.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC
|
|
1
|
+
{"version":3,"file":"auto-update.js","sourceRoot":"","sources":["../src/auto-update.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,OAAO,EACL,mBAAmB,EAInB,UAAU,GACX,MAAM,uBAAuB,CAAC;AAE/B,6FAA6F;AAC7F,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,UAAU,EAAE,OAAO,EAAE,OAAO,CAAU,CAAC;AAGzE,6EAA6E;AAC7E,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,MAAM;IACN,QAAQ;IACR,MAAM;IACN,SAAS;IACT,QAAQ;IACR,mBAAmB;IACnB,SAAS;CACD,CAAC;AAGX,wEAAwE;AACxE,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,WAAW;IACX,WAAW;IACX,WAAW;IACX,QAAQ;IACR,mBAAmB;CACX,CAAC;AAGX;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAGjC;IACC,OAAO,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC;AAC7D,CAAC;AAsED,sFAAsF;AACtF,MAAM,UAAU,UAAU,CACxB,MAA0D,EAC1D,GAAS;IAET,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACjC,OAAO,MAAM,CAAC,WAAW,KAAK,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC;AAC/F,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAC/B,MAAgF,EAChF,IAAU;IAEV,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC;IACpE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,EAAE,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC;QAClD,IAAI,mBAAmB,CAAC,MAAM,EAAE,EAAE,CAAC;YAAE,OAAO,EAAE,CAAC;IACjD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,GAA+B;IAC7C,KAAK,EAAE,eAAe;IACtB,KAAK,EAAE,eAAe;IACtB,KAAK,EAAE,eAAe;CACvB,CAAC;AAEF,MAAM,WAAW,GAAoC;IACnD,QAAQ,EAAE,cAAc;IACxB,KAAK,EAAE,eAAe;IACtB,KAAK,EAAE,eAAe;CACvB,CAAC;AAEF,qEAAqE;AACrE,SAAS,QAAQ,CAAC,OAAe;IAC/B,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AAChC,CAAC;AAED,MAAM,KAAK,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;AAE9D,8EAA8E;AAC9E,MAAM,UAAU,gBAAgB,CAAC,KAAsB;IACrD,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC;IACvC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,sDAAsD,EAAE,CAAC;IAC5F,CAAC;IACD,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,gBAAgB,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACjE,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QAClB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,KAAK,CAAC,gBAAgB,yBAAyB,EAAE,CAAC;IACzF,CAAC;IACD,MAAM,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IAC1B,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAW,CAAC;IAC3C,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;QACjB,OAAO;YACL,MAAM,EAAE,QAAQ;YAChB,GAAG,IAAI;YACP,MAAM,EAAE,IAAI,CAAC,gEAAgE;SAC9E,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,OAAO;YACL,MAAM,EAAE,QAAQ;YAChB,GAAG,IAAI;YACP,MAAM,EAAE,IAAI,CAAC,wEAAwE;SACtF,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACrB,OAAO;YACL,MAAM,EAAE,QAAQ;YAChB,GAAG,IAAI;YACP,MAAM,EAAE,IAAI,CAAC,mFAAmF;SACjG,CAAC;IACJ,CAAC;IACD,IAAI,aAAa,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;QACjC,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,GAAG,IAAI;YACP,MAAM,EAAE,+BAA+B,CAAC,uBAAuB,KAAK,CAAC,KAAK,CAAC,WAAW,wHAAwH;SAC/M,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;IAC1B,MAAM,QAAQ,GAAG,KAAK,CAAC,WAAW,KAAK,IAAI,CAAC;IAC5C,IAAI,QAAQ,IAAI,CAAC,KAAK,CAAC,iBAAiB,EAAE,CAAC;QACzC,OAAO;YACL,MAAM,EAAE,mBAAmB;YAC3B,GAAG,IAAI;YACP,MAAM,EAAE,IAAI,CAAC,6MAA6M;SAC3N,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;QACrC,OAAO;YACL,MAAM,EAAE,QAAQ;YAChB,GAAG,IAAI;YACP,MAAM,EAAE,IAAI,CAAC,6IAA6I;SAC3J,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAwB,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC;IACtE,IAAI,KAAK,CAAC,kBAAkB,EAAE,CAAC;QAC7B,OAAO;YACL,MAAM,EAAE,QAAQ;YAChB,GAAG,IAAI;YACP,MAAM,EAAE,IAAI,CAAC,gJAAgJ;SAC9J,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GACT,KAAK,CAAC,QAAQ,IAAI,MAAM,CAAC,YAAY;QACnC,CAAC,CAAC,UAAU;QACZ,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,MAAM,CAAC,SAAS;YACpC,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,MAAM,CAAC,SAAS;gBACpC,CAAC,CAAC,OAAO;gBACT,CAAC,CAAC,IAAI,CAAC;IACf,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,iBAAiB,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACtF,OAAO;YACL,MAAM,EAAE,QAAQ;YAChB,GAAG,IAAI;YACP,MAAM,EAAE,IAAI,CAAC,SAAS,IAAI,kFAAkF;SAC7G,CAAC;IACJ,CAAC;IACD,qFAAqF;IACrF,IAAI,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,iBAAiB,EAAE,CAAC;QAC1C,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,GAAG,IAAI;YACP,MAAM,EAAE,KAAK,CAAC,eAAe;gBAC3B,CAAC,CAAC,IAAI,CAAC,sEAAsE,KAAK,CAAC,eAAe,EAAE;gBACpG,CAAC,CAAC,IAAI,CAAC,oKAAoK;SAC9K,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,KAAK,EAAW,CAAC;IAChD,IAAI,UAAU,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAChF,MAAM,GAAG,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,kCAAkC,CAAC;QACvF,OAAO;YACL,MAAM,EAAE,MAAM;YACd,GAAG,IAAI;YACP,KAAK;YACL,MAAM,EAAE,IAAI;YACZ,MAAM,EAAE,iCAAiC,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,UAAU,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,CAAC,+BAA+B,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG;SACrL,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;QACjC,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,GAAG,IAAI;YACP,MAAM,EAAE,wBAAwB,CAAC,0FAA0F;SAC5H,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC;IAChF,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;IACnF,IAAI,KAAK,CAAC,OAAO,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;QACpC,MAAM,OAAO,GAAG,mBAAmB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,iBAAiB,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC9F,OAAO;YACL,MAAM,EAAE,MAAM;YACd,GAAG,IAAI;YACP,KAAK,EAAE,OAAO;YACd,MAAM,EAAE,KAAK;YACb,MAAM,EAAE,IAAI,CAAC,KAAK,WAAW,CAAC,KAAK,CAAC,qDAAqD,KAAK,CAAC,IAAI,CAAC,GAAG,OAAO,IAAI,OAAO,CAAC,OAAO,EAAE,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,qCAAqC,CAAC,CAAC,CAAC,EAAE,GAAG;SACxM,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,CAAC;QACtC,OAAO;YACL,MAAM,EAAE,MAAM;YACd,GAAG,IAAI;YACP,KAAK,EAAE,iBAAiB,CAAC,MAAM,EAAE,GAAG,CAAC;YACrC,MAAM,EAAE,KAAK;YACb,MAAM,EAAE,IAAI,CAAC,KAAK,WAAW,CAAC,KAAK,CAAC,+DAA+D,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,cAAc,IAAI;SACvK,CAAC;IACJ,CAAC;IACD,OAAO;QACL,MAAM,EAAE,SAAS;QACjB,GAAG,IAAI;QACP,MAAM,EAAE,IAAI,CAAC,KAAK,WAAW,CAAC,KAAK,CAAC,8DAA8D,KAAK,CAAC,IAAI,CAAC,uBAAuB,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,qCAAqC,CAAC,CAAC,CAAC,EAAE,GAAG;KACvM,CAAC;AACJ,CAAC"}
|
|
@@ -6,7 +6,7 @@
|
|
|
6
6
|
*/
|
|
7
7
|
import { z } from "zod";
|
|
8
8
|
/** Every state of an update request (`platform_update_requests.status`). */
|
|
9
|
-
export declare const PLATFORM_UPDATE_STATUSES: readonly ["pending", "running", "succeeded", "rolled_back", "failed", "refused", "needs_cloud_shell", "cancelled"];
|
|
9
|
+
export declare const PLATFORM_UPDATE_STATUSES: readonly ["pending", "running", "succeeded", "rolled_back", "failed", "refused", "needs_cloud_shell", "cancelled", "superseded"];
|
|
10
10
|
export type PlatformUpdateStatusValue = (typeof PLATFORM_UPDATE_STATUSES)[number];
|
|
11
11
|
/** States in which a request is still in flight (at most one at a time). */
|
|
12
12
|
export declare const ACTIVE_UPDATE_STATUSES: readonly PlatformUpdateStatusValue[];
|
|
@@ -14,10 +14,27 @@ export declare const ACTIVE_UPDATE_STATUSES: readonly PlatformUpdateStatusValue[
|
|
|
14
14
|
export declare function isFinishedUpdateStatus(status: PlatformUpdateStatusValue): boolean;
|
|
15
15
|
/**
|
|
16
16
|
* The phases of an upgrader run, in order (`platform_update_events.phase`).
|
|
17
|
-
* `rollback` only appears when a roll had to be undone
|
|
17
|
+
* `rollback` only appears when a roll had to be undone; `converge` only on
|
|
18
|
+
* the converge route (#819), where the install's cloud setup is brought to
|
|
19
|
+
* what the release expects before and around the roll.
|
|
18
20
|
*/
|
|
19
|
-
export declare const PLATFORM_UPDATE_PHASES: readonly ["queued", "start", "verify", "assess", "backup", "health-baseline", "migrations", "roll", "health", "rollback", "record", "self-update", "finish"];
|
|
21
|
+
export declare const PLATFORM_UPDATE_PHASES: readonly ["queued", "start", "verify", "assess", "backup", "converge", "health-baseline", "migrations", "roll", "health", "rollback", "record", "self-update", "finish"];
|
|
20
22
|
export type PlatformUpdatePhase = (typeof PLATFORM_UPDATE_PHASES)[number];
|
|
23
|
+
/**
|
|
24
|
+
* Which in-cloud job installs a request (#819, `platform_update_requests.route`):
|
|
25
|
+
*
|
|
26
|
+
* - `app_roll` — the upgrader job (its own narrow service account): new
|
|
27
|
+
* images + expand-only migrations, nothing in the cloud setup changes;
|
|
28
|
+
* - `converge` — the converge job, running as the install's existing
|
|
29
|
+
* `caelo-provisioner` account: the same upgrade an Owner runs from a
|
|
30
|
+
* terminal (backup, converge, roll, health check, rollback), for a
|
|
31
|
+
* release that raises the infrastructure contract.
|
|
32
|
+
*
|
|
33
|
+
* The admin picks the route from the release manifest before the click;
|
|
34
|
+
* either job re-checks everything against the signed manifest.
|
|
35
|
+
*/
|
|
36
|
+
export declare const PLATFORM_UPDATE_ROUTES: readonly ["app_roll", "converge"];
|
|
37
|
+
export type PlatformUpdateRoute = (typeof PLATFORM_UPDATE_ROUTES)[number];
|
|
21
38
|
/** Severity of one timeline line. */
|
|
22
39
|
export declare const PLATFORM_UPDATE_EVENT_LEVELS: readonly ["info", "success", "warn", "error"];
|
|
23
40
|
export type PlatformUpdateEventLevel = (typeof PLATFORM_UPDATE_EVENT_LEVELS)[number];
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"platform-updates.d.ts","sourceRoot":"","sources":["../src/platform-updates.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,4EAA4E;AAC5E,eAAO,MAAM,wBAAwB,
|
|
1
|
+
{"version":3,"file":"platform-updates.d.ts","sourceRoot":"","sources":["../src/platform-updates.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,4EAA4E;AAC5E,eAAO,MAAM,wBAAwB,kIAe3B,CAAC;AACX,MAAM,MAAM,yBAAyB,GAAG,CAAC,OAAO,wBAAwB,CAAC,CAAC,MAAM,CAAC,CAAC;AAElF,4EAA4E;AAC5E,eAAO,MAAM,sBAAsB,EAAE,SAAS,yBAAyB,EAA2B,CAAC;AAEnG,wCAAwC;AACxC,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,yBAAyB,GAAG,OAAO,CAEjF;AAED;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,0KAezB,CAAC;AACX,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1E;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,sBAAsB,mCAAoC,CAAC;AACxE,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1E,qCAAqC;AACrC,eAAO,MAAM,4BAA4B,+CAAgD,CAAC;AAC1F,MAAM,MAAM,wBAAwB,GAAG,CAAC,OAAO,4BAA4B,CAAC,CAAC,MAAM,CAAC,CAAC;AAErF,0EAA0E;AAC1E,eAAO,MAAM,wBAAwB,6BAA8B,CAAC;AACpE,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,wBAAwB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE9E;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,KAAK,CAAC;AAEhD;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,uRACmO,CAAC;AAE7Q,kDAAkD;AAClD,eAAO,MAAM,yBAAyB,OAAO,CAAC;AAI9C,gFAAgF;AAChF,eAAO,MAAM,oBAAoB,aAEwC,CAAC;AAE1E,iEAAiE;AACjE,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,CAAC;AAErD;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CActE;AAoBD;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,6BAA8B,CAAC;AAC/D,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEpE,mFAAmF;AACnF,eAAO,MAAM,sBAAsB,4CAA6C,CAAC;AAIjF,4DAA4D;AAC5D,wBAAgB,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAOnD;AAED;;;;GAIG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;kBAqC3B,CAAC;AACL,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,kDAAkD;AAClD,MAAM,WAAW,kBAAmB,SAAQ,YAAY;IACtD,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,sEAAsE;IACtE,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,kFAAkF;IAClF,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAgBD;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,aAAa,GAAG,WAAW,GAAG,gBAAgB,CAAC,EAC1E,EAAE,EAAE,IAAI,GACP,OAAO,CAOT;AAED,uFAAuF;AACvF,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAC1B,kFAAkF;IAClF,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,sEAAsE;IACtE,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;IACrC,6BAA6B;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,IAAI,CACV,kBAAkB,EAChB,MAAM,GACN,cAAc,GACd,WAAW,GACX,WAAW,GACX,QAAQ,GACR,aAAa,GACb,aAAa,GACb,WAAW,GACX,gBAAgB,CACnB,EACD,SAAS,EAAE,oBAAoB,EAC/B,EAAE,EAAE,IAAI,GACP,MAAM,GAAG,IAAI,CAwBf;AAED;;;;;GAKG;AACH,eAAO,MAAM,uBAAuB,KAAK,CAAC;AAE1C,0DAA0D;AAC1D,eAAO,MAAM,gBAAgB,+CAAgD,CAAC;AAC9E,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE9D;;;;GAIG;AACH,eAAO,MAAM,kCAAkC,KAAK,CAAC;AAErD;;;;GAIG;AACH,eAAO,MAAM,mCAAmC,MAAM,CAAC;AAEvD,uFAAuF;AACvF,MAAM,WAAW,yBAAyB;IACxC,iDAAiD;IACjD,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,0CAA0C;IAC1C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B;;;OAGG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,wFAAwF;IACxF,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;CACrC;AAED,6EAA6E;AAC7E,wBAAgB,sBAAsB,CAAC,UAAU,EAAE,IAAI,GAAG,MAAM,EAAE,GAAG,EAAE,IAAI,GAAG,OAAO,CAKpF"}
|
package/dist/platform-updates.js
CHANGED
|
@@ -16,6 +16,12 @@ export const PLATFORM_UPDATE_STATUSES = [
|
|
|
16
16
|
"refused",
|
|
17
17
|
"needs_cloud_shell",
|
|
18
18
|
"cancelled",
|
|
19
|
+
/**
|
|
20
|
+
* Asked the Owner to act (`needs_cloud_shell`), but the install has since
|
|
21
|
+
* moved past it: it runs the target release (or a newer one), or a newer
|
|
22
|
+
* request exists (#817, migration 0317). Shown in the history only.
|
|
23
|
+
*/
|
|
24
|
+
"superseded",
|
|
19
25
|
];
|
|
20
26
|
/** States in which a request is still in flight (at most one at a time). */
|
|
21
27
|
export const ACTIVE_UPDATE_STATUSES = ["pending", "running"];
|
|
@@ -25,7 +31,9 @@ export function isFinishedUpdateStatus(status) {
|
|
|
25
31
|
}
|
|
26
32
|
/**
|
|
27
33
|
* The phases of an upgrader run, in order (`platform_update_events.phase`).
|
|
28
|
-
* `rollback` only appears when a roll had to be undone
|
|
34
|
+
* `rollback` only appears when a roll had to be undone; `converge` only on
|
|
35
|
+
* the converge route (#819), where the install's cloud setup is brought to
|
|
36
|
+
* what the release expects before and around the roll.
|
|
29
37
|
*/
|
|
30
38
|
export const PLATFORM_UPDATE_PHASES = [
|
|
31
39
|
"queued",
|
|
@@ -33,6 +41,7 @@ export const PLATFORM_UPDATE_PHASES = [
|
|
|
33
41
|
"verify",
|
|
34
42
|
"assess",
|
|
35
43
|
"backup",
|
|
44
|
+
"converge",
|
|
36
45
|
"health-baseline",
|
|
37
46
|
"migrations",
|
|
38
47
|
"roll",
|
|
@@ -42,6 +51,20 @@ export const PLATFORM_UPDATE_PHASES = [
|
|
|
42
51
|
"self-update",
|
|
43
52
|
"finish",
|
|
44
53
|
];
|
|
54
|
+
/**
|
|
55
|
+
* Which in-cloud job installs a request (#819, `platform_update_requests.route`):
|
|
56
|
+
*
|
|
57
|
+
* - `app_roll` — the upgrader job (its own narrow service account): new
|
|
58
|
+
* images + expand-only migrations, nothing in the cloud setup changes;
|
|
59
|
+
* - `converge` — the converge job, running as the install's existing
|
|
60
|
+
* `caelo-provisioner` account: the same upgrade an Owner runs from a
|
|
61
|
+
* terminal (backup, converge, roll, health check, rollback), for a
|
|
62
|
+
* release that raises the infrastructure contract.
|
|
63
|
+
*
|
|
64
|
+
* The admin picks the route from the release manifest before the click;
|
|
65
|
+
* either job re-checks everything against the signed manifest.
|
|
66
|
+
*/
|
|
67
|
+
export const PLATFORM_UPDATE_ROUTES = ["app_roll", "converge"];
|
|
45
68
|
/** Severity of one timeline line. */
|
|
46
69
|
export const PLATFORM_UPDATE_EVENT_LEVELS = ["info", "success", "warn", "error"];
|
|
47
70
|
/** Who started a request: the Owner's click, or the Phase 5 scheduler. */
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"platform-updates.js","sourceRoot":"","sources":["../src/platform-updates.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,4EAA4E;AAC5E,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,SAAS;IACT,SAAS;IACT,WAAW;IACX,aAAa;IACb,QAAQ;IACR,SAAS;IACT,mBAAmB;IACnB,WAAW;
|
|
1
|
+
{"version":3,"file":"platform-updates.js","sourceRoot":"","sources":["../src/platform-updates.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;GAKG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,4EAA4E;AAC5E,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,SAAS;IACT,SAAS;IACT,WAAW;IACX,aAAa;IACb,QAAQ;IACR,SAAS;IACT,mBAAmB;IACnB,WAAW;IACX;;;;OAIG;IACH,YAAY;CACJ,CAAC;AAGX,4EAA4E;AAC5E,MAAM,CAAC,MAAM,sBAAsB,GAAyC,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;AAEnG,wCAAwC;AACxC,MAAM,UAAU,sBAAsB,CAAC,MAAiC;IACtE,OAAO,CAAC,sBAAsB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAClD,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,UAAU;IACV,iBAAiB;IACjB,YAAY;IACZ,MAAM;IACN,QAAQ;IACR,UAAU;IACV,QAAQ;IACR,aAAa;IACb,QAAQ;CACA,CAAC;AAGX;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,UAAU,EAAE,UAAU,CAAU,CAAC;AAGxE,qCAAqC;AACrC,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,CAAU,CAAC;AAG1F,0EAA0E;AAC1E,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAU,CAAC;AAGpE;;;;GAIG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAG,EAAE,CAAC;AAEhD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,4BAA4B,GACvC,0QAA0Q,CAAC;AAE7Q,kDAAkD;AAClD,MAAM,CAAC,MAAM,yBAAyB,GAAG,IAAI,CAAC;AAE9C,MAAM,MAAM,GAAG,6CAA6C,CAAC;AAE7D,gFAAgF;AAChF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC;KAClC,MAAM,EAAE;KACR,KAAK,CAAC,MAAM,EAAE,uDAAuD,CAAC,CAAC;AAK1E;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,EAAU;IACjD,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5B,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC1B,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChE,MAAM,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChE,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/C,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/C,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/C,oEAAoE;IACpE,wCAAwC;IACxC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC;IACvC,OAAO,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5D,CAAC;AAED,iEAAiE;AACjE,SAAS,iBAAiB,CAAC,CAAS,EAAE,CAAS;IAC7C,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxB,MAAM,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACxD,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QAChB,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QAChB,IAAI,CAAC,KAAK,SAAS;YAAE,OAAO,CAAC,CAAC,CAAC;QAC/B,IAAI,CAAC,KAAK,SAAS;YAAE,OAAO,CAAC,CAAC;QAC9B,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3B,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3B,IAAI,EAAE,IAAI,EAAE,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC;YAAE,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACtE,IAAI,EAAE,KAAK,EAAE;YAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAClC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAU,CAAC;AAG/D,mFAAmF;AACnF,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAU,CAAC;AAEjF,MAAM,UAAU,GAAG,2BAA2B,CAAC;AAE/C,4DAA4D;AAC5D,MAAM,UAAU,eAAe,CAAC,EAAU;IACxC,IAAI,CAAC;QACH,IAAI,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;QACnD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC;IACjC,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE;IACzB,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;IACtB,SAAS,EAAE,CAAC,CAAC,OAAO,EAAE;IACtB;;;;;OAKG;IACH,YAAY,EAAE,CAAC,CAAC,OAAO,EAAE;IACzB,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC;IACvC,sFAAsF;IACtF,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAC,QAAQ,EAAE;IACtE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAC,QAAQ,EAAE;IACpE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,mBAAmB,CAAC;IACtF,oFAAoF;IACpF,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IAC3C;;;;;OAKG;IACH,iBAAiB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;CACpD,CAAC;KACD,MAAM,EAAE;KACR,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,KAAK,IAAI,CAAC,EAAE;IAClE,OAAO,EAAE,qDAAqD;CAC/D,CAAC;KACD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,CAAC,OAAO,KAAK,QAAQ,EAAE;IAC1D,OAAO,EAAE,mDAAmD;CAC7D,CAAC;KACD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,iBAAiB,IAAI,CAAC,CAAC,SAAS,EAAE;IACjD,OAAO,EAAE,uDAAuD;CACjE,CAAC,CAAC;AAeL,0DAA0D;AAC1D,SAAS,YAAY,CAAC,EAAQ,EAAE,QAAgB;IAC9C,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE;QAC7C,QAAQ;QACR,IAAI,EAAE,SAAS;QACf,MAAM,EAAE,SAAS;QACjB,SAAS,EAAE,KAAK;KACjB,CAAC,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;IACrB,MAAM,CAAC,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,EAAE,KAAK,IAAI,GAAG,CAAC,CAAC;IAC/E,OAAO,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,SAAS,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAE7F;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAA0E,EAC1E,EAAQ;IAER,IAAI,MAAM,CAAC,WAAW,KAAK,IAAI,IAAI,MAAM,CAAC,SAAS,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC1E,MAAM,GAAG,GAAG,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACxC,IAAI,KAAK,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAC/B,OAAO,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,IAAI,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,KAAK,IAAI,GAAG,GAAG,GAAG,CAAC;AAC7E,CAAC;AAaD;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAWC,EACD,SAA+B,EAC/B,EAAQ;IAER,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,0DAA0D,CAAC;IAC9F,kEAAkE;IAClE,uEAAuE;IACvE,IACE,MAAM,CAAC,MAAM;QACb,CAAC,MAAM,CAAC,WAAW,KAAK,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,EAC9E,CAAC;QACD,OAAO,+BAA+B,CAAC;IACzC,CAAC;IACD,IAAI,SAAS,CAAC,OAAO,KAAK,QAAQ;QAAE,OAAO,4CAA4C,CAAC;IACxF,IAAI,SAAS,CAAC,kBAAkB,EAAE,CAAC;QACjC,OAAO,iFAAiF,CAAC;IAC3F,CAAC;IACD,IAAI,SAAS,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,4CAA4C,CAAC;IACpF,MAAM,OAAO,GACX,CAAC,SAAS,CAAC,QAAQ,IAAI,MAAM,CAAC,YAAY,CAAC;QAC3C,CAAC,SAAS,CAAC,IAAI,KAAK,OAAO,IAAI,MAAM,CAAC,SAAS,CAAC;QAChD,CAAC,SAAS,CAAC,IAAI,KAAK,OAAO,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC;IACnD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,+BAA+B,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,GAAG,SAAS,CAAC,IAAI,yBAAyB,CAAC;IACjI,CAAC;IACD,IAAI,CAAC,mBAAmB,CAAC,MAAM,EAAE,EAAE,CAAC;QAAE,OAAO,gCAAgC,CAAC;IAC9E,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,CAAC;AAE1C,0DAA0D;AAC1D,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,iBAAiB,EAAE,eAAe,CAAU,CAAC;AAG9E;;;;GAIG;AACH,MAAM,CAAC,MAAM,kCAAkC,GAAG,EAAE,CAAC;AAErD;;;;GAIG;AACH,MAAM,CAAC,MAAM,mCAAmC,GAAG,GAAG,CAAC;AAkBvD,6EAA6E;AAC7E,MAAM,UAAU,sBAAsB,CAAC,UAAyB,EAAE,GAAS;IACzE,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC;IAC5C,OAAO,CACL,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI,mCAAmC,GAAG,IAAI,CAC5F,CAAC;AACJ,CAAC"}
|
|
@@ -31,9 +31,9 @@ export declare const PROPOSAL_STATUSES: readonly ["pending", "applied", "rejecte
|
|
|
31
31
|
/** Zod enum over {@link PROPOSAL_STATUSES} — the single source for every gated-domain `status` schema. */
|
|
32
32
|
export declare const proposalStatus: z.ZodEnum<{
|
|
33
33
|
pending: "pending";
|
|
34
|
+
superseded: "superseded";
|
|
34
35
|
applied: "applied";
|
|
35
36
|
rejected: "rejected";
|
|
36
|
-
superseded: "superseded";
|
|
37
37
|
}>;
|
|
38
38
|
/** Union of the four propose/execute states. */
|
|
39
39
|
export type ProposalStatus = z.infer<typeof proposalStatus>;
|
|
@@ -84,6 +84,16 @@ export declare function withGcpRedirects(matcher: GcpPathMatcher, plan: Redirect
|
|
|
84
84
|
* @throws {GcpUrlMapBudgetError} when the plan does not fit.
|
|
85
85
|
*/
|
|
86
86
|
export declare function assertGcpRedirectBudget(plan: RedirectPlan, baseRules: readonly GcpPathRule[]): void;
|
|
87
|
-
/**
|
|
87
|
+
/**
|
|
88
|
+
* The site's own routing in the `public` path matcher (stack + budget): the
|
|
89
|
+
* paths the load balancer sends to the gateway instead of the static bucket.
|
|
90
|
+
* `/api/*` is the gateway's whole API, the remote-MCP broker included
|
|
91
|
+
* (#806). The two `/.well-known/oauth-*` prefixes are the broker's
|
|
92
|
+
* discovery documents, which MCP clients look up at the host root (RFC 9728
|
|
93
|
+
* protected-resource metadata, RFC 8414 authorization-server metadata) —
|
|
94
|
+
* they must reach the gateway, not 404 in the bucket. No
|
|
95
|
+
* `openid-configuration` prefix: the broker is not an OpenID provider and
|
|
96
|
+
* serves no such document (#899), so the site keeps that path.
|
|
97
|
+
*/
|
|
88
98
|
export declare const GCP_PUBLIC_BASE_PATHS: readonly string[];
|
|
89
99
|
//# sourceMappingURL=redirect-emit-gcp.d.ts.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"redirect-emit-gcp.d.ts","sourceRoot":"","sources":["../src/redirect-emit-gcp.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,KAAK,EAAmB,YAAY,EAAsB,MAAM,oBAAoB,CAAC;AAE5F,wEAAwE;AACxE,eAAO,MAAM,0BAA0B,OAAO,CAAC;AAC/C,iEAAiE;AACjE,eAAO,MAAM,0BAA0B,OAAO,CAAC;AAU/C,MAAM,MAAM,uBAAuB,GAC/B,2BAA2B,GAC3B,OAAO,GACP,WAAW,GACX,oBAAoB,GACpB,oBAAoB,CAAC;AAEzB,kEAAkE;AAClE,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,CAAC,EAAE;QACrB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;QAC/B,QAAQ,CAAC,oBAAoB,CAAC,EAAE,uBAAuB,CAAC;QACxD,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;QAC9B,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACjC,CAAC;IACF,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACjC;AAED,4EAA4E;AAC5E,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,WAAW,EAAE,CAAC;IAC5C,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;IACzC,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACjC;AAED,2EAA2E;AAC3E,qBAAa,oBAAqB,SAAQ,KAAK;IAE3C,QAAQ,CAAC,aAAa,EAAE,MAAM;IAC9B,QAAQ,CAAC,gBAAgB,EAAE,MAAM;IACjC,QAAQ,CAAC,WAAW,EAAE,MAAM;gBAFnB,aAAa,EAAE,MAAM,EACrB,gBAAgB,EAAE,MAAM,EACxB,WAAW,EAAE,MAAM;CAO/B;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,YAAY,GAAG,WAAW,EAAE,CAEtE;AAwBD,6EAA6E;AAC7E,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAE5D;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,YAAY,GAAG,cAAc,CAc5F;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,YAAY,EAClB,SAAS,EAAE,SAAS,WAAW,EAAE,GAChC,IAAI,CAEN;AAED
|
|
1
|
+
{"version":3,"file":"redirect-emit-gcp.d.ts","sourceRoot":"","sources":["../src/redirect-emit-gcp.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,KAAK,EAAmB,YAAY,EAAsB,MAAM,oBAAoB,CAAC;AAE5F,wEAAwE;AACxE,eAAO,MAAM,0BAA0B,OAAO,CAAC;AAC/C,iEAAiE;AACjE,eAAO,MAAM,0BAA0B,OAAO,CAAC;AAU/C,MAAM,MAAM,uBAAuB,GAC/B,2BAA2B,GAC3B,OAAO,GACP,WAAW,GACX,oBAAoB,GACpB,oBAAoB,CAAC;AAEzB,kEAAkE;AAClE,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,WAAW,CAAC,EAAE;QACrB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;QAC/B,QAAQ,CAAC,oBAAoB,CAAC,EAAE,uBAAuB,CAAC;QACxD,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;QAC9B,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;KACjC,CAAC;IACF,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACjC;AAED,4EAA4E;AAC5E,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,WAAW,EAAE,CAAC;IAC5C,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,OAAO,EAAE,CAAC;IACzC,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACjC;AAED,2EAA2E;AAC3E,qBAAa,oBAAqB,SAAQ,KAAK;IAE3C,QAAQ,CAAC,aAAa,EAAE,MAAM;IAC9B,QAAQ,CAAC,gBAAgB,EAAE,MAAM;IACjC,QAAQ,CAAC,WAAW,EAAE,MAAM;gBAFnB,aAAa,EAAE,MAAM,EACrB,gBAAgB,EAAE,MAAM,EACxB,WAAW,EAAE,MAAM;CAO/B;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,YAAY,GAAG,WAAW,EAAE,CAEtE;AAwBD,6EAA6E;AAC7E,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,WAAW,GAAG,OAAO,CAE5D;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,cAAc,EAAE,IAAI,EAAE,YAAY,GAAG,cAAc,CAc5F;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,YAAY,EAClB,SAAS,EAAE,SAAS,WAAW,EAAE,GAChC,IAAI,CAEN;AAED;;;;;;;;;;GAUG;AACH,eAAO,MAAM,qBAAqB,EAAE,SAAS,MAAM,EAIlD,CAAC"}
|
|
@@ -86,6 +86,20 @@ export function withGcpRedirects(matcher, plan) {
|
|
|
86
86
|
export function assertGcpRedirectBudget(plan, baseRules) {
|
|
87
87
|
withGcpRedirects({ name: "budget-check", pathRules: baseRules }, plan);
|
|
88
88
|
}
|
|
89
|
-
/**
|
|
90
|
-
|
|
89
|
+
/**
|
|
90
|
+
* The site's own routing in the `public` path matcher (stack + budget): the
|
|
91
|
+
* paths the load balancer sends to the gateway instead of the static bucket.
|
|
92
|
+
* `/api/*` is the gateway's whole API, the remote-MCP broker included
|
|
93
|
+
* (#806). The two `/.well-known/oauth-*` prefixes are the broker's
|
|
94
|
+
* discovery documents, which MCP clients look up at the host root (RFC 9728
|
|
95
|
+
* protected-resource metadata, RFC 8414 authorization-server metadata) —
|
|
96
|
+
* they must reach the gateway, not 404 in the bucket. No
|
|
97
|
+
* `openid-configuration` prefix: the broker is not an OpenID provider and
|
|
98
|
+
* serves no such document (#899), so the site keeps that path.
|
|
99
|
+
*/
|
|
100
|
+
export const GCP_PUBLIC_BASE_PATHS = [
|
|
101
|
+
"/api/*",
|
|
102
|
+
"/.well-known/oauth-protected-resource/*",
|
|
103
|
+
"/.well-known/oauth-authorization-server/*",
|
|
104
|
+
];
|
|
91
105
|
//# sourceMappingURL=redirect-emit-gcp.js.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"redirect-emit-gcp.js","sourceRoot":"","sources":["../src/redirect-emit-gcp.ts"],"names":[],"mappings":"AAAA,mCAAmC;AA+BnC,wEAAwE;AACxE,MAAM,CAAC,MAAM,0BAA0B,GAAG,IAAI,CAAC;AAC/C,iEAAiE;AACjE,MAAM,CAAC,MAAM,0BAA0B,GAAG,IAAI,CAAC;AAE/C,4DAA4D;AAC5D,MAAM,aAAa,GAAwD;IACzE,GAAG,EAAE,2BAA2B;IAChC,GAAG,EAAE,OAAO;IACZ,GAAG,EAAE,oBAAoB;IACzB,GAAG,EAAE,oBAAoB;CAC1B,CAAC;AA8BF,2EAA2E;AAC3E,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAElC;IACA;IACA;IAHX,YACW,aAAqB,EACrB,gBAAwB,EACxB,WAAmB;QAE5B,KAAK,CACH,wCAAwC,0BAA0B,uBAAuB,0BAA0B,wDAAwD,aAAa,qBAAqB,gBAAgB,cAAc,WAAW,2cAA2c,CAClsB,CAAC;QANO,kBAAa,GAAb,aAAa,CAAQ;QACrB,qBAAgB,GAAhB,gBAAgB,CAAQ;QACxB,gBAAW,GAAX,WAAW,CAAQ;QAK5B,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAkB;IACrD,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,UAAU,CAAC,CAAkB;IACpC,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CACb,uCAAuC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,4IAA4I,CAC9M,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CACb,mCAAmC,CAAC,CAAC,QAAQ,MAAM,CAAC,CAAC,QAAQ,iLAAiL,CAC/O,CAAC;IACJ,CAAC;IACD,OAAO;QACL,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC;QACxB,WAAW,EAAE;YACX,YAAY,EAAE,CAAC,CAAC,QAAQ;YACxB,oBAAoB,EAAE,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC;YACjD,kEAAkE;YAClE,UAAU,EAAE,KAAK;SAClB;KACF,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,iBAAiB,CAAC,IAAiB;IACjD,OAAO,IAAI,CAAC,WAAW,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC;AACtE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAuB,EAAE,IAAkB;IAC1E,IAAI,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CACb,mCAAmC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,2MAA2M,CAC3Q,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5E,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,EAAE,GAAG,SAAS,CAAC,CAAC;IAC1C,MAAM,UAAU,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACrE,IAAI,UAAU,GAAG,0BAA0B,IAAI,SAAS,CAAC,MAAM,GAAG,0BAA0B,EAAE,CAAC;QAC7F,MAAM,IAAI,oBAAoB,CAAC,SAAS,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,CAAC;AACnC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CACrC,IAAkB,EAClB,SAAiC;IAEjC,gBAAgB,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,IAAI,CAAC,CAAC;AACzE,CAAC;AAED
|
|
1
|
+
{"version":3,"file":"redirect-emit-gcp.js","sourceRoot":"","sources":["../src/redirect-emit-gcp.ts"],"names":[],"mappings":"AAAA,mCAAmC;AA+BnC,wEAAwE;AACxE,MAAM,CAAC,MAAM,0BAA0B,GAAG,IAAI,CAAC;AAC/C,iEAAiE;AACjE,MAAM,CAAC,MAAM,0BAA0B,GAAG,IAAI,CAAC;AAE/C,4DAA4D;AAC5D,MAAM,aAAa,GAAwD;IACzE,GAAG,EAAE,2BAA2B;IAChC,GAAG,EAAE,OAAO;IACZ,GAAG,EAAE,oBAAoB;IACzB,GAAG,EAAE,oBAAoB;CAC1B,CAAC;AA8BF,2EAA2E;AAC3E,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAElC;IACA;IACA;IAHX,YACW,aAAqB,EACrB,gBAAwB,EACxB,WAAmB;QAE5B,KAAK,CACH,wCAAwC,0BAA0B,uBAAuB,0BAA0B,wDAAwD,aAAa,qBAAqB,gBAAgB,cAAc,WAAW,2cAA2c,CAClsB,CAAC;QANO,kBAAa,GAAb,aAAa,CAAQ;QACrB,qBAAgB,GAAhB,gBAAgB,CAAQ;QACxB,gBAAW,GAAX,WAAW,CAAQ;QAK5B,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAkB;IACrD,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,UAAU,CAAC,CAAkB;IACpC,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CACb,uCAAuC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,4IAA4I,CAC9M,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,CAAC,CAAC,aAAa,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CACb,mCAAmC,CAAC,CAAC,QAAQ,MAAM,CAAC,CAAC,QAAQ,iLAAiL,CAC/O,CAAC;IACJ,CAAC;IACD,OAAO;QACL,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC;QACxB,WAAW,EAAE;YACX,YAAY,EAAE,CAAC,CAAC,QAAQ;YACxB,oBAAoB,EAAE,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC;YACjD,kEAAkE;YAClE,UAAU,EAAE,KAAK;SAClB;KACF,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,iBAAiB,CAAC,IAAiB;IACjD,OAAO,IAAI,CAAC,WAAW,KAAK,SAAS,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC;AACtE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAuB,EAAE,IAAkB;IAC1E,IAAI,OAAO,CAAC,UAAU,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CACb,mCAAmC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,2MAA2M,CAC3Q,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5E,MAAM,SAAS,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,EAAE,GAAG,SAAS,CAAC,CAAC;IAC1C,MAAM,UAAU,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACrE,IAAI,UAAU,GAAG,0BAA0B,IAAI,SAAS,CAAC,MAAM,GAAG,0BAA0B,EAAE,CAAC;QAC7F,MAAM,IAAI,oBAAoB,CAAC,SAAS,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,CAAC;AACnC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CACrC,IAAkB,EAClB,SAAiC;IAEjC,gBAAgB,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,IAAI,CAAC,CAAC;AACzE,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAsB;IACtD,QAAQ;IACR,yCAAyC;IACzC,2CAA2C;CAC5C,CAAC"}
|
|
@@ -55,16 +55,26 @@ export declare const RELEASE_MANIFEST_MEDIA_TYPE = "application/vnd.caelo.releas
|
|
|
55
55
|
export declare const SIGSTORE_BUNDLE_MEDIA_TYPE = "application/vnd.dev.sigstore.bundle.v0.3+json";
|
|
56
56
|
/** Why fetching the artifact failed. */
|
|
57
57
|
export type ReleaseArtifactErrorCode = "registry" | "artifact-shape" | "blob-digest";
|
|
58
|
+
/** Why {@link fetchReleaseArtifact} failed. */
|
|
59
|
+
export interface ReleaseArtifactError {
|
|
60
|
+
readonly code: ReleaseArtifactErrorCode;
|
|
61
|
+
readonly message: string;
|
|
62
|
+
/**
|
|
63
|
+
* Set on `registry` errors a retry may cure: the registry could not be
|
|
64
|
+
* reached, timed out, rate-limited (429) or failed (5xx). Absent when the
|
|
65
|
+
* registry answered that the manifest, tag or blob does not exist (404 and
|
|
66
|
+
* other 4xx) — retrying that changes nothing, so callers that would
|
|
67
|
+
* otherwise "try again later" must treat it as a verdict.
|
|
68
|
+
*/
|
|
69
|
+
readonly transient?: true;
|
|
70
|
+
}
|
|
58
71
|
export type ReleaseArtifactResult = {
|
|
59
72
|
readonly ok: true;
|
|
60
73
|
readonly manifestBytes: Uint8Array;
|
|
61
74
|
readonly bundleBytes: Uint8Array;
|
|
62
75
|
} | {
|
|
63
76
|
readonly ok: false;
|
|
64
|
-
readonly error:
|
|
65
|
-
readonly code: ReleaseArtifactErrorCode;
|
|
66
|
-
readonly message: string;
|
|
67
|
-
};
|
|
77
|
+
readonly error: ReleaseArtifactError;
|
|
68
78
|
};
|
|
69
79
|
/** Where and how {@link fetchReleaseArtifact} reaches the registry. */
|
|
70
80
|
export interface ReleaseArtifactDeps {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"release-manifest.d.ts","sourceRoot":"","sources":["../src/release-manifest.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,iFAAiF;AACjF,eAAO,MAAM,gBAAgB,4CAA6C,CAAC;AAC3E,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE/D,+CAA+C;AAC/C,eAAO,MAAM,cAAc,sCAAuC,CAAC;AACnE,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAE3D,+CAA+C;AAC/C,eAAO,MAAM,YAAY,QAA0B,CAAC;AAOpD,iEAAiE;AACjE,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;iBAuBhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,wFAAwF;AACxF,eAAO,MAAM,yBAAyB,gCAAgC,CAAC;AACvE,yFAAyF;AACzF,eAAO,MAAM,2BAA2B,oDAAoD,CAAC;AAE7F,oEAAoE;AACpE,eAAO,MAAM,8BAA8B,8CAA8C,CAAC;AAC1F,eAAO,MAAM,2BAA2B,mDAAmD,CAAC;AAC5F,eAAO,MAAM,0BAA0B,kDAAkD,CAAC;AAE1F,wCAAwC;AACxC,MAAM,MAAM,wBAAwB,GAAG,UAAU,GAAG,gBAAgB,GAAG,aAAa,CAAC;AAErF,MAAM,
|
|
1
|
+
{"version":3,"file":"release-manifest.d.ts","sourceRoot":"","sources":["../src/release-manifest.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,iFAAiF;AACjF,eAAO,MAAM,gBAAgB,4CAA6C,CAAC;AAC3E,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE/D,+CAA+C;AAC/C,eAAO,MAAM,cAAc,sCAAuC,CAAC;AACnE,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,CAAC;AAE3D,+CAA+C;AAC/C,eAAO,MAAM,YAAY,QAA0B,CAAC;AAOpD,iEAAiE;AACjE,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;iBAuBhC,CAAC;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,wFAAwF;AACxF,eAAO,MAAM,yBAAyB,gCAAgC,CAAC;AACvE,yFAAyF;AACzF,eAAO,MAAM,2BAA2B,oDAAoD,CAAC;AAE7F,oEAAoE;AACpE,eAAO,MAAM,8BAA8B,8CAA8C,CAAC;AAC1F,eAAO,MAAM,2BAA2B,mDAAmD,CAAC;AAC5F,eAAO,MAAM,0BAA0B,kDAAkD,CAAC;AAE1F,wCAAwC;AACxC,MAAM,MAAM,wBAAwB,GAAG,UAAU,GAAG,gBAAgB,GAAG,aAAa,CAAC;AAErF,+CAA+C;AAC/C,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,wBAAwB,CAAC;IACxC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC;CAC3B;AAED,MAAM,MAAM,qBAAqB,GAC7B;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,aAAa,EAAE,UAAU,CAAC;IAAC,QAAQ,CAAC,WAAW,EAAE,UAAU,CAAA;CAAE,GAC3F;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,oBAAoB,CAAA;CAAE,CAAC;AAEjE,uEAAuE;AACvE,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IACvE,sEAAsE;IACtE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAiCD;;;;;;;GAOG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,qBAAqB,CAAC,CAkEhC;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,UAAU,EACjB,OAAO,EAAE,MAAM,GAEb;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAA;CAAE,GACzD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,kBAAkB,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAuBjG"}
|
package/dist/release-manifest.js
CHANGED
|
@@ -66,6 +66,19 @@ const fail = (code, message) => ({
|
|
|
66
66
|
ok: false,
|
|
67
67
|
error: { code, message },
|
|
68
68
|
});
|
|
69
|
+
/** A `registry` failure a retry may cure (see {@link ReleaseArtifactError.transient}). */
|
|
70
|
+
const failTransient = (message) => ({
|
|
71
|
+
ok: false,
|
|
72
|
+
error: { code: "registry", message, transient: true },
|
|
73
|
+
});
|
|
74
|
+
/** Whether an HTTP status says "try again" rather than "it does not exist". */
|
|
75
|
+
function isTransientStatus(status) {
|
|
76
|
+
return status >= 500 || status === 429 || status === 408;
|
|
77
|
+
}
|
|
78
|
+
/** A non-OK registry response as a failure, transient or not by its status. */
|
|
79
|
+
function failStatus(status, message) {
|
|
80
|
+
return isTransientStatus(status) ? failTransient(message) : fail("registry", message);
|
|
81
|
+
}
|
|
69
82
|
/**
|
|
70
83
|
* Fetch the release manifest artifact of `version` and both its layers,
|
|
71
84
|
* each checked against its content digest. Verifies NO signature: callers
|
|
@@ -82,6 +95,9 @@ export async function fetchReleaseArtifact(version, deps) {
|
|
|
82
95
|
headers: { Accept: "application/vnd.oci.image.manifest.v1+json" },
|
|
83
96
|
});
|
|
84
97
|
if (!res.ok) {
|
|
98
|
+
if (isTransientStatus(res.status)) {
|
|
99
|
+
return failTransient(`the registry at ${base} could not serve the release manifest of v${version} (HTTP ${res.status}); try again later.`);
|
|
100
|
+
}
|
|
85
101
|
return fail("registry", `no release manifest for v${version} at ${base} (HTTP ${res.status}). Releases before the signed manifest (epic #696) have none; otherwise check the version exists.`);
|
|
86
102
|
}
|
|
87
103
|
const parsed = OciManifestSchema.safeParse(await res.json());
|
|
@@ -91,7 +107,7 @@ export async function fetchReleaseArtifact(version, deps) {
|
|
|
91
107
|
artifact = parsed.data;
|
|
92
108
|
}
|
|
93
109
|
catch (e) {
|
|
94
|
-
return
|
|
110
|
+
return failTransient(`registry unreachable: ${e instanceof Error ? e.message : String(e)}`);
|
|
95
111
|
}
|
|
96
112
|
if (artifact.artifactType !== RELEASE_MANIFEST_ARTIFACT_TYPE) {
|
|
97
113
|
return fail("artifact-shape", `artifactType is ${artifact.artifactType ?? "(none)"}, expected ${RELEASE_MANIFEST_ARTIFACT_TYPE}`);
|
|
@@ -106,7 +122,7 @@ export async function fetchReleaseArtifact(version, deps) {
|
|
|
106
122
|
const blob = async (layerDigest) => {
|
|
107
123
|
const res = await deps.fetch(`${base}/blobs/${layerDigest}`);
|
|
108
124
|
if (!res.ok)
|
|
109
|
-
return
|
|
125
|
+
return failStatus(res.status, `blob ${layerDigest}: HTTP ${res.status}`);
|
|
110
126
|
const bytes = new Uint8Array(await res.arrayBuffer());
|
|
111
127
|
const actual = await sha256Digest(bytes);
|
|
112
128
|
if (actual !== layerDigest) {
|
|
@@ -124,7 +140,7 @@ export async function fetchReleaseArtifact(version, deps) {
|
|
|
124
140
|
return { ok: true, manifestBytes, bundleBytes };
|
|
125
141
|
}
|
|
126
142
|
catch (e) {
|
|
127
|
-
return
|
|
143
|
+
return failTransient(`registry unreachable: ${e instanceof Error ? e.message : String(e)}`);
|
|
128
144
|
}
|
|
129
145
|
}
|
|
130
146
|
/**
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"release-manifest.js","sourceRoot":"","sources":["../src/release-manifest.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,iFAAiF;AACjF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAU,CAAC;AAG3E,+CAA+C;AAC/C,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAU,CAAC;AAGnE,+CAA+C;AAC/C,MAAM,CAAC,MAAM,YAAY,GAAG,uBAAuB,CAAC;AAEpD,MAAM,MAAM,GAAG,6CAA6C,CAAC;AAC7D,MAAM,OAAO,GAAG,uCAAuC,CAAC;AAExD,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,YAAY,EAAE,0BAA0B,CAAC,CAAC;AAE1E,iEAAiE;AACjE,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,+CAA+C,CAAC;IAClF,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC;IACjC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;IAClE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC;IACxC,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACjD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACnB,uEAAuE;QACvE,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;QACrB;;;;;WAKG;QACH,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;QACxD,mFAAmF;QACnF,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KACxB,CAAC;IACF,0FAA0F;IAC1F,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;IACrB,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;CACrE,CAAC,CAAC;AAGH,wFAAwF;AACxF,MAAM,CAAC,MAAM,yBAAyB,GAAG,6BAA6B,CAAC;AACvE,yFAAyF;AACzF,MAAM,CAAC,MAAM,2BAA2B,GAAG,iDAAiD,CAAC;AAE7F,oEAAoE;AACpE,MAAM,CAAC,MAAM,8BAA8B,GAAG,2CAA2C,CAAC;AAC1F,MAAM,CAAC,MAAM,2BAA2B,GAAG,gDAAgD,CAAC;AAC5F,MAAM,CAAC,MAAM,0BAA0B,GAAG,+CAA+C,CAAC;
|
|
1
|
+
{"version":3,"file":"release-manifest.js","sourceRoot":"","sources":["../src/release-manifest.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,iFAAiF;AACjF,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAU,CAAC;AAG3E,+CAA+C;AAC/C,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAU,CAAC;AAGnE,+CAA+C;AAC/C,MAAM,CAAC,MAAM,YAAY,GAAG,uBAAuB,CAAC;AAEpD,MAAM,MAAM,GAAG,6CAA6C,CAAC;AAC7D,MAAM,OAAO,GAAG,uCAAuC,CAAC;AAExD,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,YAAY,EAAE,0BAA0B,CAAC,CAAC;AAE1E,iEAAiE;AACjE,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,eAAe,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,+CAA+C,CAAC;IAClF,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC;IACjC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;IAClE,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC;IACxC,oBAAoB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACjD,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC;QACnB,uEAAuE;QACvE,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;QACrB;;;;;WAKG;QACH,mBAAmB,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;QACxD,mFAAmF;QACnF,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KACxB,CAAC;IACF,0FAA0F;IAC1F,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE;IACrB,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;CACrE,CAAC,CAAC;AAGH,wFAAwF;AACxF,MAAM,CAAC,MAAM,yBAAyB,GAAG,6BAA6B,CAAC;AACvE,yFAAyF;AACzF,MAAM,CAAC,MAAM,2BAA2B,GAAG,iDAAiD,CAAC;AAE7F,oEAAoE;AACpE,MAAM,CAAC,MAAM,8BAA8B,GAAG,2CAA2C,CAAC;AAC1F,MAAM,CAAC,MAAM,2BAA2B,GAAG,gDAAgD,CAAC;AAC5F,MAAM,CAAC,MAAM,0BAA0B,GAAG,+CAA+C,CAAC;AA+B1F,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACnC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;CAC7F,CAAC,CAAC;AAEH,KAAK,UAAU,YAAY,CAAC,KAA8B;IACxD,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC;IAC1E,OAAO,UAAU,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;AACpF,CAAC;AAED,MAAM,IAAI,GAAG,CAAC,IAA8B,EAAE,OAAe,EAAyB,EAAE,CAAC,CAAC;IACxF,EAAE,EAAE,KAAK;IACT,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE;CACzB,CAAC,CAAC;AAEH,0FAA0F;AAC1F,MAAM,aAAa,GAAG,CAAC,OAAe,EAAyB,EAAE,CAAC,CAAC;IACjE,EAAE,EAAE,KAAK;IACT,KAAK,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE;CACtD,CAAC,CAAC;AAEH,+EAA+E;AAC/E,SAAS,iBAAiB,CAAC,MAAc;IACvC,OAAO,MAAM,IAAI,GAAG,IAAI,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,GAAG,CAAC;AAC3D,CAAC;AAED,+EAA+E;AAC/E,SAAS,UAAU,CAAC,MAAc,EAAE,OAAe;IACjD,OAAO,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;AACxF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,OAAe,EACf,IAAyB;IAEzB,MAAM,IAAI,GAAG,WAAW,IAAI,CAAC,QAAQ,IAAI,yBAAyB,OAAO,IAAI,CAAC,UAAU,IAAI,2BAA2B,EAAE,CAAC;IAC1H,IAAI,QAA2C,CAAC;IAChD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,cAAc,OAAO,EAAE,EAAE;YAC3D,OAAO,EAAE,EAAE,MAAM,EAAE,4CAA4C,EAAE;SAClE,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,IAAI,iBAAiB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBAClC,OAAO,aAAa,CAClB,mBAAmB,IAAI,6CAA6C,OAAO,UAAU,GAAG,CAAC,MAAM,qBAAqB,CACrH,CAAC;YACJ,CAAC;YACD,OAAO,IAAI,CACT,UAAU,EACV,4BAA4B,OAAO,OAAO,IAAI,UAAU,GAAG,CAAC,MAAM,mGAAmG,CACtK,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAC7D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC,gBAAgB,EAAE,wBAAwB,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC;IACzB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,aAAa,CAAC,yBAAyB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC9F,CAAC;IAED,IAAI,QAAQ,CAAC,YAAY,KAAK,8BAA8B,EAAE,CAAC;QAC7D,OAAO,IAAI,CACT,gBAAgB,EAChB,mBAAmB,QAAQ,CAAC,YAAY,IAAI,QAAQ,cAAc,8BAA8B,EAAE,CACnG,CAAC;IACJ,CAAC;IACD,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,2BAA2B,CAAC,CAAC;IAClG,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,0BAA0B,CAAC,CAAC;IAC/F,MAAM,CAAC,aAAa,CAAC,GAAG,cAAc,CAAC;IACvC,MAAM,CAAC,WAAW,CAAC,GAAG,YAAY,CAAC;IACnC,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,aAAa,IAAI,CAAC,WAAW,EAAE,CAAC;QAC/F,OAAO,IAAI,CACT,gBAAgB,EAChB,yFAAyF,CAC1F,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,KAAK,EAAE,WAAmB,EAA+C,EAAE;QACtF,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,UAAU,WAAW,EAAE,CAAC,CAAC;QAC7D,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,WAAW,UAAU,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACtF,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;QACtD,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;YAC3B,OAAO,IAAI,CACT,aAAa,EACb,2CAA2C,WAAW,cAAc,MAAM,+CAA+C,CAC1H,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;IACF,IAAI,CAAC;QACH,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;QACvD,IAAI,CAAC,CAAC,aAAa,YAAY,UAAU,CAAC;YAAE,OAAO,aAAa,CAAC;QACjE,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACnD,IAAI,CAAC,CAAC,WAAW,YAAY,UAAU,CAAC;YAAE,OAAO,WAAW,CAAC;QAC7D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,CAAC;IAClD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,aAAa,CAAC,yBAAyB,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC9F,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,KAAiB,EACjB,OAAe;IAIf,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,gCAAgC,EAAE,CAAC;IAClF,CAAC;IACD,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACrD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,yFAAyF,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE;SACzH,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;QACpC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,kBAAkB;YACxB,OAAO,EAAE,cAAc,OAAO,gCAAgC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE;SACpF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;AAC7C,CAAC"}
|
package/dist/version.d.ts
CHANGED
|
@@ -19,7 +19,7 @@
|
|
|
19
19
|
* Format: SemVer 2.0.0. Pre-1.0 minor bumps are breaking; post-1.0
|
|
20
20
|
* follow standard SemVer.
|
|
21
21
|
*/
|
|
22
|
-
export declare const CAELO_VERSION = "0.10.
|
|
22
|
+
export declare const CAELO_VERSION = "0.10.57";
|
|
23
23
|
/**
|
|
24
24
|
* Deprecated alias for back-compat — early P17 work spelled this
|
|
25
25
|
* `CALEO_VERSION` (typo of "Caelo"). New code should import
|
|
@@ -31,7 +31,7 @@ export declare const CAELO_VERSION = "0.10.55";
|
|
|
31
31
|
*
|
|
32
32
|
* @deprecated use CAELO_VERSION
|
|
33
33
|
*/
|
|
34
|
-
export declare const CALEO_VERSION = "0.10.
|
|
34
|
+
export declare const CALEO_VERSION = "0.10.57";
|
|
35
35
|
/**
|
|
36
36
|
* Parsed shape — major/minor/patch + optional pre-release tag.
|
|
37
37
|
* Stable interface for callers that need to feature-gate (rare —
|
package/dist/version.js
CHANGED
|
@@ -20,7 +20,7 @@
|
|
|
20
20
|
* Format: SemVer 2.0.0. Pre-1.0 minor bumps are breaking; post-1.0
|
|
21
21
|
* follow standard SemVer.
|
|
22
22
|
*/
|
|
23
|
-
export const CAELO_VERSION = "0.10.
|
|
23
|
+
export const CAELO_VERSION = "0.10.57";
|
|
24
24
|
/**
|
|
25
25
|
* Deprecated alias for back-compat — early P17 work spelled this
|
|
26
26
|
* `CALEO_VERSION` (typo of "Caelo"). New code should import
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@caelo-cms/shared",
|
|
3
|
-
"version": "0.10.
|
|
3
|
+
"version": "0.10.57",
|
|
4
4
|
"private": false,
|
|
5
5
|
"license": "MPL-2.0",
|
|
6
6
|
"description": "Shared Zod schemas + types + the two-pass HTML composer used by every Caelo CMS workspace package. Stable enough for plugin authors and embedders to depend on directly.",
|
package/src/auto-update.test.ts
CHANGED
|
@@ -57,6 +57,7 @@ function input(over: Partial<AutoUpdateInput> & { version?: string; publishedHou
|
|
|
57
57
|
release: { version, publishedAt: hoursAgo(publishedHoursAgo) },
|
|
58
58
|
facts: FACTS,
|
|
59
59
|
upgraderAvailable: true,
|
|
60
|
+
convergeAvailable: true,
|
|
60
61
|
now: NOW,
|
|
61
62
|
...rest,
|
|
62
63
|
} satisfies AutoUpdateInput;
|
|
@@ -245,10 +246,12 @@ describe("decideAutoUpdate — pause", () => {
|
|
|
245
246
|
|
|
246
247
|
describe("decideAutoUpdate — releases that never install automatically", () => {
|
|
247
248
|
const cases: [string, Partial<AutoUpdateInput>, string][] = [
|
|
248
|
-
|
|
249
|
+
// autoConverge is off by default: the Owner installs it (#819).
|
|
250
|
+
["infra change", { facts: { ...FACTS, infraChange: true } }, "manual"],
|
|
251
|
+
["infra change on a security fix", { facts: { ...SECURITY, infraChange: true } }, "manual"],
|
|
249
252
|
[
|
|
250
|
-
"infra change on
|
|
251
|
-
{ facts: { ...
|
|
253
|
+
"infra change, no converge job on this install",
|
|
254
|
+
{ facts: { ...FACTS, infraChange: true }, convergeAvailable: false },
|
|
252
255
|
"needs_cloud_shell",
|
|
253
256
|
],
|
|
254
257
|
["destructive migrations", { facts: { ...FACTS, contractMigrations: true } }, "manual"],
|
|
@@ -260,7 +263,7 @@ describe("decideAutoUpdate — releases that never install automatically", () =>
|
|
|
260
263
|
expect(decideAutoUpdate({ ...input({}), ...over }).action).toBe(action);
|
|
261
264
|
});
|
|
262
265
|
|
|
263
|
-
it("auto_converge on
|
|
266
|
+
it("auto_converge on installs a cloud-setup change through the converge job (#819)", () => {
|
|
264
267
|
const everything = {
|
|
265
268
|
...POLICY,
|
|
266
269
|
autoSecurity: true,
|
|
@@ -274,15 +277,51 @@ describe("decideAutoUpdate — releases that never install automatically", () =>
|
|
|
274
277
|
]) {
|
|
275
278
|
for (const version of [VERSIONS.patch, VERSIONS.minor]) {
|
|
276
279
|
const d = decideAutoUpdate(input({ policy: everything, facts, version }));
|
|
277
|
-
expect(d.action).toBe("
|
|
278
|
-
expect(d.
|
|
280
|
+
expect(d.action).toBe("install");
|
|
281
|
+
expect(d.action === "install" && d.route).toBe("converge");
|
|
279
282
|
}
|
|
280
283
|
}
|
|
281
284
|
});
|
|
282
285
|
|
|
283
|
-
it("auto_converge
|
|
286
|
+
it("auto_converge only widens WHERE a release may install, never WHICH kinds", () => {
|
|
287
|
+
const d = decideAutoUpdate(
|
|
288
|
+
input({
|
|
289
|
+
policy: { ...POLICY, autoPatch: false, autoSecurity: false, autoConverge: true },
|
|
290
|
+
facts: { ...FACTS, infraChange: true },
|
|
291
|
+
}),
|
|
292
|
+
);
|
|
293
|
+
expect(d.action).toBe("notify");
|
|
294
|
+
});
|
|
295
|
+
|
|
296
|
+
it("auto_converge still waits for the soak period and never takes destructive migrations", () => {
|
|
297
|
+
const on = { ...POLICY, autoPatch: true, autoConverge: true };
|
|
298
|
+
const soaking = decideAutoUpdate(
|
|
299
|
+
input({ policy: on, facts: { ...FACTS, infraChange: true }, publishedHoursAgo: 1 }),
|
|
300
|
+
);
|
|
301
|
+
expect(soaking.action).toBe("wait");
|
|
302
|
+
expect(soaking.action === "wait" && soaking.route).toBe("converge");
|
|
303
|
+
const destructive = decideAutoUpdate(
|
|
304
|
+
input({ policy: on, facts: { ...FACTS, infraChange: true, contractMigrations: true } }),
|
|
305
|
+
);
|
|
306
|
+
expect(destructive.action).toBe("manual");
|
|
307
|
+
});
|
|
308
|
+
|
|
309
|
+
it("a converge-route install needs the converge job, not the upgrader", () => {
|
|
310
|
+
const on = { ...POLICY, autoPatch: true, autoConverge: true };
|
|
311
|
+
const d = decideAutoUpdate(
|
|
312
|
+
input({ policy: on, facts: { ...FACTS, infraChange: true }, upgraderAvailable: false }),
|
|
313
|
+
);
|
|
314
|
+
expect(d.action).toBe("install");
|
|
315
|
+
const none = decideAutoUpdate(
|
|
316
|
+
input({ policy: on, facts: { ...FACTS, infraChange: true }, convergeAvailable: false }),
|
|
317
|
+
);
|
|
318
|
+
expect(none.action).toBe("needs_cloud_shell");
|
|
319
|
+
});
|
|
320
|
+
|
|
321
|
+
it("auto_converge off: the Owner installs it from Settings → Updates", () => {
|
|
284
322
|
const d = decideAutoUpdate(input({ facts: { ...FACTS, infraChange: true } }));
|
|
285
|
-
expect(d.
|
|
323
|
+
expect(d.action).toBe("manual");
|
|
324
|
+
expect(d.reason).toContain("Settings → Updates");
|
|
286
325
|
});
|
|
287
326
|
|
|
288
327
|
it("auto_converge does not touch releases without a cloud-setup change", () => {
|
package/src/auto-update.ts
CHANGED
|
@@ -25,9 +25,11 @@
|
|
|
25
25
|
* 2. off the stable channel, or the policy only notifies → notify;
|
|
26
26
|
* 3. major → notify (never automatic before 1.0);
|
|
27
27
|
* 4. release information unreadable → blocked (fails loudly, no guess);
|
|
28
|
-
* 5. changes the cloud setup
|
|
29
|
-
*
|
|
30
|
-
*
|
|
28
|
+
* 5. changes the cloud setup (#819): with no converge job on this
|
|
29
|
+
* install → needs_cloud_shell (the terminal path); with one but
|
|
30
|
+
* `autoConverge` off → manual (the Owner installs it from Settings →
|
|
31
|
+
* Updates); with `autoConverge` on → on through the rules below, and
|
|
32
|
+
* an install it decides goes to the converge job (`route: converge`);
|
|
31
33
|
* 6. destructive database changes → manual (never automatic);
|
|
32
34
|
* 7. the kind is not switched on (security / patch / minor) → notify;
|
|
33
35
|
* 8. no upgrader on this install → blocked;
|
|
@@ -39,6 +41,7 @@
|
|
|
39
41
|
|
|
40
42
|
import {
|
|
41
43
|
inMaintenanceWindow,
|
|
44
|
+
type PlatformUpdateRoute,
|
|
42
45
|
type StoredUpdatePolicy,
|
|
43
46
|
type UpdateKind,
|
|
44
47
|
updateKind,
|
|
@@ -109,6 +112,11 @@ export interface AutoUpdateInput {
|
|
|
109
112
|
readonly facts: ReleaseFacts | { readonly unavailable: string };
|
|
110
113
|
/** This install has an upgrader the admin can hand a request to. */
|
|
111
114
|
readonly upgraderAvailable: boolean;
|
|
115
|
+
/**
|
|
116
|
+
* This install has a converge job the admin can start (#819): releases
|
|
117
|
+
* that change the cloud setup can install from Caelo at all.
|
|
118
|
+
*/
|
|
119
|
+
readonly convergeAvailable: boolean;
|
|
112
120
|
/** Why it has none right now, in plain words (null: none set up at all). */
|
|
113
121
|
readonly upgraderProblem?: string | null;
|
|
114
122
|
readonly now: Date;
|
|
@@ -128,6 +136,8 @@ export type AutoUpdateDecision =
|
|
|
128
136
|
readonly version: string;
|
|
129
137
|
readonly kind: UpdateKind;
|
|
130
138
|
readonly basis: AutoUpdateBasis;
|
|
139
|
+
/** Which job installs it once the wait is over. */
|
|
140
|
+
readonly route: PlatformUpdateRoute;
|
|
131
141
|
readonly reason: string;
|
|
132
142
|
/** When it becomes installable; null = until the Owner resumes. */
|
|
133
143
|
readonly until: Date | null;
|
|
@@ -139,6 +149,8 @@ export type AutoUpdateDecision =
|
|
|
139
149
|
readonly version: string;
|
|
140
150
|
readonly kind: UpdateKind;
|
|
141
151
|
readonly basis: AutoUpdateBasis;
|
|
152
|
+
/** Which job installs it: the upgrader, or the converge job (#819). */
|
|
153
|
+
readonly route: PlatformUpdateRoute;
|
|
142
154
|
readonly reason: string;
|
|
143
155
|
};
|
|
144
156
|
|
|
@@ -228,20 +240,22 @@ export function decideAutoUpdate(input: AutoUpdateInput): AutoUpdateDecision {
|
|
|
228
240
|
};
|
|
229
241
|
}
|
|
230
242
|
const facts = input.facts;
|
|
231
|
-
|
|
232
|
-
|
|
233
|
-
// Caelo, `policy.autoConverge` decides here like autoPatch does below.
|
|
234
|
-
// Until then the Owner's "install automatically" choice is stored but
|
|
235
|
-
// has no effect, and the reason says so.
|
|
236
|
-
const ownerChoice = policy.autoConverge
|
|
237
|
-
? " Your setting to install these automatically takes effect once Caelo can run them itself."
|
|
238
|
-
: "";
|
|
243
|
+
const converge = facts.infraChange === true;
|
|
244
|
+
if (converge && !input.convergeAvailable) {
|
|
239
245
|
return {
|
|
240
246
|
action: "needs_cloud_shell",
|
|
241
247
|
...base,
|
|
242
|
-
reason: `v${v} changes this install's cloud setup,
|
|
248
|
+
reason: `v${v} changes this install's cloud setup, and this install has no converge job to do that from Caelo. The Owner installs it once with their own account in Cloud Shell or from the computer they installed from.`,
|
|
249
|
+
};
|
|
250
|
+
}
|
|
251
|
+
if (converge && !policy.autoConverge) {
|
|
252
|
+
return {
|
|
253
|
+
action: "manual",
|
|
254
|
+
...base,
|
|
255
|
+
reason: `v${v} changes this install's cloud setup. The update policy does not install those automatically; the Owner installs it from Settings → Updates.`,
|
|
243
256
|
};
|
|
244
257
|
}
|
|
258
|
+
const route: PlatformUpdateRoute = converge ? "converge" : "app_roll";
|
|
245
259
|
if (facts.contractMigrations) {
|
|
246
260
|
return {
|
|
247
261
|
action: "manual",
|
|
@@ -265,7 +279,8 @@ export function decideAutoUpdate(input: AutoUpdateInput): AutoUpdateDecision {
|
|
|
265
279
|
reason: `v${v} is a ${what}; the update policy does not install those automatically. The Owner installs it.`,
|
|
266
280
|
};
|
|
267
281
|
}
|
|
268
|
-
|
|
282
|
+
// A converge-route install needs the converge job (checked above), not the upgrader.
|
|
283
|
+
if (!converge && !input.upgraderAvailable) {
|
|
269
284
|
return {
|
|
270
285
|
action: "blocked",
|
|
271
286
|
...base,
|
|
@@ -274,7 +289,7 @@ export function decideAutoUpdate(input: AutoUpdateInput): AutoUpdateDecision {
|
|
|
274
289
|
: `v${v} could install automatically, but this install has no upgrader the admin can start. Run the upgrade command from Settings → Updates once; it sets the upgrader up.`,
|
|
275
290
|
};
|
|
276
291
|
}
|
|
277
|
-
const auto = { ...base, basis } as const;
|
|
292
|
+
const auto = { ...base, basis, route } as const;
|
|
278
293
|
if (isPausedAt(policy, now)) {
|
|
279
294
|
const until = policy.pausedUntil === null ? null : new Date(policy.pausedUntil);
|
|
280
295
|
const who = policy.pausedByOwner ? "by the Owner" : "after a failed automatic install";
|
package/src/platform-updates.ts
CHANGED
|
@@ -19,6 +19,12 @@ export const PLATFORM_UPDATE_STATUSES = [
|
|
|
19
19
|
"refused",
|
|
20
20
|
"needs_cloud_shell",
|
|
21
21
|
"cancelled",
|
|
22
|
+
/**
|
|
23
|
+
* Asked the Owner to act (`needs_cloud_shell`), but the install has since
|
|
24
|
+
* moved past it: it runs the target release (or a newer one), or a newer
|
|
25
|
+
* request exists (#817, migration 0317). Shown in the history only.
|
|
26
|
+
*/
|
|
27
|
+
"superseded",
|
|
22
28
|
] as const;
|
|
23
29
|
export type PlatformUpdateStatusValue = (typeof PLATFORM_UPDATE_STATUSES)[number];
|
|
24
30
|
|
|
@@ -32,7 +38,9 @@ export function isFinishedUpdateStatus(status: PlatformUpdateStatusValue): boole
|
|
|
32
38
|
|
|
33
39
|
/**
|
|
34
40
|
* The phases of an upgrader run, in order (`platform_update_events.phase`).
|
|
35
|
-
* `rollback` only appears when a roll had to be undone
|
|
41
|
+
* `rollback` only appears when a roll had to be undone; `converge` only on
|
|
42
|
+
* the converge route (#819), where the install's cloud setup is brought to
|
|
43
|
+
* what the release expects before and around the roll.
|
|
36
44
|
*/
|
|
37
45
|
export const PLATFORM_UPDATE_PHASES = [
|
|
38
46
|
"queued",
|
|
@@ -40,6 +48,7 @@ export const PLATFORM_UPDATE_PHASES = [
|
|
|
40
48
|
"verify",
|
|
41
49
|
"assess",
|
|
42
50
|
"backup",
|
|
51
|
+
"converge",
|
|
43
52
|
"health-baseline",
|
|
44
53
|
"migrations",
|
|
45
54
|
"roll",
|
|
@@ -51,6 +60,22 @@ export const PLATFORM_UPDATE_PHASES = [
|
|
|
51
60
|
] as const;
|
|
52
61
|
export type PlatformUpdatePhase = (typeof PLATFORM_UPDATE_PHASES)[number];
|
|
53
62
|
|
|
63
|
+
/**
|
|
64
|
+
* Which in-cloud job installs a request (#819, `platform_update_requests.route`):
|
|
65
|
+
*
|
|
66
|
+
* - `app_roll` — the upgrader job (its own narrow service account): new
|
|
67
|
+
* images + expand-only migrations, nothing in the cloud setup changes;
|
|
68
|
+
* - `converge` — the converge job, running as the install's existing
|
|
69
|
+
* `caelo-provisioner` account: the same upgrade an Owner runs from a
|
|
70
|
+
* terminal (backup, converge, roll, health check, rollback), for a
|
|
71
|
+
* release that raises the infrastructure contract.
|
|
72
|
+
*
|
|
73
|
+
* The admin picks the route from the release manifest before the click;
|
|
74
|
+
* either job re-checks everything against the signed manifest.
|
|
75
|
+
*/
|
|
76
|
+
export const PLATFORM_UPDATE_ROUTES = ["app_roll", "converge"] as const;
|
|
77
|
+
export type PlatformUpdateRoute = (typeof PLATFORM_UPDATE_ROUTES)[number];
|
|
78
|
+
|
|
54
79
|
/** Severity of one timeline line. */
|
|
55
80
|
export const PLATFORM_UPDATE_EVENT_LEVELS = ["info", "success", "warn", "error"] as const;
|
|
56
81
|
export type PlatformUpdateEventLevel = (typeof PLATFORM_UPDATE_EVENT_LEVELS)[number];
|
package/src/redirect-emit-gcp.ts
CHANGED
|
@@ -161,5 +161,19 @@ export function assertGcpRedirectBudget(
|
|
|
161
161
|
withGcpRedirects({ name: "budget-check", pathRules: baseRules }, plan);
|
|
162
162
|
}
|
|
163
163
|
|
|
164
|
-
/**
|
|
165
|
-
|
|
164
|
+
/**
|
|
165
|
+
* The site's own routing in the `public` path matcher (stack + budget): the
|
|
166
|
+
* paths the load balancer sends to the gateway instead of the static bucket.
|
|
167
|
+
* `/api/*` is the gateway's whole API, the remote-MCP broker included
|
|
168
|
+
* (#806). The two `/.well-known/oauth-*` prefixes are the broker's
|
|
169
|
+
* discovery documents, which MCP clients look up at the host root (RFC 9728
|
|
170
|
+
* protected-resource metadata, RFC 8414 authorization-server metadata) —
|
|
171
|
+
* they must reach the gateway, not 404 in the bucket. No
|
|
172
|
+
* `openid-configuration` prefix: the broker is not an OpenID provider and
|
|
173
|
+
* serves no such document (#899), so the site keeps that path.
|
|
174
|
+
*/
|
|
175
|
+
export const GCP_PUBLIC_BASE_PATHS: readonly string[] = [
|
|
176
|
+
"/api/*",
|
|
177
|
+
"/.well-known/oauth-protected-resource/*",
|
|
178
|
+
"/.well-known/oauth-authorization-server/*",
|
|
179
|
+
];
|
|
@@ -153,20 +153,22 @@ describe("GCP URL-map rules", () => {
|
|
|
153
153
|
});
|
|
154
154
|
|
|
155
155
|
it("refuses a plan over the 1,000-predicate quota with the counts, before any change", () => {
|
|
156
|
+
// The base rule routes /api/* and the remote-MCP discovery paths (#806).
|
|
157
|
+
expect(GCP_PUBLIC_BASE_PATHS).toHaveLength(3);
|
|
156
158
|
const base = [{ paths: [...GCP_PUBLIC_BASE_PATHS] }];
|
|
157
159
|
const rows = (n: number) => Array.from({ length: n }, (_, i) => row(`/p${i}`, "/x"));
|
|
158
|
-
expect(() => assertGcpRedirectBudget(planOf(rows(
|
|
160
|
+
expect(() => assertGcpRedirectBudget(planOf(rows(498)), base)).not.toThrow();
|
|
159
161
|
try {
|
|
160
|
-
assertGcpRedirectBudget(planOf(rows(
|
|
162
|
+
assertGcpRedirectBudget(planOf(rows(499)), base);
|
|
161
163
|
throw new Error("expected GcpUrlMapBudgetError");
|
|
162
164
|
} catch (e) {
|
|
163
165
|
expect(e).toBeInstanceOf(GcpUrlMapBudgetError);
|
|
164
166
|
expect((e as GcpUrlMapBudgetError).predicatesNeeded).toBe(1001);
|
|
165
|
-
expect((e as Error).message).toContain("
|
|
167
|
+
expect((e as Error).message).toContain("499 redirect(s) need 1001 paths");
|
|
166
168
|
expect((e as Error).message).toContain("bulk_delete_redirects");
|
|
167
169
|
}
|
|
168
170
|
// File-like paths cost one predicate each.
|
|
169
|
-
const files = Array.from({ length:
|
|
171
|
+
const files = Array.from({ length: 997 }, (_, i) => row(`/p${i}.html`, "/x"));
|
|
170
172
|
expect(() => assertGcpRedirectBudget(planOf(files), base)).not.toThrow();
|
|
171
173
|
});
|
|
172
174
|
|
package/src/release-manifest.ts
CHANGED
|
@@ -71,12 +71,23 @@ export const SIGSTORE_BUNDLE_MEDIA_TYPE = "application/vnd.dev.sigstore.bundle.v
|
|
|
71
71
|
/** Why fetching the artifact failed. */
|
|
72
72
|
export type ReleaseArtifactErrorCode = "registry" | "artifact-shape" | "blob-digest";
|
|
73
73
|
|
|
74
|
+
/** Why {@link fetchReleaseArtifact} failed. */
|
|
75
|
+
export interface ReleaseArtifactError {
|
|
76
|
+
readonly code: ReleaseArtifactErrorCode;
|
|
77
|
+
readonly message: string;
|
|
78
|
+
/**
|
|
79
|
+
* Set on `registry` errors a retry may cure: the registry could not be
|
|
80
|
+
* reached, timed out, rate-limited (429) or failed (5xx). Absent when the
|
|
81
|
+
* registry answered that the manifest, tag or blob does not exist (404 and
|
|
82
|
+
* other 4xx) — retrying that changes nothing, so callers that would
|
|
83
|
+
* otherwise "try again later" must treat it as a verdict.
|
|
84
|
+
*/
|
|
85
|
+
readonly transient?: true;
|
|
86
|
+
}
|
|
87
|
+
|
|
74
88
|
export type ReleaseArtifactResult =
|
|
75
89
|
| { readonly ok: true; readonly manifestBytes: Uint8Array; readonly bundleBytes: Uint8Array }
|
|
76
|
-
| {
|
|
77
|
-
readonly ok: false;
|
|
78
|
-
readonly error: { readonly code: ReleaseArtifactErrorCode; readonly message: string };
|
|
79
|
-
};
|
|
90
|
+
| { readonly ok: false; readonly error: ReleaseArtifactError };
|
|
80
91
|
|
|
81
92
|
/** Where and how {@link fetchReleaseArtifact} reaches the registry. */
|
|
82
93
|
export interface ReleaseArtifactDeps {
|
|
@@ -101,6 +112,22 @@ const fail = (code: ReleaseArtifactErrorCode, message: string): ReleaseArtifactR
|
|
|
101
112
|
error: { code, message },
|
|
102
113
|
});
|
|
103
114
|
|
|
115
|
+
/** A `registry` failure a retry may cure (see {@link ReleaseArtifactError.transient}). */
|
|
116
|
+
const failTransient = (message: string): ReleaseArtifactResult => ({
|
|
117
|
+
ok: false,
|
|
118
|
+
error: { code: "registry", message, transient: true },
|
|
119
|
+
});
|
|
120
|
+
|
|
121
|
+
/** Whether an HTTP status says "try again" rather than "it does not exist". */
|
|
122
|
+
function isTransientStatus(status: number): boolean {
|
|
123
|
+
return status >= 500 || status === 429 || status === 408;
|
|
124
|
+
}
|
|
125
|
+
|
|
126
|
+
/** A non-OK registry response as a failure, transient or not by its status. */
|
|
127
|
+
function failStatus(status: number, message: string): ReleaseArtifactResult {
|
|
128
|
+
return isTransientStatus(status) ? failTransient(message) : fail("registry", message);
|
|
129
|
+
}
|
|
130
|
+
|
|
104
131
|
/**
|
|
105
132
|
* Fetch the release manifest artifact of `version` and both its layers,
|
|
106
133
|
* each checked against its content digest. Verifies NO signature: callers
|
|
@@ -120,6 +147,11 @@ export async function fetchReleaseArtifact(
|
|
|
120
147
|
headers: { Accept: "application/vnd.oci.image.manifest.v1+json" },
|
|
121
148
|
});
|
|
122
149
|
if (!res.ok) {
|
|
150
|
+
if (isTransientStatus(res.status)) {
|
|
151
|
+
return failTransient(
|
|
152
|
+
`the registry at ${base} could not serve the release manifest of v${version} (HTTP ${res.status}); try again later.`,
|
|
153
|
+
);
|
|
154
|
+
}
|
|
123
155
|
return fail(
|
|
124
156
|
"registry",
|
|
125
157
|
`no release manifest for v${version} at ${base} (HTTP ${res.status}). Releases before the signed manifest (epic #696) have none; otherwise check the version exists.`,
|
|
@@ -131,7 +163,7 @@ export async function fetchReleaseArtifact(
|
|
|
131
163
|
}
|
|
132
164
|
artifact = parsed.data;
|
|
133
165
|
} catch (e) {
|
|
134
|
-
return
|
|
166
|
+
return failTransient(`registry unreachable: ${e instanceof Error ? e.message : String(e)}`);
|
|
135
167
|
}
|
|
136
168
|
|
|
137
169
|
if (artifact.artifactType !== RELEASE_MANIFEST_ARTIFACT_TYPE) {
|
|
@@ -153,7 +185,7 @@ export async function fetchReleaseArtifact(
|
|
|
153
185
|
|
|
154
186
|
const blob = async (layerDigest: string): Promise<Uint8Array | ReleaseArtifactResult> => {
|
|
155
187
|
const res = await deps.fetch(`${base}/blobs/${layerDigest}`);
|
|
156
|
-
if (!res.ok) return
|
|
188
|
+
if (!res.ok) return failStatus(res.status, `blob ${layerDigest}: HTTP ${res.status}`);
|
|
157
189
|
const bytes = new Uint8Array(await res.arrayBuffer());
|
|
158
190
|
const actual = await sha256Digest(bytes);
|
|
159
191
|
if (actual !== layerDigest) {
|
|
@@ -171,7 +203,7 @@ export async function fetchReleaseArtifact(
|
|
|
171
203
|
if (!(bundleBytes instanceof Uint8Array)) return bundleBytes;
|
|
172
204
|
return { ok: true, manifestBytes, bundleBytes };
|
|
173
205
|
} catch (e) {
|
|
174
|
-
return
|
|
206
|
+
return failTransient(`registry unreachable: ${e instanceof Error ? e.message : String(e)}`);
|
|
175
207
|
}
|
|
176
208
|
}
|
|
177
209
|
|