@catladder/cli 0.0.0-fix-changeset-hint-package-manager-20002c27 → 0.0.0-fix-github-gating-release-push-fbb576dc

package/dist/packages/pipeline/src/deploy/cloudRun/utils/getServiceName.d.ts

@@ -1,6 +1,74 @@
+import type { StringOrBashExpression } from "../../../../../bash/src/index.js";
 import type { DeployConfigCloudRun } from "../..";
 import type { BuildConfig } from "../../../build/types";
 import type { ComponentContext } from "../../../types/context";
 import type { EnvironmentContext } from "../../../types/environmentContext";
+/**
+ * cloud run only serves its deterministic url
+ * `https://<service>-<projectNumber>.<region>.run.app` while that first dns
+ * label stays within the 63 characters a dns label allows — the label holds
+ * the service name, the project number and any traffic tag together.
+ *
+ * Beyond it cloud run silently switches to a legacy url built from a random
+ * identifier that nothing can recompute. The url catladder generates would
+ * then be a hostname that can never resolve, and everything consuming
+ * ROOT_URL/ROOT_URL_INTERNAL (cloud tasks targets, service-to-service
+ * calls) fails with a dns error instead of a helpful one — which is why the
+ * component part is shortened to stay under the limit rather than left to
+ * overflow.
+ *
+ * https://cloud.google.com/run/docs/triggering/https-request
+ */
+export declare const CLOUD_RUN_DNS_SEGMENT_LIMIT = 63;
+/**
+ * review environments resolve their slug at runtime (`mr<iid>` on gitlab,
+ * `pr<number>` on github), so its exact length is unknown while generating.
+ * Budget for a six digit number so that service names — and with them the
+ * urls of already deployed services — do not start changing years later
+ * just because a project's merge request numbers grew a digit.
+ */
+export declare const REVIEW_SLUG_LENGTH_BUDGET: number;
+export type CloudRunComponentPartInput = {
+    customerName: string;
+    appName: string;
+    env: string;
+    /** whether the env resolves a review slug at runtime */
+    isReviewEnv: boolean;
+    componentName: string;
+    projectNumber: string;
+    /**
+     * the config's other component names, so that a shortened name colliding
+     * with a sibling's is caught while generating instead of at deploy time,
+     * where two components would fight over one cloud run service
+     */
+    otherComponentNames: string[];
+};
+export type CloudRunComponentPart = {
+    /** the component part of the service name, shortened if it had to be */
+    value: string;
+    /** characters dropped from the component name — 0 when it already fit */
+    dropped: number;
+    /** dns label length of the resulting url, review slug budget included */
+    dnsSegmentLength: number;
+};
+/**
+ * the component-name part of a cloud run service name, shortened just
+ * enough to keep the deterministic url resolvable.
+ *
+ * Only the component part is shortened: the env and review slug parts have
+ * to stay intact (they are what makes the name unique per environment), the
+ * project number is fixed, and customerName/appName are shared by every
+ * service of the project.
+ */
+export declare const resolveCloudRunComponentPart: ({ customerName, appName, env, isReviewEnv, componentName, projectNumber, otherComponentNames, }: CloudRunComponentPartInput) => CloudRunComponentPart;
+/**
+ * the cloud run service name as it is passed to `gcloud run` — lowercased,
+ * and shortened when the deterministic url would otherwise not fit.
+ */
 export declare const getServiceName: (context: ComponentContext) => string | import("../../../../../bash/src/index.js").BashExpression;
 export declare const getServiceNameForEnvContext: (context: EnvironmentContext<BuildConfig, DeployConfigCloudRun>) => string | import("../../../../../bash/src/index.js").BashExpression;
+/**
+ * the service name part of the deterministic url, still to be lowercased
+ * together with the rest of the hostname by the caller.
+ */
+export declare const getRawServiceNameForEnvContext: (context: EnvironmentContext<BuildConfig, DeployConfigCloudRun>) => StringOrBashExpression;

package/dist/packages/pipeline/src/deploy/cloudRun/utils/getServiceName.js

@@ -1,8 +1,189 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getServiceNameForEnvContext = exports.getServiceName = void 0;
-const getServiceName = (context) => context.environment.fullName.toLowerCase();
+exports.getRawServiceNameForEnvContext = exports.getServiceNameForEnvContext = exports.getServiceName = exports.resolveCloudRunComponentPart = exports.REVIEW_SLUG_LENGTH_BUDGET = exports.CLOUD_RUN_DNS_SEGMENT_LIMIT = void 0;
+const bash_1 = require("../../../../../bash/src/index.js");
+const store_1 = require("../../../store");
+/**
+ * cloud run only serves its deterministic url
+ * `https://<service>-<projectNumber>.<region>.run.app` while that first dns
+ * label stays within the 63 characters a dns label allows — the label holds
+ * the service name, the project number and any traffic tag together.
+ *
+ * Beyond it cloud run silently switches to a legacy url built from a random
+ * identifier that nothing can recompute. The url catladder generates would
+ * then be a hostname that can never resolve, and everything consuming
+ * ROOT_URL/ROOT_URL_INTERNAL (cloud tasks targets, service-to-service
+ * calls) fails with a dns error instead of a helpful one — which is why the
+ * component part is shortened to stay under the limit rather than left to
+ * overflow.
+ *
+ * https://cloud.google.com/run/docs/triggering/https-request
+ */
+exports.CLOUD_RUN_DNS_SEGMENT_LIMIT = 63;
+/**
+ * review environments resolve their slug at runtime (`mr<iid>` on gitlab,
+ * `pr<number>` on github), so its exact length is unknown while generating.
+ * Budget for a six digit number so that service names — and with them the
+ * urls of already deployed services — do not start changing years later
+ * just because a project's merge request numbers grew a digit.
+ */
+exports.REVIEW_SLUG_LENGTH_BUDGET = "mr123456".length;
+/**
+ * a service name shortened past this point is no longer recognizable. When
+ * even this does not fit, the fixed parts (customer name, app name, env,
+ * project number) are what needs to shrink — only the user can do that.
+ */
+const MIN_COMPONENT_PART_LENGTH = 6;
+const quote = (name) => `"${name}"`;
+/**
+ * a trailing dash would end up in the hostname as `...-foo-.run.app`
+ */
+const shortenTo = (name, maxLength) => name.slice(0, maxLength).replace(/-+$/, "");
+/**
+ * the component-name part of a cloud run service name, shortened just
+ * enough to keep the deterministic url resolvable.
+ *
+ * Only the component part is shortened: the env and review slug parts have
+ * to stay intact (they are what makes the name unique per environment), the
+ * project number is fixed, and customerName/appName are shared by every
+ * service of the project.
+ */
+const resolveCloudRunComponentPart = ({ customerName, appName, env, isReviewEnv, componentName, projectNumber, otherComponentNames, }) => {
+    const fixedParts = [
+        customerName,
+        appName,
+        env,
+        ...(isReviewEnv ? ["_".repeat(exports.REVIEW_SLUG_LENGTH_BUDGET)] : []),
+        projectNumber,
+    ];
+    // + 1 for the dash that joins the component part to the rest
+    const fixedLength = fixedParts.join("-").length + 1;
+    const available = exports.CLOUD_RUN_DNS_SEGMENT_LIMIT - fixedLength;
+    if (componentName.length <= available) {
+        return {
+            value: componentName,
+            dropped: 0,
+            dnsSegmentLength: fixedLength + componentName.length,
+        };
+    }
+    if (available < MIN_COMPONENT_PART_LENGTH) {
+        throw new Error(`Cannot build a resolvable cloud run url for component ${quote(componentName)} in env ${quote(env)}.\n` +
+            `Everything but the component name already takes ${fixedLength} of the ${exports.CLOUD_RUN_DNS_SEGMENT_LIMIT} characters ` +
+            `a dns label allows (${fixedParts.join("-")}-<component>), leaving only ${available} for the component name.\n` +
+            `Shorten appName (${quote(appName)}) or customerName (${quote(customerName)}) by at least ` +
+            `${MIN_COMPONENT_PART_LENGTH - available} character(s).` +
+            (isReviewEnv
+                ? `\nReview environments also carry a runtime slug, for which ${exports.REVIEW_SLUG_LENGTH_BUDGET} characters are reserved.`
+                : ""));
+    }
+    const value = shortenTo(componentName, available);
+    const colliding = otherComponentNames.filter((other) => shortenTo(other, available) === value);
+    if (colliding.length > 0) {
+        throw new Error(`Cloud run service names collide in env ${quote(env)}: ${quote(componentName)} and ` +
+            `${colliding.map(quote).join(", ")} all shorten to ${quote(value)}, so they would deploy over each other.\n` +
+            `The deterministic cloud run url allows ${exports.CLOUD_RUN_DNS_SEGMENT_LIMIT} characters, which leaves ${available} ` +
+            `for the component name here — rename the components so their first ${available} characters differ.`);
+    }
+    return {
+        value,
+        dropped: componentName.length - value.length,
+        dnsSegmentLength: fixedLength + value.length,
+    };
+};
+exports.resolveCloudRunComponentPart = resolveCloudRunComponentPart;
+/**
+ * one note per shortened service name instead of one per generated job:
+ * service names are resolved again for every job that references them
+ */
+const reportedTruncations = new Set();
+const reportTruncation = (env, componentName, { value, dnsSegmentLength }) => {
+    const key = `${env}/${componentName}`;
+    if (reportedTruncations.has(key)) {
+        return;
+    }
+    reportedTruncations.add(key);
+    console.warn(`ℹ️ component "${componentName}" deploys to cloud run as "...-${value}" in env "${env}": ` +
+        `the full name would push the url past the ${exports.CLOUD_RUN_DNS_SEGMENT_LIMIT} characters cloud run ` +
+        `serves deterministically, so the component part is shortened ` +
+        `(${dnsSegmentLength} of ${exports.CLOUD_RUN_DNS_SEGMENT_LIMIT} characters used).`);
+};
+/**
+ * the cloud run service name before lowercasing, so that callers keep
+ * lowercasing the whole expression exactly like they did before.
+ *
+ * Returns `fullName` unchanged unless the component part had to be
+ * shortened — every project whose url already fits generates byte-identical
+ * output.
+ *
+ * Note that the composition below has to match the one `fullName` is built
+ * from in getEnvironmentContext; the tests pin that they agree.
+ */
+const getRawServiceName = ({ fullName, environmentSlugPrefix, componentName, env, isReviewEnv, deployConfig, config, }) => {
+    const projectNumber = deployConfig
+        ? (0, store_1.readGcloudProjectNumber)(config, deployConfig.projectId)
+        : null;
+    if (!projectNumber) {
+        // without the project number there is no deterministic url to keep
+        // resolvable — generating the url itself fails with a store error that
+        // says how to fix it, so don't second-guess the name here
+        return fullName;
+    }
+    const componentPart = (0, exports.resolveCloudRunComponentPart)({
+        customerName: config.customerName,
+        appName: config.appName,
+        env,
+        isReviewEnv,
+        componentName,
+        projectNumber,
+        otherComponentNames: Object.keys(config.components).filter((name) => name !== componentName),
+    });
+    if (componentPart.dropped === 0) {
+        return fullName;
+    }
+    reportTruncation(env, componentName, componentPart);
+    return (0, bash_1.joinBashExpressions)([
+        config.customerName,
+        config.appName,
+        environmentSlugPrefix,
+        componentPart.value,
+    ], "-");
+};
+const fromComponentContext = (context) => {
+    var _a;
+    const deployConfig = (_a = context.deploy) === null || _a === void 0 ? void 0 : _a.config;
+    return {
+        fullName: context.environment.fullName,
+        environmentSlugPrefix: context.environment.slugPrefix,
+        componentName: context.name,
+        env: context.env,
+        isReviewEnv: context.environment.envType === "review",
+        deployConfig: deployConfig && deployConfig.type === "google-cloudrun"
+            ? deployConfig
+            : null,
+        config: context.fullConfig,
+    };
+};
+const fromEnvironmentContext = (context) => ({
+    fullName: context.fullName,
+    environmentSlugPrefix: context.environmentSlugPrefix,
+    componentName: context.componentName,
+    env: context.env,
+    isReviewEnv: context.envType === "review",
+    deployConfig: context.deployConfigRaw || null,
+    config: context.fullConfig,
+});
+/**
+ * the cloud run service name as it is passed to `gcloud run` — lowercased,
+ * and shortened when the deterministic url would otherwise not fit.
+ */
+const getServiceName = (context) => getRawServiceName(fromComponentContext(context)).toLowerCase();
 exports.getServiceName = getServiceName;
-const getServiceNameForEnvContext = (context) => context.fullName.toLowerCase();
+const getServiceNameForEnvContext = (context) => getRawServiceName(fromEnvironmentContext(context)).toLowerCase();
 exports.getServiceNameForEnvContext = getServiceNameForEnvContext;
+/**
+ * the service name part of the deterministic url, still to be lowercased
+ * together with the rest of the hostname by the caller.
+ */
+const getRawServiceNameForEnvContext = (context) => getRawServiceName(fromEnvironmentContext(context));
+exports.getRawServiceNameForEnvContext = getRawServiceNameForEnvContext;
 //# sourceMappingURL=getServiceName.js.map

package/dist/packages/pipeline/src/deploy/cloudRun/utils/getServiceName.js.map

@@ -1 +1 @@
-{"version":3,"file":"getServiceName.js","sourceRoot":"","sources":["../../../../../../../../../packages/pipeline/src/deploy/cloudRun/utils/getServiceName.ts"],"names":[],"mappings":";;;AAIO,MAAM,cAAc,GAAG,CAAC,OAAyB,EAAE,EAAE,CAC1D,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;AADhC,QAAA,cAAc,kBACkB;AAEtC,MAAM,2BAA2B,GAAG,CACzC,OAA8D,EAC9D,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;AAFvB,QAAA,2BAA2B,+BAEJ"}
+{"version":3,"file":"getServiceName.js","sourceRoot":"","sources":["../../../../../../../../../packages/pipeline/src/deploy/cloudRun/utils/getServiceName.ts"],"names":[],"mappings":";;;AACA,0CAAsD;AAGtD,0CAAyD;AAKzD;;;;;;;;;;;;;;;GAeG;AACU,QAAA,2BAA2B,GAAG,EAAE,CAAC;AAE9C;;;;;;GAMG;AACU,QAAA,yBAAyB,GAAG,UAAU,CAAC,MAAM,CAAC;AAE3D;;;;GAIG;AACH,MAAM,yBAAyB,GAAG,CAAC,CAAC;AAEpC,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,IAAI,GAAG,CAAC;AAE5C;;GAEG;AACH,MAAM,SAAS,GAAG,CAAC,IAAY,EAAE,SAAiB,EAAE,EAAE,CACpD,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AA2B9C;;;;;;;;GAQG;AACI,MAAM,4BAA4B,GAAG,CAAC,EAC3C,YAAY,EACZ,OAAO,EACP,GAAG,EACH,WAAW,EACX,aAAa,EACb,aAAa,EACb,mBAAmB,GACQ,EAAyB,EAAE;IACtD,MAAM,UAAU,GAAG;QACjB,YAAY;QACZ,OAAO;QACP,GAAG;QACH,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,iCAAyB,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,aAAa;KACd,CAAC;IACF,6DAA6D;IAC7D,MAAM,WAAW,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IACpD,MAAM,SAAS,GAAG,mCAA2B,GAAG,WAAW,CAAC;IAE5D,IAAI,aAAa,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC;QACtC,OAAO;YACL,KAAK,EAAE,aAAa;YACpB,OAAO,EAAE,CAAC;YACV,gBAAgB,EAAE,WAAW,GAAG,aAAa,CAAC,MAAM;SACrD,CAAC;IACJ,CAAC;IAED,IAAI,SAAS,GAAG,yBAAyB,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CACb,yDAAyD,KAAK,CAAC,aAAa,CAAC,WAAW,KAAK,CAAC,GAAG,CAAC,KAAK;YACrG,mDAAmD,WAAW,WAAW,mCAA2B,cAAc;YAClH,uBAAuB,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,+BAA+B,SAAS,4BAA4B;YAC/G,oBAAoB,KAAK,CAAC,OAAO,CAAC,sBAAsB,KAAK,CAAC,YAAY,CAAC,gBAAgB;YAC3F,GAAG,yBAAyB,GAAG,SAAS,gBAAgB;YACxD,CAAC,WAAW;gBACV,CAAC,CAAC,8DAA8D,iCAAyB,2BAA2B;gBACpH,CAAC,CAAC,EAAE,CAAC,CACV,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,SAAS,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,mBAAmB,CAAC,MAAM,CAC1C,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,SAAS,CAAC,KAAK,KAAK,CACjD,CAAC;IACF,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,0CAA0C,KAAK,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,aAAa,CAAC,OAAO;YAClF,GAAG,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,KAAK,CAAC,KAAK,CAAC,2CAA2C;YAC5G,0CAA0C,mCAA2B,6BAA6B,SAAS,GAAG;YAC9G,sEAAsE,SAAS,qBAAqB,CACvG,CAAC;IACJ,CAAC;IAED,OAAO;QACL,KAAK;QACL,OAAO,EAAE,aAAa,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM;QAC5C,gBAAgB,EAAE,WAAW,GAAG,KAAK,CAAC,MAAM;KAC7C,CAAC;AACJ,CAAC,CAAC;AA3DW,QAAA,4BAA4B,gCA2DvC;AAEF;;;GAGG;AACH,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAU,CAAC;AAE9C,MAAM,gBAAgB,GAAG,CACvB,GAAW,EACX,aAAqB,EACrB,EAAE,KAAK,EAAE,gBAAgB,EAAyB,EAClD,EAAE;IACF,MAAM,GAAG,GAAG,GAAG,GAAG,IAAI,aAAa,EAAE,CAAC;IACtC,IAAI,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QACjC,OAAO;IACT,CAAC;IACD,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,OAAO,CAAC,IAAI,CACV,iBAAiB,aAAa,kCAAkC,KAAK,aAAa,GAAG,KAAK;QACxF,6CAA6C,mCAA2B,wBAAwB;QAChG,+DAA+D;QAC/D,IAAI,gBAAgB,OAAO,mCAA2B,oBAAoB,CAC7E,CAAC;AACJ,CAAC,CAAC;AAYF;;;;;;;;;;GAUG;AACH,MAAM,iBAAiB,GAAG,CAAC,EACzB,QAAQ,EACR,qBAAqB,EACrB,aAAa,EACb,GAAG,EACH,WAAW,EACX,YAAY,EACZ,MAAM,GACW,EAA0B,EAAE;IAC7C,MAAM,aAAa,GAAG,YAAY;QAChC,CAAC,CAAC,IAAA,+BAAuB,EAAC,MAAM,EAAE,YAAY,CAAC,SAAS,CAAC;QACzD,CAAC,CAAC,IAAI,CAAC;IACT,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,mEAAmE;QACnE,uEAAuE;QACvE,0DAA0D;QAC1D,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,aAAa,GAAG,IAAA,oCAA4B,EAAC;QACjD,YAAY,EAAE,MAAM,CAAC,YAAY;QACjC,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,GAAG;QACH,WAAW;QACX,aAAa;QACb,aAAa;QACb,mBAAmB,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,MAAM,CACxD,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,aAAa,CACjC;KACF,CAAC,CAAC;IACH,IAAI,aAAa,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;QAChC,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,gBAAgB,CAAC,GAAG,EAAE,aAAa,EAAE,aAAa,CAAC,CAAC;IACpD,OAAO,IAAA,0BAAmB,EACxB;QACE,MAAM,CAAC,YAAY;QACnB,MAAM,CAAC,OAAO;QACd,qBAAqB;QACrB,aAAa,CAAC,KAAK;KACpB,EACD,GAAG,CACJ,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,oBAAoB,GAAG,CAAC,OAAyB,EAAoB,EAAE;;IAC3E,MAAM,YAAY,GAAG,MAAA,OAAO,CAAC,MAAM,0CAAE,MAAM,CAAC;IAC5C,OAAO;QACL,QAAQ,EAAE,OAAO,CAAC,WAAW,CAAC,QAAQ;QACtC,qBAAqB,EAAE,OAAO,CAAC,WAAW,CAAC,UAAU;QACrD,aAAa,EAAE,OAAO,CAAC,IAAI;QAC3B,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,WAAW,EAAE,OAAO,CAAC,WAAW,CAAC,OAAO,KAAK,QAAQ;QACrD,YAAY,EACV,YAAY,IAAI,YAAY,CAAC,IAAI,KAAK,iBAAiB;YACrD,CAAC,CAAC,YAAY;YACd,CAAC,CAAC,IAAI;QACV,MAAM,EAAE,OAAO,CAAC,UAAU;KAC3B,CAAC;AACJ,CAAC,CAAC;AAEF,MAAM,sBAAsB,GAAG,CAC7B,OAA8D,EAC5C,EAAE,CAAC,CAAC;IACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;IAC1B,qBAAqB,EAAE,OAAO,CAAC,qBAAqB;IACpD,aAAa,EAAE,OAAO,CAAC,aAAa;IACpC,GAAG,EAAE,OAAO,CAAC,GAAG;IAChB,WAAW,EAAE,OAAO,CAAC,OAAO,KAAK,QAAQ;IACzC,YAAY,EAAE,OAAO,CAAC,eAAe,IAAI,IAAI;IAC7C,MAAM,EAAE,OAAO,CAAC,UAAU;CAC3B,CAAC,CAAC;AAEH;;;GAGG;AACI,MAAM,cAAc,GAAG,CAAC,OAAyB,EAAE,EAAE,CAC1D,iBAAiB,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;AADpD,QAAA,cAAc,kBACsC;AAE1D,MAAM,2BAA2B,GAAG,CACzC,OAA8D,EAC9D,EAAE,CAAC,iBAAiB,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;AAFzD,QAAA,2BAA2B,+BAE8B;AAEtE;;;GAGG;AACI,MAAM,8BAA8B,GAAG,CAC5C,OAA8D,EAC9D,EAAE,CAAC,iBAAiB,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC,CAAC;AAF3C,QAAA,8BAA8B,kCAEa"}

package/dist/packages/pipeline/src/store/index.d.ts

@@ -27,6 +27,14 @@ export declare const getCatladderStorePath: (directory: string) => string;
  * remedy is always rerunning project setup — not hand-editing the file.
  */
 export declare const readCatladderStore: (directory?: string) => CatladderStore;
+/**
+ * gcloud project number from the store, or null when it has not been
+ * fetched yet. Use this where a missing number is not itself the problem —
+ * `getGcloudProjectNumber` is the one that reports it.
+ */
+export declare const readGcloudProjectNumber: (config: {
+    store?: CatladderStore;
+}, projectId: string) => string | null;
 /**
  * gcloud project number from the store — needed to compute deterministic
  * cloud run urls (`<service>-<projectNumber>.<region>.run.app`) at

package/dist/packages/pipeline/src/store/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getGcloudProjectNumber = exports.readCatladderStore = exports.getCatladderStorePath = exports.catladderStoreSchema = exports.CATLADDER_STORE_FILE = exports.CATLADDER_STORE_FILE_NAME = exports.CATLADDER_STORE_DIR = void 0;
+exports.getGcloudProjectNumber = exports.readGcloudProjectNumber = exports.readCatladderStore = exports.getCatladderStorePath = exports.catladderStoreSchema = exports.CATLADDER_STORE_FILE = exports.CATLADDER_STORE_FILE_NAME = exports.CATLADDER_STORE_DIR = void 0;
 const fs_1 = require("fs");
 const path_1 = require("path");
 const yaml_1 = require("yaml");
@@ -52,6 +52,13 @@ const readCatladderStore = (directory = process.cwd()) => {
     }
 };
 exports.readCatladderStore = readCatladderStore;
+/**
+ * gcloud project number from the store, or null when it has not been
+ * fetched yet. Use this where a missing number is not itself the problem —
+ * `getGcloudProjectNumber` is the one that reports it.
+ */
+const readGcloudProjectNumber = (config, projectId) => { var _a, _b, _c, _d; return (_d = (_c = (_b = (_a = config.store) === null || _a === void 0 ? void 0 : _a.gcloudProjects) === null || _b === void 0 ? void 0 : _b[projectId]) === null || _c === void 0 ? void 0 : _c.projectNumber) !== null && _d !== void 0 ? _d : null; };
+exports.readGcloudProjectNumber = readGcloudProjectNumber;
 /**
  * gcloud project number from the store — needed to compute deterministic
  * cloud run urls (`<service>-<projectNumber>.<region>.run.app`) at
@@ -61,8 +68,7 @@ exports.readCatladderStore = readCatladderStore;
  * catenv fail until `catladder project setup` has stored it.
  */
 const getGcloudProjectNumber = (config, projectId) => {
-    var _a, _b, _c;
-    const projectNumber = (_c = (_b = (_a = config.store) === null || _a === void 0 ? void 0 : _a.gcloudProjects) === null || _b === void 0 ? void 0 : _b[projectId]) === null || _c === void 0 ? void 0 : _c.projectNumber;
+    const projectNumber = (0, exports.readGcloudProjectNumber)(config, projectId);
     if (!projectNumber) {
         throw new Error(`Missing gcloud project number for project "${projectId}" in ${exports.CATLADDER_STORE_FILE}.\n` +
             `Run "catladder project setup" to fetch and store it.`);

package/dist/packages/pipeline/src/store/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../../packages/pipeline/src/store/index.ts"],"names":[],"mappings":";;;AAAA,2BAA8C;AAC9C,+BAA4B;AAC5B,+BAA6B;AAC7B,6BAAwB;AAEX,QAAA,mBAAmB,GAAG,kBAAkB,CAAC;AACzC,QAAA,yBAAyB,GAAG,WAAW,CAAC;AACxC,QAAA,oBAAoB,GAAG,GAAG,2BAAmB,IAAI,iCAAyB,EAAE,CAAC;AAE1F;;;;;;;;GAQG;AACU,QAAA,oBAAoB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC3C;;OAEG;IACH,cAAc,EAAE,OAAC;SACd,MAAM,CACL,OAAC,CAAC,MAAM,EAAE,EACV,OAAC,CAAC,MAAM,CAAC;QACP,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC;KACzC,CAAC,CACH;SACA,QAAQ,EAAE;CACd,CAAC,CAAC;AAII,MAAM,qBAAqB,GAAG,CAAC,SAAiB,EAAE,EAAE,CACzD,IAAA,WAAI,EAAC,SAAS,EAAE,2BAAmB,EAAE,iCAAyB,CAAC,CAAC;AADrD,QAAA,qBAAqB,yBACgC;AAElE;;;;;;;GAOG;AACI,MAAM,kBAAkB,GAAG,CAChC,YAAoB,OAAO,CAAC,GAAG,EAAE,EACjB,EAAE;;IAClB,MAAM,IAAI,GAAG,IAAA,6BAAqB,EAAC,SAAS,CAAC,CAAC;IAC9C,IAAI,CAAC,IAAA,eAAU,EAAC,IAAI,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,CAAC;QACH,OAAO,4BAAoB,CAAC,KAAK,CAC/B,MAAA,IAAA,YAAK,EAAC,IAAA,iBAAY,EAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,mCAAI,EAAE,CACvD,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,IAAI,CACV,uBAAuB,4BAAoB,wDACzC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAC3C,EAAE,CACH,CAAC;QACF,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC,CAAC;AAnBW,QAAA,kBAAkB,sBAmB7B;AAEF;;;;;;;GAOG;AACI,MAAM,sBAAsB,GAAG,CACpC,MAAkC,EAClC,SAAiB,EACT,EAAE;;IACV,MAAM,aAAa,GACjB,MAAA,MAAA,MAAA,MAAM,CAAC,KAAK,0CAAE,cAAc,0CAAG,SAAS,CAAC,0CAAE,aAAa,CAAC;IAC3D,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CACb,8CAA8C,SAAS,QAAQ,4BAAoB,KAAK;YACtF,sDAAsD,CACzD,CAAC;IACJ,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC,CAAC;AAbW,QAAA,sBAAsB,0BAajC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../../packages/pipeline/src/store/index.ts"],"names":[],"mappings":";;;AAAA,2BAA8C;AAC9C,+BAA4B;AAC5B,+BAA6B;AAC7B,6BAAwB;AAEX,QAAA,mBAAmB,GAAG,kBAAkB,CAAC;AACzC,QAAA,yBAAyB,GAAG,WAAW,CAAC;AACxC,QAAA,oBAAoB,GAAG,GAAG,2BAAmB,IAAI,iCAAyB,EAAE,CAAC;AAE1F;;;;;;;;GAQG;AACU,QAAA,oBAAoB,GAAG,OAAC,CAAC,MAAM,CAAC;IAC3C;;OAEG;IACH,cAAc,EAAE,OAAC;SACd,MAAM,CACL,OAAC,CAAC,MAAM,EAAE,EACV,OAAC,CAAC,MAAM,CAAC;QACP,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC;KACzC,CAAC,CACH;SACA,QAAQ,EAAE;CACd,CAAC,CAAC;AAII,MAAM,qBAAqB,GAAG,CAAC,SAAiB,EAAE,EAAE,CACzD,IAAA,WAAI,EAAC,SAAS,EAAE,2BAAmB,EAAE,iCAAyB,CAAC,CAAC;AADrD,QAAA,qBAAqB,yBACgC;AAElE;;;;;;;GAOG;AACI,MAAM,kBAAkB,GAAG,CAChC,YAAoB,OAAO,CAAC,GAAG,EAAE,EACjB,EAAE;;IAClB,MAAM,IAAI,GAAG,IAAA,6BAAqB,EAAC,SAAS,CAAC,CAAC;IAC9C,IAAI,CAAC,IAAA,eAAU,EAAC,IAAI,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,CAAC;QACH,OAAO,4BAAoB,CAAC,KAAK,CAC/B,MAAA,IAAA,YAAK,EAAC,IAAA,iBAAY,EAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,mCAAI,EAAE,CACvD,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,IAAI,CACV,uBAAuB,4BAAoB,wDACzC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAC3C,EAAE,CACH,CAAC;QACF,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC,CAAC;AAnBW,QAAA,kBAAkB,sBAmB7B;AAEF;;;;GAIG;AACI,MAAM,uBAAuB,GAAG,CACrC,MAAkC,EAClC,SAAiB,EACF,EAAE,uBACjB,OAAA,MAAA,MAAA,MAAA,MAAA,MAAM,CAAC,KAAK,0CAAE,cAAc,0CAAG,SAAS,CAAC,0CAAE,aAAa,mCAAI,IAAI,CAAA,EAAA,CAAC;AAJtD,QAAA,uBAAuB,2BAI+B;AAEnE;;;;;;;GAOG;AACI,MAAM,sBAAsB,GAAG,CACpC,MAAkC,EAClC,SAAiB,EACT,EAAE;IACV,MAAM,aAAa,GAAG,IAAA,+BAAuB,EAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACjE,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CACb,8CAA8C,SAAS,QAAQ,4BAAoB,KAAK;YACtF,sDAAsD,CACzD,CAAC;IACJ,CAAC;IACD,OAAO,aAAa,CAAC;AACvB,CAAC,CAAC;AAZW,QAAA,sBAAsB,0BAYjC"}

package/dist/skills/catladder-deploys/references/deploy-types.md

@@ -46,6 +46,7 @@ resources with `yarn catladder project setup`; detect drift with
 - `cloudSql?: DeployConfigCloudRunCloudSql | false` — `{ type: "unmanaged", instanceConnectionName, dbUser?, dbNamePrefix?, dbBaseName?, deleteDatabaseOnStop?, dbConnectionStringFormat? ("prisma" default | "rails" | "jdbc"), dbConnectionStringVariablesMode? ("embedded" default | "legacy"), dbAdditionalQueryParams? }`. Injects `DB_*` vars plus `DATABASE_URL`/`DATABASE_JDBC_URL`; in the default `"embedded"` mode the connection strings contain the component's final values (referenceable from other components, `vars.public` overrides of `DB_*` flow in). To share another component's database: `dbBaseName: "<owner>"` + `DB_PASSWORD: "${<owner>:DB_PASSWORD}"` in `vars.public`.
 - `execute?: Record<string, DeployConfigCloudRunExecute | null>` — run a script / job / HTTP call at a lifecycle point (`when`: `preDeploy` | `postDeploy` | `preStop` | `postStop`) or on a `schedule`.
 - `debug?: boolean`.
+- Service name and url: the service deploys as `<customerName>-<appName>-<env>[-<reviewSlug>]-<componentName>`, and `ROOT_URL`/`ROOT_URL_INTERNAL` are cloud run's deterministic url `https://<service>-<projectNumber>.<region>.run.app`. That url only exists while its first dns label stays within 63 characters, so catladder **shortens the component part** of the service name when it would not fit — otherwise cloud run would serve a legacy url with a random identifier and the generated hostname would never resolve. Review environments carry a runtime slug on top, for which 8 characters are reserved, so a name can fit `dev`/`prod` and still be shortened for `review`. Generation fails instead of shortening when two components would end up with the same name, or when customerName/appName/env/project number already leave no room.
 
 ## `npmPackage`
 

package/dist/skills/catladder-migrate-ci-backend/SKILL.md

@@ -260,13 +260,17 @@ now-wrong `gitRemote`, regenerate once more, and finish with
   PR is mergeable the moment it opens, checks still running, and the
   auto-merge button does not even appear. `yarn catladder project setup`
   configures it: auto-merge + delete-merged-branches on the repo, and a
-  branch protection rule on the default branch requiring the generated
-  **`catladder ✅`** aggregate check (the one stable context — never
-  require individual job names, they change with every component
-  add/rename and a stale required name blocks its own PR forever).
-  `project doctor` verifies it. Two things stay human choices: "Do not
-  allow bypassing" (leave it off — generated CI means a generation bug
-  can only be fixed via the admin bypass) and required reviews.
+  repository **ruleset** (`catladder merge gating`) on the default
+  branch requiring the generated **`catladder ✅`** aggregate check
+  (the one stable context — never require individual job names, they
+  change with every component add/rename and a stale required name
+  blocks its own PR forever). The ruleset carries a bypass for the
+  GitHub Actions app: the release job pushes the release commit and
+  tag straight to the default branch with the workflow token, which a
+  required check would otherwise reject (GH006 — classic branch
+  protection has no bypass list, which is why setup uses a ruleset and
+  migrates old classic-protection gating away). `project doctor`
+  verifies all of it. Required reviews stay a human choice.
 - Tell the team where the pipeline lives now and how manual actions
   work there (on GitHub, manual jobs are dispatch workflows in the
   Actions sidebar — `🚀 catladder create release`, `▶️ catladder deploy`,