@faable/faable 1.15.4 → 1.17.0

package/dist/commands/deploy/buildpacks/node/index.js

@@ -7,6 +7,7 @@ import { build_project } from './build_project.js';
 import { ensure_dependencies } from './ensure_dependencies.js';
 import { inject_serve } from './inject_serve.js';
 import { resolve_node_version } from './node_version.js';
+import { wrap_next_config } from './wrap_next_config.js';
 
 const BANNER = `NODE_VERSION=$(node --version)
 NPM_VERSION=$(npm --version)
@@ -35,7 +36,15 @@ const node_buildpack = {
         };
     },
     async build(ctx, plan) {
-        const env = R.fromPairs(ctx.env_vars.map((e) => [e.name, e.value]));
+        const env = {
+            ...R.fromPairs(ctx.env_vars.map((e) => [e.name, e.value])),
+            // Platform-injected build-time identity, mirroring the runtime env the
+            // controller sets on the pod. FAABLE_DEPLOY_ID (build id ≡ runtime id)
+            // is the deterministic Next.js buildId source — user secrets can't
+            // override either. See arch/deploy/version-skew-coexistence.md.
+            FAABLE_APP_ID: ctx.app.id,
+            FAABLE_DEPLOY_ID: ctx.deployment.id,
+        };
         log.info(`Building with env variables ${Object.keys(env).join(",")}`);
         // The workflow no longer runs `npm ci` — install here when needed, before
         // the build and before `COPY . .` packages node_modules into the image.
@@ -44,7 +53,16 @@ const node_buildpack = {
         const build_command = plan.build_script
             ? `npm run ${plan.build_script}`
             : ctx.config.buildCommand;
-        await build_project({ command: build_command, env, cwd: ctx.workdir });
+        // Next: wrap next.config for the duration of the build so the buildId is
+        // the deployment id (transparent version-skew protection). Restored
+        // BEFORE the docker build — `COPY . .` must package the original config.
+        const wrapped = plan.type === "next" ? await wrap_next_config(ctx.workdir, env) : null;
+        try {
+            await build_project({ command: build_command, env, cwd: ctx.workdir });
+        }
+        finally {
+            await wrapped?.restore();
+        }
         // Frameworks without a bundled static server (CRA/Vue/Angular) need
         // `serve` installed into node_modules before packaging.
         if (plan.inject_serve) {

package/dist/commands/deploy/buildpacks/node/wrap_next_config.js

@@ -0,0 +1,138 @@
+import { existsSync, rmSync, renameSync } from 'fs';
+import { rename, writeFile, rm, readFile } from 'fs/promises';
+import path__default from 'path';
+import { log } from '../../../../log.js';
+
+/**
+ * Transparent deterministic-buildId for Next.js apps
+ * (arch/deploy/version-skew-coexistence.md, Fase 1).
+ *
+ * Next reads no env var for its buildId — the only deterministic source is
+ * `generateBuildId` in the user's next.config. Rather than asking users to
+ * edit their config, the buildpack wraps it for the duration of `next build`:
+ * the original file is renamed aside and replaced by a generated wrapper that
+ * resolves it (object | function | promise | async) and adds a
+ * `generateBuildId` reading FAABLE_DEPLOY_ID — ONLY when the user doesn't
+ * define their own.
+ *
+ * The wrapper is self-contained (no imports beyond the original config): the
+ * user's node_modules has no faable packages.
+ *
+ * Restoration is guaranteed: `restore()` runs in the caller's finally (before
+ * the docker build, so `COPY . .` packages the original config — `next start`
+ * loads next.config at runtime too), and a signal handler covers Ctrl-C
+ * mid-build. `next.config.ts` is skipped with a warning (it needs Next's own
+ * TS loader; not wrappable from a JS wrapper).
+ */
+const CONFIG_FILES = ["next.config.js", "next.config.cjs", "next.config.mjs"];
+const ORIGINAL_PREFIX = "next.config.faable-original";
+const wrapperBody = (originalFile, flavor) => {
+    const resolver = `
+const resolveConfig = async (original, phase, args) => {
+  let config = original && original.__esModule ? original.default : original;
+  if (typeof config === "function") config = config(phase, args);
+  config = await config;
+  config = config || {};
+  if (config.generateBuildId) return config; // user-defined wins, never override
+  return {
+    ...config,
+    // Deterministic buildId = platform deployment id (build id ≡ runtime id).
+    generateBuildId: () => process.env.FAABLE_DEPLOY_ID ?? null,
+  };
+};`;
+    if (flavor === "cjs") {
+        return `// Generated by faable deploy for this build only — auto-restored afterwards.
+// Adds a deterministic buildId (FAABLE_DEPLOY_ID) unless the config defines
+// its own generateBuildId. See faable.com docs on version skew.
+${originalFile ? `const original = require("./${originalFile}");` : `const original = {};`}
+${resolver}
+module.exports = (phase, args) => resolveConfig(original, phase, args);
+`;
+    }
+    return `// Generated by faable deploy for this build only — auto-restored afterwards.
+// Adds a deterministic buildId (FAABLE_DEPLOY_ID) unless the config defines
+// its own generateBuildId. See faable.com docs on version skew.
+${originalFile ? `import original from "./${originalFile}";` : `const original = {};`}
+${resolver}
+export default (phase, args) => resolveConfig(original, phase, args);
+`;
+};
+const packageIsESM = async (workdir) => {
+    try {
+        const pkg = JSON.parse(await readFile(path__default.join(workdir, "package.json"), "utf8"));
+        return pkg.type === "module";
+    }
+    catch {
+        return false;
+    }
+};
+/**
+ * Wraps the project's next.config for the build. Returns null (no-op) when
+ * there is nothing to do: FAABLE_DEPLOY_ID absent from `env`, a `.ts` config,
+ * or the user already handles the buildId. Callers MUST `await
+ * wrapped?.restore()` in a finally.
+ */
+const wrap_next_config = async (workdir, env) => {
+    if (!env.FAABLE_DEPLOY_ID)
+        return null;
+    if (existsSync(path__default.join(workdir, "next.config.ts"))) {
+        log.warn(`next.config.ts detected — skipping the deterministic buildId wrap (define generateBuildId with FAABLE_DEPLOY_ID yourself to opt in).`);
+        return null;
+    }
+    const configFile = CONFIG_FILES.find((f) => existsSync(path__default.join(workdir, f)));
+    // Wrapper flavor/extension: mirror the original; with no config at all,
+    // .mjs is unambiguous regardless of package.json type.
+    let wrapperFile;
+    let originalFile = null;
+    let flavor;
+    if (!configFile) {
+        wrapperFile = "next.config.mjs";
+        flavor = "esm";
+    }
+    else {
+        const ext = path__default.extname(configFile); // .js | .cjs | .mjs
+        originalFile = `${ORIGINAL_PREFIX}${ext}`;
+        wrapperFile = configFile;
+        flavor =
+            ext === ".mjs" || (ext === ".js" && (await packageIsESM(workdir)))
+                ? "esm"
+                : "cjs";
+    }
+    const wrapperPath = path__default.join(workdir, wrapperFile);
+    const originalPath = originalFile ? path__default.join(workdir, originalFile) : null;
+    if (configFile && originalPath) {
+        await rename(path__default.join(workdir, configFile), originalPath);
+    }
+    await writeFile(wrapperPath, wrapperBody(originalFile, flavor), "utf8");
+    log.info(`🧬 Deterministic buildId: wrapped ${configFile ?? "(no next.config)"} → generateBuildId from FAABLE_DEPLOY_ID`);
+    // Ctrl-C / SIGTERM mid-build must not leave the user's workdir mutated.
+    const restoreSync = () => {
+        try {
+            rmSync(wrapperPath, { force: true });
+            if (configFile && originalPath) {
+                renameSync(originalPath, path__default.join(workdir, configFile));
+            }
+        }
+        catch {
+            // Best effort on the signal path
+        }
+    };
+    process.once("SIGINT", restoreSync);
+    process.once("SIGTERM", restoreSync);
+    let restored = false;
+    return {
+        restore: async () => {
+            if (restored)
+                return;
+            restored = true;
+            process.removeListener("SIGINT", restoreSync);
+            process.removeListener("SIGTERM", restoreSync);
+            await rm(wrapperPath, { force: true });
+            if (configFile && originalPath) {
+                await rename(originalPath, path__default.join(workdir, configFile));
+            }
+        },
+    };
+};
+
+export { wrap_next_config };

package/dist/commands/deploy/index.js

@@ -104,7 +104,7 @@ const deploy = {
                 .catch((error) => log.warn(`Could not mark deployment BUILDING: ${error.message}`));
             const stop_log_sync = start_log_sync(api, deployment.id);
             try {
-                await buildpack.build({ workdir, config, app, env_vars }, plan);
+                await buildpack.build({ workdir, config, app, env_vars, deployment }, plan);
                 // Upload to Faable registry, tagged by version and pinned to digest
                 const { image_ref } = await upload_tag({
                     app,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@faable/faable",
-  "version": "1.15.4",
+  "version": "1.17.0",
   "main": "dist/index.js",
   "license": "MIT",
   "author": "Marc Pomar <marc@faable.com>",