@faable/faable 1.23.0 → 1.24.1

package/dist/api/FaableApi.js

@@ -1,5 +1,13 @@
 import { create_base_client } from './base_client.js';
 
+// Socket-level failures where no response ever arrived: the connection died
+// before the server produced anything, so a single retry is safe for any
+// method (a reset mid-flight means the request was not processed).
+const RESET_CODES = new Set(["ECONNRESET", "EPIPE"]);
+const RETRY_DELAY_MS = 300;
+const is_connection_reset = (e) => e.isAxiosError &&
+    !e.response &&
+    (RESET_CODES.has(e.code ?? "") || e.message.includes("socket hang up"));
 const firstPage = async (res) => {
     const items = (await res).results;
     return items;
@@ -27,6 +35,20 @@ class FaableApi {
             // Do something with request error
             return Promise.reject(error);
         });
+        // Registered before the error-wrapping interceptor so it sees the raw
+        // axios error. Retries once per request; the retried call re-enters the
+        // full chain (auth headers included).
+        const client = this.client;
+        this.client.interceptors.response.use(undefined, async (error) => {
+            const e = error;
+            const config = e.config;
+            if (config && !config._retried && is_connection_reset(e)) {
+                config._retried = true;
+                await new Promise((r) => setTimeout(r, RETRY_DELAY_MS));
+                return client.request(config);
+            }
+            throw error;
+        });
         this.client.interceptors.response.use((response) => response, (error) => {
             const e = error;
             if (e.isAxiosError) {

package/dist/api/strategies/oidc.strategy.js

@@ -22,14 +22,14 @@ const exchangeGithubOidcToken = async (gh_token, target_app_id) => {
             // actionable next step.
             if (status === 404) {
                 throw new Error('No app linked to this repository. Run "faable link" locally to link it, ' +
-                    "or link it from the dashboard (https://dashboard.faable.com).");
+                    "or link it from the dashboard (https://dashboard.faable.com).", { cause: err });
             }
             // Monorepo: several apps are linked to the same repository.
             if (status === 400) {
                 throw new Error(serverMessage ||
-                    "This repository has multiple linked apps. Specify which one with `faable deploy <app_id>`.");
+                    "This repository has multiple linked apps. Specify which one with `faable deploy <app_id>`.", { cause: err });
             }
-            throw new Error(`Faable OIDC token exchange failed (${status ?? "network error"})${serverMessage ? `: ${serverMessage}` : ""}`);
+            throw new Error(`Faable OIDC token exchange failed (${status ?? "network error"})${serverMessage ? `: ${serverMessage}` : ""}`, { cause: err });
         }
         throw err;
     }

package/dist/commands/deploy/index.js

@@ -2,16 +2,11 @@ import { requireApi } from '../../api/context.js';
 import { Configuration } from '../../lib/Configuration.js';
 import { log } from '../../log.js';
 import { link } from '../link/index.js';
-import { configure_buildpacks, detect_buildpack, plan_summary, get_buildpack, buildpack_names } from '@faabletools/buildpacks';
-import { cmd } from '../../lib/cmd.js';
-import { check_environment } from './check_environment.js';
 import { git_context } from './git_context.js';
 import { deploy_remote } from './remote/index.js';
 import { resolve_app_id } from './resolve_app_id.js';
 import { secrets } from './secrets/index.js';
 import { is_superseded } from './superseded.js';
-import { mark_build_failure, start_log_sync, upload_logs } from './upload_logs.js';
-import { upload_tag } from './upload_tag.js';
 
 const deploy = {
     command: 'deploy [app_id]',
@@ -31,29 +26,10 @@ const deploy = {
             type: 'string',
             description: 'Working directory'
         })
-            .option('buildpack', {
-            alias: 'b',
-            type: 'string',
-            choices: buildpack_names(),
-            description: 'Force a specific buildpack (overrides auto-detection and faable.json)'
-        })
-            .option('remote', {
-            type: 'boolean',
-            description: 'Build server-side (remote build), regardless of the app build_mode'
-        })
-            .option('local', {
-            type: 'boolean',
-            description: 'Build locally with Docker, even if the app is set to remote builds'
-        })
-            .conflicts('remote', 'local')
             .showHelpOnFail(false);
     },
     handler: async (args) => {
         const workdir = args.workdir || process.cwd();
-        // Wire the shared buildpacks package to the CLI's sinks: pino (which tees
-        // into the build-log buffer) and cmd() (which captures subprocess output
-        // into the same buffer). Must happen before any detect/build call.
-        configure_buildpacks({ log, exec: cmd });
         // Pass the explicit app target to the OIDC exchange so a monorepo (several
         // apps, one repo) can be disambiguated in CI.
         const ctx = await requireApi(args.app_id);
@@ -71,113 +47,14 @@ const deploy = {
         // Capture the commit/ref/actor so the deployment records which commit
         // it came from and who pushed it (env in CI, git fallback locally).
         const git = await git_context({ workdir });
-        // Resolve the buildpack plan (detection or forced override). All the build
-        // thinking happens here; build() below just executes the plan. Detection can
-        // fail (e.g. an app whose start command can't be inferred) — and it runs
-        // before the create-first deployment exists, so without this a detection
-        // failure would leave NO deployment row: no deploy-failed email, nothing in
-        // the dashboard, just a red X in the CI logs the user may never see. Record
-        // it as a failed deployment instead.
-        let plan;
-        try {
-            plan = await detect_buildpack({ workdir, config }, args.buildpack || config.buildpack);
-        }
-        catch (error) {
-            // Log the reason into the build buffer first (so it rides along in the
-            // attached logs), then record a typeless BUILD_ERROR row — typeless so it
-            // can't rewrite the app's runtime_strategy. Best-effort: a create that
-            // itself fails (e.g. the free-plan quota gate) must not mask the original
-            // detection error.
-            log.error(error.message);
-            const failed = await api
-                .createDeployment({ app_id: app.id, ...git })
-                .catch(() => null);
-            if (failed) {
-                await mark_build_failure(api, { deployment_id: failed.id, app });
-            }
-            throw error;
-        }
-        // Remote build path (v2, arch/deploy/deploy-v2-remote-build.md): the
-        // server decides via the app's build_mode; --remote/--local override for
-        // testing. Pre-build failures with a server-decided mode fall back to the
-        // local build below (deploy_remote returns null); with --remote they
-        // fail hard.
-        let deployment;
-        const want_remote = !args.local && (Boolean(args.remote) || app.build_mode === 'remote');
-        const remote_deployment = want_remote
-            ? await deploy_remote({
-                api,
-                app,
-                plan,
-                git,
-                workdir,
-                explicit: Boolean(args.remote)
-            })
-            : null;
-        if (remote_deployment) {
-            deployment = remote_deployment;
-        }
-        else {
-            if (want_remote) {
-                log.warn('↩️ Falling back to a local build');
-            }
-            // Create-first: register the deployment BEFORE building. Gate rejections
-            // (free-plan quota 429, disabled app 409) surface here, at second 0 —
-            // before any build minutes are spent. The row is born QUEUED; the CLI
-            // owns it until the built image lands (or the build fails). `type` rides
-            // on the create — the buildpack plan is already resolved.
-            deployment = await api.createDeployment({
-                app_id: app.id,
-                type: plan.type,
-                ...git
-            });
-            try {
-                // Check if we can build docker images
-                await check_environment();
-                const runtime_label = plan.runtime.version
-                    ? `${plan.runtime.name}-${plan.runtime.version}`
-                    : plan.runtime.name;
-                log.info(`🚀 Deploying "${app.name}" (${app.id}) runtime=${runtime_label}`);
-                log.info(`🧩 Build plan ${plan_summary(plan)}`);
-                // get environment variables
-                const env_vars = await api.getAppSecrets(app.id);
-                const buildpack = get_buildpack(plan.buildpack);
-                if (!buildpack) {
-                    throw new Error(`No buildpack registered for plan=${plan.buildpack}`);
-                }
-                // The build starts now: declare it (QUEUED → BUILDING) and stream the
-                // captured output to the deployment while it runs (best-effort).
-                await api
-                    .updateDeploymentStatus(deployment.id, { phase: 'BUILDING' })
-                    .catch((error) => log.warn(`Could not mark deployment BUILDING: ${error.message}`));
-                const stop_log_sync = start_log_sync(api, deployment.id);
-                try {
-                    await buildpack.build({ workdir, config, app, env_vars, deployment }, plan);
-                    // Upload to Faable registry, tagged by version and pinned to digest
-                    const { image_ref } = await upload_tag({
-                        app,
-                        api,
-                        deployment_id: deployment.id
-                    });
-                    // Complete the deployment with the built image — this is the handoff:
-                    // the controller claims it and materializes the workload.
-                    await api.completeDeployment(deployment.id, image_ref);
-                }
-                finally {
-                    stop_log_sync();
-                }
-            }
-            catch (error) {
-                // The deployment already exists (created pre-build), so a failed build
-                // marks THAT row BUILD_ERROR with the captured logs — no extra row, no
-                // second quota hit. Gate rejections can't reach here anymore: the
-                // create happens before any building.
-                await mark_build_failure(api, { deployment_id: deployment.id, app });
-                throw error;
-            }
-            // Attach the final build output to the deployment (best-effort).
-            await upload_logs(api, deployment.id);
-        } // end local build path (remote builds upload their own logs server-side)
+        // Remote build only (arch/deploy/remote-artifact-default-cutover.md): the
+        // CLI no longer builds — it uploads the source and the platform builds
+        // server-side (framework detection, buildpacks, artifact/image output all
+        // live in the builder). No Docker, no local fallback: a rejected admission
+        // (build_mode=local opt-out, or the global kill-switch off) or a build
+        // error throws and exits red.
+        log.info(`🚀 Deploying "${app.name}" (${app.id})`);
+        const deployment = await deploy_remote({ api, app, git, workdir });
         const dashboard_url = `https://dashboard.faable.com/deploy/${app.team}/app/${app.id}`;
         log.info(`Preparing to deploy in faable cloud · ${deployment.id}`);
         log.info(`📊 View it in the dashboard -> ${dashboard_url}`);

package/dist/commands/deploy/remote/index.js

@@ -4,42 +4,29 @@ import { collect_manifest } from './manifest.js';
 import { upload_missing_blobs } from './upload.js';
 
 /**
- * Remote build path (v2, arch/deploy/deploy-v2-remote-build.md): upload the
- * source delta to the CAS, create the deployment with `source` (manifest +
- * serialized BuildPlan) and follow the server-side build until the image
- * handoff. No Docker daemon needed.
+ * Remote build (arch/deploy/remote-artifact-default-cutover.md): upload the
+ * source delta to the CAS, create the deployment with `source` (manifest only —
+ * the builder re-detects the framework server-side) and follow the server-side
+ * build until the handoff. No Docker daemon, no local buildpacks.
  *
- * Fallback contract:
- *  - PRE-build failures (collection, upload, create — including the server
- *    gate `remote_build_disabled`) return null when the mode came from the
- *    server, so the caller falls back to a local build. With --remote they
- *    fail hard (testing wants to see the errors).
- *  - Failures AFTER the deployment exists never fall back: a BUILD_ERROR
- *    would fail locally too (it's the user's build), and a timeout may still
- *    be building — a local fallback would double-deploy.
+ * There is no local fallback anymore: the CLI no longer builds. Any failure —
+ * a rejected admission (`remote_build_disabled` when the app opted out with
+ * build_mode=local, or the global kill-switch is off), an upload error, or a
+ * BUILD_ERROR — throws so the command exits red.
  */
 const deploy_remote = async (props) => {
-    const { api, app, plan, git, workdir, explicit } = props;
-    log.info(`☁️ Remote build (${explicit ? "--remote" : `app build_mode=remote`})`);
-    let deployment;
-    try {
-        const manifest = await collect_manifest(workdir);
-        log.info(`🗂️ ${manifest.length} files in the source manifest`);
-        await upload_missing_blobs(api, app.id, workdir, manifest);
-        deployment = await api.createDeployment({
-            app_id: app.id,
-            type: plan.type,
-            source: { manifest, plan },
-            ...git,
-        });
-    }
-    catch (error) {
-        if (explicit)
-            throw error;
-        const code = error?.response?.data?.code;
-        log.warn(`☁️ Remote build unavailable${code ? ` (${code})` : `: ${error.message}`}`);
-        return null;
-    }
+    const { api, app, git, workdir } = props;
+    log.info(`☁️ Remote build`);
+    const manifest = await collect_manifest(workdir);
+    log.info(`🗂️ ${manifest.length} files in the source manifest`);
+    await upload_missing_blobs(api, app.id, workdir, manifest);
+    // No `plan`: the builder re-detects on the assembled tree and syncs the app's
+    // runtime_strategy on completion.
+    const deployment = await api.createDeployment({
+        app_id: app.id,
+        source: { manifest },
+        ...git,
+    });
     log.info(`Preparing to build in faable cloud · ${deployment.id}`);
     await follow_remote_build(api, deployment.id);
     return deployment;

package/dist/commands/deploy/remote/manifest.js

@@ -15,15 +15,15 @@ const MAX_FILE_BYTES = 100 * 1024 * 1024;
  * them like a fresh clone would.
  *
  * Symlinks are rejected (no representation in the manifest by design — see
- * deploy-v2-remote-build.md) and a non-git directory is unsupported in the
- * MVP (deploy with --local instead).
+ * deploy-v2-remote-build.md) and a non-git directory is unsupported (the source
+ * tree is collected via git).
  */
 const collect_manifest = async (workdir) => {
     const inside = await cmd(`git rev-parse --is-inside-work-tree`, {
         cwd: workdir,
     }).catch(() => null);
     if (!inside || String(inside.stdout).trim() !== "true") {
-        throw new Error("Remote builds need a git repository (the source tree is collected via git). Deploy with --local instead.");
+        throw new Error("Deploys need a git repository (the source tree is collected via git). Initialize one with `git init` and commit your files.");
     }
     // -c/-o: tracked + untracked; --exclude-standard: .gitignore/.git/info.
     // -z: NUL-separated (paths with spaces/UTF-8 survive).
@@ -57,7 +57,7 @@ const collect_manifest = async (workdir) => {
         if (stat.isDirectory())
             continue;
         if (stat.isSymbolicLink()) {
-            throw new Error(`Symlinks are not supported in remote builds: ${rel}. Deploy with --local instead.`);
+            throw new Error(`Symlinks are not supported: ${rel}. Replace the symlink with the real file.`);
         }
         if (stat.size > MAX_FILE_BYTES) {
             throw new Error(`${rel} is too large for a remote build (${stat.size} bytes > ${MAX_FILE_BYTES}).`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@faable/faable",
-  "version": "1.23.0",
+  "version": "1.24.1",
   "main": "dist/index.js",
   "license": "MIT",
   "author": "Marc Pomar <marc@faable.com>",
@@ -27,8 +27,7 @@
   ],
   "dependencies": {
     "@actions/core": "^3.0.0",
-    "@faabletools/buildpacks": "^1.7.0",
-    "axios": "^1.13.2",
+    "axios": "^1.18.1",
     "fs-extra": "^11.3.2",
     "handlebars": "^4.7.8",
     "open": "^11.0.0",

package/dist/commands/deploy/check_environment.js

@@ -1,12 +0,0 @@
-import { cmd } from '../../lib/cmd.js';
-
-const check_environment = async () => {
-    try {
-        await cmd("docker ps");
-    }
-    catch (error) {
-        throw new Error(`Docker is not running`, { cause: error });
-    }
-};
-
-export { check_environment };

package/dist/commands/deploy/upload_logs.js

@@ -1,67 +0,0 @@
-import { buildLog } from '../../lib/log_buffer.js';
-import { log } from '../../log.js';
-
-// Best-effort by design: attaching logs (or recording a failed build) must
-// never break or fail a deploy — an older API without these endpoints just
-// produces a warn.
-const upload_logs = async (api, deployment_id) => {
-    try {
-        const { content, truncated } = buildLog.contents();
-        if (!content)
-            return;
-        await api.uploadDeploymentLogs(deployment_id, { content, truncated });
-        log.info(`📝 Build logs attached to deployment ${deployment_id}`);
-    }
-    catch (error) {
-        log.warn(`Could not upload build logs (non-fatal): ${error.message}`);
-    }
-};
-// Live log sync during the build: re-upload the whole buffer every interval
-// while it grows. The API endpoint is an idempotent replace (one log row per
-// deployment), so partial uploads are simply superseded — the dashboard sees
-// the build progressing instead of only the final dump. Rate-limit friendly:
-// 10s interval = 6 req/min against the endpoint's 30/min cap.
-const start_log_sync = (api, deployment_id, intervalMs = 10_000) => {
-    let lastSize = 0;
-    let inFlight = false;
-    const timer = setInterval(async () => {
-        if (inFlight)
-            return;
-        const { content, truncated, size } = buildLog.contents();
-        if (!content || size === lastSize)
-            return;
-        inFlight = true;
-        try {
-            await api.uploadDeploymentLogs(deployment_id, { content, truncated });
-            lastSize = size;
-        }
-        catch (error) {
-            // Quiet: the final upload_logs still runs at the end of the deploy.
-            log.debug(`Log sync failed (non-fatal): ${error.message}`);
-        }
-        finally {
-            inFlight = false;
-        }
-    }, intervalMs);
-    // Never keep the process alive just for log syncing.
-    timer.unref?.();
-    return () => clearInterval(timer);
-};
-// Mark the create-first deployment as a failed build (phase BUILD_ERROR) and
-// attach the captured logs. The deployment row already exists — created
-// before the build started — so unlike the old flow no extra row is created
-// (and no quota is consumed) to record the failure.
-const mark_build_failure = async (api, { deployment_id, app, }) => {
-    try {
-        await api
-            .updateDeploymentStatus(deployment_id, { phase: "BUILD_ERROR" })
-            .catch((error) => log.warn(`Could not mark deployment BUILD_ERROR: ${error.message}`));
-        await upload_logs(api, deployment_id);
-        log.error(`❌ Build failed — logs attached to deployment ${deployment_id} · https://dashboard.faable.com/deploy/${app.team}/app/${app.id}`);
-    }
-    catch (error) {
-        log.warn(`Could not report the failed build (non-fatal): ${error.message}`);
-    }
-};
-
-export { mark_build_failure, start_log_sync, upload_logs };

package/dist/commands/deploy/upload_tag.js

@@ -1,73 +0,0 @@
-import { log } from '../../log.js';
-import { cmd } from '../../lib/cmd.js';
-
-/**
- * `<hostname>/<image>:<deployment_id>` — one tag per build, never
- * overwritten. Without a tag docker resolves `:latest`, which every deploy
- * rewrites: any rescheduled pod (node drain, eviction) would silently pull
- * whatever build was pushed last, breaking the deployment ↔ code identity.
- */
-const build_upload_tagname = (hostname, image, deployment_id) => `${hostname}/${image}:${deployment_id}`;
-/**
- * Strips the tag from an image ref, keeping registry ports intact
- * (`host:5000/img:tag` → `host:5000/img`). A colon only denotes a tag when
- * it appears after the last path segment separator.
- */
-const strip_image_tag = (ref) => {
-    const last_slash = ref.lastIndexOf("/");
-    const last_colon = ref.lastIndexOf(":");
-    return last_colon > last_slash ? ref.slice(0, last_colon) : ref;
-};
-/**
- * Pins a pushed tag to its content digest: `repo:tag@sha256:…`. Kubernetes
- * pulls by digest (immutable even if the tag were re-pushed); the tag stays
- * as the human-readable label. `RepoDigests` entries come as `repo@sha256:…`
- * (no tag) and may reference other registries — only the entry for this
- * repo counts. Returns null when none matches (caller falls back to the tag).
- */
-const pin_tag_to_digest = (tagname, repo_digests) => {
-    const repo = strip_image_tag(tagname);
-    const match = repo_digests.find((d) => d.startsWith(`${repo}@sha256:`));
-    if (!match)
-        return null;
-    return `${tagname}@${match.slice(repo.length + 1)}`;
-};
-const upload_tag = async (args) => {
-    const { api, app, deployment_id } = args;
-    log.info(`🔁 Uploading...`);
-    const registry = await api.getRegistry(app.id);
-    // Registry login
-    const { user, password, hostname, image } = registry;
-    await cmd(`echo "${password}" | docker login --username "${user}" --password-stdin ${hostname}`);
-    // Tag the local build (tagged `app.id` by the buildpack) for this version
-    const upload_tagname = build_upload_tagname(hostname, image, deployment_id);
-    await cmd(`docker tag ${app.id} ${upload_tagname}`);
-    // Upload the image to faable registry
-    await cmd(`docker push ${upload_tagname}`);
-    // Pin to the digest the registry just assigned. Best-effort: the tagged
-    // ref alone is already unique per build, the digest just makes it
-    // tamper-proof.
-    let image_ref = upload_tagname;
-    try {
-        const inspect = await cmd(`docker inspect --format '{{json .RepoDigests}}' ${upload_tagname}`);
-        const repo_digests = JSON.parse(String(inspect.stdout).trim());
-        const pinned = pin_tag_to_digest(upload_tagname, repo_digests);
-        if (pinned) {
-            image_ref = pinned;
-        }
-        else {
-            log.warn(`Could not resolve the pushed digest; deploying by tag only.`);
-        }
-    }
-    catch (error) {
-        log.warn(`Could not inspect the pushed image (${error.message}); deploying by tag only.`);
-    }
-    log.info(`✅ Upload completed.`);
-    return {
-        upload_tagname,
-        /** Immutable ref recorded on the deployment: `repo:tag@sha256:…` */
-        image_ref,
-    };
-};
-
-export { build_upload_tagname, pin_tag_to_digest, strip_image_tag, upload_tag };