@granite-js/pulumi-aws 2.5.2 → 2.5.3

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # @granite-js/pulumi-aws
 
+## 2.5.3
+
+### Patch Changes
+
+- 8b04ab6: Add configurable deployment channels across Forge, deployment storage and the AWS CDN. Forge automatically
+  registers each app/channel selector in S3, so channel creation requires no per-channel infrastructure configuration.
+  Channel objects, state, history and cluster pointers are isolated under `channels/<channel>/`. Registered path
+  suffixes select channels while the legacy default and unregistered filename tags keep their existing routes.
+  Conditional selector reservations and checks against retained legacy bundles prevent tag/channel name conflicts
+  between updated publishers. Registration and rollout events invalidate service selectors, and unique invalidation
+  caller references prevent simultaneous requests from colliding. Missing channel deployments never fall back to
+  another namespace. Cluster rollouts now write the `.deploymentInfo` pointer used by readers and invalidation.
+
+  The exported `paths` helpers take one options object instead of positional arguments.
+
 ## 2.5.2
 
 ## 2.5.1

package/README.md

@@ -77,6 +77,98 @@ pulumi up
 
 Review the changes that Pulumi proposes, then confirm deployment. Pulumi will provision your React Native CDN infrastructure on AWS.
 
+## Deployment channels
+
+Deploy the channel-aware infrastructure once. Subsequent channel creation is handled by Forge, without changing
+the Pulumi configuration or redeploying Lambda for each channel:
+
+```sh
+granite-forge deploy --bucket sample-bucket --channel next
+```
+
+Forge gets the app name from the Granite config and registers the app/channel pair in S3 before uploading the
+platform bundles. Shared and app bundles are separate deployments and should use the same channel name.
+
+```text
+/ios/sample-app/1/bundle   -> existing unscoped default bundle
+/ios/sample-app/1/next     -> next channel's default bundle
+/android/shared/1/next    -> next channel's shared bundle
+```
+
+### S3 registration and lookup
+
+The selector record is stored outside the channel's mutable rollout state:
+
+```text
+deployments/sample-app/selectors/next.json
+  {"version":1,"type":"CHANNEL"}
+
+channels/next/deployments/sample-app/deployment_state
+channels/next/bundles/sample-app/<deploymentId>/bundle.ios.hbc.gz
+```
+
+On a CloudFront cache miss, the origin-request Lambda reads the selector record and then resolves deployment
+state in the selected channel. The URI is rewritten to its S3 bundle key. `bundle` bypasses registration lookup
+and keeps the legacy path. A missing registration keeps the existing filename-tag behavior; a registered channel
+with missing deployment state returns 404, never a legacy bundle. Invalid metadata or storage access errors fail
+instead of being interpreted as an unregistered selector. Lambda does not keep an in-process registration cache.
+Query parameters do not select or override channels.
+
+Numeric groups from 1 to 1000 retain their rollout meaning within the chosen channel. Named clusters still require
+`allowAccessCluster`; the component's default handler keeps cluster access disabled.
+
+### Backward compatibility and concurrent publishers
+
+`--channel` omission preserves existing S3 keys and URLs. `bundle` is reserved and cannot be a channel name.
+Channel names follow the [Forge CLI rules](../forge-cli/README.md#deployment-channels).
+
+Before creating a channel, the deployment manager lists all pages under `bundles/<app>/` and rejects a matching
+legacy tag on either platform, including retained objects from older deployments. New legacy tagged uploads
+reserve the same selector key with `{"version":1,"type":"LEGACY_TAG"}`. Conditional S3 writes (`If-None-Match: *`)
+ensure one owner when tag and channel registrations race. Repeated registration of the same kind is idempotent;
+it does not overwrite or invalidate an existing registration.
+
+Upgrade legacy tag publishers to the updated deployment manager before enabling channel creation. Older writers
+cannot honor reservations. Checks cover retained visible objects and registration records, so do not reuse known
+legacy names after deleting their artifacts. Keep selector records permanently: failed uploads do not remove a
+channel registration or enable legacy fallback. Retrying the deployment uses the same registration.
+
+Deployment credentials need `s3:ListBucket` for the legacy bundle prefix in addition to object read/write access.
+Lambda only reads registrations and deployment state; it does not scan legacy objects. The extra registration
+read occurs on cache misses for channel-like suffixes, not every cached request.
+
+### Cache invalidation
+
+S3 notifications watch `deployments/` and `channels/`. Selector registrations, deployment-state updates and cluster
+pointer changes reach the cache-removal Lambda. Registration events clear previously cached legacy/missing-selector
+responses, and the final rollout update invalidates again after both platform uploads succeed.
+
+For `deployments/sample-app/selectors/next.json` or `channels/next/deployments/sample-app/deployment_state`, the paths are:
+
+```text
+/ios/sample-app/*
+/android/sample-app/*
+```
+
+Invalidation covers the affected service across its channels; other services are unaffected. Another channel may
+incur a cache miss but retains its own deployment state and bundle. Cluster changes narrow this to the affected
+cluster. History and bundle uploads do not invalidate selectors. This remains asynchronous; a successful Forge
+command does not mean CloudFront invalidation has finished. See [AWS invalidation path rules](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/invalidation-specifying-objects.html).
+
+### Shared bundles and rollout order
+
+The component bootstraps its prebuilt shared bundle only into the existing unscoped namespace. Publish compatible
+shared and app bundles explicitly to each channel. Routing does not validate bytecode/runtime compatibility or
+make separate shared/app publications atomic.
+
+Install and verify the common Lambda code and S3 notifications before enabling channel URLs in clients. The old
+Lambda interprets the last segment as a filename tag. Wait for selector invalidations before enabling new clients,
+including clearing any responses cached before the infrastructure upgrade. After this one-time upgrade, deploying
+a new channel only writes S3 data; it needs no per-channel infrastructure configuration.
+
+Review the complete Pulumi preview before any future apply: the existing component also manages the legacy
+shared bundle and deployment pointer.
+
 ## Cleaning up
 
 To remove the deployed resources, use:

package/dist/{chunk-ZBT5SDIQ.js → chunk-GEE3OQDP.js}

@@ -15867,16 +15867,66 @@ var S3Client2 = class {
     const response = await this.s3Client.send(command);
     return response;
   }
+  async *listObjectKeys(prefix) {
+    let continuationToken;
+    for (; ; ) {
+      const response = await this.s3Client.send(
+        new ListObjectsV2Command({
+          Bucket: this.bucket,
+          Prefix: prefix,
+          ContinuationToken: continuationToken
+        })
+      );
+      for (const object2 of response.Contents ?? []) {
+        if (object2.Key !== void 0) {
+          yield object2.Key;
+        }
+      }
+      if (!response.IsTruncated) {
+        return;
+      }
+      continuationToken = response.NextContinuationToken;
+      if (!continuationToken) {
+        throw new Error("Truncated S3 listing has no continuation token");
+      }
+    }
+  }
   destroy() {
     this.s3Client.destroy();
   }
 };
+var InvalidRequest3 = class extends Error {
+  constructor(message) {
+    super();
+    this.name = "InvalidRequest";
+    this.message = message;
+  }
+};
+function validateChannel(channel) {
+  if (channel === "bundle") {
+    throw new InvalidRequest3("bundle is reserved for the legacy default bundle");
+  }
+  if (!isChannelName(channel)) {
+    throw new InvalidRequest3(
+      "Channel must contain 1-64 letters, digits, underscores or hyphens, starting with a letter or digit"
+    );
+  }
+  return channel;
+}
+function isChannelName(value) {
+  return typeof value === "string" && value !== "bundle" && /^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$/.test(value);
+}
+function channelPrefix(channel) {
+  return channel === void 0 ? "" : `channels/${validateChannel(channel)}/`;
+}
 var paths = {
-  bundlePathPrefix: (appName, deploymentId) => `bundles/${appName}/${deploymentId}`,
-  bundleList: (appName) => `deployments/${appName}/DEPLOYMENTS`,
-  deploymentState: (appName) => `deployments/${appName}/deployment_state`,
-  clusterDeploymentState: (appName, clusterId) => `deployments/${appName}/clusters/${clusterId}`,
-  clusterDeploymentInfoPath: (appName, clusterId) => `deployments/${appName}/clusters/${clusterId}.deploymentInfo`
+  appBundlePrefix: ({ appName, channel }) => `${channelPrefix(channel)}bundles/${appName}/`,
+  selectorRegistration: ({ appName, selector }) => `deployments/${appName}/selectors/${encodeURIComponent(selector)}.json`,
+  bundlePathPrefix: ({ appName, deploymentId, channel }) => `${channelPrefix(channel)}bundles/${appName}/${deploymentId}`,
+  bundleList: ({ appName, channel }) => `${channelPrefix(channel)}deployments/${appName}/DEPLOYMENTS`,
+  deploymentState: ({ appName, channel }) => `${channelPrefix(channel)}deployments/${appName}/deployment_state`,
+  clusterDeploymentState: ({ appName, clusterId, channel }) => `${channelPrefix(channel)}deployments/${appName}/clusters/${clusterId}`,
+  clusterDeploymentInfoPath: ({ appName, clusterId, channel }) => `${channelPrefix(channel)}deployments/${appName}/clusters/${clusterId}.deploymentInfo`
 };
 function shuffle(arr) {
   const result = arr.slice();
@@ -15991,7 +16041,7 @@ function isFullyRollout(config) {
 }
 async function readBundleList(appName, context) {
   const { s3Client } = context;
-  const data = await s3Client.getObject(paths.bundleList(appName));
+  const data = await s3Client.getObject(paths.bundleList({ appName, channel: context.channel }));
   return JSON.parse(data);
 }
 var store$4;
@@ -16357,8 +16407,8 @@ var clusterDeploymentInfo = /* @__PURE__ */ object({
 var deploymentState = /* @__PURE__ */ union([pendingDeploymentState, stableDeploymentState, canaryDeploymentState]);
 async function readCluster({ appName, clusterId }, context) {
   const { s3Client } = context;
+  const deploymentInfoPath = paths.clusterDeploymentInfoPath({ appName, clusterId, channel: context.channel });
   try {
-    const deploymentInfoPath = paths.clusterDeploymentInfoPath(appName, clusterId);
     const rawData = await s3Client.getObject(deploymentInfoPath);
     const { deploymentId } = parse(clusterDeploymentInfo, JSON.parse(rawData));
     return deploymentId;
@@ -16375,7 +16425,7 @@ var InternalServerError = class extends Error {
 };
 async function readDeploymentState(appName, context) {
   const { s3Client } = context;
-  const deploymentStatePath = paths.deploymentState(appName);
+  const deploymentStatePath = paths.deploymentState({ appName, channel: context.channel });
   try {
     const rawData = await s3Client.getObject(deploymentStatePath);
     const state = parse(deploymentState, JSON.parse(rawData));
@@ -16387,19 +16437,12 @@ async function readDeploymentState(appName, context) {
     throw error;
   }
 }
-function resolveBundle({ appName, platform, deploymentId, tag }) {
-  const bundleUrlPrefix = paths.bundlePathPrefix(appName, deploymentId);
+function resolveBundle({ appName, platform, deploymentId, tag, channel }) {
+  const bundleUrlPrefix = paths.bundlePathPrefix({ appName, deploymentId, channel });
   const extension = "hbc.gz";
   const name = [BUNDLE_BASE_NAME, platform, tag, extension].filter(Boolean).join(".");
   return `${bundleUrlPrefix}/${name}`;
 }
-var InvalidRequest3 = class extends Error {
-  constructor(message) {
-    super();
-    this.name = "InvalidRequest";
-    this.message = message;
-  }
-};
 var NotFoundError = class extends Error {
   constructor(message) {
     super();
@@ -16437,8 +16480,8 @@ async function resolveDeploymentIdByGroupId(appName, numericGroupId, context) {
 }
 async function resolveDeploymentIdByCluster(appName, clusterId, context) {
   const { s3Client } = context;
+  const clusterDeploymentInfoPath = paths.clusterDeploymentInfoPath({ appName, clusterId, channel: context.channel });
   try {
-    const clusterDeploymentInfoPath = paths.clusterDeploymentInfoPath(appName, clusterId);
     const rawData = await s3Client.getObject(clusterDeploymentInfoPath);
     const deploymentInfo = parse(clusterDeploymentInfo, JSON.parse(rawData));
     return deploymentInfo.deploymentId;
@@ -16449,9 +16492,94 @@ async function resolveDeploymentIdByCluster(appName, clusterId, context) {
     throw new InternalServerError("resolveDeploymentIdByCluster", error);
   }
 }
+var registrationSchema = /* @__PURE__ */ object({
+  version: /* @__PURE__ */ literal(1),
+  type: /* @__PURE__ */ union([/* @__PURE__ */ literal("CHANNEL"), /* @__PURE__ */ literal("LEGACY_TAG")])
+});
+function isAppName(appName) {
+  return /^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(appName);
+}
+async function readRegistration(options, { s3Client }) {
+  let raw;
+  try {
+    raw = await s3Client.getObject(paths.selectorRegistration(options));
+  } catch (error) {
+    if (error instanceof NoSuchKey) {
+      return void 0;
+    }
+    throw error;
+  }
+  try {
+    return parse(registrationSchema, JSON.parse(raw));
+  } catch (error) {
+    throw new InternalServerError("Invalid selector registration", error);
+  }
+}
+async function resolveChannel(options, context) {
+  if (!isAppName(options.appName) || !isChannelName(options.selector)) {
+    return void 0;
+  }
+  const registration = await readRegistration(options, context);
+  return registration?.type === "CHANNEL" ? options.selector : void 0;
+}
+async function registerChannel({ appName, channel }, context) {
+  validateChannel(channel);
+  if (!isAppName(appName)) {
+    throw new InvalidRequest3("Channel registration requires a URL-safe application name");
+  }
+  await claimSelector({ appName, selector: channel }, "CHANNEL", context);
+}
+async function reserveLegacyTag(options, context) {
+  if (isAppName(options.appName) && isChannelName(options.selector)) {
+    await claimSelector(options, "LEGACY_TAG", context);
+  }
+}
+async function claimSelector(options, type, context) {
+  const { s3Client } = context;
+  let lastConflict;
+  for (let attempt = 0; attempt < 3; attempt++) {
+    const existing = await readRegistration(options, context);
+    if (existing !== void 0) {
+      if (existing.type !== type) {
+        throw new InvalidRequest3(
+          `Selector ${options.selector} for ${options.appName} is already reserved as ${existing.type}`
+        );
+      }
+      return;
+    }
+    if (type === "CHANNEL") {
+      const prefix = paths.appBundlePrefix({ appName: options.appName });
+      for await (const key of s3Client.listObjectKeys(prefix)) {
+        if (["ios", "android"].some((platform) => key.endsWith(`/bundle.${platform}.${options.selector}.hbc.gz`))) {
+          throw new InvalidRequest3(
+            `Channel ${options.selector} conflicts with an existing legacy bundle tag for ${options.appName}`
+          );
+        }
+      }
+    }
+    try {
+      await s3Client.putObject(paths.selectorRegistration(options), {
+        Body: JSON.stringify({ version: 1, type }),
+        ContentType: "application/json",
+        CacheControl: "no-store",
+        IfNoneMatch: "*"
+      });
+      return;
+    } catch (error) {
+      if (!(error instanceof S3ServiceException) || ![409, 412].includes(error.$metadata.httpStatusCode ?? 0)) {
+        throw error;
+      }
+      lastConflict = error;
+    }
+  }
+  throw new InternalServerError("Concurrent selector registration could not be completed", lastConflict);
+}
 async function rollout({ state, appName }, context) {
   const { s3Client } = context;
-  await s3Client.putObject(paths.deploymentState(appName), {
+  if (context.channel !== void 0) {
+    await registerChannel({ appName, channel: context.channel }, context);
+  }
+  await s3Client.putObject(paths.deploymentState({ appName, channel: context.channel }), {
     Body: JSON.stringify(state),
     ContentType: "application/json"
   });
@@ -16459,14 +16587,17 @@ async function rollout({ state, appName }, context) {
 }
 async function rolloutCluster({ appName, deploymentId, clusterId }, context) {
   const { s3Client } = context;
-  await s3Client.putObject(paths.clusterDeploymentState(appName, clusterId), {
+  if (context.channel !== void 0) {
+    await registerChannel({ appName, channel: context.channel }, context);
+  }
+  await s3Client.putObject(paths.clusterDeploymentInfoPath({ appName, clusterId, channel: context.channel }), {
     Body: JSON.stringify({ deploymentId }),
     ContentType: "application/json"
   });
 }
 async function writeBundleList(appName, deploymentInfo, context) {
   const { s3Client } = context;
-  await s3Client.putObject(paths.bundleList(appName), {
+  await s3Client.putObject(paths.bundleList({ appName, channel: context.channel }), {
     Body: JSON.stringify(deploymentInfo.slice(0, MAX_HISTORY_COUNT)),
     ContentType: "application/json"
   });
@@ -16491,7 +16622,12 @@ function toDeployedAtString(date) {
 }
 async function uploadBundle({ bundlePath, appName, deploymentId, deployedAt, platform, tag }, context) {
   const { s3Client } = context;
-  const bundlePathKey = resolveBundle({ appName, platform, deploymentId, tag });
+  const bundlePathKey = resolveBundle({ appName, platform, deploymentId, tag, channel: context.channel });
+  if (context.channel !== void 0) {
+    await registerChannel({ appName, channel: context.channel }, context);
+  } else if (tag) {
+    await reserveLegacyTag({ appName, selector: tag }, context);
+  }
   await s3Client.putObject(bundlePathKey, {
     Body: fs.createReadStream(bundlePath),
     Metadata: {
@@ -16508,6 +16644,8 @@ async function uploadBundle({ bundlePath, appName, deploymentId, deployedAt, pla
   return { bundlePathKey, deploymentInfo };
 }
 var DeployManager = {
+  registerChannel,
+  resolveChannel,
   planRollout,
   rollout,
   rolloutCluster,
@@ -16521,8 +16659,10 @@ var DeployManager = {
 };
 
 export {
+  NoSuchKey,
   S3Client2,
   InvalidRequest3,
+  validateChannel,
   NotFoundError,
   DeployManager
 };

package/dist/index.cjs

@@ -1982,6 +1982,11 @@ var ReactNativeBundleCDN = class extends pulumi.ComponentResource {
             events: ["s3:ObjectCreated:*", "s3:ObjectRemoved:*"],
             filterPrefix: "deployments/"
             // Only trigger for objects in deployments/ folder
+          },
+          {
+            lambdaFunctionArn: cacheInvalidationLambda.arn,
+            events: ["s3:ObjectCreated:*", "s3:ObjectRemoved:*"],
+            filterPrefix: "channels/"
           }
         ]
       },

package/dist/index.js

@@ -1983,6 +1983,11 @@ var ReactNativeBundleCDN = class extends pulumi.ComponentResource {
             events: ["s3:ObjectCreated:*", "s3:ObjectRemoved:*"],
             filterPrefix: "deployments/"
             // Only trigger for objects in deployments/ folder
+          },
+          {
+            lambdaFunctionArn: cacheInvalidationLambda.arn,
+            events: ["s3:ObjectCreated:*", "s3:ObjectRemoved:*"],
+            filterPrefix: "channels/"
           }
         ]
       },