@m8t-stack/cli 0.2.63 → 0.2.64

package/dist/cli.js

@@ -1364,7 +1364,7 @@ var init_enable_hosted_brain = __esm({
 import { Builtins, Cli } from "clipanion";
 
 // src/lib/package-version.ts
-var CLI_VERSION = "0.2.63";
+var CLI_VERSION = "0.2.64";
 
 // src/lib/render-error.ts
 init_errors();
@@ -19006,15 +19006,35 @@ import { DefaultAzureCredential as DefaultAzureCredential16 } from "@azure/ident
 init_errors();
 var DEFAULT_IMAGE_REPO = "ghcr.io/m8t-labs/m8t";
 function parseImageRef2(ref) {
-  const lastColon = ref.lastIndexOf(":");
-  const lastSlash = ref.lastIndexOf("/");
-  let name = ref;
+  let rest = ref;
+  let digest;
+  const at = rest.lastIndexOf("@");
+  if (at !== -1) {
+    digest = rest.slice(at + 1) || void 0;
+    rest = rest.slice(0, at);
+  }
+  const lastColon = rest.lastIndexOf(":");
+  const lastSlash = rest.lastIndexOf("/");
+  let name = rest;
   let tag;
   if (lastColon > lastSlash) {
-    name = ref.slice(0, lastColon);
-    tag = ref.slice(lastColon + 1) || void 0;
+    name = rest.slice(0, lastColon);
+    tag = rest.slice(lastColon + 1) || void 0;
   }
-  return { registry: name.split("/")[0], repo: name, tag };
+  return { registry: name.split("/")[0], repo: name, tag, digest };
+}
+function assertGatewayDigest(c) {
+  if (!c.digest?.startsWith("sha256:")) {
+    throw new LocalCliError({
+      code: "PLATFORM_GATEWAY_DIGEST_MISSING",
+      message: `The release manifest's gateway pin (${c.ref}:${c.tag}) carries no usable image digest.`,
+      hint: "Re-fetch the release channel, or target a release whose manifest pins a gateway digest. Deploying by tag instead is not offered: a mutable tag cannot establish which bytes run."
+    });
+  }
+  return c.digest;
+}
+function gatewayRefFromComponent(c) {
+  return `${c.ref}@${assertGatewayDigest(c)}`;
 }
 var SEMVER_TAG = /^v(\d+)\.(\d+)\.(\d+)$/;
 function isSemverTag(tag) {
@@ -19058,7 +19078,7 @@ function parseContainerAppResourceId(id) {
 }
 function planUpdate(opts) {
   const cur = parseImageRef2(opts.currentImage);
-  const currentTag = cur.tag ?? "(none)";
+  const currentTag = cur.tag ?? cur.digest ?? "(none)";
   if (cur.repo !== opts.imageRepo) {
     return { kind: "refuse-byoc", current: currentTag, currentRepo: cur.repo, trackedRepo: opts.imageRepo };
   }
@@ -19067,6 +19087,9 @@ function planUpdate(opts) {
   }
   const available = opts.to ?? pickNewestSemver(opts.availableTags);
   if (!available) return { kind: "no-versions", current: currentTag };
+  if (cur.digest && opts.toDigest && cur.digest === opts.toDigest) {
+    return { kind: "noop", current: currentTag, available };
+  }
   if (cur.tag === available) return { kind: "noop", current: currentTag, available };
   if (!opts.to) {
     const currentIsSemver = cur.tag ? isSemverTag(cur.tag) : false;
@@ -20057,14 +20080,14 @@ async function applyGatewayImage(a, ctx, gatewayResourceId) {
   const { resourceGroup, name } = parseContainerAppResourceId(gatewayResourceId);
   const current = (await runAz(["containerapp", "show", "-g", resourceGroup, "-n", name, "--query", "properties.template.containers[0].image", "-o", "tsv"])).trim();
   const tags = await fetchPublicTags(DEFAULT_IMAGE_REPO);
-  const plan = planUpdate({ currentImage: current, availableTags: tags, imageRepo: DEFAULT_IMAGE_REPO, to: a.to });
   const digest = ctx.manifest.components.gateway.digest;
+  const plan = planUpdate({ currentImage: current, availableTags: tags, imageRepo: DEFAULT_IMAGE_REPO, to: a.to, toDigest: digest });
   switch (plan.kind) {
     case "refuse-byoc":
       ctx.onProgress?.(`gateway is BYOC (${plan.currentRepo}) \u2014 marking externally managed.`);
       return { tag: a.to, digest, state: "external" };
     case "roll":
-      await runAz(["containerapp", "update", "-n", name, "-g", resourceGroup, "--image", `${plan.repo}:${plan.target}`]);
+      await runAz(["containerapp", "update", "-n", name, "-g", resourceGroup, "--image", `${plan.repo}@${assertGatewayDigest(ctx.manifest.components.gateway)}`]);
       return { tag: a.to, digest, state: "managed" };
     case "noop":
       return { tag: a.to, digest, state: "managed" };
@@ -20107,7 +20130,7 @@ async function resolveBicepParamsForConverge(ctx, opts = {}) {
   const location = opts.location ?? (await runAz(["resource", "list", "-g", ctx.resourceGroup, "--query", "[0].location", "-o", "tsv"])).trim();
   const foundryResourceId = await resolveFoundryResourceId(opts.foundryEndpoint ?? "", opts.foundryResourceId);
   const acrPullIdentityResourceId = resolveAcrPullIdentity({ explicit: opts.acrPullIdentity });
-  const imageRef = `${ctx.manifest.components.gateway.ref}:${ctx.manifest.components.gateway.tag}`;
+  const imageRef = gatewayRefFromComponent(ctx.manifest.components.gateway);
   const acrResourceId = await resolveAcrResourceId({ imageRef, explicit: opts.acrResourceId });
   return {
     location,
@@ -20243,6 +20266,57 @@ async function applyPersona(a, ctx, opts) {
   return { treeSha: a.to, foundryVersion };
 }
 
+// src/lib/gateway-verify.ts
+function compareGatewayBinding(args) {
+  const base = { stampTag: args.stampTag, stampDigest: args.stampDigest };
+  if (!args.liveImage) {
+    return { ...base, live: { kind: "unread" }, comparedBy: "none", match: "unknown" };
+  }
+  const parsed = parseImageRef2(args.liveImage);
+  if (parsed.digest) {
+    const comparable = Boolean(args.stampDigest);
+    return {
+      ...base,
+      live: { kind: "digest", digest: parsed.digest },
+      comparedBy: comparable ? "digest" : "none",
+      match: comparable ? parsed.digest === args.stampDigest : "unknown"
+    };
+  }
+  if (parsed.tag) {
+    const comparable = args.stampTag !== "unknown" && args.stampTag !== "";
+    return {
+      ...base,
+      live: { kind: "tag", tag: parsed.tag },
+      comparedBy: comparable ? "tag" : "none",
+      match: comparable ? parsed.tag === args.stampTag : "unknown"
+    };
+  }
+  return { ...base, live: { kind: "unread" }, comparedBy: "none", match: "unknown" };
+}
+var LABEL = (s) => `  ${s}`.padEnd(22, " ");
+function renderLiveVerify(v, apiVersion, fmt2 = { ok: (s) => s, warn: (s) => s }) {
+  const stamp = v.stampDigest ? `${v.stampTag} \xB7 ${v.stampDigest}` : v.stampTag;
+  let live;
+  switch (v.live.kind) {
+    case "digest":
+      live = v.live.digest;
+      break;
+    case "tag":
+      live = `${v.live.tag}  (tag-pinned \u2014 bytes not verified)`;
+      break;
+    default:
+      live = "unknown";
+  }
+  const verdict = v.match === "unknown" ? fmt2.warn("unknown") : v.match ? fmt2.ok("yes") : fmt2.warn("no");
+  const how = v.comparedBy === "none" ? "" : `  (compared by ${v.comparedBy})`;
+  return [
+    `${LABEL("stamp gateway:")}${stamp}`,
+    `${LABEL("live gateway:")}${live}`,
+    `${LABEL("match:")}${verdict}${how}`,
+    `${LABEL("/api/version:")}${apiVersion}`
+  ];
+}
+
 // src/commands/platform/status.ts
 var PlatformStatusCommand = class extends M8tCommand {
   static paths = [["platform", "status"]];
@@ -20298,7 +20372,12 @@ var PlatformStatusCommand = class extends M8tCommand {
     const rows = statusRows(manifest, stamp, tree);
     let verify;
     if (this.verify) {
-      verify = await this.probeLive(gw.containerAppResourceId, gw.gatewayUrl, stamp?.components.gateway.tag);
+      verify = await this.probeLive(
+        gw.containerAppResourceId,
+        gw.gatewayUrl,
+        stamp?.components.gateway.tag,
+        stamp?.components.gateway.digest
+      );
     }
     if (mode === "json") {
       this.context.stdout.write(
@@ -20318,12 +20397,7 @@ var PlatformStatusCommand = class extends M8tCommand {
     if (verify) {
       log("");
       log(colors.field("live verify:"));
-      log(`  stamp gateway tag:  ${verify.stampGatewayTag}`);
-      log(`  live gateway tag:   ${verify.liveGatewayTag}`);
-      log(
-        `  match:               ${verify.gatewayTagMatch === "unknown" ? colors.warn("unknown") : verify.gatewayTagMatch ? colors.success("yes") : colors.warn("no")}`
-      );
-      log(`  /api/version:        ${verify.apiVersion}`);
+      for (const line2 of renderLiveVerify(verify.gateway, verify.apiVersion, { ok: colors.success, warn: colors.warn })) log(line2);
     }
     return 0;
   }
@@ -20347,11 +20421,11 @@ var PlatformStatusCommand = class extends M8tCommand {
    * error, etc.) degrades the affected field to "unknown" rather than
    * throwing — a verify probe must never crash the read-only status command.
    */
-  async probeLive(gatewayResourceId, gatewayUrl, stampGatewayTag) {
-    let liveGatewayTag = "unknown";
+  async probeLive(gatewayResourceId, gatewayUrl, stampGatewayTag, stampGatewayDigest) {
+    let liveImage;
     try {
       const { resourceGroup, name } = parseContainerAppResourceId(gatewayResourceId);
-      const image = (await runAz([
+      liveImage = (await runAz([
         "containerapp",
         "show",
         "-g",
@@ -20362,11 +20436,9 @@ var PlatformStatusCommand = class extends M8tCommand {
         "properties.template.containers[0].image",
         "-o",
         "tsv"
-      ])).trim();
-      const tag = image.split(":").pop();
-      if (tag) liveGatewayTag = tag;
+      ])).trim() || void 0;
     } catch {
-      liveGatewayTag = "unknown";
+      liveImage = void 0;
     }
     let apiVersion = "unknown";
     try {
@@ -20380,9 +20452,17 @@ var PlatformStatusCommand = class extends M8tCommand {
     } catch {
       apiVersion = "unknown";
     }
-    const stampTag = stampGatewayTag ?? "unknown";
-    const gatewayTagMatch = liveGatewayTag === "unknown" || stampTag === "unknown" ? "unknown" : liveGatewayTag === stampTag;
-    return { liveGatewayTag, stampGatewayTag: stampTag, gatewayTagMatch, apiVersion };
+    return {
+      gateway: compareGatewayBinding({
+        stampTag: stampGatewayTag ?? "unknown",
+        // A stamp records "" for a component whose digest it never established, so
+        // empty and absent are the SAME claim here. `??` would preserve "" and let a
+        // caller treat it as a recorded value.
+        stampDigest: stampGatewayDigest === "" ? void 0 : stampGatewayDigest,
+        liveImage
+      }),
+      apiVersion
+    };
   }
 };
 
@@ -20973,7 +21053,7 @@ async function buildConvergeDeps(args) {
           ...existing,
           bicep: {
             ...existing.bicep,
-            imageRef: `${ctx.manifest.components.gateway.ref}:${ctx.manifest.components.gateway.tag}`
+            imageRef: gatewayRefFromComponent(ctx.manifest.components.gateway)
           },
           updatedAt: (/* @__PURE__ */ new Date()).toISOString()
         }
@@ -28986,7 +29066,7 @@ ${colors.error("\u2717")} The GitHub App on disk is installed on ${colors.field(
 // src/commands/bootstrap/launch.ts
 var DEFAULT_RG = "rg-m8t-stack";
 var DEFAULT_INSTALLER = "ghcr.io/m8t-labs/m8t-installer";
-var DEFAULT_INSTALLER_TAG = "v0.1.53";
+var DEFAULT_INSTALLER_TAG = "v0.1.55";
 var ACI_NAME = "m8t-installer";
 var MI_NAME = "m8t-installer-mi";
 var BootstrapLaunchCommand = class extends M8tCommand {