@magland/mochi 0.3.1 → 0.4.1

package/dist/deploy-runner-cli.js

@@ -43,6 +43,7 @@ const cli_api_1 = require("./cli-api");
 const cli_api_2 = require("./cli-api");
 const wake_1 = require("./ci/wake");
 const deploy_cli_1 = require("./deploy-cli");
+const runners_1 = require("./ci/runners");
 const scan_1 = require("./scan");
 // `mochi deploy fly runner`: put a workflow runner on Fly.io, beside a
 // vault that is already there or anywhere else.
@@ -81,12 +82,14 @@ function parseArgs(args, usage) {
         name: null,
         allow: [],
         labels: [],
+        jobTimeout: null,
         region: null,
         volumeGb: null,
         vmSize: null,
         memory: null,
         idle: null,
         image: null,
+        imageOnly: false,
         fromSource: false,
         localBuild: false,
         org: null,
@@ -105,6 +108,16 @@ function parseArgs(args, usage) {
             out.allow.push(...list(args[++i] ?? ''));
         else if (a === '--labels' || a === '--label')
             out.labels.push(...list(args[++i] ?? ''));
+        else if (a === '--job-timeout') {
+            const raw = (args[++i] ?? '').trim();
+            const m = /^(\d+)\s*(m|h)?$/i.exec(raw);
+            if (!m)
+                (0, deploy_cli_1.die)('--job-timeout takes minutes, or a duration like 45m or 2h');
+            const n = parseInt(m[1], 10) * ((m[2] ?? 'm').toLowerCase() === 'h' ? 60 : 1);
+            if (!(0, runners_1.isUsableJobTimeout)(n))
+                (0, deploy_cli_1.die)(`--job-timeout takes 1 to ${runners_1.MAX_JOB_TIMEOUT_MINUTES} minutes`);
+            out.jobTimeout = n;
+        }
         else if (a === '--region')
             out.region = args[++i];
         else if (a === '--volume') {
@@ -121,6 +134,8 @@ function parseArgs(args, usage) {
             out.idle = args[++i];
         else if (a === '--image')
             out.image = args[++i];
+        else if (a === '--image-only')
+            out.imageOnly = true;
         else if (a === '--from-source')
             out.fromSource = true;
         else if (a === '--local-build')
@@ -161,6 +176,7 @@ function rejectShapingFlags(a, usage, allowYes) {
         ['--vm-memory', a.memory !== null],
         ['--idle', a.idle !== null],
         ['--image', a.image !== null],
+        ['--image-only', a.imageOnly],
         ['--from-source', a.fromSource],
         ['--local-build', a.localBuild],
         ['--org', a.org !== null],
@@ -188,7 +204,8 @@ async function liveSettings(app) {
         out.region = vol.region;
         out.volumeGb = vol.size_gb;
     }
-    const guest = (await (0, deploy_cli_1.machines)(app)).find((m) => m.config?.guest)?.config?.guest;
+    const config = (await (0, deploy_cli_1.machines)(app)).find((m) => m.config)?.config;
+    const guest = config?.guest;
     if (guest) {
         if (guest.cpu_kind)
             out.cpuKind = guest.cpu_kind;
@@ -197,6 +214,11 @@ async function liveSettings(app) {
         if (guest.memory_mb)
             out.memory = `${guest.memory_mb}mb`;
     }
+    // The machine's own idle timeout, so a redeploy keeps a tuned --idle rather
+    // than quietly resetting it to the default.
+    const idle = config?.env?.MOCHI_IDLE;
+    if (idle)
+        out.idle = idle;
     return out;
 }
 function resolveSettings(a, live) {
@@ -269,6 +291,60 @@ async function registeredRunners(target) {
     const data = await (0, cli_api_1.api)(target, 'GET', '/api/runners');
     return (data.runners ?? []) ?? [];
 }
+/**
+ * The fly deploy itself, shared by the full deploy and --image-only. Exits
+ * the process on failure, after saying what to try.
+ */
+async function flyDeploy(app, a, settings, buildRoot, image) {
+    const config = writeTempConfig(app, settings);
+    if (buildRoot !== null) {
+        console.log(`==> Building ${buildRoot} ${a.localBuild ? 'with the local Docker' : "on Fly's builder"}`);
+    }
+    else {
+        console.log(`==> Deploying ${image}`);
+    }
+    const code = await (0, deploy_cli_1.flyStream)([
+        'deploy',
+        '--app',
+        app,
+        '--config',
+        config,
+        ...(buildRoot !== null
+            ? ['--dockerfile', path.join(buildRoot, 'Dockerfile.runner'), ...(a.localBuild ? ['--local-only'] : [])]
+            : ['--image', image]),
+        '--ha=false',
+        '--yes',
+    ], buildRoot ?? undefined);
+    fs.rmSync(path.dirname(config), { recursive: true, force: true });
+    if (code !== 0) {
+        console.error('');
+        console.error('The deploy failed. The app, the volume, and the registration survive, so fix the');
+        console.error('cause and run the same command again.');
+        if (buildRoot === null && a.image === null) {
+            // Named as the likely cause rather than as one possibility among many,
+            // because it is the one every early deploy hits: the runner image is
+            // published per release like the vault's, so a version of the CLI newer
+            // than the newest release has no image to pull. Fly reports a package
+            // that is absent, and one that is private, with the same message about
+            // authentication, and a package newly published to GHCR is private
+            // until someone says otherwise.
+            console.error('');
+            console.error(`If Fly could not fetch ${image}:`);
+            console.error('');
+            console.error('  - It may not be published. The runner image is built per release, so a CLI');
+            console.error('    newer than the newest release asks for a tag that does not exist yet.');
+            console.error('  - It may be private. A package newly published to GHCR is private until it');
+            console.error('    is made public, and Fly reports that as an authentication error too.');
+            console.error('');
+            console.error('Either way, this deploys the checkout you are running instead:');
+            console.error('');
+            console.error(`  mochi deploy fly runner ${app} --from-source`);
+            console.error('');
+            console.error('or --image <ref> deploys some other tag.');
+        }
+        process.exit(1);
+    }
+}
 async function deployFlyRunnerCmd(args, usage) {
     const a = parseArgs(args, usage);
     if (!a.app) {
@@ -292,6 +368,46 @@ async function deployFlyRunnerCmd(args, usage) {
     }
     const buildRoot = a.fromSource ? (0, deploy_cli_1.sourceRoot)() : null;
     const image = buildRoot === null ? a.image ?? `${RUNNER_IMAGE_REPO}:${(0, deploy_cli_1.ownVersion)()}` : null;
+    if (image !== null && a.image === null)
+        await (0, deploy_cli_1.requirePublishedImage)(image, true);
+    // --image-only: move the machine to a new image and touch nothing else (no
+    // registration, no token, no wake rewrite, no secret staging), so it needs
+    // flyctl and no vault login. That is the shape a pipeline wants: the runner
+    // image is built beside the vault's, a runner and the vault it serves speak
+    // one protocol, and a job holding only a Fly credential can do exactly this
+    // much and no more.
+    if (a.imageOnly) {
+        if (a.allow.length > 0 || a.labels.length > 0) {
+            (0, deploy_cli_1.die)(`${a.allow.length > 0 ? '--allow' : '--labels'} changes the registration, which lives in the vault, and --image-only\n` +
+                'deploys without touching the vault. Drop one or the other.');
+        }
+        await (0, deploy_cli_1.requireFly)();
+        if (!(await (0, deploy_cli_1.appExists)(app))) {
+            (0, deploy_cli_1.die)(`No Fly app named '${app}' that you can see, and --image-only updates one that\n` +
+                'already exists. The full deploy creates it:\n\n' +
+                `  mochi deploy fly runner ${app} --allow '<globs>'\n`);
+        }
+        const have = await (0, deploy_cli_1.secretNames)(app);
+        const missing = [HOST_SECRET, TOKEN_SECRET, WAKE_SECRET].filter((n) => !have.includes(n));
+        if (missing.length > 0) {
+            (0, deploy_cli_1.die)(`The app is missing ${missing.join(', ')}, so the machine deployed\n` +
+                'here could not serve any vault. The full deploy sets them:\n\n' +
+                `  mochi deploy fly runner ${app}\n`);
+        }
+        if (!(await (0, deploy_cli_1.namedVolume)(app, VOLUME_NAME))) {
+            (0, deploy_cli_1.die)(`The app has no '${VOLUME_NAME}' volume. The full deploy creates it:\n\n  mochi deploy fly runner ${app}\n`);
+        }
+        const settings = resolveSettings(a, await liveSettings(app));
+        console.log(`==> Updating '${app}' (${(0, deploy_cli_1.appUrl)(app)}), touching nothing but the machine`);
+        await flyDeploy(app, a, settings, buildRoot, image);
+        console.log('');
+        console.log(`==> Deployed: ${(0, deploy_cli_1.appUrl)(app)}`);
+        console.log('');
+        console.log('The registration, the runner token, and the wake address were left as they');
+        console.log(`were. It stops after ${settings.idle} with no job, and the vault starts it again`);
+        console.log('when one is waiting.');
+        return;
+    }
     // The vault first: a runner with no vault to serve is nothing, and finding
     // out that the login is missing after creating a Fly app would be a poor
     // trade. This is the same login every other admin command uses.
@@ -379,6 +495,7 @@ async function deployFlyRunnerCmd(args, usage) {
             name,
             labels: a.labels.length ? a.labels : ['ubuntu-latest'],
             allow: a.allow,
+            ...(a.jobTimeout === null ? {} : { jobTimeoutMinutes: a.jobTimeout }),
             wakeUrl: wake.url,
             wakeSecret: wake.secret,
         });
@@ -391,6 +508,12 @@ async function deployFlyRunnerCmd(args, usage) {
         const data = await (0, cli_api_1.api)(target, 'POST', `/api/runners/${encodeURIComponent(name)}/token`, {});
         runnerToken = data.token;
     }
+    // A timeout named by a flag applies to a runner that was already registered
+    // too, on the terms the rest of this command sets: a flag changes the thing
+    // it names, and a setting left unnamed keeps whatever the vault has.
+    if (a.jobTimeout !== null && registered) {
+        await (0, cli_api_1.api)(target, 'PATCH', `/api/runners/${encodeURIComponent(name)}`, { jobTimeoutMinutes: a.jobTimeout });
+    }
     // The wake address is rewritten on every deploy, not only on the first. The
     // secret is this run's, and the app it points at is this app; a redeploy
     // that left an older secret in place would leave the vault sending one the
@@ -409,54 +532,7 @@ async function deployFlyRunnerCmd(args, usage) {
     const set = await (0, deploy_cli_1.fly)(['secrets', 'import', '-a', app, '--stage'], staged.join('\n') + '\n');
     if (set.code !== 0)
         (0, deploy_cli_1.die)(`Could not set the secrets:\n${set.stderr.trim() || set.stdout.trim()}`);
-    const config = writeTempConfig(app, settings);
-    if (buildRoot !== null) {
-        console.log(`==> Building ${buildRoot} ${a.localBuild ? 'with the local Docker' : "on Fly's builder"}`);
-    }
-    else {
-        console.log(`==> Deploying ${image}`);
-    }
-    const code = await (0, deploy_cli_1.flyStream)([
-        'deploy',
-        '--app',
-        app,
-        '--config',
-        config,
-        ...(buildRoot !== null
-            ? ['--dockerfile', path.join(buildRoot, 'Dockerfile.runner'), ...(a.localBuild ? ['--local-only'] : [])]
-            : ['--image', image]),
-        '--ha=false',
-        '--yes',
-    ], buildRoot ?? undefined);
-    fs.rmSync(path.dirname(config), { recursive: true, force: true });
-    if (code !== 0) {
-        console.error('');
-        console.error('The deploy failed. The app, the volume, and the registration survive, so fix the');
-        console.error('cause and run the same command again.');
-        if (buildRoot === null && a.image === null) {
-            // Named as the likely cause rather than as one possibility among many,
-            // because it is the one every early deploy hits: the runner image is
-            // published per release like the vault's, so a version of the CLI newer
-            // than the newest release has no image to pull. Fly reports a package
-            // that is absent, and one that is private, with the same message about
-            // authentication, and a package newly published to GHCR is private
-            // until someone says otherwise.
-            console.error('');
-            console.error(`If Fly could not fetch ${image}:`);
-            console.error('');
-            console.error('  - It may not be published. The runner image is built per release, so a CLI');
-            console.error('    newer than the newest release asks for a tag that does not exist yet.');
-            console.error('  - It may be private. A package newly published to GHCR is private until it');
-            console.error('    is made public, and Fly reports that as an authentication error too.');
-            console.error('');
-            console.error('Either way, this deploys the checkout you are running instead:');
-            console.error('');
-            console.error(`  mochi deploy fly runner ${app} --from-source`);
-            console.error('');
-            console.error('or --image <ref> deploys some other tag.');
-        }
-        process.exit(1);
-    }
+    await flyDeploy(app, a, settings, buildRoot, image);
     // A machine is started by the deploy and will stop itself once it has been
     // idle for the configured time. Saying so is worth a line, because a
     // `deploy fly` that ends with a stopped machine looks like a failure to

package/dist/domains.js

@@ -0,0 +1,259 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DOMAINS_FILE = void 0;
+exports.domainsFilePath = domainsFilePath;
+exports.loadDomains = loadDomains;
+exports.domainRepoFor = domainRepoFor;
+exports.repoDomain = repoDomain;
+exports.isSiteRequest = isSiteRequest;
+exports.setRepoDomain = setRepoDomain;
+exports.clearRepoDomain = clearRepoDomain;
+exports.moveRepoDomains = moveRepoDomains;
+exports.moveCollectionDomains = moveCollectionDomains;
+exports.dropRepoDomains = dropRepoDomains;
+exports.dropCollectionDomains = dropCollectionDomains;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const atomic_1 = require("./atomic");
+const config_1 = require("./config");
+const filecache_1 = require("./filecache");
+const scan_1 = require("./scan");
+const siteshost_1 = require("./siteshost");
+// Custom domains for repository sites, in <vault>/domains.json beside
+// config.json: a map from a hostname the operator points at the vault to the
+// `<collection>/<repo>` whose site answers there.
+//
+// Vault state rather than repository state, deliberately. The server decides
+// per request whether a Host header names a site, so the answer has to come
+// from one stat-cached file the way config.json does, not from a scan of every
+// repository. It also matches who may write it: attaching a hostname is the
+// operator's act, since the operator is who points DNS at the vault, covers
+// the name with a certificate, and answers for what the server serves under
+// it. A repository admin enables the site and may pick a label on the sites
+// host; a custom domain takes a site admin, through the API or the CLI, and
+// the file is hand-editable like everything else in a vault.
+//
+// One domain maps to one repository, and each repository holds at most one
+// domain: setRepoDomain replaces whatever the repository had. A domain equal
+// to the sites host, or under it, is refused, since those names already have a
+// meaning; nothing can check the forge's own hostname, which the server never
+// knows, so mapping that is the one mistake this cannot catch and the
+// documentation warns about.
+exports.DOMAINS_FILE = 'domains.json';
+function domainsFilePath(root) {
+    return path.join(root, exports.DOMAINS_FILE);
+}
+function normalize(parsed) {
+    const out = {};
+    if (typeof parsed !== 'object' || parsed === null)
+        return out;
+    const domains = parsed.domains;
+    if (typeof domains !== 'object' || domains === null)
+        return out;
+    for (const [rawHost, target] of Object.entries(domains)) {
+        const host = (0, siteshost_1.normalizeHostname)(rawHost);
+        if (!(0, config_1.isPlausibleHostname)(host) || typeof target !== 'string')
+            continue;
+        const slash = target.indexOf('/');
+        if (slash <= 0)
+            continue;
+        const collection = target.slice(0, slash);
+        const repo = target.slice(slash + 1);
+        if (!(0, scan_1.isValidName)(collection) || !(0, scan_1.isValidName)(repo))
+            continue;
+        out[host] = `${collection}/${repo}`;
+    }
+    return out;
+}
+const EMPTY = {};
+const cache = (0, filecache_1.fileCache)({
+    read: (file) => {
+        try {
+            return normalize(JSON.parse(fs.readFileSync(file, 'utf8')));
+        }
+        catch (e) {
+            // A file that cannot be read maps nothing: the custom domains stop
+            // answering rather than answering wrongly, and the forge is unaffected.
+            console.error(`domains.json could not be read: ${e instanceof Error ? e.message : e}`);
+            return EMPTY;
+        }
+    },
+    missing: () => EMPTY,
+});
+/** Every custom domain, as hostname -> `<collection>/<repo>`. */
+function loadDomains(root) {
+    return cache.get(domainsFilePath(root));
+}
+/** The repository whose custom domain this hostname is, or null. */
+function domainRepoFor(root, hostname) {
+    const target = loadDomains(root)[(0, siteshost_1.normalizeHostname)(hostname)];
+    if (target === undefined)
+        return null;
+    const slash = target.indexOf('/');
+    return { collection: target.slice(0, slash), repo: target.slice(slash + 1) };
+}
+/** The custom domain a repository holds, or null. */
+function repoDomain(root, collection, repo) {
+    const full = `${collection}/${repo}`;
+    for (const [host, target] of Object.entries(loadDomains(root))) {
+        if (target === full)
+            return host;
+    }
+    return null;
+}
+/**
+ * Whether a request's hostname is a site rather than the forge: under the
+ * sites host, or a custom domain. This is the question the session, the rate
+ * exemptions, and the egress exemptions each ask, so it is one function; on a
+ * hostname it answers true for, no session is resolved and no path is exempt
+ * from any limit, because every path there belongs to the site being served.
+ */
+function isSiteRequest(root, hostname) {
+    if ((0, siteshost_1.isUnderSitesHost)((0, config_1.loadConfig)(root).sites.host, hostname))
+        return true;
+    return loadDomains(root)[(0, siteshost_1.normalizeHostname)(hostname)] !== undefined;
+}
+function write(root, domains) {
+    const file = domainsFilePath(root);
+    if (Object.keys(domains).length === 0) {
+        // Nothing mapped, so nothing on disk, the same way redirects.json goes.
+        fs.rmSync(file, { force: true });
+    }
+    else {
+        (0, atomic_1.writeFileAtomic)(file, JSON.stringify({ domains }, null, 2) + '\n');
+    }
+    cache.invalidate(file);
+}
+function edit(root, fn) {
+    const file = domainsFilePath(root);
+    (0, atomic_1.withFileLock)(`${file}.lock`, () => {
+        cache.invalidate(file);
+        const domains = { ...loadDomains(root) };
+        fn(domains);
+        write(root, domains);
+    });
+}
+/**
+ * Attach a domain to a repository, replacing any domain the repository already
+ * held. Returns the problem, or null on success; the kind tells a surface
+ * whether the caller's value was wrong or merely taken, so each words its own
+ * refusal with the right status.
+ */
+function setRepoDomain(root, collection, repo, domain) {
+    const host = (0, siteshost_1.normalizeHostname)(domain);
+    if (!(0, config_1.isPlausibleHostname)(host)) {
+        return { kind: 'invalid', message: 'a domain is a hostname of at least two labels, like docs.example.org' };
+    }
+    const sitesHost = (0, config_1.loadConfig)(root).sites.host;
+    if (sitesHost && (host === sitesHost || host.endsWith(`.${sitesHost}`))) {
+        return {
+            kind: 'invalid',
+            message: `a name under the sites host ${sitesHost} already has a meaning; use the repository's site label instead`,
+        };
+    }
+    const full = `${collection}/${repo}`;
+    let conflict = null;
+    edit(root, (domains) => {
+        const holder = domains[host];
+        if (holder !== undefined && holder !== full) {
+            conflict = holder;
+            return;
+        }
+        for (const [h, target] of Object.entries(domains)) {
+            if (target === full)
+                delete domains[h];
+        }
+        domains[host] = full;
+    });
+    return conflict ? { kind: 'conflict', message: `${host} already serves the site of ${conflict}` } : null;
+}
+/** Detach whatever domain a repository holds; holding none is fine. */
+function clearRepoDomain(root, collection, repo) {
+    const full = `${collection}/${repo}`;
+    if (repoDomain(root, collection, repo) === null)
+        return;
+    edit(root, (domains) => {
+        for (const [host, target] of Object.entries(domains)) {
+            if (target === full)
+                delete domains[host];
+        }
+    });
+}
+/** A repository moved; its domain, if any, follows it. Called by renameRepo. */
+function moveRepoDomains(root, collection, repo, toCollection, toName) {
+    const from = `${collection}/${repo}`;
+    if (repoDomain(root, collection, repo) === null)
+        return;
+    edit(root, (domains) => {
+        for (const [host, target] of Object.entries(domains)) {
+            if (target === from)
+                domains[host] = `${toCollection}/${toName}`;
+        }
+    });
+}
+/** A collection moved; every domain into it follows. Called by renameCollection. */
+function moveCollectionDomains(root, collection, toName) {
+    const prefix = `${collection}/`;
+    const map = loadDomains(root);
+    if (!Object.values(map).some((t) => t.startsWith(prefix)))
+        return;
+    edit(root, (domains) => {
+        for (const [host, target] of Object.entries(domains)) {
+            if (target.startsWith(prefix))
+                domains[host] = `${toName}/${target.slice(prefix.length)}`;
+        }
+    });
+}
+/**
+ * A repository or collection is gone; its domains go with it, so a repository
+ * created later under the name does not inherit a hostname somebody attached
+ * to what was deleted. Called by deleteRepo and deleteCollection.
+ */
+function dropRepoDomains(root, collection, repo) {
+    clearRepoDomain(root, collection, repo);
+}
+function dropCollectionDomains(root, collection) {
+    const prefix = `${collection}/`;
+    const map = loadDomains(root);
+    if (!Object.values(map).some((t) => t.startsWith(prefix)))
+        return;
+    edit(root, (domains) => {
+        for (const [host, target] of Object.entries(domains)) {
+            if (target.startsWith(prefix))
+                delete domains[host];
+        }
+    });
+}

package/dist/egress.js

@@ -41,9 +41,10 @@ const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const atomic_1 = require("./atomic");
 const config_1 = require("./config");
+const domains_1 = require("./domains");
 const redirects_1 = require("./redirects");
 const scan_1 = require("./scan");
-const siteshost_1 = require("./siteshost");
+const sitesettings_1 = require("./sitesettings");
 // Outgoing bytes, counted and capped.
 //
 // A host that bills for egress and does not cap it -- Fly is the one this was
@@ -198,15 +199,17 @@ function readDays(file) {
  * program, and reading the number is what an operator does before changing it;
  * the stylesheet and the icon because the admin page is unreadable without them.
  *
- * None of it applies on a sites hostname, where these paths belong to the site
- * being served and are ordinary traffic, exactly as isRateExempt has it.
+ * None of it applies on a sites hostname or a custom domain, where these paths
+ * belong to the site being served and are ordinary traffic, exactly as
+ * isRateExempt has it.
  */
 function isEgressExempt(root, req) {
-    if ((0, siteshost_1.isUnderSitesHost)((0, config_1.loadConfig)(root).sites.host, req.hostname))
+    if ((0, domains_1.isSiteRequest)(root, req.hostname))
         return false;
     const p = req.path;
-    if (p === '/login' || p === '/logout' || p === '/api/config' || p === '/api/egress')
+    if (p === '/login' || p.startsWith('/login/') || p === '/logout' || p === '/api/config' || p === '/api/egress') {
         return true;
+    }
     if (p === '/admin' || p.startsWith('/admin/'))
         return true;
     return p.startsWith('/assets/') || p === '/favicon.svg' || p === '/favicon.ico';
@@ -276,6 +279,18 @@ function normalizeKeys(root, keys) {
     }
     return changed ? out : null;
 }
+/**
+ * The repository a site hostname names, or null for a hostname that serves no
+ * site: a custom domain out of domains.json, or a name under the sites host,
+ * resolved exactly as the site handler resolves it so that a request's bytes
+ * are attributed to whatever answered it.
+ */
+function siteHostRepo(root, hostname) {
+    const domain = (0, domains_1.domainRepoFor)(root, hostname);
+    if (domain)
+        return domain;
+    return (0, sitesettings_1.findRepoBySiteHostname)(root, (0, config_1.loadConfig)(root).sites.host, hostname);
+}
 /**
  * Which row a request's bytes belong to.
  *
@@ -287,11 +302,13 @@ function normalizeKeys(root, keys) {
  * to none is one unmatched row rather than a row of its own.
  */
 function keyFor(root, req) {
-    const site = (0, siteshost_1.parseSiteHost)((0, config_1.loadConfig)(root).sites.host, req.hostname);
+    const site = siteHostRepo(root, req.hostname);
     if (site) {
         const resolved = resolveRepoKey(root, site.collection, site.repo);
         return resolved === null ? UNMATCHED_KEY : `${resolved}${SITE_SUFFIX}`;
     }
+    if ((0, domains_1.isSiteRequest)(root, req.hostname))
+        return VAULT_KEY;
     const m = /^\/([^/]+)\/([^/]+)(?:\/(.*))?$/.exec(req.path);
     if (!m)
         return VAULT_KEY;