@mondaydotcomorg/z2h-cli 0.29.4 → 0.30.0

package/dist/commands/deploy.js

@@ -90,7 +90,7 @@ async function buildAndStamp(opts) {
  * register the release with the platform in one server-side transaction.
  */
 async function uploadAndRegister(opts) {
-    const { paths, keyPrefix, appName, token, nextVersion, entry, gitRemote, isPreview, description } = opts;
+    const { paths, keyPrefix, appName, token, nextVersion, entry, gitRemote, isPreview, description, masterAppName } = opts;
     util_logger.info(`uploading ${isPreview ? 'preview ' : ''}build → s3://${constants.BUCKET_WRITE_NAME}/${keyPrefix}/`);
     await util_s3_upload.uploadDir(paths.shadowBuild, keyPrefix);
     // `integrations` is inferred from the backend sources in the working tree and
@@ -104,9 +104,25 @@ async function uploadAndRegister(opts) {
         deployedBy: whoDeployed(),
         isPreview,
     });
-    await util_broker_app.registerOrUpdateApp({ appName, token, nextVersion, entry, gitRemote, integrations, description });
+    await util_broker_app.registerOrUpdateApp({
+        appName,
+        token,
+        nextVersion,
+        entry,
+        gitRemote,
+        integrations,
+        description,
+        masterAppName,
+    });
 }
 async function deployPreview({ paths, consumerName, appName, token, opts }) {
+    // A preview inherits from the live app it previews, resolved by name server-side —
+    // fail fast with an actionable message if that app was never claimed/deployed (e.g. a
+    // local checkout scaffolded before `create` started claiming names), rather than
+    // letting a deep backend 404 surface as a generic "App registration failed".
+    if (!(await util_broker_app.fetchApp(appName))) {
+        throw new util_errors.DeployError('register_error', `Cannot preview "${appName}": it has never been created or deployed. Run 'z2h-cli create ${consumerName}' (or deploy it once) first.`);
+    }
     await fs.ensureDir(paths.shadowDir);
     const { previewId } = await shadow_prepare.resolvePortAndMetadata(paths, util_appName.cleanAppName(consumerName));
     const previewSlug = util_appName.buildPreviewSlug(consumerName, previewId);
@@ -138,6 +154,7 @@ async function deployPreview({ paths, consumerName, appName, token, opts }) {
         entry,
         gitRemote: '',
         isPreview: true,
+        masterAppName: appName,
     });
     const previewUrl = `https://bigbrain.me/bigbrain-vibe/${previewSlug}`;
     util_logger.output(`[z2h-cli] preview ready ✅\n  app:            ${appName}\n  previewAppName: ${previewAppName}\n  open:           ${previewUrl}`, {

package/dist/commands/generate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generate.d.ts","sourceRoot":"","sources":["../../src/commands/generate.ts"],"names":[],"mappings":"AAkBA,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;CACf;AAwHD;;;;;GAKG;AACH,wBAAsB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CA8E3F"}
+{"version":3,"file":"generate.d.ts","sourceRoot":"","sources":["../../src/commands/generate.ts"],"names":[],"mappings":"AAkBA,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;CACf;AAwHD;;;;;GAKG;AACH,wBAAsB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAqF3F"}

package/dist/commands/generate.js

@@ -141,6 +141,12 @@ async function generateCommand(appName, opts) {
     if (existing?.deployed) {
         throw new Error(`An app named "${appName}" already exists in the Z2H registry. Pick a different name.`);
     }
+    // generate skips `create` entirely, but the preview it deploys below still resolves this
+    // app's own row by name server-side — claim it now so that lookup finds something, same as
+    // `create` does for the normal flow.
+    if (!existing) {
+        await util_broker_app.claimApp(util_appName.mfAppName(appName), util_git_repo.defaultS3Remote(appName));
+    }
     util_logger.info(`copying template "${template.id}" → ${appDir}`);
     // Excludes node_modules (installed into templateDir itself by build-templates.mjs, never
     // needed by the generated app), .build-shadow (a scratch dir that build-templates.mjs

package/dist/esm/commands/deploy.mjs

@@ -14,7 +14,7 @@ import { resolveGitEnv } from '../util/git/git-env.mjs';
 import { validateRemoteOptions, resolveRemoteUrl } from '../util/git/remote-options.mjs';
 import { setupS3Client } from '../util/s3/client.mjs';
 import { getMachineAppName } from '../util/machine-identity.mjs';
-import { registerOrUpdateApp } from '../util/broker/app.mjs';
+import { fetchApp, registerOrUpdateApp } from '../util/broker/app.mjs';
 import { openInBrowser } from '../util/open-browser.mjs';
 import { resolvePortAndMetadata } from '../shadow/prepare.mjs';
 import { tagDeployError, DeployError, grantReasonForStatus } from '../util/errors.mjs';
@@ -83,7 +83,7 @@ async function buildAndStamp(opts) {
  * register the release with the platform in one server-side transaction.
  */
 async function uploadAndRegister(opts) {
-    const { paths, keyPrefix, appName, token, nextVersion, entry, gitRemote, isPreview, description } = opts;
+    const { paths, keyPrefix, appName, token, nextVersion, entry, gitRemote, isPreview, description, masterAppName } = opts;
     info(`uploading ${isPreview ? 'preview ' : ''}build → s3://${BUCKET_WRITE_NAME}/${keyPrefix}/`);
     await uploadDir(paths.shadowBuild, keyPrefix);
     // `integrations` is inferred from the backend sources in the working tree and
@@ -97,9 +97,25 @@ async function uploadAndRegister(opts) {
         deployedBy: whoDeployed(),
         isPreview,
     });
-    await registerOrUpdateApp({ appName, token, nextVersion, entry, gitRemote, integrations, description });
+    await registerOrUpdateApp({
+        appName,
+        token,
+        nextVersion,
+        entry,
+        gitRemote,
+        integrations,
+        description,
+        masterAppName,
+    });
 }
 async function deployPreview({ paths, consumerName, appName, token, opts }) {
+    // A preview inherits from the live app it previews, resolved by name server-side —
+    // fail fast with an actionable message if that app was never claimed/deployed (e.g. a
+    // local checkout scaffolded before `create` started claiming names), rather than
+    // letting a deep backend 404 surface as a generic "App registration failed".
+    if (!(await fetchApp(appName))) {
+        throw new DeployError('register_error', `Cannot preview "${appName}": it has never been created or deployed. Run 'z2h-cli create ${consumerName}' (or deploy it once) first.`);
+    }
     await ensureDir(paths.shadowDir);
     const { previewId } = await resolvePortAndMetadata(paths, cleanAppName(consumerName));
     const previewSlug = buildPreviewSlug(consumerName, previewId);
@@ -131,6 +147,7 @@ async function deployPreview({ paths, consumerName, appName, token, opts }) {
         entry,
         gitRemote: '',
         isPreview: true,
+        masterAppName: appName,
     });
     const previewUrl = `https://bigbrain.me/bigbrain-vibe/${previewSlug}`;
     output(`[z2h-cli] preview ready ✅\n  app:            ${appName}\n  previewAppName: ${previewAppName}\n  open:           ${previewUrl}`, {

package/dist/esm/commands/generate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"generate.d.ts","sourceRoot":"","sources":["../../../src/commands/generate.ts"],"names":[],"mappings":"AAkBA,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;CACf;AAwHD;;;;;GAKG;AACH,wBAAsB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CA8E3F"}
+{"version":3,"file":"generate.d.ts","sourceRoot":"","sources":["../../../src/commands/generate.ts"],"names":[],"mappings":"AAkBA,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;CACf;AAwHD;;;;;GAKG;AACH,wBAAsB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAqF3F"}

package/dist/esm/commands/generate.mjs

@@ -5,10 +5,10 @@ import { execa } from 'execa';
 import { pathExists, readdir } from 'fs-extra';
 import { assertWorkspace } from '../util/workspace.mjs';
 import { validateAppName, mfAppName, cleanAppName } from '../util/app-name.mjs';
-import { fetchApp } from '../util/broker/app.mjs';
+import { fetchApp, claimApp } from '../util/broker/app.mjs';
 import { patchBuiltBundle, patchOneFile } from '../util/dashboard-templates/patch-bundle.mjs';
 import { findTemplate } from '../util/dashboard-templates/load-catalog.mjs';
-import { initRepo, defaultS3Remote } from '../util/git/repo.mjs';
+import { defaultS3Remote, initRepo } from '../util/git/repo.mjs';
 import { info, output } from '../util/logger.mjs';
 
 // Must match zth-backend-runner's route pattern — fail at generate time, not at first invocation.
@@ -133,6 +133,12 @@ async function generateCommand(appName, opts) {
     if (existing?.deployed) {
         throw new Error(`An app named "${appName}" already exists in the Z2H registry. Pick a different name.`);
     }
+    // generate skips `create` entirely, but the preview it deploys below still resolves this
+    // app's own row by name server-side — claim it now so that lookup finds something, same as
+    // `create` does for the normal flow.
+    if (!existing) {
+        await claimApp(mfAppName(appName), defaultS3Remote(appName));
+    }
     info(`copying template "${template.id}" → ${appDir}`);
     // Excludes node_modules (installed into templateDir itself by build-templates.mjs, never
     // needed by the generated app), .build-shadow (a scratch dir that build-templates.mjs

package/dist/esm/util/broker/app.d.ts

@@ -30,6 +30,8 @@ export interface RegisterOrUpdateOptions {
     gitRemote: string;
     integrations?: string[];
     description?: string;
+    /** For a preview app's first registration, the real app it previews. Ignored past v1. */
+    masterAppName?: string;
 }
 /**
  * v1 creates the app row (+ owner grant, prompting for visibility); later

package/dist/esm/util/broker/app.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../../../../src/util/broker/app.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjD,MAAM,WAAW,OAAO;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,0FAA0F;IAC1F,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACtC,uGAAuG;IACvG,QAAQ,EAAE,OAAO,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;GAGG;AACH,wBAAsB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAsBvE;AAED;;;;;GAKG;AACH,wBAAsB,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAWhF;AA4CD,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,aAAa,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,CAiBtF"}
+{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../../../../src/util/broker/app.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjD,MAAM,WAAW,OAAO;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,0FAA0F;IAC1F,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACtC,uGAAuG;IACvG,QAAQ,EAAE,OAAO,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;GAGG;AACH,wBAAsB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAsBvE;AAED;;;;;GAKG;AACH,wBAAsB,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAWhF;AA6CD,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,aAAa,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,yFAAyF;IACzF,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,CA2BtF"}

package/dist/esm/util/broker/app.mjs

@@ -47,11 +47,11 @@ async function claimApp(appName, gitRemote) {
         throw new Error(`Claiming app name failed (${res.status}): ${text.slice(0, 1024)}`);
     }
 }
-async function registerApp(appName, token, version, entry, visibility, gitRemote, integrations, description) {
+async function registerApp(appName, token, version, entry, visibility, gitRemote, integrations, description, masterAppName) {
     const res = await fetch(`${brokerBaseUrl()}/z2h-cli/apps/register`, {
         method: 'POST',
         headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json', ...routingHeaders() },
-        body: JSON.stringify({ appName, version, entry, visibility, gitRemote, integrations, description }),
+        body: JSON.stringify({ appName, version, entry, visibility, gitRemote, integrations, description, masterAppName }),
     });
     if (!res.ok) {
         const text = await res.text();
@@ -77,12 +77,12 @@ async function updateApp(appName, token, version, entry, gitRemote, integrations
  * deploy and preview so this branching logic lives in exactly one place.
  */
 async function registerOrUpdateApp(opts) {
-    const { appName, token, nextVersion, entry, gitRemote, integrations, description } = opts;
+    const { appName, token, nextVersion, entry, gitRemote, integrations, description, masterAppName } = opts;
     try {
         if (nextVersion === 1) {
             const visibility = await resolveAppVisibility(appName);
             info(`registering "${appName}" → v${nextVersion} (${visibility})`);
-            await registerApp(appName, token, nextVersion, entry, visibility, gitRemote, integrations, description);
+            await registerApp(appName, token, nextVersion, entry, visibility, gitRemote, integrations, description, masterAppName);
         }
         else {
             info(`updating "${appName}" → v${nextVersion}`);

package/dist/util/broker/app.d.ts

@@ -30,6 +30,8 @@ export interface RegisterOrUpdateOptions {
     gitRemote: string;
     integrations?: string[];
     description?: string;
+    /** For a preview app's first registration, the real app it previews. Ignored past v1. */
+    masterAppName?: string;
 }
 /**
  * v1 creates the app row (+ owner grant, prompting for visibility); later

package/dist/util/broker/app.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../../../src/util/broker/app.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjD,MAAM,WAAW,OAAO;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,0FAA0F;IAC1F,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACtC,uGAAuG;IACvG,QAAQ,EAAE,OAAO,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;GAGG;AACH,wBAAsB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAsBvE;AAED;;;;;GAKG;AACH,wBAAsB,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAWhF;AA4CD,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,aAAa,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,CAiBtF"}
+{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../../../src/util/broker/app.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjD,MAAM,WAAW,OAAO;IACtB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,0FAA0F;IAC1F,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACtC,uGAAuG;IACvG,QAAQ,EAAE,OAAO,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;GAGG;AACH,wBAAsB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAsBvE;AAED;;;;;GAKG;AACH,wBAAsB,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAWhF;AA6CD,MAAM,WAAW,uBAAuB;IACtC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,aAAa,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,yFAAyF;IACzF,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC,CA2BtF"}

package/dist/util/broker/app.js

@@ -49,11 +49,11 @@ async function claimApp(appName, gitRemote) {
         throw new Error(`Claiming app name failed (${res.status}): ${text.slice(0, 1024)}`);
     }
 }
-async function registerApp(appName, token, version, entry, visibility, gitRemote, integrations, description) {
+async function registerApp(appName, token, version, entry, visibility, gitRemote, integrations, description, masterAppName) {
     const res = await fetch(`${constants.brokerBaseUrl()}/z2h-cli/apps/register`, {
         method: 'POST',
         headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json', ...constants.routingHeaders() },
-        body: JSON.stringify({ appName, version, entry, visibility, gitRemote, integrations, description }),
+        body: JSON.stringify({ appName, version, entry, visibility, gitRemote, integrations, description, masterAppName }),
     });
     if (!res.ok) {
         const text = await res.text();
@@ -79,12 +79,12 @@ async function updateApp(appName, token, version, entry, gitRemote, integrations
  * deploy and preview so this branching logic lives in exactly one place.
  */
 async function registerOrUpdateApp(opts) {
-    const { appName, token, nextVersion, entry, gitRemote, integrations, description } = opts;
+    const { appName, token, nextVersion, entry, gitRemote, integrations, description, masterAppName } = opts;
     try {
         if (nextVersion === 1) {
             const visibility = await util_promptVisibility.resolveAppVisibility(appName);
             util_logger.info(`registering "${appName}" → v${nextVersion} (${visibility})`);
-            await registerApp(appName, token, nextVersion, entry, visibility, gitRemote, integrations, description);
+            await registerApp(appName, token, nextVersion, entry, visibility, gitRemote, integrations, description, masterAppName);
         }
         else {
             util_logger.info(`updating "${appName}" → v${nextVersion}`);

package/handler-api/backend-runner/channels/snowflake-channel/run-query.ts

@@ -58,35 +58,32 @@ function hashQueryShape(rawSql: string): string {
 }
 
 /**
- * The permissions-aware pool returns different rows to different people, so the
- * cache key has to carry whatever decides that — the caller's roles and user
- * group, exactly as bigbrain-zth keys it. Get this wrong and one user is served
- * another's rows. The stateless pool reads as a fixed service account, so every
- * caller shares one entry there.
+ * The permissions-aware pool returns different rows to different people —
+ * including different rows to two people with the same roles/user_group, since
+ * Snowflake now enforces column/row-level grants per user. The cache key must
+ * therefore scope to the individual caller, exactly as bigbrain-zth keys it.
+ * The stateless pool reads as a fixed service account, so every caller shares
+ * one entry there.
  */
 /**
  * Returns the cache scope key for the current caller, or null when we must not
  * cache at all.
  *
- * On the permissions-aware path we hash the caller's roles + user_group, mirroring
+ * On the permissions-aware path we scope to the caller's user id, mirroring
  * bigbrain-zth exactly. If there is no execution context (e.g. the call arrived
  * outside a normal invoke flow) we fail **closed**: skipping both the cache read
  * and the write prevents an unauthenticated scope-collapse where every caller
- * would share one entry keyed by `hash('|')`.
+ * would share one entry.
  */
 function cacheScope(useStateless: boolean): string | null {
   if (useStateless) {
     return 'stateless';
   }
-  const user = context.execution.get()?.user as { roles?: string[]; user_group?: string } | undefined;
-  if (!user) {
+  const user = context.execution.get()?.user as { id?: number } | undefined;
+  if (!user?.id) {
     return null;
   }
-  const roles = [...(user.roles ?? [])].sort((a, b) => a.localeCompare(b)).join(',');
-  return createHash('sha256')
-    .update(`${roles}|${user.user_group ?? ''}`)
-    .digest('hex')
-    .slice(0, 16);
+  return `user:${user.id}`;
 }
 
 /**

package/handler-api/backend-runner/channels/with-timeout.ts

@@ -1,6 +1,6 @@
 import { ChannelError } from '../backend-runner.errors';
 
-export const UPSTREAM_TIMEOUT_MS = 15_000;
+export const UPSTREAM_TIMEOUT_MS = 60_000;
 export const LLM_TIMEOUT_MS = 60_000;
 /**
  * Head-room added on top of an upstream's *own* budget when racing it.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mondaydotcomorg/z2h-cli",
-  "version": "0.29.4",
+  "version": "0.30.0",
   "bin": "./bin/z2h-cli.js",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -51,7 +51,7 @@
   ],
   "dependencies": {
     "@aws-sdk/client-s3": "^3.706.0",
-    "@mondaydotcomorg/z2h-dashboard-templates": "^0.3.5",
+    "@mondaydotcomorg/z2h-dashboard-templates": "^0.3.6",
     "@mondaydotcomorg/z2h-shared-utils": "^0.6.2",
     "acorn": "^8.14.0",
     "acorn-walk": "^8.3.4",

package/src/commands/__tests__/deploy.test.ts

@@ -39,8 +39,21 @@ vi.mock('../../util/auth/broker-credential-provider', () => ({
   fetchDeployVersion: vi.fn(),
 }));
 
+const { STUB_MASTER_APP } = vi.hoisted(() => ({
+  STUB_MASTER_APP: {
+    appName: 'mf-my-app',
+    version: 1,
+    entry: {},
+    deployed: true,
+    deployedBy: 'someone@x.com',
+    gitRemote: 's3://bucket/my-app/git',
+    createdBy: 'someone@x.com',
+  },
+}));
+
 vi.mock('../../util/broker/app', () => ({
   registerOrUpdateApp: vi.fn().mockResolvedValue(undefined),
+  fetchApp: vi.fn().mockResolvedValue(STUB_MASTER_APP),
 }));
 
 vi.mock('../../util/git/repo', () => ({
@@ -90,6 +103,7 @@ describe('deploy --preview', () => {
     vi.mocked(brokerProvider.brokerCredentialProvider).mockClear();
     vi.mocked(brokerProvider.fetchDeployVersion).mockReset().mockResolvedValue(0);
     vi.mocked(brokerApp.registerOrUpdateApp).mockClear().mockResolvedValue(undefined);
+    vi.mocked(brokerApp.fetchApp).mockClear().mockResolvedValue(STUB_MASTER_APP);
     vi.mocked(gitRepo.guardCleanTree).mockClear();
     vi.mocked(gitRepo.pullAndResolve).mockClear();
     vi.mocked(gitRepo.pushToRemote).mockClear();
@@ -148,6 +162,7 @@ describe('deploy --preview', () => {
       entry: expect.objectContaining({ ...ASSET_MANIFEST, version: 3, gitRemote: '' }),
       gitRemote: '',
       integrations: [],
+      masterAppName: 'mf-my-app',
     });
   });
 
@@ -165,6 +180,7 @@ describe('deploy --preview', () => {
       entry: expect.objectContaining({ ...ASSET_MANIFEST, version: 1, gitRemote: '' }),
       gitRemote: '',
       integrations: [],
+      masterAppName: 'mf-my-app',
     });
   });
 
@@ -220,6 +236,18 @@ describe('deploy --preview', () => {
     expect((err as DeployError).reason).toBe('register_error');
   });
 
+  it('fails fast with an actionable message when the live app was never created/deployed', async () => {
+    vi.mocked(brokerApp.fetchApp).mockResolvedValue(null);
+
+    const err = await deployCommand({ preview: true }).catch((e: unknown) => e);
+
+    expect(err).toBeInstanceOf(DeployError);
+    expect((err as DeployError).reason).toBe('register_error');
+    expect((err as Error).message).toMatch(/never been created or deployed/);
+    expect(buildCommand).not.toHaveBeenCalled();
+    expect(brokerApp.registerOrUpdateApp).not.toHaveBeenCalled();
+  });
+
   it('rejects deploying a preview for an app already named with the preview prefix', async () => {
     await writeJson(path.join(tmp, 'package.json'), { name: 'zth-preview-abc123-my-app' });
     await expect(deployCommand({ preview: true })).rejects.toThrow(/reserved for the ephemeral preview mechanism/);

package/src/commands/deploy.ts

@@ -20,7 +20,7 @@ import { resolveGitEnv } from '../util/git/git-env';
 import { type RemoteType, validateRemoteOptions, resolveRemoteUrl } from '../util/git/remote-options';
 import { setupS3Client } from '../util/s3/client';
 import { getMachineAppName } from '../util/machine-identity';
-import { registerOrUpdateApp } from '../util/broker/app';
+import { fetchApp, registerOrUpdateApp } from '../util/broker/app';
 import { openInBrowser } from '../util/open-browser';
 import { resolvePortAndMetadata } from '../shadow/prepare';
 import { DeployError, tagDeployError, grantReasonForStatus } from '../util/errors';
@@ -132,8 +132,10 @@ async function uploadAndRegister(opts: {
   gitRemote: string;
   isPreview: boolean;
   description?: string;
+  masterAppName?: string;
 }): Promise<void> {
-  const { paths, keyPrefix, appName, token, nextVersion, entry, gitRemote, isPreview, description } = opts;
+  const { paths, keyPrefix, appName, token, nextVersion, entry, gitRemote, isPreview, description, masterAppName } =
+    opts;
 
   info(`uploading ${isPreview ? 'preview ' : ''}build → s3://${BUCKET_WRITE_NAME}/${keyPrefix}/`);
   await uploadDir(paths.shadowBuild, keyPrefix);
@@ -150,10 +152,30 @@ async function uploadAndRegister(opts: {
     isPreview,
   });
 
-  await registerOrUpdateApp({ appName, token, nextVersion, entry, gitRemote, integrations, description });
+  await registerOrUpdateApp({
+    appName,
+    token,
+    nextVersion,
+    entry,
+    gitRemote,
+    integrations,
+    description,
+    masterAppName,
+  });
 }
 
 async function deployPreview({ paths, consumerName, appName, token, opts }: DeployContext): Promise<void> {
+  // A preview inherits from the live app it previews, resolved by name server-side —
+  // fail fast with an actionable message if that app was never claimed/deployed (e.g. a
+  // local checkout scaffolded before `create` started claiming names), rather than
+  // letting a deep backend 404 surface as a generic "App registration failed".
+  if (!(await fetchApp(appName))) {
+    throw new DeployError(
+      'register_error',
+      `Cannot preview "${appName}": it has never been created or deployed. Run 'z2h-cli create ${consumerName}' (or deploy it once) first.`
+    );
+  }
+
   await ensureDir(paths.shadowDir);
   const { previewId } = await resolvePortAndMetadata(paths, cleanAppName(consumerName));
 
@@ -190,6 +212,7 @@ async function deployPreview({ paths, consumerName, appName, token, opts }: Depl
     entry,
     gitRemote: '',
     isPreview: true,
+    masterAppName: appName,
   });
 
   const previewUrl = `https://bigbrain.me/bigbrain-vibe/${previewSlug}`;

package/src/commands/generate.ts

@@ -5,7 +5,7 @@ import { execa } from 'execa';
 import { pathExists, readdir } from 'fs-extra';
 import { assertWorkspace } from '../util/workspace';
 import { validateAppName, cleanAppName, mfAppName } from '../util/app-name';
-import { fetchApp } from '../util/broker/app';
+import { claimApp, fetchApp } from '../util/broker/app';
 import { patchBuiltBundle, patchOneFile, type PatchedConfig } from '../util/dashboard-templates/patch-bundle';
 import { findTemplate, type DashboardTemplateEntry } from '../util/dashboard-templates/load-catalog';
 import { initRepo, defaultS3Remote } from '../util/git/repo';
@@ -163,6 +163,13 @@ export async function generateCommand(appName: string, opts: GenerateOptions): P
     throw new Error(`An app named "${appName}" already exists in the Z2H registry. Pick a different name.`);
   }
 
+  // generate skips `create` entirely, but the preview it deploys below still resolves this
+  // app's own row by name server-side — claim it now so that lookup finds something, same as
+  // `create` does for the normal flow.
+  if (!existing) {
+    await claimApp(mfAppName(appName), defaultS3Remote(appName));
+  }
+
   info(`copying template "${template.id}" → ${appDir}`);
   // Excludes node_modules (installed into templateDir itself by build-templates.mjs, never
   // needed by the generated app), .build-shadow (a scratch dir that build-templates.mjs

package/src/util/broker/app.ts

@@ -72,12 +72,13 @@ async function registerApp(
   visibility: 'public' | 'private',
   gitRemote: string,
   integrations?: string[],
-  description?: string
+  description?: string,
+  masterAppName?: string
 ): Promise<void> {
   const res = await fetch(`${brokerBaseUrl()}/z2h-cli/apps/register`, {
     method: 'POST',
     headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json', ...routingHeaders() },
-    body: JSON.stringify({ appName, version, entry, visibility, gitRemote, integrations, description }),
+    body: JSON.stringify({ appName, version, entry, visibility, gitRemote, integrations, description, masterAppName }),
   });
   if (!res.ok) {
     const text = await res.text();
@@ -114,6 +115,8 @@ export interface RegisterOrUpdateOptions {
   gitRemote: string;
   integrations?: string[];
   description?: string;
+  /** For a preview app's first registration, the real app it previews. Ignored past v1. */
+  masterAppName?: string;
 }
 
 /**
@@ -123,13 +126,23 @@ export interface RegisterOrUpdateOptions {
  * deploy and preview so this branching logic lives in exactly one place.
  */
 export async function registerOrUpdateApp(opts: RegisterOrUpdateOptions): Promise<void> {
-  const { appName, token, nextVersion, entry, gitRemote, integrations, description } = opts;
+  const { appName, token, nextVersion, entry, gitRemote, integrations, description, masterAppName } = opts;
 
   try {
     if (nextVersion === 1) {
       const visibility = await resolveAppVisibility(appName);
       info(`registering "${appName}" → v${nextVersion} (${visibility})`);
-      await registerApp(appName, token, nextVersion, entry, visibility, gitRemote, integrations, description);
+      await registerApp(
+        appName,
+        token,
+        nextVersion,
+        entry,
+        visibility,
+        gitRemote,
+        integrations,
+        description,
+        masterAppName
+      );
     } else {
       info(`updating "${appName}" → v${nextVersion}`);
       await updateApp(appName, token, nextVersion, entry, gitRemote, integrations, description);