@samebase/convex-hosting 0.13.1 → 0.15.0

package/dist/client/index.js

@@ -1,25 +1,51 @@
 import "./runtime.js";
 import { httpActionGeneric, ROUTABLE_HTTP_METHODS, } from "convex/server";
+import { answer } from "./answer.js";
+import { ASSETS_FORMAT, MARK_HEADER } from "./manifest.js";
 /**
- * The HTTP action that serves the site, for `routeAll`: it answers a request with the file of
- * version `versionId` (another method than GET or HEAD on a file answers 405), else with what
- * `worker` answers, else 404. `worker` is the Worker script, the object with `fetch(request)`
- * that the app's server entry exports: the code that runs on a miss. As on Cloudflare, the presence
- * of code decides how `not_found_handling` applies: with `worker`, it applies to navigations only
- * and `worker` answers the other misses; without it, the site is files only, so it applies to every
- * request.
+ * The HTTP action that serves the site, for `routeAll`: it answers a request with an asset (another
+ * method than GET or HEAD on an asset answers 405), else with what `worker` answers, else 404. As on
+ * Cloudflare, the presence of a Worker script decides how `not_found_handling` applies: with
+ * `worker`, it applies to navigations only and `worker` answers the other misses; without it, it
+ * applies to every request.
+ *
+ * The assets are in the pushed code, so a request calls no function of the component: a file costs
+ * this action and the download of its bytes, any other answer this action alone.
  *
  * A page and a 404 answer `Cache-Control: no-store`. The deployment's Cloudflare front keeps that
  * for a path without an extension and replaces it with a four-hour browser `max-age` for a path
  * with one, so a browser that asks for a script before its upload ended keeps the 404; the deploy
  * order prevents that case, because no page refers to a file that is not uploaded yet.
  */
-function serveSite(component, versionId, worker) {
+function serveSite({ component, assets, worker }) {
     return httpActionGeneric(async (ctx, request) => {
-        const asset = await answer(ctx, component, request, versionId, worker !== undefined);
+        // Read first: a mark says when its request reached this code.
+        const arrivedAt = Date.now();
+        if (assets.format !== ASSETS_FORMAT) {
+            return notServed(500, `.convex-hosting/version.js has format ${assets.format}, and this release of ` +
+                `@samebase/convex-hosting reads format ${ASSETS_FORMAT}. Deploy again.`);
+        }
+        if (request.headers.get(MARK_HEADER) === assets.markToken) {
+            const result = await ctx.runMutation(component.lib.markLive, {
+                versionId: assets.versionId,
+                arrivedAt,
+            });
+            return Response.json({ versionId: assets.versionId, result }, { headers: NO_STORE });
+        }
+        const { files } = assets;
+        // A first install pushes before its upload; the deploy pushes again when the upload ends.
+        if (files === null) {
+            return notServed(404, `Version ${assets.versionId} of the site is not uploaded yet.`);
+        }
+        // The storage URLs name the deployment they were taken from.
+        if (files.cloudUrl !== process.env.CONVEX_CLOUD_URL) {
+            return notServed(404, `Version ${assets.versionId} of the site was uploaded to ${files.cloudUrl}, not to this ` +
+                `deployment. Deploy to this deployment with convex-hosting deploy.`);
+        }
+        const asset = await answer(files, request, worker !== undefined);
         if (asset !== null)
-            return asset;
-        // `route` answers every files-only request itself, so this 404 only fails closed.
+            return await withBody(asset);
+        // `answer` answers every assets-only request itself, so this 404 only fails closed.
         if (worker === undefined)
             return new Response(null, { status: 404, headers: NO_STORE });
         const page = await worker.fetch(request);
@@ -33,87 +59,39 @@ function serveSite(component, versionId, worker) {
  * every path, as every request reaches a Cloudflare Worker with static assets. Convex answers HEAD
  * through GET.
  *
+ * ```ts
+ * routeAll({ http, component: components.hosting, assets, worker: server });
+ * ```
+ *
  * Returns the action, for the paths that a component's HTTP prefix would otherwise take: Convex
  * picks an exact route first, then the longest prefix, so an app whose session routes sit under a
  * component's prefix registers them with `http.route({ path, method, handler })`.
  */
-export function routeAll(http, component, versionId, worker) {
-    const site = serveSite(component, versionId, worker);
+export function routeAll(options) {
+    const action = serveSite(options);
     for (const method of ROUTABLE_HTTP_METHODS) {
-        http.route({ pathPrefix: "/", method, handler: site });
+        options.http.route({ pathPrefix: "/", method, handler: action });
     }
-    return site;
+    return action;
 }
-/**
- * Answers `request` with the asset of version `versionId` that Cloudflare's asset handler picks,
- * or returns `null` when no asset matches. `hasUserWorker` is Cloudflare's `has_user_worker`.
- *
- * A version that does not exist, is still uploading, or is being deleted answers 404, so a
- * half-installed site does not render pages without their files. The first request for a `ready`
- * version marks it live, which deletes the versions that were live before it; a version older than
- * the live one is never marked.
- */
-async function answer(ctx, component, request, versionId, hasUserWorker) {
-    const { state, asset } = await ctx.runQuery(component.lib.route, {
-        versionId,
-        method: request.method,
-        url: request.url,
-        headers: handlerHeaders(request.headers),
-        hasUserWorker,
-    });
-    if (state === null || state === "uploading" || state === "deleting") {
-        const problem = state === null
-            ? "does not exist"
-            : state === "uploading"
-                ? "is still uploading"
-                : "is being deleted";
-        return new Response(`Version ${versionId} of the site ${problem}.`, {
-            status: 404,
-            headers: NO_STORE,
-        });
-    }
-    // Only the pushed code knows which version the deployment runs, so its first request reports it.
-    if (state === "ready") {
-        await ctx.runMutation(component.lib.markLive, { versionId });
-    }
-    if (asset === null)
-        return null;
-    const headers = new Headers();
-    for (const { name, value } of asset.headers)
-        headers.append(name, value);
-    if (asset.bodyUrl === null)
-        return new Response(null, { status: asset.status, headers });
+/** The response of `asset`, with the stored file as its body when it has one. */
+async function withBody(asset) {
+    if (asset.url === null)
+        return new Response(null, { status: asset.status, headers: asset.headers });
     // An app cannot read a component's storage, so the body comes from the storage URL.
     let stored;
     try {
-        stored = await fetch(asset.bodyUrl);
+        stored = await fetch(asset.url);
     }
     catch {
-        return badGateway();
+        return new Response(null, { status: 502, headers: NO_STORE });
     }
-    // A deploy deleted the file between the query and the fetch.
+    // A deploy deleted the file: this code was replaced, and a later version's mark deleted it.
     if (stored.status === 404)
         return new Response(null, { status: 404, headers: NO_STORE });
     if (!stored.ok)
-        return badGateway();
-    return new Response(stored.body, { status: asset.status, headers });
-}
-/**
- * The request headers that Cloudflare's handler reads. It reads only the presence of
- * `Authorization` and `Range`, so their values (a credential, for one) stay out of the query.
- */
-function handlerHeaders(headers) {
-    const picked = {};
-    for (const name of ["if-none-match", "sec-fetch-mode"]) {
-        const value = headers.get(name);
-        if (value !== null)
-            picked[name] = value;
-    }
-    for (const name of ["authorization", "range"]) {
-        if (headers.has(name))
-            picked[name] = "";
-    }
-    return picked;
+        return new Response(null, { status: 502, headers: NO_STORE });
+    return new Response(stored.body, { status: asset.status, headers: asset.headers });
 }
 /**
  * For the answers that no uploaded file gives. The deployment's Cloudflare front caches 404 answers
@@ -121,7 +99,8 @@ function handlerHeaders(headers) {
  * missing for hours (the 0.3.2 incident).
  */
 const NO_STORE = { "Cache-Control": "no-store" };
-function badGateway() {
-    return new Response(null, { status: 502, headers: NO_STORE });
+/** A site that cannot serve this request, named in the body. */
+function notServed(status, message) {
+    return new Response(message, { status, headers: NO_STORE });
 }
 //# sourceMappingURL=index.js.map

package/dist/client/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/client/index.ts"],"names":[],"mappings":"AAAA,OAAO,cAAc,CAAC;AACtB,OAAO,EACL,iBAAiB,EACjB,qBAAqB,GAKtB,MAAM,eAAe,CAAC;AAGvB;;;;;;;;;;;;;GAaG;AACH,SAAS,SAAS,CAChB,SAAuB,EACvB,SAAiB,EACjB,MAAuD;IAEvD,OAAO,iBAAiB,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE;QAC9C,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC;QACrF,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QACjC,kFAAkF;QAClF,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;QACxF,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1C,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QACzC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,QAAQ,CACtB,IAAgB,EAChB,SAAuB,EACvB,SAAiB,EACjB,MAAuD;IAEvD,MAAM,IAAI,GAAG,SAAS,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IACrD,KAAK,MAAM,MAAM,IAAI,qBAAqB,EAAE,CAAC;QAC3C,IAAI,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,MAAM,CACnB,GAAyE,EACzE,SAAuB,EACvB,OAAgB,EAChB,SAAiB,EACjB,aAAsB;IAEtB,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE;QAC/D,SAAS;QACT,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,OAAO,EAAE,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC;QACxC,aAAa;KACd,CAAC,CAAC;IACH,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,WAAW,IAAI,KAAK,KAAK,UAAU,EAAE,CAAC;QACpE,MAAM,OAAO,GACX,KAAK,KAAK,IAAI;YACZ,CAAC,CAAC,gBAAgB;YAClB,CAAC,CAAC,KAAK,KAAK,WAAW;gBACrB,CAAC,CAAC,oBAAoB;gBACtB,CAAC,CAAC,kBAAkB,CAAC;QAC3B,OAAO,IAAI,QAAQ,CAAC,WAAW,SAAS,gBAAgB,OAAO,GAAG,EAAE;YAClE,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,QAAQ;SAClB,CAAC,CAAC;IACL,CAAC;IACD,iGAAiG;IACjG,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;QACtB,MAAM,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAEhC,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,KAAK,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC,OAAO;QAAE,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACzE,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI;QAAE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IAEzF,oFAAoF;IACpF,IAAI,MAAgB,CAAC;IACrB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,UAAU,EAAE,CAAC;IACtB,CAAC;IACD,6DAA6D;IAC7D,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;IACzF,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,UAAU,EAAE,CAAC;IACpC,OAAO,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;AACtE,CAAC;AAED;;;GAGG;AACH,SAAS,cAAc,CAAC,OAAgB;IACtC,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,CAAC,eAAe,EAAE,gBAAgB,CAAC,EAAE,CAAC;QACvD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,KAAK,KAAK,IAAI;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IAC3C,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,CAAC,eAAe,EAAE,OAAO,CAAC,EAAE,CAAC;QAC9C,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;IAC3C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,QAAQ,GAAG,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC;AAEjD,SAAS,UAAU;IACjB,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;AAChE,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/client/index.ts"],"names":[],"mappings":"AAAA,OAAO,cAAc,CAAC;AACtB,OAAO,EACL,iBAAiB,EACjB,qBAAqB,GAGtB,MAAM,eAAe,CAAC;AAEvB,OAAO,EAAE,MAAM,EAAe,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,aAAa,EAAE,WAAW,EAAe,MAAM,eAAe,CAAC;AAmBxE;;;;;;;;;;;;;;GAcG;AACH,SAAS,SAAS,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAmB;IAC/D,OAAO,iBAAiB,CAAC,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE;QAC9C,8DAA8D;QAC9D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;YACpC,OAAO,SAAS,CACd,GAAG,EACH,yCAAyC,MAAM,CAAC,MAAM,wBAAwB;gBAC5E,yCAAyC,aAAa,iBAAiB,CAC1E,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,MAAM,CAAC,SAAS,EAAE,CAAC;YAC1D,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC,GAAG,CAAC,QAAQ,EAAE;gBAC3D,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,SAAS;aACV,CAAC,CAAC;YACH,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;QACvF,CAAC;QACD,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC;QACzB,0FAA0F;QAC1F,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,OAAO,SAAS,CAAC,GAAG,EAAE,WAAW,MAAM,CAAC,SAAS,mCAAmC,CAAC,CAAC;QACxF,CAAC;QACD,6DAA6D;QAC7D,IAAI,KAAK,CAAC,QAAQ,KAAK,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;YACpD,OAAO,SAAS,CACd,GAAG,EACH,WAAW,MAAM,CAAC,SAAS,gCAAgC,KAAK,CAAC,QAAQ,gBAAgB;gBACvF,mEAAmE,CACtE,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,MAAM,KAAK,SAAS,CAAC,CAAC;QACjE,IAAI,KAAK,KAAK,IAAI;YAAE,OAAO,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;QACjD,oFAAoF;QACpF,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;QACxF,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1C,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QACzC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,QAAQ,CAAC,OAAwB;IAC/C,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAClC,KAAK,MAAM,MAAM,IAAI,qBAAqB,EAAE,CAAC;QAC3C,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,iFAAiF;AACjF,KAAK,UAAU,QAAQ,CAAC,KAAa;IACnC,IAAI,KAAK,CAAC,GAAG,KAAK,IAAI;QACpB,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAC9E,oFAAoF;IACpF,IAAI,MAAgB,CAAC;IACrB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;IAChE,CAAC;IACD,4FAA4F;IAC5F,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;IACzF,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC9E,OAAO,IAAI,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;AACrF,CAAC;AAED;;;;GAIG;AACH,MAAM,QAAQ,GAAG,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC;AAEjD,gEAAgE;AAChE,SAAS,SAAS,CAAC,MAAc,EAAE,OAAe;IAChD,OAAO,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC;AAC9D,CAAC"}

package/dist/client/manifest.d.ts

@@ -0,0 +1,68 @@
+import type { NormalizedAssetConfig } from "../workers-sdk/packages/workers-shared/asset-worker/src/types.js";
+/**
+ * The format of `Assets`. `serveSite` refuses assets of another format, which only a deploy with
+ * another release of this package writes.
+ */
+export declare const ASSETS_FORMAT = 1;
+/**
+ * The header with which the CLI, after the push, asks the served code to mark its version live. Its
+ * value is the site's `markToken`; a request without it is an ordinary request.
+ */
+export declare const MARK_HEADER = "Convex-Hosting-Mark";
+/** The path of that request, which names it in logs; the header alone decides. */
+export declare const MARK_PATH = "/.convex-hosting/mark";
+/**
+ * The static assets of one version, as `.convex-hosting/version.js` exports them under `assets`,
+ * Cloudflare's name for them: the version's id, and everything that serving reads, so that a
+ * request reads no database. `files` is `null` in the code that a first install pushes before its
+ * upload, which serves nothing.
+ */
+export type Assets = {
+    /** `ASSETS_FORMAT` of the release that wrote it. */
+    format: number;
+    versionId: string;
+    /**
+     * The CLI sends it after the push, so that only the CLI makes the served code mark its version
+     * live; another request with the header pays nothing more than any other request.
+     */
+    markToken: string;
+    files: AssetFiles | null;
+};
+export type AssetFiles = {
+    /** The deployment's `CONVEX_CLOUD_URL` at the upload: the origin of every storage URL. */
+    cloudUrl: string;
+    /** Cloudflare's normalized `AssetConfig` for the version, as its handler takes it. */
+    config: NormalizedAssetConfig;
+    /**
+     * Cloudflare's asset manifest, in base64, which Cloudflare's own reader searches. The tail of an
+     * entry, which Cloudflare leaves zero, holds the indexes of its URL and its content type.
+     */
+    manifest: string;
+    contentTypes: string[];
+    /**
+     * The storage URL of each stored file is `urlPrefix`, its key, and `urlSuffix`. The keys are one
+     * string, `urlKeyWidth` characters each, padded with spaces: Convex evaluates the module for
+     * every request, and one string costs less than an array of 100,000.
+     */
+    urlPrefix: string;
+    urlSuffix: string;
+    urlKeys: string;
+    urlKeyWidth: number;
+};
+/** Where an entry's tail, after the content hash, keeps the index of its URL (a big-endian u32). */
+export declare const TAIL_URL = 0;
+/** Where the tail keeps the index of the content type (a big-endian u16). */
+export declare const TAIL_CONTENT_TYPE = 4;
+/** The content type index of an entry without a content type. */
+export declare const NO_CONTENT_TYPE = 65535;
+export type ManifestHit = {
+    /** The hex of the content hash, which is the ETag, as on Cloudflare. */
+    eTag: string;
+    url: string;
+    contentType: string | undefined;
+};
+/**
+ * Decodes the manifest once, like Cloudflare's `AssetsManifest`, and returns its lookup: it finds the
+ * entry of a path with Cloudflare's binary search, or returns `null`.
+ */
+export declare function manifestLookup(files: AssetFiles): (path: string) => Promise<ManifestHit | null>;

package/dist/client/manifest.js

@@ -0,0 +1,48 @@
+import { binarySearch, hashPath, } from "../workers-sdk/packages/workers-shared/asset-worker/src/assets-manifest.js";
+import { CONTENT_HASH_SIZE } from "../workers-sdk/packages/workers-shared/utils/constants.js";
+/**
+ * The format of `Assets`. `serveSite` refuses assets of another format, which only a deploy with
+ * another release of this package writes.
+ */
+export const ASSETS_FORMAT = 1;
+/**
+ * The header with which the CLI, after the push, asks the served code to mark its version live. Its
+ * value is the site's `markToken`; a request without it is an ordinary request.
+ */
+export const MARK_HEADER = "Convex-Hosting-Mark";
+/** The path of that request, which names it in logs; the header alone decides. */
+export const MARK_PATH = "/.convex-hosting/mark";
+/** Where an entry's tail, after the content hash, keeps the index of its URL (a big-endian u32). */
+export const TAIL_URL = 0;
+/** Where the tail keeps the index of the content type (a big-endian u16). */
+export const TAIL_CONTENT_TYPE = 4;
+/** The content type index of an entry without a content type. */
+export const NO_CONTENT_TYPE = 0xffff;
+/**
+ * Decodes the manifest once, like Cloudflare's `AssetsManifest`, and returns its lookup: it finds the
+ * entry of a path with Cloudflare's binary search, or returns `null`.
+ */
+export function manifestLookup(files) {
+    const manifest = fromBase64(files.manifest);
+    return async (path) => {
+        const contentHash = binarySearch(manifest, await hashPath(path));
+        if (contentHash === false)
+            return null;
+        const tail = new DataView(contentHash.buffer, contentHash.byteOffset + CONTENT_HASH_SIZE);
+        const key = tail.getUint32(TAIL_URL) * files.urlKeyWidth;
+        const contentType = tail.getUint16(TAIL_CONTENT_TYPE);
+        return {
+            eTag: Array.from(contentHash, (byte) => byte.toString(16).padStart(2, "0")).join(""),
+            url: files.urlPrefix +
+                files.urlKeys.slice(key, key + files.urlKeyWidth).trimEnd() +
+                files.urlSuffix,
+            contentType: contentType === NO_CONTENT_TYPE ? undefined : files.contentTypes[contentType],
+        };
+    };
+}
+/** Convex's runtime decodes base64 natively; Node before 25, where tests run, does not. */
+function fromBase64(text) {
+    const decoded = Uint8Array.fromBase64?.(text);
+    return decoded ?? Uint8Array.from(atob(text), (char) => char.charCodeAt(0));
+}
+//# sourceMappingURL=manifest.js.map

package/dist/client/manifest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manifest.js","sourceRoot":"","sources":["../../src/client/manifest.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EACZ,QAAQ,GACT,MAAM,4EAA4E,CAAC;AAEpF,OAAO,EAAE,iBAAiB,EAAE,MAAM,2DAA2D,CAAC;AAE9F;;;GAGG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,CAAC;AAE/B;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,qBAAqB,CAAC;AAEjD,kFAAkF;AAClF,MAAM,CAAC,MAAM,SAAS,GAAG,uBAAuB,CAAC;AA0CjD,oGAAoG;AACpG,MAAM,CAAC,MAAM,QAAQ,GAAG,CAAC,CAAC;AAC1B,6EAA6E;AAC7E,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC;AACnC,iEAAiE;AACjE,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC;AAStC;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,KAAiB;IAC9C,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC5C,OAAO,KAAK,EAAE,IAAY,EAA+B,EAAE;QACzD,MAAM,WAAW,GAAG,YAAY,CAAC,QAAQ,EAAE,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QACjE,IAAI,WAAW,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC;QACvC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,WAAW,CAAC,MAAM,EAAE,WAAW,CAAC,UAAU,GAAG,iBAAiB,CAAC,CAAC;QAC1F,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,WAAW,CAAC;QACzD,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;QACtD,OAAO;YACL,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YACpF,GAAG,EACD,KAAK,CAAC,SAAS;gBACf,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,GAAG,KAAK,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE;gBAC3D,KAAK,CAAC,SAAS;YACjB,WAAW,EAAE,WAAW,KAAK,eAAe,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,WAAW,CAAC;SAC3F,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED,2FAA2F;AAC3F,SAAS,UAAU,CAAC,IAAY;IAC9B,MAAM,OAAO,GAAI,UAA4D,CAAC,UAAU,EAAE,CAAC,IAAI,CAAC,CAAC;IACjG,OAAO,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;AAC9E,CAAC"}

package/dist/client/version-module.d.ts

@@ -2,5 +2,5 @@
 // fresh clone, before its first deploy. Script file on purpose: a wildcard module name is only allowed
 // in an ambient context.
 declare module "*/.convex-hosting/version.js" {
-  export const versionId: string;
+  export const assets: import("./manifest.js").Assets;
 }

package/dist/component/_generated/component.d.ts

@@ -21,24 +21,8 @@ import type { FunctionReference } from "convex/server";
 export type ComponentApi<Name extends string | undefined = string | undefined> = {
     lib: {
         markLive: FunctionReference<"mutation", "internal", {
+            arrivedAt: number;
             versionId: string;
-        }, null, Name>;
-        route: FunctionReference<"query", "internal", {
-            hasUserWorker: boolean;
-            headers: Record<string, string>;
-            method: string;
-            url: string;
-            versionId: string;
-        }, {
-            asset: null | {
-                bodyUrl: string | null;
-                headers: Array<{
-                    name: string;
-                    value: string;
-                }>;
-                status: number;
-            };
-            state: "uploading" | "ready" | "live" | "deleting" | null;
-        }, Name>;
+        }, "marked" | "live" | "superseded" | "uploading" | "deleting" | "missing", Name>;
     };
 };

package/dist/component/lib.d.ts

@@ -95,20 +95,25 @@ export declare const finishVersion: import("convex/server").RegisteredMutation<"
     versionId: string;
 }, Promise<null>>;
 /**
- * Marks a `ready` version `live` and schedules `collect`. `serveSite` calls it at each request that
- * finds the version `ready`. An older upload never goes live over a newer one: the mark does nothing
- * when a live version was created after this one. So a request that started on replaced code, and
- * reaches its lookup or its mark after the new code's first request marked the new version, cannot
- * make the old version newest, and `collect` cannot delete the new version's files. A version that
- * is already live stays as it is, so concurrent first requests are fine.
+ * Marks a `ready` version `live` and schedules `collect`, and says what it did. `serveSite` calls
+ * it for the request that the CLI sends after the push, with the site's mark token, so only the
+ * code that serves marks its own version. A version that is already live stays as it is, so a
+ * repeated mark is fine. It never throws, so the CLI reads every outcome from the answer.
  *
- * Precondition: deploys to one deployment do not overlap. When two overlap and the older upload is
- * pushed last, its requests look like requests of replaced code: its version serves but stays
- * `ready`, and nothing is deleted until the next deploy.
+ * The request may still run when its code is replaced, so two rules refuse a mark of replaced code.
+ * An older upload never goes live over a newer one: the mark does nothing when a live version was
+ * created after this one. And a mark is late when another version went live after its request
+ * arrived, at `arrivedAt`: that version's code has served since. `arrivedAt` is the HTTP action's
+ * clock and the live time is this mutation's, so the rule holds as far as the two agree.
+ *
+ * Precondition: deploys to one deployment do not overlap. When two overlap, the mark of the
+ * version that serves may be refused: it then stays `ready`, and nothing is deleted until the next
+ * deploy. The limits are in `docs/design.md`, "Stated, not solved".
  */
 export declare const markLive: import("convex/server").RegisteredMutation<"public", {
+    arrivedAt: number;
     versionId: string;
-}, Promise<null>>;
+}, Promise<"deleting" | "live" | "marked" | "missing" | "superseded" | "uploading">>;
 /**
  * One chain of calls, one batch per call, each scheduling the next with `runAfter(0)` while work
  * remains. First the `_storage` files that no entry references and that are older than
@@ -146,40 +151,4 @@ export declare const collect: import("convex/server").RegisteredMutation<"intern
         kind: "versions";
     };
 }, Promise<null>>;
-/**
- * Runs Cloudflare's asset handler for one request against one version. `state` is the kind of the
- * version's state, or `null` when the version does not exist. `asset` is `null` when the version is
- * uploading, being deleted, or does not exist, or when no asset answers.
- *
- * `hasUserWorker` is Cloudflare's `has_user_worker`: whether the app has code that answers a miss.
- * With it, Cloudflare's router asks `canFetch` first, which keeps `not_found_handling` for
- * navigations only, and the app answers the other misses. Without it, every request goes to
- * `handleRequest`, so `not_found_handling` applies to all of them, and an asset always answers.
- */
-export declare const route: import("convex/server").RegisteredQuery<"public", {
-    hasUserWorker: boolean;
-    headers: Record<string, string>;
-    method: string;
-    url: string;
-    versionId: string;
-}, Promise<{
-    state: null;
-    asset: null;
-} | {
-    state: "deleting" | "uploading";
-    asset: null;
-} | {
-    state: "live" | "ready";
-    asset: null;
-} | {
-    state: "live" | "ready";
-    asset: {
-        status: number;
-        headers: {
-            name: string;
-            value: string;
-        }[];
-        bodyUrl: string | null;
-    };
-}>>;
 export {};