@steve31415/baselib 3.3.0 → 3.3.1

package/dist/deploy/deploy.js

@@ -12,7 +12,7 @@ import { DEFAULT_ACCOUNT, loadConfig, loadHooks } from './config.js';
 import { must, mustJson } from './exec.js';
 import { openEvidence, PhaseTimer } from './evidence.js';
 import { acquireLock, clearHold, publishRetainedAssets, readHold, readReleaseRecord, releaseLock, verifyLock, writeReleaseRecord, } from './gcs.js';
-import { consistentBaseSha, servingStateOf, SHA40 } from './plan.js';
+import { consistentBaseSha, readServingState, SHA40 } from './plan.js';
 const RELEASE_DEADLINE_MS = 25 * 60_000;
 const IMAGE_DIGEST = /@sha256:[0-9a-f]{64}$/;
 export async function runDeploy(options) {
@@ -87,12 +87,9 @@ export async function runDeploy(options) {
         }
         const serving = [];
         for (const service of config.services) {
-            const described = await mustJson(runner, 'gcloud', [
-                'run', 'services', 'describe', service.name,
-                ...gcloudBase, '--region', config.region, '--format=json',
-            ]);
+            const { described, state } = await readServingState(runner, gcloudBase, config.region, service.name);
             await evidence.save(`${service.name}-before.json`, JSON.stringify(described, null, 2));
-            serving.push(servingStateOf(service.name, described));
+            serving.push(state);
         }
         const base = consistentBaseSha(serving, sha);
         if (!base.ok)

package/dist/deploy/plan.d.ts

@@ -1,4 +1,4 @@
-import type { ServingState } from './types.js';
+import type { Runner, ServingState } from './types.js';
 export declare const SHA40: RegExp;
 /** Lock staleness is judged from the GCS object's server-side timeCreated,
  *  never from anything the lock writer wrote (its clock may be wrong). */
@@ -41,8 +41,32 @@ export declare function pickRevisionForSha(revisions: unknown[], targetSha: stri
     revision: string;
     imageDigest: string;
 } | null;
-/** Extract serving state from a `gcloud run services describe --format=json`. */
-export declare function servingStateOf(service: string, described: unknown): ServingState;
+/** The one revision carrying 100% of traffic in a `gcloud run services
+ *  describe --format=json`, from *observed* traffic (`status.traffic`, never
+ *  `spec.traffic`, which is only the desired state). */
+export declare function servingRevisionName(service: string, described: unknown): string;
+/**
+ * Extract serving state from a `gcloud run services describe --format=json`.
+ *
+ * The serving revision's BUILD_ID and image are read from the service
+ * template only when that revision IS the latest created one. When it is
+ * not — a previous release created a revision that never took traffic (a
+ * failed secret-access check, a crashed startup, an aborted deploy) — the
+ * template describes the *wrong* revision, so the caller must pass that
+ * revision's own `gcloud run revisions describe --format=json` as
+ * `servingRevision` (readServingState does). Lesson 2026-09-04, watchdog2:
+ * a re-run after a failed traffic switch read the new SHA out of the
+ * template, logged "already serving", wrote the release record, and left
+ * the old revision serving.
+ */
+export declare function servingStateOf(service: string, described: unknown, servingRevision?: unknown): ServingState;
+/** Describe a service and resolve its serving state, describing the serving
+ *  revision too whenever the template no longer belongs to it. Returns the
+ *  raw service description as well, for evidence. */
+export declare function readServingState(runner: Runner, gcloudBase: string[], region: string, service: string): Promise<{
+    described: unknown;
+    state: ServingState;
+}>;
 export declare function contentTypeFor(path: string): string;
 /** Parse release-record listing rows into {sha, at} entries. */
 export declare function releaseEntriesFrom(rows: {

package/dist/deploy/plan.js

@@ -1,6 +1,7 @@
 // Pure decision logic for pw-deploy/pw-rollback: everything here is
 // side-effect-free so the concurrency-sensitive choices (lock staleness,
 // rollback targeting, serving-state consistency) are unit-tested directly.
+import { mustJson } from './exec.js';
 export const SHA40 = /^[0-9a-f]{40}$/;
 /** Lock staleness is judged from the GCS object's server-side timeCreated,
  *  never from anything the lock writer wrote (its clock may be wrong). */
@@ -101,22 +102,71 @@ export function pickRevisionForSha(revisions, targetSha) {
     matches.sort((a, b) => b.created - a.created);
     return matches[0] ? { revision: matches[0].revision, imageDigest: matches[0].imageDigest } : null;
 }
-/** Extract serving state from a `gcloud run services describe --format=json`. */
-export function servingStateOf(service, described) {
+/** The one revision carrying 100% of traffic in a `gcloud run services
+ *  describe --format=json`, from *observed* traffic (`status.traffic`, never
+ *  `spec.traffic`, which is only the desired state). */
+export function servingRevisionName(service, described) {
     const d = described;
     const active = (d.status?.traffic ?? []).filter((t) => (t.percent ?? 0) === 100);
     if (active.length !== 1 || !active[0].revisionName) {
         throw new Error(`${service}: expected exactly one 100% traffic target`);
     }
-    const env = d.spec?.template?.spec?.containers?.[0]?.env ?? [];
+    return active[0].revisionName;
+}
+/**
+ * Extract serving state from a `gcloud run services describe --format=json`.
+ *
+ * The serving revision's BUILD_ID and image are read from the service
+ * template only when that revision IS the latest created one. When it is
+ * not — a previous release created a revision that never took traffic (a
+ * failed secret-access check, a crashed startup, an aborted deploy) — the
+ * template describes the *wrong* revision, so the caller must pass that
+ * revision's own `gcloud run revisions describe --format=json` as
+ * `servingRevision` (readServingState does). Lesson 2026-09-04, watchdog2:
+ * a re-run after a failed traffic switch read the new SHA out of the
+ * template, logged "already serving", wrote the release record, and left
+ * the old revision serving.
+ */
+export function servingStateOf(service, described, servingRevision) {
+    const d = described;
+    const revision = servingRevisionName(service, described);
+    const latest = d.status?.latestCreatedRevisionName;
+    let container;
+    if (latest === undefined || latest === revision) {
+        container = d.spec?.template?.spec?.containers?.[0];
+    }
+    else if (servingRevision !== undefined) {
+        container = servingRevision.spec?.containers?.[0];
+    }
+    else {
+        throw new Error(`${service}: traffic serves ${revision} but the latest revision is ${latest}; ` +
+            'the serving revision must be described separately');
+    }
+    const env = container?.env ?? [];
     const buildSha = env.find((e) => e.name === 'BUILD_ID')?.value ?? null;
     return {
         service,
-        revision: active[0].revisionName,
+        revision,
         buildSha: buildSha !== null && SHA40.test(buildSha) ? buildSha : null,
-        imageDigest: d.spec?.template?.spec?.containers?.[0]?.image ?? null,
+        imageDigest: container?.image ?? null,
     };
 }
+/** Describe a service and resolve its serving state, describing the serving
+ *  revision too whenever the template no longer belongs to it. Returns the
+ *  raw service description as well, for evidence. */
+export async function readServingState(runner, gcloudBase, region, service) {
+    const described = await mustJson(runner, 'gcloud', [
+        'run', 'services', 'describe', service, ...gcloudBase, '--region', region, '--format=json',
+    ]);
+    const revision = servingRevisionName(service, described);
+    const latest = described.status?.latestCreatedRevisionName;
+    const servingRevision = latest !== undefined && latest !== revision
+        ? await mustJson(runner, 'gcloud', [
+            'run', 'revisions', 'describe', revision, ...gcloudBase, '--region', region, '--format=json',
+        ])
+        : undefined;
+    return { described, state: servingStateOf(service, described, servingRevision) };
+}
 const CONTENT_TYPES = {
     '.js': 'text/javascript',
     '.mjs': 'text/javascript',

package/dist/deploy/rollback.js

@@ -8,7 +8,7 @@ import { must, mustJson } from './exec.js';
 import { openEvidence, PhaseTimer } from './evidence.js';
 import { acquireLock, listReleaseRecords, placeHold, releaseLock } from './gcs.js';
 import { DEFAULT_ACCOUNT, loadConfig } from './config.js';
-import { pickRevisionForSha, releaseEntriesFrom, selectRollbackTarget, servingStateOf, SHA40, } from './plan.js';
+import { pickRevisionForSha, releaseEntriesFrom, selectRollbackTarget, readServingState, SHA40, } from './plan.js';
 export async function runRollback(options) {
     const log = options.log ?? ((m) => console.error(`[pw-rollback] ${m}`));
     const runner = options.runner;
@@ -39,11 +39,8 @@ export async function runRollback(options) {
         timer.enter('target');
         const serving = [];
         for (const service of config.services) {
-            const described = await mustJson(runner, 'gcloud', [
-                'run', 'services', 'describe', service.name,
-                ...gcloudBase, '--region', config.region, '--format=json',
-            ]);
-            serving.push(servingStateOf(service.name, described));
+            const { state } = await readServingState(runner, gcloudBase, config.region, service.name);
+            serving.push(state);
         }
         const evidence = await openEvidence(config.app, requested ?? serving[0].buildSha ?? 'rollback');
         evidenceDir = evidence.dir;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@steve31415/baselib",
-  "version": "3.3.0",
+  "version": "3.3.1",
   "description": "Plasticine new-world shared platform library: logging, auth, service-to-service auth, db, HTTP, sync, app updates",
   "type": "module",
   "license": "MIT",