@substrat-run/control-plane-api 0.34.0 → 0.36.0

package/dist/api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../src/api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AA2B5B,OAAO,KAAK,EAAE,eAAe,EAA4B,MAAM,yBAAyB,CAAC;AACzF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAEtD,OAAO,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC3E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAe3D,OAAO,KAAK,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAC5E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAGtD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAGL,KAAK,yBAAyB,EAC/B,MAAM,uBAAuB,CAAC;AAE/B,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,SAAS,CAAC;IAChB;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC3C;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IAChG;;;;;;;;;OASG;IACH,sBAAsB,CAAC,EAAE,CACvB,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,eAAe,KACnB,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IACzC;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,CAAC,aAAa,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IACpF;;;;;OAKG;IACH,cAAc,CAAC,EAAE,gBAAgB,CAAC;IAClC;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,sBAAsB,CAAC;IAC9C;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,qBAAqB,CAAC;IAC5C;;;;OAIG;IACH,YAAY,EAAE,iBAAiB,CAAC;IAChC;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,WAAW,CAAC;IAClC;;;;;OAKG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,yBAAyB,CAAC;IAC9C;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;CAChC;AAKD,KAAK,IAAI,GAAG;IAAE,KAAK,EAAE,eAAe,CAAC;IAAC,SAAS,EAAE,SAAS,CAAA;CAAE,CAAC;AA4J7D;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,sBAAsB,GAAG,IAAI,CAAC;IAAE,SAAS,EAAE,IAAI,CAAA;CAAE,CAAC,CA0lEhG"}
+{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../src/api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AA2B5B,OAAO,KAAK,EAAE,eAAe,EAA4B,MAAM,yBAAyB,CAAC;AACzF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAGtD,OAAO,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC3E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAe3D,OAAO,KAAK,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAC5E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAGtD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAGL,KAAK,yBAAyB,EAC/B,MAAM,uBAAuB,CAAC;AAE/B,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,SAAS,CAAC;IAChB;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC3C;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IAChG;;;;;;;;;OASG;IACH,sBAAsB,CAAC,EAAE,CACvB,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,eAAe,KACnB,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IACzC;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,CAAC,aAAa,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IACpF;;;;;OAKG;IACH,cAAc,CAAC,EAAE,gBAAgB,CAAC;IAClC;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,sBAAsB,CAAC;IAC9C;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,qBAAqB,CAAC;IAC5C;;;;OAIG;IACH,YAAY,EAAE,iBAAiB,CAAC;IAChC;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,WAAW,CAAC;IAClC;;;;;OAKG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,yBAAyB,CAAC;IAC9C;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;CAChC;AAKD,KAAK,IAAI,GAAG;IAAE,KAAK,EAAE,eAAe,CAAC;IAAC,SAAS,EAAE,SAAS,CAAA;CAAE,CAAC;AA4J7D;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,sBAAsB,GAAG,IAAI,CAAC;IAAE,SAAS,EAAE,IAAI,CAAA;CAAE,CAAC,CAgoEhG"}

package/dist/api.js

@@ -1,6 +1,7 @@
 import { Hono } from 'hono';
 import { adminAction, channelName, createTenantInput, entitlementGrantInput, hostname as hostnameSchema, hostnameRegion, hostnameStatus, identityLink, principalId as principalIdSchema, promotionAcknowledgement, provisionableJurisdiction, publishVersionInput, queryScopeInput, readScopeTableInput, registerVerticalInput, scopeDump, scopeId as scopeIdSchema, scopeStatus, storageShape, surfaceName, tenantId as tenantIdSchema, tenantStatus, z, } from '@substrat-run/contracts';
 import { migrationProgress, ulid } from '@substrat-run/kernel';
+import { TENANT_HEADER } from './auth.js';
 import { ControlPlaneError } from './client.js';
 import { provisionSiblingScope } from './platform-drain.js';
 import { mapError } from './errors.js';
@@ -500,8 +501,7 @@ export function createControlPlaneApi(options) {
     // prod-channel/static (a scope with no bound version), then to reading this host's own
     // scope DB directly (a co-located host, or the contract tests — data is right here).
     const verticalForScope = async (c, scope) => {
-        const slug = scope.vertical;
-        if (!slug)
+        if (!scope.vertical)
             return undefined;
         const actor = c.get('actor');
         // A scope on the stable serving script (#286) is reached THERE — that script holds
@@ -511,12 +511,29 @@ export function createControlPlaneApi(options) {
             if (serving)
                 return serving;
         }
-        if (scope.verticalVersionId && options.resolveVerticalVersion) {
-            const bound = await options.resolveVerticalVersion(slug, scope.verticalVersionId, actor);
-            if (bound)
-                return bound;
-        }
-        return options.verticals?.[slug] ?? (await options.resolveVertical?.(slug, actor));
+        const bySlug = async (slug) => {
+            if (scope.verticalVersionId && options.resolveVerticalVersion) {
+                const bound = await options.resolveVerticalVersion(slug, scope.verticalVersionId, actor);
+                if (bound)
+                    return bound;
+            }
+            return options.verticals?.[slug] ?? (await options.resolveVertical?.(slug, actor));
+        };
+        const direct = await bySlug(scope.vertical);
+        if (direct)
+            return direct;
+        // Miss path only (#417) — a resolved scope never pays for these registry reads: a
+        // scope bound to a BARE slug that is not registered, while the owning tenant's
+        // prefixed registration of the same name exists, is addressing the prefixed lineage
+        // under its bare spelling. Retry once under the registry id; anything else still
+        // misses and surfaces through `diagnoseUnboundScope` as before.
+        if (scope.tenantId && !scope.vertical.includes('/') && (await ownerOf(actor, scope.vertical)) === undefined) {
+            const tenant = await admin.getTenant(actor, scope.tenantId).catch(() => null);
+            const prefixed = tenant ? `${tenant.slug}/${scope.vertical}` : null;
+            if (prefixed && (await ownerOf(actor, prefixed)) !== undefined)
+                return bySlug(prefixed);
+        }
+        return undefined;
     };
     /**
      * Why a scope's vertical did not resolve to a running deployment — an ACTIONABLE 501
@@ -1075,7 +1092,7 @@ export function createControlPlaneApi(options) {
     // re-run resumes from there (each adopt is data-first and retry-safe).
     app.post('/verticals/:slug/adopt-serving', async (c) => {
         const p = c.get('principal');
-        const slug = effectiveSlug(p, c.req.param('slug'));
+        const slug = await resolveVerticalId(c, c.req.param('slug'));
         const actor = c.get('actor');
         if (p.kind === 'builder') {
             const v = await verticalOf(actor, slug);
@@ -1241,6 +1258,33 @@ export function createControlPlaneApi(options) {
     // slug carrying any OTHER tenant's prefix yields a two-slash id that fails
     // `verticalSlug` validation / the ownership check downstream — fail-closed.
     const effectiveSlug = (p, raw) => p.kind === 'builder' ? (raw.startsWith(`${p.tenantSlug}/`) ? raw : `${p.tenantSlug}/${raw}`) : raw;
+    // The ONE (bare slug, tenant context) → registry id resolution for the routes that
+    // ADDRESS an existing vertical (#417). A builder's context is its auth (`effectiveSlug`,
+    // unchanged). STAFF acting for a workspace — the CLI over a service token, the
+    // dashboard's tenant-narrowed seam — name it via the same `x-substrat-tenant` header a
+    // builder session uses, and the prefix is formed exactly as a pinned push forms it: a
+    // bare slug the pinned workspace owns stays itself (staff hand-registrations predate
+    // prefixed claims), otherwise `<workspace.slug>/<slug>` — but only when that row
+    // EXISTS. Addressing never redirects to a lineage that is not there: a platform-owned
+    // bare slug under an irrelevant pin, and an unknown pin, resolve to the raw slug —
+    // exactly the pre-#417 behavior. Registration and deploy keep their own CLAIM
+    // semantics; this helper only addresses lineages, it never decides where one lands.
+    const resolveVerticalId = async (c, raw) => {
+        const p = c.get('principal');
+        if (p.kind === 'builder')
+            return effectiveSlug(p, raw);
+        const pin = c.req.header(TENANT_HEADER)?.trim();
+        if (!pin)
+            return raw;
+        const actor = c.get('actor');
+        const workspace = (await admin.listTenants(actor)).find((t) => t.slug === pin || t.id === pin);
+        if (!workspace || raw.startsWith(`${workspace.slug}/`))
+            return raw;
+        if ((await ownerOf(actor, raw)) === workspace.id)
+            return raw;
+        const prefixed = `${workspace.slug}/${raw}`;
+        return (await ownerOf(actor, prefixed)) !== undefined ? prefixed : raw;
+    };
     app.get('/verticals', async (c) => {
         const all = await admin.listVerticals(c.get('actor'));
         const p = c.get('principal');
@@ -1269,7 +1313,7 @@ export function createControlPlaneApi(options) {
     });
     app.get('/verticals/:slug/versions', async (c) => {
         const p = c.get('principal');
-        const slug = effectiveSlug(p, c.req.param('slug'));
+        const slug = await resolveVerticalId(c, c.req.param('slug'));
         // A builder reading a vertical it does not own gets 404 — indistinguishable from
         // absent, the same fail-closed reflex K-3 uses for a cross-tenant scope.
         if (p.kind === 'builder' && (await ownerOf(p.actor, slug)) !== p.tenantId) {
@@ -1286,7 +1330,7 @@ export function createControlPlaneApi(options) {
             return c.json({ error: 'verticalSlug does not match the path' }, 400);
         }
         const p = c.get('principal');
-        const slug = effectiveSlug(p, input.verticalSlug);
+        const slug = await resolveVerticalId(c, input.verticalSlug);
         if (p.kind === 'builder' && (await ownerOf(p.actor, slug)) !== p.tenantId) {
             return c.json({ error: 'forbidden' }, 403);
         }
@@ -1303,7 +1347,7 @@ export function createControlPlaneApi(options) {
     // permission-diff checkpoint stays the human gate — this route only reads.
     app.get('/verticals/:slug/versions/:id/registry', async (c) => {
         const p = c.get('principal');
-        const slug = effectiveSlug(p, c.req.param('slug'));
+        const slug = await resolveVerticalId(c, c.req.param('slug'));
         if (p.kind === 'builder' && (await ownerOf(p.actor, slug)) !== p.tenantId) {
             return c.json({ error: 'not found' }, 404);
         }
@@ -1328,7 +1372,7 @@ export function createControlPlaneApi(options) {
     // may ask; the staff `listing` flip below is the review gate. Owner-checked (like promote).
     app.post('/verticals/:slug/publish-request', async (c) => {
         const p = c.get('principal');
-        const slug = effectiveSlug(p, c.req.param('slug'));
+        const slug = await resolveVerticalId(c, c.req.param('slug'));
         if (p.kind === 'builder' && (await ownerOf(p.actor, slug)) !== p.tenantId) {
             return c.json({ error: 'not found' }, 404);
         }
@@ -1363,7 +1407,7 @@ export function createControlPlaneApi(options) {
     });
     app.get('/verticals/:slug/channels', async (c) => {
         const p = c.get('principal');
-        const slug = effectiveSlug(p, c.req.param('slug'));
+        const slug = await resolveVerticalId(c, c.req.param('slug'));
         if (p.kind === 'builder' && (await ownerOf(p.actor, slug)) !== p.tenantId) {
             return c.json({ error: 'not found' }, 404);
         }
@@ -1374,7 +1418,7 @@ export function createControlPlaneApi(options) {
     // history, and a foreign slug 404s indistinguishably from an absent one.
     app.get('/verticals/:slug/channels/:channel/history', async (c) => {
         const p = c.get('principal');
-        const slug = effectiveSlug(p, c.req.param('slug'));
+        const slug = await resolveVerticalId(c, c.req.param('slug'));
         const channel = channelName.parse(c.req.param('channel'));
         if (p.kind === 'builder' && (await ownerOf(p.actor, slug)) !== p.tenantId) {
             return c.json({ error: 'not found' }, 404);
@@ -1446,7 +1490,7 @@ export function createControlPlaneApi(options) {
     };
     app.post('/verticals/:slug/channels/:channel/promote', async (c) => {
         const p = c.get('principal');
-        const slug = effectiveSlug(p, c.req.param('slug'));
+        const slug = await resolveVerticalId(c, c.req.param('slug'));
         const channel = channelName.parse(c.req.param('channel'));
         if (p.kind === 'builder') {
             // A builder promotes only verticals it owns — and prod only while the vertical
@@ -2012,7 +2056,7 @@ export function createControlPlaneApi(options) {
     // makes a self-serve act; a listed vertical's prod is staff-gated (marketplace-publish.md §2).
     const previewVertical = async (c) => {
         const p = c.get('principal');
-        const slug = effectiveSlug(p, c.req.param('slug'));
+        const slug = await resolveVerticalId(c, c.req.param('slug'));
         const v = await verticalOf(c.get('actor'), slug);
         if (!v)
             return { error: `unknown vertical '${slug}'`, status: 404 };