@substrat-run/control-plane-api 0.48.1 → 0.49.0

package/dist/api.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../src/api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AA6B5B,OAAO,KAAK,EAGV,eAAe,EAIhB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAGtD,OAAO,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC3E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAe3D,OAAO,KAAK,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAC5E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAQtD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAGL,KAAK,yBAAyB,EAC/B,MAAM,uBAAuB,CAAC;AAE/B,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,SAAS,CAAC;IAChB;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC3C;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IAChG;;;;;;;;;OASG;IACH,sBAAsB,CAAC,EAAE,CACvB,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,eAAe,KACnB,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IACzC;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,CAAC,aAAa,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IACpF;;;;;OAKG;IACH,cAAc,CAAC,EAAE,gBAAgB,CAAC;IAClC;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,sBAAsB,CAAC;IAC9C;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,qBAAqB,CAAC;IAC5C;;;;;;;;OAQG;IACH,sBAAsB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C;;;;OAIG;IACH,YAAY,EAAE,iBAAiB,CAAC;IAChC;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,WAAW,CAAC;IAClC;;;;;OAKG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,yBAAyB,CAAC;IAC9C;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;CAChC;AAKD,KAAK,IAAI,GAAG;IAAE,KAAK,EAAE,eAAe,CAAC;IAAC,SAAS,EAAE,SAAS,CAAA;CAAE,CAAC;AA8M7D;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,sBAAsB,GAAG,IAAI,CAAC;IAAE,SAAS,EAAE,IAAI,CAAA;CAAE,CAAC,CAygFhG"}
+{"version":3,"file":"api.d.ts","sourceRoot":"","sources":["../src/api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AA+B5B,OAAO,KAAK,EAGV,eAAe,EAIhB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAGtD,OAAO,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC3E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAe3D,OAAO,KAAK,EAAe,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AACzF,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAQtD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAGL,KAAK,yBAAyB,EAC/B,MAAM,uBAAuB,CAAC;AAE/B,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,SAAS,CAAC;IAChB;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC3C;;;;;;OAMG;IACH,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IAChG;;;;;;;;;OASG;IACH,sBAAsB,CAAC,EAAE,CACvB,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,eAAe,KACnB,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IACzC;;;;;;;OAOG;IACH,kBAAkB,CAAC,EAAE,CAAC,aAAa,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IACpF;;;;;OAKG;IACH,cAAc,CAAC,EAAE,gBAAgB,CAAC;IAClC;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,sBAAsB,CAAC;IAC9C;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,qBAAqB,CAAC;IAC5C;;;;;;;;OAQG;IACH,sBAAsB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3C;;;;OAIG;IACH,YAAY,EAAE,iBAAiB,CAAC;IAChC;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,WAAW,CAAC;IAClC;;;;;OAKG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,yBAAyB,CAAC;IAC9C;;;;;;OAMG;IACH,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;CAChC;AAKD,KAAK,IAAI,GAAG;IAAE,KAAK,EAAE,eAAe,CAAC;IAAC,SAAS,EAAE,SAAS,CAAA;CAAE,CAAC;AA8M7D;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,sBAAsB,GAAG,IAAI,CAAC;IAAE,SAAS,EAAE,IAAI,CAAA;CAAE,CAAC,CA8oFhG"}

package/dist/api.js

@@ -1,5 +1,5 @@
 import { Hono } from 'hono';
-import { adminAction, channelName, createTenantInput, entitlementGrantInput, hostname as hostnameSchema, hostnameRegion, hostnameStatus, identityLink, listPageQuery, pageOf, principalId as principalIdSchema, promotionAcknowledgement, provisionableJurisdiction, publishVersionInput, queryScopeInput, readScopeTableInput, registerVerticalInput, scopeDump, scopeId as scopeIdSchema, scopeStatus, storageShape, surfaceName, tenantId as tenantIdSchema, tenantStatus, z, } from '@substrat-run/contracts';
+import { adminAction, ASSET_PART_PREFIX, assetHash, channelName, createTenantInput, entitlementGrantInput, hostname as hostnameSchema, hostnameRegion, hostnameStatus, identityLink, listPageQuery, pageOf, principalId as principalIdSchema, promotionAcknowledgement, provisionableJurisdiction, publishVersionInput, queryScopeInput, readScopeTableInput, registerVerticalInput, scopeDump, scopeId as scopeIdSchema, scopeStatus, storageShape, surfaceName, tenantId as tenantIdSchema, tenantStatus, z, } from '@substrat-run/contracts';
 import { migrationProgress, ulid } from '@substrat-run/kernel';
 import { TENANT_HEADER } from './auth.js';
 import { ControlPlaneError } from './client.js';
@@ -1578,6 +1578,22 @@ export function createControlPlaneApi(options) {
         const registry = json ? (storedDeployManifest.parse(JSON.parse(json)).registry ?? null) : null;
         return c.json({ registry });
     });
+    // The static files (#340) one version ships: path, size, content type, content address —
+    // read straight out of the retained manifest, which is where they were persisted for the
+    // promote path anyway. Owner-narrowed exactly like the registry route above. `assets` is
+    // null for a version that retained no manifest (pushed pre-#286) or shipped no static
+    // files; the two are distinguishable by the caller only as "nothing to show", which is
+    // all the dashboard panel needs to render an empty state.
+    app.get('/verticals/:slug/versions/:id/assets', async (c) => {
+        const p = c.get('principal');
+        const slug = await resolveVerticalId(c, c.req.param('slug'));
+        if (p.kind === 'builder' && (await ownerOf(p.actor, slug)) !== p.tenantId) {
+            return c.json({ error: 'not found' }, 404);
+        }
+        const json = await admin.versionManifest(c.get('actor'), slug, c.req.param('id'));
+        const assets = json ? (storedDeployManifest.parse(JSON.parse(json)).assets ?? null) : null;
+        return c.json({ assets });
+    });
     app.post('/verticals/:slug/versions/:id/admit', async (c) => {
         const slug = c.req.param('slug');
         const id = c.req.param('id');
@@ -1725,6 +1741,13 @@ export function createControlPlaneApi(options) {
             modules,
             doClasses: manifest.doClasses,
             bindings: [...manifest.bindings, ...storeBindings],
+            // #340: the version's static files travel with it onto the serving script — from
+            // the RETAINED manifest, with no bytes. An asset upload session is driven by
+            // content addresses, and the runtime's asset store is namespace-wide and deduped,
+            // so re-declaring the same hashes re-attaches the same files. This is why the
+            // manifest is retained rather than the bytes: the archive script gives back the
+            // modules (#286), and the asset store gives back the assets.
+            ...(manifest.assets ? { assets: manifest.assets } : {}),
         }, serving
             ? { priorDoClasses: serving.doClasses, priorMigrationTag: serving.migrationTag }
             : undefined);
@@ -1915,21 +1938,72 @@ export function createControlPlaneApi(options) {
                 }, 409);
             }
         }
+        // Two kinds of part in one body (#340): worker MODULES (unprefixed) and static ASSETS
+        // (`asset:<served path>`). Splitting on the prefix — rather than on content type or on
+        // whether the manifest happens to name it — is what keeps an uploaded file from being
+        // able to enter the wrong pipeline.
         const modules = [];
+        const assetParts = new Map();
         for (const [name, value] of form.entries()) {
             if (name === 'manifest')
                 continue;
-            if (value instanceof File) {
-                modules.push({
-                    name,
-                    content: new Uint8Array(await value.arrayBuffer()),
-                    contentType: value.type || 'application/javascript+module',
-                });
+            if (!(value instanceof File))
+                continue;
+            if (name.startsWith(ASSET_PART_PREFIX)) {
+                assetParts.set(name.slice(ASSET_PART_PREFIX.length), value);
+                continue;
             }
+            modules.push({
+                name,
+                content: new Uint8Array(await value.arrayBuffer()),
+                contentType: value.type || 'application/javascript+module',
+            });
         }
         if (!modules.some((m) => m.name === manifest.entry)) {
             return c.json({ error: `entry module '${manifest.entry}' is not among the uploaded files` }, 400);
         }
+        // The static-asset half of the §4 sandbox contract (self-serve-deploy.md §4.1). The
+        // bytes are inert — no code, no authority — so they are ACCEPTED; the content-address
+        // is not, so it is VERIFIED. The runtime's asset store dedups by hash across the whole
+        // dispatch namespace, which means bytes stored under a hash they do not have would let
+        // one push decide what another vertical's identical-hash asset serves. Re-deriving the
+        // hash here (from the received bytes, with the same `assetHash` the CLI used) is what
+        // makes that structurally impossible — and it is the only inspection of the bytes we do.
+        const assets = [];
+        for (const file of manifest.assets?.files ?? []) {
+            const part = assetParts.get(file.path);
+            if (!part) {
+                return c.json({ error: `asset '${file.path}' is named in the manifest but was not uploaded` }, 400);
+            }
+            const content = new Uint8Array(await part.arrayBuffer());
+            if (content.byteLength !== file.size) {
+                return c.json({ error: `asset '${file.path}' declares ${file.size} bytes but ${content.byteLength} arrived` }, 400);
+            }
+            const actual = await assetHash(content, file.path);
+            if (actual !== file.hash) {
+                return c.json({
+                    error: `asset '${file.path}' does not match its declared content hash ` +
+                        `(declared ${file.hash}, computed ${actual}) — the hash is the runtime's shared dedup key, ` +
+                        `so a mismatch is refused rather than stored`,
+                }, 400);
+            }
+            assets.push({
+                path: file.path,
+                hash: file.hash,
+                size: file.size,
+                contentType: file.contentType,
+                content,
+            });
+            assetParts.delete(file.path);
+        }
+        if (assetParts.size > 0) {
+            // An unlisted asset part would be uploaded by nothing and served by nothing; saying so
+            // beats silently dropping it, because the builder's page would 404 with no explanation.
+            const extra = [...assetParts.keys()].slice(0, 5).join(', ');
+            return c.json({
+                error: `${assetParts.size} uploaded asset part(s) are absent from the manifest (${extra}${assetParts.size > 5 ? ', …' : ''})`,
+            }, 400);
+        }
         // Mint the version id first: the deploymentRef (the dispatch script name) is keyed
         // on it, so it is CF-valid and unique per version.
         const id = ulid();
@@ -1942,6 +2016,10 @@ export function createControlPlaneApi(options) {
                 modules,
                 doClasses: manifest.doClasses,
                 bindings: manifest.bindings,
+                // #340: the verified bytes go up with the bundle. The manifest's routing config
+                // rides along untouched — it decides what the RUNTIME does with paths, and carries
+                // no reach, so there is nothing in it for the sandbox contract to refuse.
+                ...(manifest.assets ? { assets: { ...manifest.assets, files: assets } } : {}),
             });
         }
         catch (e) {
@@ -2041,16 +2119,20 @@ export function createControlPlaneApi(options) {
         if (!options.observability) {
             return c.json({ error: 'observability is not configured on this control plane' }, 501);
         }
+        // `service` repeats: one deployed unit per param, so a caller can ask for a
+        // vertical's whole set (the dashboard's "all versions") in one query and get one
+        // merged stream back. Capped because each extra service is another backend query.
+        const services = (c.req.queries('service') ?? []).filter((s) => s.length > 0);
         const input = z
             .object({
-            service: z.string().min(1).max(200).optional(),
+            services: z.array(z.string().min(1).max(200)).max(20).optional(),
             level: z.enum(['log', 'info', 'warn', 'error', 'debug']).optional(),
             search: z.string().min(1).max(200).optional(),
             hours: z.coerce.number().int().min(1).max(72).default(1),
             limit: z.coerce.number().int().min(1).max(500).default(100),
         })
             .parse({
-            service: c.req.query('service') || undefined,
+            services: services.length ? services : undefined,
             level: c.req.query('level') || undefined,
             search: c.req.query('search') || undefined,
             hours: c.req.query('hours'),
@@ -2265,6 +2347,16 @@ export function createControlPlaneApi(options) {
      *  label is unique within a tenant, so dropping the prefix stays collision-free. Both
      *  create (provision + reuse-match) and delete (reap-match) run through here, so they agree. */
     const previewSlug = (slug, tag) => `${slug.split('/').at(-1)}--${tag}`;
+    /** Reap one preview: wipe the DO in its own deployment, then drop the directory row and
+     *  its hostnames. Storage-before-row, the same ordering the DELETE route uses — a crash
+     *  between the two converges on retry. Shared by that route and by the create path, which
+     *  reaps a HALF-BUILT leftover before re-forking (see `orchestratedPreview`). */
+    const reapPreview = async (c, preview) => {
+        const vertical = await verticalForScope(c, preview);
+        if (vertical)
+            await vertical.deleteScope({ scopeId: preview.id });
+        await options.host.deleteSnapshot(c.get('actor'), preview.tenantId, preview.id);
+    };
     /** Given a base hostname `<label>.<domain>`, mint (or find) the preview's `--<tag>`
      *  hostname `<label>--<tag>.<domain>` bound to `previewId`. Non-canonical, so it never
      *  demotes the prod surface. Shared by the fork and clean-room paths. */
@@ -2302,13 +2394,22 @@ export function createControlPlaneApi(options) {
             }
             return src.hostname;
         }
-        const base = platformBaseDomains[0];
-        if (!base) {
+        if (platformBaseDomains.length === 0) {
             throw new ControlPlaneError(409, `no platform base domain configured — a clean-room preview has no source URL to derive from`);
         }
+        // Mint under `<label>.<jurisdiction>.<baseDomain>`, exactly as provisioning does
+        // (provision.ts `bindDefaultHostname` → `egeryds.global.substrat.run`). A clean-room
+        // preview scope is provisioned `global` by construction (see the caller), and the
+        // wildcard DNS/cert lives on `*.global.substrat.run` — NOT the certless apex
+        // `*.substrat.run`. `platformBaseDomains` lists every platform suffix for custom-hostname
+        // detection (`substrat.run`, `global.substrat.run`, …); the registrable base is the
+        // shortest, the one all jurisdiction domains are subdomains of. Taking `[0]` grabbed the
+        // bare apex and stranded clean-room previews on a hostname that never resolves.
+        const baseDomain = [...platformBaseDomains].sort((a, b) => a.length - b.length)[0];
+        const jurisdiction = 'global';
         const tenant = await admin.getTenant(actor, tenantId);
         const handle = tenant?.slug ?? tenantId;
-        return `${slug.split('/').at(-1)}-${handle}.${base}`;
+        return `${slug.split('/').at(-1)}-${handle}.${jurisdiction}.${baseDomain}`;
     };
     const orchestratedPreview = async (c, tenantId, slug, 
     // A FORK copies this scope's data; `null` provisions an empty clean-room scope (#509 (b)).
@@ -2361,7 +2462,20 @@ export function createControlPlaneApi(options) {
         // onto the SAME preview — successive pushes roll their migrations forward on one copy
         // (§4's rehearsal case) — unless `refresh` asks for a fresh one.
         const existing = (await admin.listScopes(actor, { tenantId, vertical: slug })).find((s) => s.kind === 'preview' && s.slug === previewSlug(slug, opts.tag));
-        if (existing && !opts.refresh) {
+        // A preview only HAS data once its two-phase create finished: the directory row lands
+        // first as `provisioning` (K-31), the fork's export→restore runs, and `activateScope`
+        // is the last step. So a row still at `provisioning` is a create that DIED mid-fork —
+        // its DO is empty. Reuse must never adopt one: reuse only rebinds the version and the
+        // hostname, it never copies data, so adopting a half-built row hands back a
+        // permanently EMPTY preview and reports `reused: true` — success for a URL that shows
+        // a reviewer no data at all. That is exactly what a CI retry does (the generated
+        // workflow retries `preview create` on a transient), so the failure mode is the
+        // COMMON one, not a corner: attempt 1 forks and dies, attempt 2 adopts its corpse and
+        // goes green. Instead, reap the leftover and fall through to a fresh fork below —
+        // which is what the retry was asking for. Same for an explicit `refresh`, whose fresh
+        // scope would otherwise collide with the old row's still-bound `--<tag>` hostname.
+        const stale = existing !== undefined && (opts.refresh || existing.status !== 'active');
+        if (existing && !stale) {
             // Heal a preview provisioned before #527: clear any inherited serving_ref so routing
             // follows the bound version (its per-version script), not the prod serving script.
             if (existing.servingRef)
@@ -2373,6 +2487,10 @@ export function createControlPlaneApi(options) {
             await assertServesBoundVersion(existing.id);
             return { scopeId: existing.id, hostname, url: `https://${hostname}`, versionId: opts.versionId, reused: true };
         }
+        // Free the tag: the slug is unique per tenant and the `--<tag>` hostname is still bound
+        // to the old row, so the fresh fork below cannot be provisioned until this one is gone.
+        if (existing && stale)
+            await reapPreview(c, existing);
         const previewId = scopeIdSchema.parse(ulid());
         if (source) {
             // A fresh fork. Export from where the prod data lives TODAY. The canonical
@@ -2531,10 +2649,7 @@ export function createControlPlaneApi(options) {
             // Storage-before-row, the same ordering as the fork hard-delete: wipe the DO in the
             // PR version's deployment, then deleteSnapshot (fork-only re-check, hostnames + row,
             // audit). A crash between the two converges on retry.
-            const vertical = await verticalForScope(c, preview);
-            if (vertical)
-                await vertical.deleteScope({ scopeId: preview.id });
-            await options.host.deleteSnapshot(actor, tenantId, preview.id);
+            await reapPreview(c, preview);
             return c.json({ deleted: preview.id });
         }
         catch (e) {