@teamscala/service-boot 0.23.536 → 0.23.537

package/src/apply-logger-config.ts

@@ -5,6 +5,7 @@
 
 import { setMinLevel } from "@teamscala/logger/creator";
 import { configureFileSink } from "@teamscala/logger/file-sink";
+import { substituteHostPaths } from "@teamscala/os/host-paths";
 
 export function applyLoggerConfig(config: {
 	minLevel?: "debug" | "info" | "warn" | "error";
@@ -16,7 +17,7 @@ export function applyLoggerConfig(config: {
 		setMinLevel(config.minLevel);
 	}
 	configureFileSink({
-		logDir: config.logDir,
+		logDir: config.logDir ? substituteHostPaths(config.logDir) : undefined,
 		maxFileSize: config.maxFileSize,
 		maxFiles: config.maxFiles,
 	});

package/src/build-client-assets/hydrate-bundle.ts

@@ -8,6 +8,7 @@ import { join } from "node:path";
 import { getAppLogger } from "@teamscala/logger/app-loggers";
 import { removeStaleHashedFiles } from "./hashed-output.ts";
 import {
+	ASSET_PUBLIC_PREFIX,
 	uploadSourceMaps,
 	type SourceMapUploadResult,
 } from "./sourcemaps-upload.ts";
@@ -71,7 +72,7 @@ export async function buildHydrateBundle(
 			plugins: [resilientBlockPlugin],
 			splitting: true,
 			sourcemap: "external",
-			publicPath: "/assets/",
+			publicPath: ASSET_PUBLIC_PREFIX,
 			external: ["*.css"],
 		});
 	} catch (e) {
@@ -195,7 +196,7 @@ export async function buildHydrateBundle(
 			.map((o) => o.path.split("/").pop() as string),
 	);
 	const sourceMaps = await uploadSourceMaps(cwd, outDir, hash, log, currentOutputs);
-	return { hydratePath: `/assets/${hashedName}`, sourceMaps };
+	return { hydratePath: `${ASSET_PUBLIC_PREFIX}${hashedName}`, sourceMaps };
 }
 
 async function removeStaleChunks(

package/src/build-client-assets/manifest.ts

@@ -4,57 +4,19 @@
  */
 
 import { join } from "node:path";
-import { getAppLogger } from "@teamscala/logger/app-loggers";
 import type { SourceMapUploadResult } from "./sourcemaps-upload.ts";
 
 export const MANIFEST_FILE = "asset-manifest.json";
 
 export interface AssetManifest {
-	// Optional because a TOMBSTONE from a build that failed with no prior
-	// success carries NO paths — there are no real assets to name, and inventing
-	// URLs nothing built is the deleted fallback class (no-shims).
-	// `readManifest` returns null unless both are present, so a path-less
-	// tombstone reads as unbuilt everywhere (verification, readiness, render).
 	stylesPath?: string;
 	hydratePath?: string;
-	// TOMBSTONE fields — present iff the last build FAILED (no-silent-reverts).
-	// `buildFailed: true` + reason + timestamp are written by performBuild
-	// before it re-throws; every boot rebuilds unconditionally, so the failed
-	// build is retried by construction. read-html-template reads these to stamp
-	// the served HTML with the failure status (operator-visible signal that
-	// the bundle is stale, not fresh).
 	buildFailed?: boolean;
 	buildFailedReason?: string;
 	buildFailedAt?: string;
-	// VERIFIED outcome of the last source-map upload attempt for THIS build's
-	// release (`uploaded` = every response checked 2xx; `failed` names each
-	// rejection in `failures`; `skipped` = no SENTRY_AUTH_TOKEN/SENTRY_URL).
-	// Every boot rebuilds and re-attempts the upload, so a failed upload is
-	// retried until it verifies — an unuploaded release must not silently
-	// persist forever.
 	sourceMaps?: SourceMapUploadResult;
 }
 
-export async function readClientBuildStatus(
-	cwd = process.cwd(),
-): Promise<{ failed: true; reason?: string; at?: string } | { failed: false }> {
-	const path = join(cwd, "dist", "client", MANIFEST_FILE);
-	if (!(await Bun.file(path).exists())) return { failed: false };
-	try {
-		const parsed = (await Bun.file(path).json()) as Partial<AssetManifest>;
-		if (parsed.buildFailed === true) {
-			return {
-				failed: true,
-				reason: parsed.buildFailedReason,
-				at: parsed.buildFailedAt,
-			};
-		}
-	} catch (error) {
-		getAppLogger().warn("asset manifest unreadable — reporting not-failed", error);
-	}
-	return { failed: false };
-}
-
 export async function readManifest(outDir: string): Promise<AssetManifest | null> {
 	const path = join(outDir, MANIFEST_FILE);
 	if (!(await Bun.file(path).exists())) return null;

package/src/build-client-assets/sourcemaps-upload.test.ts

@@ -44,8 +44,7 @@ afterAll(async () => {
 });
 
 afterEach(() => {
-	delete process.env.SENTRY_AUTH_TOKEN;
-	delete process.env.SENTRY_URL;
+	delete process.env.SENTRY_DSN;
 });
 
 describe("uploadSourceMaps — skip path (absent env)", () => {
@@ -81,8 +80,7 @@ describe("uploadSourceMaps — skip path (absent env)", () => {
 
 describe("uploadCachedSourceMaps — the fingerprint-skip retry path", () => {
 	test("no cached maps → failed, naming the release and the reason", async () => {
-		process.env.SENTRY_AUTH_TOKEN = "test-token";
-		process.env.SENTRY_URL = "https://glitchtip.test";
+		process.env.SENTRY_DSN = "https://cred@glitchtip.test/scala";
 		const cwd = await makeDir();
 		const result = await uploadCachedSourceMaps(cwd, "deadbeef", noopLog);
 		expect(result.status).toBe("failed");

package/src/build-client-assets/sourcemaps-upload.ts

@@ -3,12 +3,11 @@
  * @status handwritten
  */
 
-
 import { mkdir, readdir, rename, rm } from "node:fs/promises";
 import { join } from "node:path";
+import { resilientFetch } from "@teamscala/http/resilient-fetch";
 import { getAppLogger } from "@teamscala/logger/app-loggers";
-import { userHome } from "@teamscala/os/host-paths";
-import { spawnSync } from "@teamscala/os/spawn";
+import { createSafeFallback } from "@teamscala/safe-fallback/create-safe-fallback";
 
 export type SourceMapUploadStatus = "uploaded" | "failed" | "skipped";
 
@@ -20,6 +19,8 @@ export interface SourceMapUploadResult {
 	at: string;
 }
 
+export const ASSET_PUBLIC_PREFIX = "/assets/";
+
 const UPLOAD_TIMEOUT_MS = 30_000;
 
 export function sourceMapsCacheDir(cwd: string, release: string): string {
@@ -30,6 +31,183 @@ export function releaseFromHydratePath(hydratePath: string): string | null {
 	return /hydrate-([a-z0-9]+)\.js/.exec(hydratePath)?.[1] ?? null;
 }
 
+export function sourceMapArtifactName(mapFileName: string): string {
+	return `~${ASSET_PUBLIC_PREFIX}${mapFileName.replace(/\.map$/, "")}`;
+}
+
+export interface ReleaseTarget {
+	origin: string;
+	credential: string;
+	project: string;
+}
+
+export function sentryTarget(dsn: string | undefined = process.env.SENTRY_DSN): ReleaseTarget | null {
+	const value = dsn?.trim();
+	if (!value) return null;
+	const schemeEnd = value.indexOf("://");
+	if (schemeEnd <= 0) return null;
+	const remainder = value.slice(schemeEnd + 3);
+	const at = remainder.indexOf("@");
+	if (at <= 0) return null;
+	const hostAndProject = remainder.slice(at + 1);
+	const slash = hostAndProject.lastIndexOf("/");
+	if (slash <= 0 || slash === hostAndProject.length - 1) return null;
+	return {
+		origin: `${value.slice(0, schemeEnd)}://${hostAndProject.slice(0, slash)}`,
+		credential: remainder.slice(0, at),
+		project: hostAndProject.slice(slash + 1),
+	};
+}
+
+export class SourceMapTransportError extends Error {
+	readonly cause: unknown;
+
+	constructor(message: string, cause: unknown) {
+		super(message);
+		this.name = "SourceMapTransportError";
+		this.cause = cause;
+	}
+}
+
+function describe(error: unknown): string {
+	return error instanceof Error ? error.message : String(error);
+}
+
+function releaseFilesUrl(target: ReleaseTarget, release: string): string {
+	const org = process.env.SENTRY_ORG ?? "scala";
+	return `${target.origin}/api/0/projects/${encodeURIComponent(org)}/${encodeURIComponent(target.project)}/releases/${encodeURIComponent(release)}/files/`;
+}
+
+async function readReleaseFiles(target: ReleaseTarget, release: string): Promise<Response> {
+	return resilientFetch("temps", releaseFilesUrl(target, release), {
+		method: "GET",
+		signal: AbortSignal.timeout(UPLOAD_TIMEOUT_MS),
+		headers: { Authorization: `Bearer ${target.credential}` },
+	});
+}
+
+async function postReleaseFile(
+	target: ReleaseTarget,
+	release: string,
+	artifactName: string,
+	data: ArrayBuffer,
+): Promise<Response> {
+	const form = new FormData();
+	form.append("name", artifactName);
+	form.append("file", new Blob([data]), artifactName.slice(artifactName.lastIndexOf("/") + 1));
+	return resilientFetch("temps", releaseFilesUrl(target, release), {
+		method: "POST",
+		body: form,
+		signal: AbortSignal.timeout(UPLOAD_TIMEOUT_MS),
+		headers: { Authorization: `Bearer ${target.credential}` },
+	});
+}
+
+const readBackFallback = createSafeFallback<{ names: string[] }>({
+	name: "sourcemaps:read-back",
+	onFailure: "fail-closed-error",
+});
+
+const transportFallback = createSafeFallback<Response>({
+	name: "sourcemaps:transport",
+	onFailure: "fail-closed-error",
+});
+
+const mapTransferFallback = createSafeFallback<void>({
+	name: "sourcemaps:map-transfer",
+	onFailure: "fail-closed-warn",
+	degradedResult: undefined,
+});
+
+function isTransportFailure(error: unknown): boolean {
+	return error instanceof SourceMapTransportError;
+}
+
+const transportCallParams = { isExpectedOutcome: isTransportFailure };
+
+async function postMap(
+	target: ReleaseTarget,
+	release: string,
+	artifactName: string,
+	data: ArrayBuffer,
+): Promise<string | null> {
+	const response = await postTransportCall(
+		`POST ${artifactName}`,
+		() => postReleaseFile(target, release, artifactName, data),
+	);
+	if (response.ok) return null;
+	return `${artifactName} → HTTP ${response.status}: ${(await response.text()).slice(0, 300)}`;
+}
+
+async function releaseFileNames(target: ReleaseTarget, release: string): Promise<string[]> {
+	const response = await postTransportCall(
+		"GET release files",
+		() => readReleaseFiles(target, release),
+	);
+	if (!response.ok) {
+		throw new SourceMapTransportError(
+			`GET release files → HTTP ${response.status}: ${(await response.text()).slice(0, 300)}`,
+			null,
+		);
+	}
+	return readBackFallback.call(async () => {
+		const body: unknown = await response.json();
+		if (!Array.isArray(body)) throw new Error("release file list is not an array");
+		return {
+			names: body.flatMap((row) =>
+				row && typeof row === "object" && typeof (row as { name?: unknown }).name === "string"
+					? [(row as { name: string }).name]
+					: [],
+			),
+		};
+	});
+}
+
+async function postTransportCall(
+	label: string,
+	operation: () => Promise<Response>,
+): Promise<Response> {
+	return transportFallback
+		.call(
+			async () => {
+				const response = await operation();
+				if (response.status >= 500) {
+					throw new SourceMapTransportError(`${label} → HTTP ${response.status}`, null);
+				}
+				return response;
+			},
+			transportCallParams,
+		)
+		.catch((error: unknown) => {
+			throw new SourceMapTransportError(
+				error instanceof SourceMapTransportError
+					? `${label} → ${error.message}`
+					: `${label} → ${describe(error)}`,
+				error,
+			);
+		});
+}
+
+async function retainOrDeleteMap(
+	outDir: string,
+	name: string,
+	cacheDir: string,
+	keep: boolean,
+	log: ReturnType<typeof getAppLogger>,
+): Promise<void> {
+	await mapTransferFallback
+		.call(async () => {
+			if (keep) {
+				await rename(join(outDir, name), join(cacheDir, name));
+				return;
+			}
+			await rm(join(outDir, name), { force: true });
+		})
+		.catch(async () => {
+			await rm(join(outDir, name), { force: true }).catch(() => {});
+		});
+}
+
 async function moveMapsToCache(
 	cwd: string,
 	outDir: string,
@@ -39,37 +217,28 @@ async function moveMapsToCache(
 ): Promise<string[]> {
 	const cacheDir = sourceMapsCacheDir(cwd, release);
 	const moved: string[] = [];
-	for (const name of await readdir(outDir, "utf-8")) {
-		if (!name.endsWith(".map")) continue;
-		const base = name.replace(/\.map$/, "");
-		try {
-			await mkdir(cacheDir, { recursive: true });
-			if (currentOutputs.has(base)) {
-				await rename(join(outDir, name), join(cacheDir, name));
-				moved.push(name);
-			} else {
-				// Stale map (older release). The serve-safety guarantee still
-				// requires it NOT live under the served root; delete rather than
-				// pollute this release's cache with another release's maps.
-				await rm(join(outDir, name), { force: true });
-				log.warn("stale sourcemap removed from served root (older release)", { name });
-			}
-		} catch (error) {
-			log.warn("sourcemap cache move failed — map deleted (never serve source)", {
-				name,
-				error: error instanceof Error ? error.message : String(error),
-			});
-			await rm(join(outDir, name), { force: true });
-		}
+	const entries = await readdir(outDir, "utf-8");
+	const maps = entries.filter((name) => name.endsWith(".map"));
+	if (maps.length === 0) return moved;
+	await mkdir(cacheDir, { recursive: true });
+	for (const name of maps) {
+		const keep = currentOutputs.has(name.replace(/\.map$/, ""));
+		await retainOrDeleteMap(outDir, name, cacheDir, keep, log).then(
+			() => {
+				if (keep) moved.push(name);
+				else log.warn("stale sourcemap removed from served root (older release)", { name });
+			},
+			(error: unknown) => {
+				log.warn("sourcemap cache move failed", { name, error: describe(error) });
+			},
+		);
 	}
 	return moved;
 }
 
-function authEnv(): { token: string; url: string } | null {
-	const token = process.env.SENTRY_AUTH_TOKEN;
-	const url = process.env.SENTRY_URL;
-	if (!token || !url) return null;
-	return { token, url };
+async function readCachedMapNames(cacheDir: string): Promise<string[]> {
+	const entries = await readdir(cacheDir, "utf-8");
+	return entries.filter((name) => name.endsWith(".map"));
 }
 
 export async function uploadCachedSourceMaps(
@@ -78,14 +247,14 @@ export async function uploadCachedSourceMaps(
 	log: ReturnType<typeof getAppLogger>,
 ): Promise<SourceMapUploadResult> {
 	const at = new Date().toISOString();
-	const auth = authEnv();
 	const cacheDir = sourceMapsCacheDir(cwd, release);
-	if (!auth) {
+	const target = sentryTarget();
+	if (!target) {
 		return { status: "skipped", uploaded: 0, total: 0, failures: [], at };
 	}
 	let names: string[] = [];
 	try {
-		names = (await readdir(cacheDir, "utf-8")).filter((n) => n.endsWith(".map"));
+		names = await readCachedMapNames(cacheDir);
 	} catch {
 		names = [];
 	}
@@ -95,12 +264,12 @@ export async function uploadCachedSourceMaps(
 			uploaded: 0,
 			total: 0,
 			failures: [
-				`no cached source maps for release ${release} at ${cacheDir} — the build that produced them predates retention or they were removed; next bundle rebuild regenerates them`,
+				`no cached source maps for release ${release} at ${cacheDir} — the build that produced them predates retention or they were removed; the next bundle rebuild regenerates them`,
 			],
 			at,
 		};
 	}
-	return uploadMapsFromCache(cacheDir, names, release, auth, log, at);
+	return uploadMapsFromCache(cacheDir, names, release, target, log, at);
 }
 
 export async function uploadSourceMaps(
@@ -111,137 +280,74 @@ export async function uploadSourceMaps(
 	currentOutputs: ReadonlySet<string> = new Set(),
 ): Promise<SourceMapUploadResult> {
 	const at = new Date().toISOString();
-	const auth = authEnv();
-	// Inject debug IDs into the served bundles + maps (if glitchtip-cli is
-	// present). Runs on outDir BEFORE the cache move so both the served
-	// bundle and its retained map carry the same debug id. The CLI is
-	// optional — only used for the inject step.
-	const cli = join(userHome(), ".local", "bin", "glitchtip-cli");
-	if (await Bun.file(cli).exists()) {
-		spawnSync({
-			name: "glitchtip-cli-sourcemaps-inject",
-			command: [cli, "sourcemaps", "inject", outDir],
-			env: { ...process.env, SENTRY_AUTH_TOKEN: auth?.token ?? "" },
-			timeoutMs: 60_000,
-			captureStderr: true,
-		});
-	}
-	// The move is unconditional — the served root must never hold `.map`
-	// files, whether or not an upload will follow.
 	const names = await moveMapsToCache(cwd, outDir, release, currentOutputs, log);
-	if (!auth) {
-		// Best-effort by design, but VISIBLE: one warn per boot names the
-		// missing env instead of a silent skip that reads as success.
+	const cacheDir = sourceMapsCacheDir(cwd, release);
+	if (names.length === 0) {
+		log.warn("[build-client-assets] no source maps to upload for this build", { release, cacheDir });
+		return { status: "skipped", uploaded: 0, total: 0, failures: [], at };
+	}
+	const target = sentryTarget();
+	if (!target) {
 		log.warn(
-			`[build-client-assets] source maps NOT uploaded — SENTRY_AUTH_TOKEN/SENTRY_URL absent (maps retained at ${sourceMapsCacheDir(cwd, release)} for retry once configured)`,
+			`[build-client-assets] source maps NOT uploaded — SENTRY_DSN absent (maps retained at ${cacheDir} for retry once configured)`,
 			{ release, mapsRetained: names.length },
 		);
 		return { status: "skipped", uploaded: 0, total: names.length, failures: [], at };
 	}
-	return uploadMapsFromCache(
-		sourceMapsCacheDir(cwd, release),
-		names,
-		release,
-		auth,
-		log,
-		at,
-	);
+	return uploadMapsFromCache(cacheDir, names, release, target, log, at);
 }
 
 async function uploadMapsFromCache(
 	cacheDir: string,
 	names: string[],
 	release: string,
-	auth: { token: string; url: string },
+	target: ReleaseTarget,
 	log: ReturnType<typeof getAppLogger>,
 	at: string,
 ): Promise<SourceMapUploadResult> {
-	const org = process.env.SENTRY_ORG ?? "scala";
-	const project = process.env.SENTRY_PROJECT ?? "scala-hub";
-	const headers = { Authorization: `Bearer ${auth.token}` };
+	const expected = names.map(sourceMapArtifactName);
 	const failures: string[] = [];
-	try {
-		// Create the release (2xx or 208 already-exists are both "exists now").
-		// The direct release API posts to SENTRY_URL (which we control).
-		const releaseRes = await fetch(`${auth.url}/api/0/organizations/${org}/releases/`, {
-			method: "POST",
-			signal: AbortSignal.timeout(UPLOAD_TIMEOUT_MS),
-			headers: { ...headers, "Content-Type": "application/json" },
-			body: JSON.stringify({ version: release, projects: [project] }),
-		});
-		if (!(releaseRes.ok || releaseRes.status === 208)) {
-			const body = (await releaseRes.text()).slice(0, 300);
-			failures.push(
-				`release create ${release} → HTTP ${releaseRes.status}: ${body}`,
-			);
-		}
-	} catch (err) {
-		failures.push(
-			`release create ${release} → ${err instanceof Error ? err.message : String(err)}`,
-		);
+	for (const name of names) {
+		const artifactName = sourceMapArtifactName(name);
+		const data = await Bun.file(join(cacheDir, name))
+			.arrayBuffer()
+			.catch((error: unknown) => {
+				failures.push(`${artifactName} → cached map unreadable: ${describe(error)}`);
+				return null;
+			});
+		if (data === null) continue;
+		const failure = await postMap(target, release, artifactName, data);
+		if (failure) failures.push(failure);
 	}
-	// Upload through the OFFICIAL glitchtip-cli (chunk-upload + assemble
-	// protocol, debug-id matching). The plain release-files POST endpoints
-	// return 405 on GlitchTip — measured live 2026-09-01 against
-	// glitchtip.scala.business: every map failed HTTP 405 while the same 57
-	// maps uploaded clean through the CLI, which is why client stacks had
-	// never resolved despite the pipeline "running". The CLI reads
-	// SENTRY_URL/SENTRY_AUTH_TOKEN from its env; verify its own summary line
-	// rather than assuming the exit code alone.
-	const cli = join(userHome(), ".local", "bin", "glitchtip-cli");
-	if (!(await Bun.file(cli).exists())) {
+	const stored = await releaseFileNames(target, release).catch((error: unknown) => {
 		failures.push(
-			`glitchtip-cli not installed at ${cli} — install it (dev host) or add it to the image (Railway); maps retained for retry`,
+			`${describe(error)} (release ${release}, ${releaseFilesUrl(target, release)})`,
 		);
-		logNamedFailures(log, release, project, names.length, 0, failures, cacheDir);
-		return { status: "failed", uploaded: 0, total: names.length, failures, at };
-	}
-	const proc = spawnSync({
-		name: "glitchtip-cli-sourcemaps-upload",
-		command: [
-			cli,
-			"sourcemaps",
-			"upload",
-			"--org",
-			org,
-			"--project",
-			project,
-			"--release",
-			release,
-			"--url-prefix",
-			"~",
-			cacheDir,
-		],
-		env: { ...process.env, SENTRY_AUTH_TOKEN: auth.token, SENTRY_URL: auth.url },
-		timeoutMs: 600_000,
-		captureStderr: true,
+		return null;
 	});
-	const summary = /Upload complete:\s*(\d+) file\(s\) uploaded,\s*(\d+) error\(s\)/.exec(
-		`${proc.stdout}\n${proc.stderr}`,
-	);
-	const uploaded = summary ? Number(summary[1]) : 0;
-	const errored = summary ? Number(summary[2]) : 0;
-	if (!proc.success || !summary || errored > 0) {
+	if (stored === null) {
+		logNamedFailures(log, release, target.project, expected.length, 0, failures, cacheDir);
+		return { status: "failed", uploaded: 0, total: expected.length, failures, at };
+	}
+	const missing = expected.filter((name) => !stored.includes(name));
+	for (const name of missing) {
 		failures.push(
-			`glitchtip-cli upload → exit ${proc.exitCode}${proc.timedOut ? " (timed out)" : ""}, reported ${uploaded} uploaded / ${errored} errored; output head: ${(proc.stderr || proc.stdout).slice(0, 500)}`,
+			`${name} → absent from release ${release} after upload; temps stores the name verbatim and resolves stacks by it, so a map stored under another name cannot symbolicate`,
 		);
 	}
-	const status: SourceMapUploadStatus = failures.length === 0 && uploaded === names.length
-		? "uploaded"
-		: "failed";
+	const uploaded = expected.length - missing.length;
+	const status: SourceMapUploadStatus = failures.length === 0 ? "uploaded" : "failed";
 	if (status === "uploaded") {
-		log.info("[build-client-assets] source maps uploaded to GlitchTip (verified)", {
+		log.info("[build-client-assets] source maps uploaded to temps (read back)", {
 			release,
-			project,
+			project: target.project,
 			uploaded,
-			total: names.length,
+			total: expected.length,
 		});
 	} else {
-		// Name every failure — a report that cannot answer "what do I do" is
-		// unfinished. Each failure carries its cause and the named remedy.
-		logNamedFailures(log, release, project, names.length, uploaded, failures, cacheDir);
+		logNamedFailures(log, release, target.project, expected.length, uploaded, failures, cacheDir);
 	}
-	return { status, uploaded, total: names.length, failures, at };
+	return { status, uploaded, total: expected.length, failures, at };
 }
 
 function logNamedFailures(
@@ -261,4 +367,4 @@ function logNamedFailures(
 		failures,
 		cacheDir,
 	});
-}
+}