blogwright 0.4.0-beta.3 → 0.4.0-beta.5

package/dist/cli.js

@@ -15,6 +15,8 @@ Usage:
 Commands:
   init                        First-run wizard: writes config/production.jsonc
   bootstrap   [env]           Create/reconcile the infrastructure graph
+                              (--switch-mode: move a bootstrapped stack
+                              between static and SSR serving)
   deploy      [env]           Zip the repo, build in a MicroVM, publish to site/
   rollback    <hash> [env]    Re-deploy an existing build by hash
   delete      [env]           Empty the live site/ prefix
@@ -48,6 +50,10 @@ Options:
   --refresh         Re-upload every file on deploy, even unchanged ones, so
                     metadata fixes (content types, object tags) reach live
                     objects the ETag comparison would otherwise skip.
+  --switch-mode     Allow bootstrap to change a bootstrapped stack between
+                    static and SSR serving. Without it that cutover is
+                    refused, because the distribution moves before a deploy
+                    in the new mode exists.
   --yes             Confirm destructive operations
   --help            Show this help
 `;
@@ -219,6 +225,10 @@ export async function main(argv, makeTerminal, makeContext, makeDiscoveryPorts,
             identifier: { type: 'string' },
             plain: { type: 'boolean', default: false },
             refresh: { type: 'boolean', default: false },
+            // Node's `parseArgs` matches option names literally - `--switch-mode`
+            // is declared kebab-case and read back the same way, because the camel
+            // form would reject the flag the usage text and docs advertise.
+            'switch-mode': { type: 'boolean', default: false },
             yes: { type: 'boolean', default: false },
             help: { type: 'boolean', default: false },
         },
@@ -343,7 +353,7 @@ export async function main(argv, makeTerminal, makeContext, makeDiscoveryPorts,
     });
     switch (command) {
         case 'bootstrap':
-            await commands.bootstrap(ctx);
+            await commands.bootstrap(ctx, undefined, { switchMode: values['switch-mode'] });
             break;
         case 'deploy':
             await commands.deploy(ctx, { refresh: values.refresh });

package/dist/commands.d.ts

@@ -2,8 +2,17 @@ import { type ResourceNode } from 'blogwright-core';
 import type { OpsContext } from './context.js';
 import { type GraphContext } from './graph.js';
 import { type StatusEntry } from './render.js';
+/**
+ * Refuse a silent serving-mode switch on a bootstrapped stack unless
+ * `--switch-mode` says the window is acceptable. A mode difference is a
+ * serving cutover, not a quiet convergence - the distribution's default
+ * behavior moves before a deploy in the new mode exists.
+ */
+export declare function assertModeSwitchAllowed(ctx: OpsContext, switchMode: boolean): void;
 /** Create the full infrastructure graph. */
-export declare function bootstrap(ctx: OpsContext): Promise<void>;
+export declare function bootstrap(ctx: OpsContext, nodes?: ResourceNode<OpsContext>[], opts?: {
+    switchMode?: boolean;
+}): Promise<void>;
 /**
  * Refuse to destroy the site while any plugin's own state object still
  * exists in the bucket - §State → Scoped state stores' "`blogwright
@@ -22,8 +31,8 @@ export declare function bootstrap(ctx: OpsContext): Promise<void>;
  *
  * Reads the bucket, not the plugin registry, so the refusal holds even for
  * a plugin that has since been uninstalled. Runs inside the teardown verbs
- * themselves, not `createContext` - so no other command pays for the extra
- * `listObjects` call and plugin discovery stays lazy - and ahead of
+ * themselves, not `createContext`, sharing the listing with the post-bootstrap
+ * warning while plugin discovery stays lazy - and ahead of
  * `clearRunningMicrovms`/`destroyGraph` in each, so a refusal has zero side
  * effects: nothing is terminated, nothing is deleted.
  *

package/dist/commands.js

@@ -24,12 +24,13 @@ import { AwsError, colors, findRepoRoot } from 'blogwright-core';
  * it. Both halves are asserted in `commands.test.ts`.
  */
 import { syncAfterDeploy } from 'blogwright-pds';
-import { invalidateChanged, invalidateCloudFront, manifestKey, microvmLogGroup, runBuild, } from './deploy.js';
+import { invalidateChanged, invalidateCloudFront, manifestKey, microvmLogGroup, readManifest, runBuild, webFunctionJob, } from './deploy.js';
 import { applyGraph, destroyGraph } from './graph.js';
 import { clearRunningMicrovms } from './microvms.js';
 import { buildNodes, reconcileBuilderImage } from './nodes.js';
-import { formatDuration, logStatusEntries, renderHistoryTable, renderSummary, } from './render.js';
+import { formatDuration, logStatusEntries, historyHasRevisions, NO_REVISION, renderHistoryTable, renderSummary, } from './render.js';
 import { buildRepoZip, COMMIT_FILE, listRepoFiles } from './repo.js';
+import { assertNotSsrForPreviews, preflightWebFunction, recordManifest, publishRecordedRevision, publishWebRevision, readWebBuildResult, requireSsr, warnAboutSsrSeo, } from './web-functions.js';
 /** One line per invalidation outcome, shared by the summary card and logs. */
 function describeInvalidation(inv) {
     if (inv.mode === 'none')
@@ -48,15 +49,75 @@ function siteBaseUrl(ctx) {
     const cf = ctx.state.resources['cloudfront-distribution']?.domainName;
     return typeof cf === 'string' ? `https://${cf}` : undefined;
 }
+/** The serving mode the config asks for. */
+function configuredMode(ctx) {
+    return ctx.config.ssr ? 'ssr' : 'static';
+}
+/**
+ * The serving mode the live distribution was left in, or undefined before the
+ * first bootstrap. A distribution recorded without a mode was created before
+ * SSR existed, so it is static - reading that as "unknown" would let the very
+ * stacks the switch guard exists for through it.
+ */
+function recordedMode(ctx) {
+    const distribution = ctx.state.resources['cloudfront-distribution'];
+    if (typeof distribution?.id !== 'string')
+        return undefined;
+    return distribution.mode === 'ssr' ? 'ssr' : 'static';
+}
+/**
+ * Refuse to publish in a mode the distribution is not serving. The config and
+ * the stack disagree only between editing `ssr` and re-bootstrapping, and a
+ * deploy in that gap publishes where nothing serves from - or, static over
+ * SSR, deletes the `site/` assets the live revision still references.
+ */
+function assertServingModeMatches(ctx) {
+    const recorded = recordedMode(ctx);
+    const configured = configuredMode(ctx);
+    if (recorded === undefined || recorded === configured)
+        return;
+    throw new Error(`"${ctx.env}" is configured for ${configured} serving but its distribution serves ` +
+        `${recorded}. Run \`blogwright bootstrap ${ctx.env} --switch-mode\` first; nothing was ` +
+        'built or published.');
+}
+/** What a mode switch does to the live site while the next deploy has not run. */
+function servingWindow(mode) {
+    return mode === 'ssr'
+        ? 'the distribution answers 503 from the placeholder until the first SSR deploy completes'
+        : 'the distribution serves whatever site/ holds until the next static deploy';
+}
+/**
+ * Refuse a silent serving-mode switch on a bootstrapped stack unless
+ * `--switch-mode` says the window is acceptable. A mode difference is a
+ * serving cutover, not a quiet convergence - the distribution's default
+ * behavior moves before a deploy in the new mode exists.
+ */
+export function assertModeSwitchAllowed(ctx, switchMode) {
+    const recorded = recordedMode(ctx);
+    if (recorded === undefined)
+        return;
+    const configured = configuredMode(ctx);
+    if (recorded === configured)
+        return;
+    const window = servingWindow(configured);
+    if (!switchMode) {
+        throw new Error(`refusing to switch "${ctx.env}" from ${recorded} to ${configured} serving: ${window}. ` +
+            'Nothing was applied. Re-run with --switch-mode to move the distribution now.');
+    }
+    ctx.logger.warn(`switching "${ctx.env}" from ${recorded} to ${configured} serving: ${window}`);
+}
 /** Create the full infrastructure graph. */
-export async function bootstrap(ctx) {
+export async function bootstrap(ctx, nodes = buildNodes(ctx), opts = {}) {
+    // Refused before any node is applied, so a refusal has no side effects.
+    assertModeSwitchAllowed(ctx, opts.switchMode ?? false);
     ctx.logger.info(colors.bold(`Bootstrapping "${ctx.env}" (bucket ${ctx.names.bucket})`));
     // The state bucket must exist before anything else can persist state.
-    await applyGraph(buildNodes(ctx), ctx);
+    await applyGraph(nodes, ctx);
     ctx.logger.ok(`bootstrap complete for "${ctx.env}"`);
     const domain = ctx.state.resources['cloudfront-distribution']?.domainName;
     if (typeof domain === 'string')
         ctx.logger.info(`Site will be served at https://${domain}`);
+    await warnAboutScopedState(ctx);
 }
 /**
  * The prefix every state object - scoped or not - is filed under
@@ -85,6 +146,27 @@ function scopedStateScopes(env, objects) {
         .map((key) => key.slice(prefix.length, -'.json'.length));
     return [...new Set(scopes)].sort();
 }
+/** Listing is strict; each caller decides whether a failure can be recovered. */
+async function listScopedStateScopes(ctx) {
+    const objects = await ctx.clients.s3.listObjects(ctx.names.bucket, STATE_PREFIX);
+    return scopedStateScopes(ctx.env, objects);
+}
+/** A never-bootstrapped plugin has no scoped key, so cannot produce a warning. */
+async function warnAboutScopedState(ctx) {
+    let scopes;
+    try {
+        scopes = await listScopedStateScopes(ctx);
+    }
+    catch (err) {
+        ctx.logger.warn(`could not check plugin state for "${ctx.env}" at s3://${ctx.names.bucket}/${STATE_PREFIX} ` +
+            `(bootstrap succeeded): ${String(err)}`);
+        return;
+    }
+    for (const scope of scopes) {
+        ctx.logger.warn(`plugin state for "${scope}" still exists in "${ctx.env}"; ` +
+            `run \`blogwright ${scope} bootstrap ${ctx.env}\` to reconcile its resources`);
+    }
+}
 /**
  * Refuse to destroy the site while any plugin's own state object still
  * exists in the bucket - §State → Scoped state stores' "`blogwright
@@ -103,8 +185,8 @@ function scopedStateScopes(env, objects) {
  *
  * Reads the bucket, not the plugin registry, so the refusal holds even for
  * a plugin that has since been uninstalled. Runs inside the teardown verbs
- * themselves, not `createContext` - so no other command pays for the extra
- * `listObjects` call and plugin discovery stays lazy - and ahead of
+ * themselves, not `createContext`, sharing the listing with the post-bootstrap
+ * warning while plugin discovery stays lazy - and ahead of
  * `clearRunningMicrovms`/`destroyGraph` in each, so a refusal has zero side
  * effects: nothing is terminated, nothing is deleted.
  *
@@ -134,9 +216,9 @@ function scopedStateScopes(env, objects) {
  * `destroy()` run over the entire production graph.
  */
 export async function assertNoScopedState(ctx) {
-    let objects;
+    let scopes;
     try {
-        objects = await ctx.clients.s3.listObjects(ctx.names.bucket, STATE_PREFIX);
+        scopes = await listScopedStateScopes(ctx);
     }
     catch (err) {
         // No bucket, no state objects - see this function's doc comment. Matched
@@ -152,7 +234,6 @@ export async function assertNoScopedState(ctx) {
             return;
         throw err;
     }
-    const scopes = scopedStateScopes(ctx.env, objects);
     if (scopes.length === 0)
         return;
     // The remedy MUST name the environment. `runPlugin` resolves a plugin
@@ -186,12 +267,43 @@ export async function destroy(ctx, opts) {
     await ctx.store.delete();
     ctx.logger.ok(`destroyed "${ctx.env}"`);
 }
+/** The manifest source a publish step records timings under. */
+function manifestSource(ctx, hash, startedAtMs, microvmId) {
+    return {
+        hash,
+        sourceKey: `build/${hash}.zip`,
+        startedAt: new Date(startedAtMs),
+        microvmId,
+    };
+}
+/**
+ * Read the agent's SSR result, recording a `failed` manifest when it is not
+ * there. A build that reported success but produced no result file has no
+ * revision outcome to wait for, and an SSR manifest's status is the outcome of
+ * the whole deploy - so the deploy cannot simply leave the hash unrecorded.
+ */
+async function webBuildResultOrFail(ctx, source) {
+    try {
+        return await readWebBuildResult(ctx, source.hash);
+    }
+    catch (err) {
+        await recordManifest(ctx, source, 'failed', undefined, err.message);
+        throw err;
+    }
+}
 /** Zip the repo, upload it, run the builder MicroVM, and invalidate the cache. */
 export async function deploy(ctx, opts = {}) {
     const startedAt = Date.now();
     const cwd = await findRepoRoot(ctx.ports.fs);
     const hash = await ctx.ports.vcs.revisionHash(cwd);
     ctx.logger.info(colors.bold(`Deploying ${hash} to "${ctx.env}"`));
+    assertServingModeMatches(ctx);
+    // In SSR mode the endpoint probe is mandatory and comes first: a caller that
+    // cannot invoke the endpoint is stopped before anything is built or published.
+    if (ctx.config.ssr) {
+        warnAboutSsrSeo(ctx);
+        await preflightWebFunction(ctx);
+    }
     const files = await listRepoFiles(ctx.ports, cwd, ctx.config.sourceIgnore, ctx.config.sourceInclude);
     ctx.logger.step(`zipping ${files.length} files`);
     const zip = await buildRepoZip(ctx.ports.fs, cwd, files, { [COMMIT_FILE]: hash });
@@ -205,14 +317,30 @@ export async function deploy(ctx, opts = {}) {
         hash,
         sourceKey,
         baseUrl: siteBaseUrl(ctx),
+        ...(ctx.config.ssr ? { webFunction: webFunctionJob(ctx, hash) } : {}),
         ...(opts.refresh ? { refresh: true } : {}),
     });
-    const invalidation = await invalidateChanged(ctx, hash);
+    let invalidation;
+    let outcome;
+    if (ctx.config.ssr) {
+        const source = manifestSource(ctx, hash, startedAt, manifest.microvmId);
+        const result = await webBuildResultOrFail(ctx, source);
+        outcome = await publishWebRevision(ctx, source, result);
+        invalidation = outcome.invalidation;
+    }
+    else {
+        invalidation = await invalidateChanged(ctx, hash);
+    }
     // Production content changed - mirror it to the PDS (non-fatal; see syncAfterDeploy).
     await syncAfterDeploy(ctx);
     const url = siteBaseUrl(ctx);
     const rows = [
-        { label: 'revision', value: hash },
+        {
+            label: 'revision',
+            value: outcome
+                ? `${outcome.revisionId} (${outcome.created ? 'created' : 'unchanged'})`
+                : hash,
+        },
         { label: 'environment', value: ctx.env },
         { label: 'source', value: `${files.length} files, ${(zip.byteLength / 1024).toFixed(0)} KiB` },
         { label: 'build', value: formatDuration(manifest.durationMs) },
@@ -224,8 +352,74 @@ export async function deploy(ctx, opts = {}) {
     }
     ctx.logger.ok(`deployed ${hash} in ${formatDuration(Date.now() - startedAt)}`);
 }
+/**
+ * SSR rollback: reproduce a recorded revision from its artifact and settings
+ * without a rebuild, falling back to the build path when the manifest has no
+ * `webFunction` block, the recorded artifact version is gone, or `staticDir`
+ * means the artifact does not carry the assets its pages reference.
+ */
+async function rollbackSsr(ctx, hash, opts = {}) {
+    const startedAt = Date.now();
+    warnAboutSsrSeo(ctx);
+    const config = requireSsr(ctx);
+    const manifest = await readManifest(ctx, hash);
+    const recorded = manifest?.webFunction;
+    // With staticDir configured the artifact cannot reproduce the rollback at all
+    // (it carries only the server), so the version check is not worth a request.
+    const artifactGone = recorded && config.staticDir === undefined
+        ? !(await ctx.clients.s3.objectVersionExists(ctx.names.bucket, recorded.artifactKey, recorded.artifactVersionId))
+        : false;
+    const rebuild = !recorded || config.staticDir !== undefined || artifactGone;
+    // Both paths probe: the endpoint is the only evidence that a rollback serves.
+    await preflightWebFunction(ctx);
+    let outcome;
+    if (rebuild) {
+        if (!recorded)
+            ctx.logger.warn(`${hash} has no webFunction manifest block - rebuilding`);
+        else if (config.staticDir !== undefined) {
+            ctx.logger.warn('ssr.staticDir is configured - rebuilding so its assets are republished');
+        }
+        else
+            ctx.logger.warn(`artifact version ${recorded.artifactVersionId} is gone - rebuilding`);
+        const sourceKey = `build/${hash}.zip`;
+        if (!(await ctx.clients.s3.objectExists(ctx.names.bucket, sourceKey))) {
+            throw new Error(`no build artifact at ${sourceKey}; cannot roll back to ${hash}`);
+        }
+        await reconcileBuilderImage(ctx);
+        const build = await runBuild(ctx, {
+            hash,
+            sourceKey,
+            baseUrl: siteBaseUrl(ctx),
+            webFunction: webFunctionJob(ctx, hash),
+            ...(opts.refresh ? { refresh: true } : {}),
+        });
+        const source = manifestSource(ctx, hash, startedAt, build.microvmId);
+        const result = await webBuildResultOrFail(ctx, source);
+        outcome = await publishWebRevision(ctx, source, result);
+    }
+    else {
+        outcome = await publishRecordedRevision(ctx, {
+            hash,
+            sourceKey: `build/${hash}.zip`,
+            startedAt: new Date(startedAt),
+            microvmId: 'rollback',
+        }, recorded);
+    }
+    ctx.logger.info(`  revision ${outcome.revisionId} (${outcome.created ? 'created' : 'unchanged'}), ` +
+        `${describeInvalidation(outcome.invalidation)}`);
+    // A rollback changes production content too, but the PDS mirrors the *working tree*
+    // content, which a rollback does not restore - so only warn about the divergence.
+    if (ctx.env === 'production' && ctx.config.pds) {
+        ctx.logger.warn('rollback does not sync the PDS (records mirror the current repo content); ' +
+            'check out the rolled-back revision and run `blogwright pds sync` if needed');
+    }
+    ctx.logger.ok(`rolled back to ${hash} in ${formatDuration(Date.now() - startedAt)}`);
+}
 /** Re-run the builder against an existing source zip for the given hash. */
 export async function rollback(ctx, hash, opts = {}) {
+    assertServingModeMatches(ctx);
+    if (ctx.config.ssr)
+        return rollbackSsr(ctx, hash, opts);
     const sourceKey = `build/${hash}.zip`;
     if (!(await ctx.clients.s3.objectExists(ctx.names.bucket, sourceKey))) {
         throw new Error(`no build artifact at ${sourceKey}; cannot roll back to ${hash}`);
@@ -254,6 +448,7 @@ function assertPreviewId(id) {
 }
 /** Provision the shared preview stack (one CloudFront distribution + host router + OIDC role). */
 export async function previewBootstrap(ctx) {
+    assertNotSsrForPreviews(ctx);
     if (!ctx.domain)
         throw new Error('preview bootstrap requires a domain (e.g. preview.example.com)');
     ctx.logger.info(colors.bold(`Bootstrapping preview stack (bucket ${ctx.names.bucket})`));
@@ -262,6 +457,7 @@ export async function previewBootstrap(ctx) {
 }
 /** Build the current repo and publish it to this PR's preview prefix. Prints the URL. */
 export async function previewDeploy(ctx, id, opts = {}) {
+    assertNotSsrForPreviews(ctx);
     assertPreviewId(id);
     const startedAt = Date.now();
     const cwd = await findRepoRoot(ctx.ports.fs);
@@ -325,6 +521,15 @@ export async function previewTeardown(ctx, opts) {
 }
 /** Empty the live site/ prefix (leaves infra and build history intact). */
 export async function deleteSite(ctx) {
+    if (ctx.config.ssr) {
+        // Emptying site/ cannot unpublish a revision: the app renders every page
+        // the revision serves, and its routes would keep answering from a server
+        // whose static assets are gone.
+        throw new Error(`refusing to delete site/ for "${ctx.env}": the site is served by a Lambda Web Function ` +
+            'revision, and emptying site/ cannot unpublish it. Deploy a new revision (or roll back), ' +
+            `or switch the stack back to static serving with \`blogwright bootstrap ${ctx.env} ` +
+            '--switch-mode` and deploy before deleting.');
+    }
     const count = await ctx.clients.s3.deletePrefix(ctx.names.bucket, 'site/');
     ctx.logger.ok(`deleted ${count} object(s) under site/`);
     await invalidateCloudFront(ctx);
@@ -357,13 +562,19 @@ export async function history(ctx) {
             ctx.logger.info(line);
         return;
     }
-    // The plain form is the stable contract for CI logs and agents.
-    ctx.logger.info(colors.bold('hash          status      finished                 duration'));
+    // The plain form is the stable contract for CI logs and agents. The revision
+    // column is appended only once a hash recorded one, so static output is unchanged.
+    const revisions = historyHasRevisions(manifests);
+    ctx.logger.info(colors.bold(`hash          status      finished                 duration${revisions ? '  revision' : ''}`));
     for (const m of manifests) {
         const cell = m.status === 'succeeded'
             ? colors.green(m.status.padEnd(10))
             : colors.red(m.status.padEnd(10));
-        ctx.logger.info(`${m.hash.padEnd(13)} ${cell}  ${m.finishedAt}  ${(m.durationMs / 1000).toFixed(0)}s`);
+        const duration = `${(m.durationMs / 1000).toFixed(0)}s`;
+        const revision = revisions
+            ? `  ${duration.padEnd(8)}  ${m.webFunction?.revisionId ?? NO_REVISION}`
+            : `  ${duration}`;
+        ctx.logger.info(`${m.hash.padEnd(13)} ${cell}  ${m.finishedAt}${revision}`);
     }
 }
 /** Show CloudWatch build logs for a given hash. */

package/dist/deploy.d.ts

@@ -1,5 +1,6 @@
-import { type Microvm, type RunMicrovmInput } from 'blogwright-core';
+import { type EntryShim, type Microvm, type RunMicrovmInput } from 'blogwright-core';
 import type { OpsContext } from './context.js';
+import type { WebFunctionManifest } from './web-functions.js';
 export interface DeployManifest {
     hash: string;
     sourceKey: string;
@@ -9,7 +10,46 @@ export interface DeployManifest {
     durationMs: number;
     microvmId: string;
     message?: string;
+    /**
+     * The last revision verified for this hash (or found already serving).
+     * Rollback reads it to reproduce the revision a hash is pinned to. A
+     * `failed` manifest carries it only when an earlier outcome for the same
+     * hash was verified - see {@link writeManifest}.
+     */
+    webFunction?: WebFunctionManifest;
 }
+/** Read one hash's deployment manifest, or undefined when there is none. */
+export declare function readManifest(ctx: OpsContext, hash: string): Promise<DeployManifest | undefined>;
+/**
+ * Write a hash's manifest and return what was written. In SSR mode a `failed`
+ * outcome keeps the `webFunction` block the hash's manifest already carried:
+ * that block is the only record of the artifact version and settings a
+ * verified revision was created with, and a failed redeploy or rollback of the
+ * same hash must not erase what `rollback` reproduces it from.
+ */
+export declare function writeManifest(ctx: OpsContext, manifest: DeployManifest, opts?: {
+    ssr?: boolean | undefined;
+}): Promise<DeployManifest>;
+/** Artifact and result keys for one deploy hash. */
+export declare function artifactKeys(hash: string): {
+    artifactKey: string;
+    resultKey: string;
+};
+/**
+ * The pending-job half of an SSR build: what to package, what to call the
+ * artifact, and where the agent writes the result the CLI's publish step reads.
+ */
+export interface WebFunctionJob {
+    packageDir: string;
+    entryPoint: string;
+    /** The generated entry shim the agent adds to the package, when `ssr.shim` is set. */
+    shim?: EntryShim | undefined;
+    staticDir?: string | undefined;
+    artifactKey: string;
+    resultKey: string;
+}
+/** The SSR packaging job for a hash, from the environment's `ssr` block. */
+export declare function webFunctionJob(ctx: OpsContext, hash: string): WebFunctionJob;
 /** Terminal outcome the log poller extracts from the agent's build markers. */
 export interface AgentStatus {
     state: 'idle' | 'building' | 'done' | 'failed';
@@ -55,6 +95,12 @@ export declare function runBuild(ctx: OpsContext, opts: {
     objectTags?: Record<string, string> | undefined;
     /** Re-upload every file, so metadata-only fixes (content type, tags) land. */
     refresh?: boolean | undefined;
+    /**
+     * Package the output as a Lambda Web Function revision artifact. When set,
+     * the manifest is left to the publish step: the build outcome alone is not
+     * the deploy outcome.
+     */
+    webFunction?: WebFunctionJob | undefined;
 }): Promise<DeployManifest>;
 export declare function invalidateCloudFront(ctx: OpsContext, paths?: string[]): Promise<void>;
 /** What a deploy's cache invalidation actually did, for the deploy summary. */

package/dist/deploy.js

@@ -1,7 +1,56 @@
 import { randomUUID } from 'node:crypto';
-import { AwsError, networkConnectors, pollUntil, sleep, } from 'blogwright-core';
+import { AwsError, entryShim, networkConnectors, pollUntil, sleep, } from 'blogwright-core';
 import { formatDuration, spinnerFrame } from './render.js';
 import { resolveSeo } from './seo.js';
+/** Read one hash's deployment manifest, or undefined when there is none. */
+export async function readManifest(ctx, hash) {
+    const text = await ctx.clients.s3.getObjectText(ctx.names.bucket, manifestKey(hash));
+    if (!text)
+        return undefined;
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Write a hash's manifest and return what was written. In SSR mode a `failed`
+ * outcome keeps the `webFunction` block the hash's manifest already carried:
+ * that block is the only record of the artifact version and settings a
+ * verified revision was created with, and a failed redeploy or rollback of the
+ * same hash must not erase what `rollback` reproduces it from.
+ */
+export async function writeManifest(ctx, manifest, opts = {}) {
+    let record = manifest;
+    if (opts.ssr && manifest.status === 'failed' && !manifest.webFunction) {
+        const verified = (await readManifest(ctx, manifest.hash))?.webFunction;
+        if (verified)
+            record = { ...manifest, webFunction: verified };
+    }
+    await ctx.clients.s3.putObject(ctx.names.bucket, manifestKey(manifest.hash), JSON.stringify(record, null, 2), 'application/json');
+    return record;
+}
+/** Artifact and result keys for one deploy hash. */
+export function artifactKeys(hash) {
+    return { artifactKey: `web/artifacts/${hash}.zip`, resultKey: `web/results/${hash}.json` };
+}
+/** The SSR packaging job for a hash, from the environment's `ssr` block. */
+export function webFunctionJob(ctx, hash) {
+    const ssr = ctx.config.ssr;
+    if (!ssr)
+        throw new Error(`environment "${ctx.env}" has no config.ssr block`);
+    const { artifactKey, resultKey } = artifactKeys(hash);
+    const shim = entryShim(ssr);
+    return {
+        packageDir: ssr.packageDir,
+        entryPoint: ssr.entryPoint,
+        ...(shim !== undefined ? { shim } : {}),
+        ...(ssr.staticDir !== undefined ? { staticDir: ssr.staticDir } : {}),
+        artifactKey,
+        resultKey,
+    };
+}
 function manifestKey(hash) {
     return `build/manifests/${hash}.json`;
 }
@@ -130,7 +179,9 @@ export async function pollBuild(ctx, hash, startTime, endpoint, token) {
  */
 export async function runBuild(ctx, opts) {
     const sitePrefix = opts.sitePrefix ?? 'site/';
-    const seo = resolveSeo(ctx, opts.baseUrl);
+    // robots.txt/sitemap.xml are the application's routes in SSR mode, so no SEO
+    // payload is sent (and the agent writes none).
+    const seo = opts.webFunction ? {} : resolveSeo(ctx, opts.baseUrl);
     const pendingKey = `build/pending/${opts.target ?? 'site'}.json`;
     const imageArn = ctx.state.resources['microvm-image']?.arn;
     const execRoleArn = ctx.state.resources['iam-exec-role']?.arn;
@@ -175,6 +226,7 @@ export async function runBuild(ctx, opts) {
             distDir: ctx.config.paths.dist,
             objectTags: opts.objectTags ?? ctx.tags,
             ...(opts.refresh ? { refresh: true } : {}),
+            ...(opts.webFunction ? { webFunction: opts.webFunction } : {}),
             ...seo,
         }), 'application/json');
         // Confirm the MicroVM actually reached RUNNING (a FAILED launch must not fall through
@@ -216,7 +268,12 @@ export async function runBuild(ctx, opts) {
         microvmId: run.microvmId,
         ...(result.message ? { message: result.message } : {}),
     };
-    await ctx.clients.s3.putObject(ctx.names.bucket, manifestKey(opts.hash), JSON.stringify(manifest, null, 2), 'application/json');
+    // In SSR mode a successful build is NOT yet a successful deploy: the publish
+    // step writes the manifest once the revision outcome is known. A failed build
+    // has no revision to wait for, so it is recorded here.
+    if (manifest.status === 'failed' || !opts.webFunction) {
+        await writeManifest(ctx, manifest, { ssr: Boolean(opts.webFunction) });
+    }
     if (manifest.status === 'failed') {
         throw new Error(`build failed for ${opts.hash}${manifest.message ? `: ${manifest.message}` : ''}`);
     }