breakaway 2.0.0-main.83 → 2.0.0-main.85

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "breakaway",
-  "version": "2.0.0-main.83",
+  "version": "2.0.0-main.85",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "breakaway",
-      "version": "2.0.0-main.83",
+      "version": "2.0.0-main.85",
       "license": "FSL-1.1-Apache-2.0",
       "bin": {
         "breakaway": "scripts/tasks.mjs"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "breakaway",
-  "version": "2.0.0-main.83",
+  "version": "2.0.0-main.85",
   "description": "The task board for you and your coding agents: a Cloudflare Worker, its web app, Taskwarrior sync, and the CLI (npx breakaway).",
   "license": "FSL-1.1-Apache-2.0",
   "type": "module",

package/src/infra-cloudflare.js

@@ -1162,38 +1162,95 @@ export async function observe(ctx) {
 }
 
 /**
- * A Cloudflare alert, cut down to three fields: its name, when it fired, and the Worker it names. Everything else
- * (its text, data, account and policy IDs) is left out. The board's alert webhook (src/store-routines.js) and the
- * alert history (`events`) both read alerts with this, so an alert heard both ways reads the same.
+ * A Cloudflare alert, cut down to what places it: its name, when it fired, and the Worker, zone, or hostname it names.
+ * Everything else (its text, the rest of its data, account and policy IDs) is left out. The board's alert webhook
+ * (src/store-routines.js) and the alert history (`events`) both read alerts with this, so an alert heard both ways
+ * reads the same. `zoneId` is only for finding the zone's name; it's never stored.
  * @param {any} body a notification webhook's body, or an alert history entry's `alert_body`
- * @returns {{ alert: string | null, at: string | null, worker: string | null }}
+ * @returns {{ alert: string | null, at: string | null, worker: string | null, zone: string | null,
+ *   zoneId: string | null, hostname: string | null }}
  */
 export function alertFields(body) {
-  const pick = (...values) => values.find((v) => typeof v === 'string' && v.trim()) ?? null;
+  const pick = (...values) => values.find((v) => typeof v === 'string' && v.trim())?.trim() ?? null;
+  const first = (v) => (Array.isArray(v) ? v.find((x) => typeof x === 'string') : v);
   const data = body?.data && typeof body.data === 'object' && !Array.isArray(body.data) ? body.data : {};
   const ts = Number(body?.ts);
   const at =
     Number.isFinite(ts) && ts > 0
       ? new Date(ts < 1e11 ? ts * 1000 : ts)
       : new Date(pick(body?.timestamp, body?.time) ?? Number.NaN);
+  const host = pick(data.hostname, data.host, data.domain, first(data.hostnames), first(data.hosts));
   return {
     alert: pick(body?.alert_name, body?.policy_name, body?.name, body?.alert_type),
     at: Number.isNaN(at.getTime()) ? null : at.toISOString(),
     worker: pick(data.script_name, data.worker_name, data.worker, data.service, data.script),
+    zone: pick(data.zone_name, data.zone)?.toLowerCase() ?? null,
+    zoneId: pick(data.zone_tag, data.zone_id),
+    hostname: host ? host.toLowerCase().replace(/^\*\./u, '').replace(/\.$/u, '') : null,
   };
 }
 
-/** An alert signal's text: the alert's name and the Worker it names. */
-export function alertText(alert, worker) {
+/** An alert signal's text: the alert's name and what it's on (a Worker, a zone, or a hostname). */
+export function alertText(alert, on) {
   const name = String(alert ?? '').slice(0, 200) || 'unnamed alert';
-  return `Cloudflare alert: ${name}${worker ? ` on ${String(worker).slice(0, 100)}` : ''}`;
+  return `Cloudflare alert: ${name}${on ? ` on ${String(on).slice(0, 100)}` : ''}`;
+}
+
+/** The zones an environment's resources use: the zone of each of its routes and custom domains. */
+export function zonesOf(resources) {
+  const zones = new Set();
+  for (const r of resources ?? []) {
+    if (r.kind !== 'route' && r.kind !== 'custom-domain') continue;
+    const zone = /** @type {any} */ (r.attrs)?.zone;
+    if (typeof zone === 'string' && zone) zones.add(zone.toLowerCase());
+  }
+  return zones;
+}
+
+/**
+ * Where an alert goes in one environment (BRK-255), from its fields and the environment's resources: on the Worker it
+ * names when that Worker is the environment's; on the whole environment when the zone it names (or its hostname's
+ * zone) is one the environment's routes or custom domains use; `account` when it names no Worker, zone, or hostname
+ * (it's about the account or the platform, and the board keeps one per provider, not one per environment); or null
+ * when it's another environment's, or no environment's.
+ *
+ * With `elsewhere`, the resources of the provider's other environments, an alert naming a zone or hostname that
+ * neither this environment nor any other uses is `account` too (BRK-256), still on that zone or hostname, rather than
+ * nobody's. A zone named only by its ID, which nothing here can name, stays nobody's.
+ * @param {ReturnType<typeof alertFields>} fields
+ * @param {Array<{ kind: string, name: string, attrs?: Record<string, unknown> }>} resources
+ * @param {Array<{ kind: string, name: string, attrs?: Record<string, unknown> }>} [elsewhere]
+ * @returns {{ resource: string | null, account: boolean, on: string | null } | null}
+ */
+export function alertPlace(fields, resources, elsewhere) {
+  if (fields.worker) {
+    const mine = (resources ?? []).some((r) => r.kind === 'worker' && r.name === fields.worker);
+    return mine ? { resource: rid('worker', fields.worker), account: false, on: fields.worker } : null;
+  }
+  if (!fields.zone && !fields.hostname && !fields.zoneId) return { resource: null, account: true, on: null };
+  const on = fields.hostname ?? fields.zone;
+  if (zoneUsed(fields, resources)) return { resource: null, account: false, on };
+  if (elsewhere && on && !zoneUsed(fields, elsewhere)) return { resource: null, account: true, on };
+  return null;
+}
+
+/** Whether the zone an alert names, or its hostname's zone, is one that `resources`' routes or custom domains use. */
+function zoneUsed(fields, resources) {
+  const zones = zonesOf(resources);
+  const host = fields.hostname;
+  return Boolean(
+    (fields.zone && zones.has(fields.zone)) || (host && [...zones].some((z) => host === z || host.endsWith(`.${z}`))),
+  );
 }
 
 /**
  * The account's alerts since `since`, from its alert history (`GET …/alerting/v3/history`, Notifications Read), as
- * `alert` signals: each on the Worker it names when that Worker is in the environment, or on the whole environment
- * when it names none; an alert about a Worker outside the environment is another environment's. Oldest first. The
- * board's alert webhook reports the same alerts as they fire; the store keeps one of each.
+ * `alert` signals placed by `alertPlace` (BRK-255): on the Worker it names when that Worker is in the environment, on
+ * the whole environment when it names a zone or hostname the environment uses, and marked `account` when it names
+ * none of them, or (given `ctx.elsewhere`, BRK-256) a zone or hostname no environment uses; an alert about another
+ * environment's Worker or zone is left out. A zone named only by its ID is looked up in the account's zones (Zone
+ * Read). Oldest first. The board's alert webhook reports the same alerts as they fire; the store keeps one of each, and
+ * one of each account-wide alert across the provider's environments.
  * @param {ProviderContext} ctx
  * @param {string} since ISO 8601
  * @returns {Promise<import('./infra-provider.js').Signal[]>}
@@ -1204,11 +1261,25 @@ export async function events(ctx, since) {
   const now = Date.now();
   if (from > now) return [];
   const resources = ctx.resources ?? (await discover(ctx)).resources;
-  const workers = new Set(resources.filter((r) => r.kind === 'worker').map((r) => r.name));
   const cf = reader(ctx);
-  const a = enc(await accountOf(cf, ctx));
+  const account = await accountOf(cf, ctx);
+  const a = enc(account);
   const window = `since=${enc(new Date(from).toISOString())}&before=${enc(new Date(now).toISOString())}`;
   const history = await cf.all(`/accounts/${a}/alerting/v3/history?${window}`, { permission: 'Notifications Read' });
+  /** @type {Map<string, string> | null} zone names by ID, read only when an alert names a zone by its ID alone */
+  let zoneNames = null;
+  const zoneName = async (id) => {
+    if (!zoneNames) {
+      zoneNames = new Map();
+      try {
+        for (const z of await cf.all(`/zones?account.id=${a}`, { permission: 'Zone Read' }, 50))
+          zoneNames.set(String(z.id), String(z.name).toLowerCase());
+      } catch (error) {
+        if (error?.status !== 403) throw error;
+      }
+    }
+    return zoneNames.get(id) ?? null;
+  };
   /** @type {import('./infra-provider.js').Signal[]} */
   const signals = [];
   for (const entry of history) {
@@ -1222,16 +1293,20 @@ export async function events(ctx, since) {
     const fields = alertFields(body);
     const at = fields.at ?? (Number.isNaN(Date.parse(entry?.sent)) ? null : new Date(entry.sent).toISOString());
     if (!at || Date.parse(at) < from) continue;
-    if (fields.worker && !workers.has(fields.worker)) continue;
+    if (!fields.worker && !fields.zone && !fields.hostname && fields.zoneId)
+      fields.zone = await zoneName(fields.zoneId);
+    const place = alertPlace(fields, resources, ctx.elsewhere);
+    if (!place) continue;
     signals.push({
       source: 'cloudflare',
       environment: ctx.environment,
-      resource: fields.worker ? rid('worker', fields.worker) : null,
+      resource: place.resource,
       kind: 'alert',
       level: 'warning',
       value: null,
       at,
-      text: alertText(fields.alert ?? entry?.name ?? entry?.alert_type, fields.worker),
+      text: alertText(fields.alert ?? entry?.name ?? entry?.alert_type, place.on),
+      ...(place.account ? { account: true } : {}),
     });
   }
   return signals.sort((x, y) => Date.parse(x.at) - Date.parse(y.at));

package/src/infra-provider.js

@@ -123,6 +123,8 @@ export const COST_NOTE_MAX = 500;
  * @property {number | null} value
  * @property {string} at ISO 8601
  * @property {string} text short, at most SIGNAL_TEXT_MAX characters
+ * @property {boolean} [account] true for an alert about the provider's account or platform as a whole, not this
+ *   environment (BRK-255): its resource is null, and the board keeps one per provider, not one per environment
  */
 
 /**
@@ -141,6 +143,8 @@ export const COST_NOTE_MAX = 500;
  * @property {typeof fetch} [fetch] the fetch to call the platform with; tests pass a mock
  * @property {Resource[]} [resources] what `discover` just found in the environment's scope: the store passes it to
  *   `observe` and `cost` so they needn't discover again
+ * @property {Resource[]} [elsewhere] what `discover` just found in the provider's other environments: `events` keeps an
+ *   alert on a zone or hostname none of them, nor this one, uses as account-wide instead of leaving it out (BRK-256)
  * @property {Set<string>} [reached] the store's collector: the provider adds a permission's name when a call answers
  *   with it, so Connections puts back one an earlier refusal struck (BRK-254)
  */
@@ -495,6 +499,10 @@ export function checkSignals(provider, ctx, since, signals) {
     if (s.source !== provider.id) fail(what, `a signal is from ${s.source}, not ${provider.id}`);
     if (s.environment !== ctx.environment) fail(what, `a signal is for ${s.environment}, not ${ctx.environment}`);
     if (s.resource !== null && !text(s.resource)) fail(what, 'a signal has a resource that is neither an id nor null');
+    if (s.account !== undefined && typeof s.account !== 'boolean')
+      fail(what, 'a signal has an account that isn’t true or false');
+    if (s.account && (s.resource !== null || s.kind !== 'alert'))
+      fail(what, 'an account signal is an alert on no resource');
     if (!SIGNAL_KINDS.includes(s.kind)) fail(what, `a signal has unknown kind "${s.kind}"`);
     if (!SIGNAL_LEVELS.includes(s.level)) fail(what, `a signal has unknown level "${s.level}"`);
     if (s.value !== null && (typeof s.value !== 'number' || !Number.isFinite(s.value)))