ignotum 0.0.14 → 0.0.16

package/src/cli/control-client.ts

@@ -4,29 +4,27 @@ import { isIP } from "node:net";
 import type {
   AppSlug,
   ControlApp,
-  ControlDeployment,
-  DeploymentFileUploadStatus,
+  ControlVersion,
+  BeginVersionResponse,
 } from "@ignotum/contracts/control";
 import {
-  BeginDeploymentRequest,
+  BeginVersionResponse as BeginVersionResponseSchema,
   ControlApp as ControlAppSchema,
-  ControlDeployment as ControlDeploymentSchema,
+  ControlVersion as ControlVersionSchema,
   ControlErrorCode as ControlErrorCodeSchema,
   ControlErrorResponse,
   CreateAppRequest,
-  DeploymentFileUploadResponse,
   controlAppBySlugPath,
   controlAppPath,
   controlAppsPath,
-  controlDeploymentActivatePath,
-  controlDeploymentFilePath,
-  controlDeploymentFinalizePath,
-  controlDeploymentsPath,
-  controlUploadHeaderNames,
+  controlVersionActivatePath,
+  controlVersionFilePath,
+  controlVersionFinalizePath,
+  controlVersionPath,
 } from "@ignotum/contracts/control";
-import type { ArtifactFile, DeploymentInventory } from "@ignotum/contracts/deployment";
-import { deploymentInventoryPath } from "@ignotum/contracts/deployment";
-import type { AppId, DeploymentId } from "@ignotum/contracts/runtime/identity";
+import { UploadDeclaration } from "@ignotum/contracts/app-definition";
+import { ExecutionSelection } from "@ignotum/contracts/platform";
+import type { AppId, VersionId } from "@ignotum/contracts/runtime/identity";
 import {
   Config,
   Context,
@@ -34,7 +32,6 @@ import {
   FileSystem,
   Layer,
   Option,
-  Path,
   Redacted,
   Schedule,
   Schema,
@@ -101,9 +98,10 @@ export class ControlClientUnavailable extends Schema.TaggedError<ControlClientUn
   },
 ) {}
 
-export interface DeploymentUploadFile {
+export interface VersionUploadFile {
   readonly bytes?: Uint8Array;
   readonly contentType: string;
+  readonly contentEncoding?: string;
   readonly path: string;
   readonly sha256: string;
   readonly size: number;
@@ -111,32 +109,37 @@ export interface DeploymentUploadFile {
 }
 
 interface ControlClientService {
-  readonly activateDeployment: (
+  readonly activateVersion: (
     appId: AppId,
-    deploymentId: DeploymentId,
-  ) => Effect.Effect<ControlApp, ControlApiError | ControlClientUnavailable>;
-  readonly beginDeployment: (
+    versionId: VersionId,
+  ) => Effect.Effect<ExecutionSelection, ControlApiError | ControlClientUnavailable>;
+  readonly beginVersion: (
     appId: AppId,
-    inventory: DeploymentInventory,
-  ) => Effect.Effect<ControlDeployment, ControlApiError | ControlClientUnavailable>;
+    versionId: VersionId,
+    declaration: UploadDeclaration,
+  ) => Effect.Effect<BeginVersionResponse, ControlApiError | ControlClientUnavailable>;
   readonly createApp: (
     slug: AppSlug,
   ) => Effect.Effect<ControlApp, ControlApiError | ControlClientUnavailable>;
-  readonly finalizeDeployment: (
+  readonly finalizeVersion: (
+    appId: AppId,
+    versionId: VersionId,
+  ) => Effect.Effect<ControlVersion, ControlApiError | ControlClientUnavailable>;
+  readonly getVersion: (
     appId: AppId,
-    deploymentId: DeploymentId,
-  ) => Effect.Effect<ControlDeployment, ControlApiError | ControlClientUnavailable>;
+    versionId: VersionId,
+  ) => Effect.Effect<ControlVersion, ControlApiError | ControlClientUnavailable>;
   readonly getApp: (
     appId: AppId,
   ) => Effect.Effect<ControlApp, ControlApiError | ControlClientUnavailable>;
   readonly getAppBySlug: (
     slug: AppSlug,
   ) => Effect.Effect<ControlApp, ControlApiError | ControlClientUnavailable>;
-  readonly uploadDeploymentFile: (
+  readonly uploadVersionFile: (
     appId: AppId,
-    deploymentId: DeploymentId,
-    file: DeploymentUploadFile,
-  ) => Effect.Effect<DeploymentFileUploadStatus, ControlApiError | ControlClientUnavailable>;
+    versionId: VersionId,
+    file: VersionUploadFile,
+  ) => Effect.Effect<void, ControlApiError | ControlClientUnavailable>;
 }
 
 export class ControlClient extends Context.Service<ControlClient, ControlClientService>()(
@@ -156,55 +159,18 @@ const unavailable = (message: string, cause: unknown) =>
 
 const endpoint = (apiUrl: URL, path: string): URL => new URL(path, apiUrl);
 
-const uploadFile = (file: ArtifactFile, sourcePath: string) => ({
-  contentType: file.contentType,
-  path: file.path,
-  sha256: file.sha256,
-  size: file.size,
-  sourcePath,
-});
-
-export const deploymentUploadFiles = Effect.fn("ControlClient.deploymentUploadFiles")(function* (
-  inventory: DeploymentInventory,
-  inventorySha256: string,
-  inventorySize: number,
-  buildDirectory: string,
-  memoryFiles: ReadonlyMap<string, Uint8Array> = new Map(),
-) {
-  const path = yield* Path.Path;
-  return [
-    {
-      contentType: "application/json; charset=utf-8",
-      path: deploymentInventoryPath,
-      sha256: inventorySha256,
-      size: inventorySize,
-      sourcePath: path.join(buildDirectory, deploymentInventoryPath),
-    },
-    ...inventory.files.map((file) => {
-      const bytes = memoryFiles.get(file.path);
-      return bytes === undefined
-        ? uploadFile(file, path.join(buildDirectory, file.path))
-        : {
-            bytes,
-            contentType: file.contentType,
-            path: file.path,
-            sha256: file.sha256,
-            size: file.size,
-          };
-    }),
-  ];
-});
-
 export const controlClientLayer = Layer.effect(
   ControlClient,
   Effect.gen(function* () {
     const config = yield* HostedControlConfiguration;
     const fileSystem = yield* FileSystem.FileSystem;
     const http = yield* HttpClient.HttpClient;
+    // Deployment writes are idempotent and may briefly exhaust a constrained
+    // control worker while processing the complete module graph.
     const idempotentHttp = http.pipe(
       HttpClient.retryTransient({
-        schedule: Schedule.exponential("100 millis"),
-        times: 3,
+        schedule: Schedule.spaced("100 millis"),
+        times: 20,
       }),
     );
 
@@ -297,82 +263,101 @@ export const controlClientLayer = Layer.effect(
       );
     });
 
-    const beginDeployment = Effect.fn("ControlClient.beginDeployment")(function* (
+    const beginVersion = Effect.fn("ControlClient.beginVersion")(function* (
       appId: AppId,
-      inventory: DeploymentInventory,
+      versionId: VersionId,
+      declaration: UploadDeclaration,
     ) {
       const request = yield* HttpClientRequest.post(
-        endpoint(config.apiUrl, controlDeploymentsPath(appId)),
+        endpoint(config.apiUrl, `${controlVersionPath(appId, versionId)}/begin`),
       ).pipe(
-        HttpClientRequest.schemaBodyJson(BeginDeploymentRequest)({ inventory }),
-        Effect.mapError((cause) =>
-          unavailable("The deployment request could not be encoded.", cause),
-        ),
+        HttpClientRequest.schemaBodyJson(UploadDeclaration)(declaration),
+        Effect.mapError((cause) => unavailable("The version request could not be encoded.", cause)),
       );
-      return yield* execute(request, ControlDeploymentSchema);
+      return yield* executeIdempotent(request, BeginVersionResponseSchema);
     });
 
-    const uploadDeploymentFile = Effect.fn("ControlClient.uploadDeploymentFile")(function* (
+    const uploadVersionFile = Effect.fn("ControlClient.uploadVersionFile")(function* (
       appId: AppId,
-      deploymentId: DeploymentId,
-      file: DeploymentUploadFile,
+      versionId: VersionId,
+      file: VersionUploadFile,
     ) {
       const baseRequest = HttpClientRequest.put(
-        endpoint(config.apiUrl, controlDeploymentFilePath(appId, deploymentId, file.path)),
-      ).pipe(
-        HttpClientRequest.setHeader(controlUploadHeaderNames.contentLength, String(file.size)),
-        HttpClientRequest.setHeader(controlUploadHeaderNames.sha256, file.sha256),
-      );
+        endpoint(config.apiUrl, controlVersionFilePath(appId, versionId, file.path)),
+      ).pipe(HttpClientRequest.setHeader("content-length", String(file.size)));
+      const uploadRequest =
+        file.contentEncoding === undefined
+          ? baseRequest
+          : baseRequest.pipe(HttpClientRequest.setHeader("content-encoding", file.contentEncoding));
       const request = yield* file.bytes === undefined
         ? file.sourcePath === undefined
-          ? Effect.fail(unavailable(`Deployment file '${file.path}' has no upload source.`, {}))
-          : HttpClientRequest.bodyFile(baseRequest, file.sourcePath, {
+          ? Effect.fail(unavailable(`Version file '${file.path}' has no upload source.`, {}))
+          : HttpClientRequest.bodyFile(uploadRequest, file.sourcePath, {
               contentType: file.contentType,
             }).pipe(
               Effect.provideService(FileSystem.FileSystem, fileSystem),
               Effect.mapError((cause) =>
-                unavailable(`Deployment file '${file.path}' could not be opened.`, cause),
+                unavailable(`Version file '${file.path}' could not be opened.`, cause),
               ),
             )
         : Effect.succeed(
-            HttpClientRequest.bodyUint8Array(baseRequest, file.bytes, file.contentType),
+            HttpClientRequest.bodyUint8Array(uploadRequest, file.bytes, file.contentType),
           );
-      const response = yield* executeIdempotent(request, DeploymentFileUploadResponse);
-      return response.status;
+      const response = yield* idempotentHttp.execute(authenticate(request)).pipe(
+        Effect.mapError((cause) => unavailable("The artifact upload failed.", cause)),
+        Effect.timeoutOrElse({
+          duration: "30 seconds",
+          orElse: () => Effect.fail(unavailable("The artifact upload exceeded its deadline.", {})),
+        }),
+      );
+      if (response.status !== 204) {
+        yield* decodeResponse(response, Schema.Never);
+      }
     });
 
-    const finalizeDeployment = Effect.fn("ControlClient.finalizeDeployment")(function* (
+    const finalizeVersion = Effect.fn("ControlClient.finalizeVersion")(function* (
       appId: AppId,
-      deploymentId: DeploymentId,
+      versionId: VersionId,
     ) {
       return yield* executeIdempotent(
         HttpClientRequest.post(
-          endpoint(config.apiUrl, controlDeploymentFinalizePath(appId, deploymentId)),
+          endpoint(config.apiUrl, controlVersionFinalizePath(appId, versionId)),
         ),
-        ControlDeploymentSchema,
+        ControlVersionSchema,
       );
     });
 
-    const activateDeployment = Effect.fn("ControlClient.activateDeployment")(function* (
+    const activateVersion = Effect.fn("ControlClient.activateVersion")(function* (
       appId: AppId,
-      deploymentId: DeploymentId,
+      versionId: VersionId,
     ) {
       return yield* executeIdempotent(
         HttpClientRequest.post(
-          endpoint(config.apiUrl, controlDeploymentActivatePath(appId, deploymentId)),
+          endpoint(config.apiUrl, controlVersionActivatePath(appId, versionId)),
         ),
-        ControlAppSchema,
+        ExecutionSelection,
+      );
+    });
+
+    const getVersion = Effect.fn("ControlClient.getVersion")(function* (
+      appId: AppId,
+      versionId: VersionId,
+    ) {
+      return yield* executeIdempotent(
+        HttpClientRequest.get(endpoint(config.apiUrl, controlVersionPath(appId, versionId))),
+        ControlVersionSchema,
       );
     });
 
     return ControlClient.of({
-      activateDeployment,
-      beginDeployment,
+      activateVersion,
+      beginVersion,
       createApp,
-      finalizeDeployment,
+      finalizeVersion,
       getApp,
+      getVersion,
       getAppBySlug,
-      uploadDeploymentFile,
+      uploadVersionFile,
     });
   }),
 );

package/src/cli/deploy.ts

@@ -1,245 +1,181 @@
-import { Effect, FileSystem, Path, Result, Schema } from "effect";
-
-import { deploymentInventoryPath } from "@ignotum/contracts/deployment";
-import type { DeploymentInventory } from "@ignotum/contracts/deployment";
-import type { AppSlug } from "@ignotum/contracts/control";
-import { DeploymentId } from "@ignotum/contracts/runtime/identity";
-import {
-  makeDeploymentInventory,
-  readArtifactDirectory,
-  sha256,
-  validateDeploymentArtifact,
-} from "@ignotum/deployment";
-
+import { Effect, Path, Schema } from "effect";
+import type { AppSlug, ControlVersion } from "@ignotum/contracts/control";
+import { VersionId, VersionNumber } from "@ignotum/contracts/runtime/identity";
+import { IdGenerator } from "@ignotum/shared/id";
 import { appUrl, configureApp, type AppConfiguration } from "./app-configuration.js";
-import { buildClient } from "./build/client.js";
-import { buildServer } from "./build/server.js";
-import { generate } from "./codegen.js";
+import { buildManagedVersion, type ManagedVersionBuildResult } from "./build/managed.js";
 import {
   ControlClient,
-  deploymentUploadFiles,
+  ControlClientUnavailable,
   type ControlApiError,
-  type ControlClientUnavailable,
+  type VersionUploadFile,
 } from "./control-client.js";
 
-export interface DeploymentBuildResult {
-  readonly clientAssets: number;
-  readonly inventory: DeploymentInventory;
-  readonly inventoryBytes: Uint8Array;
-  readonly outputDirectory: string;
-  readonly memoryFiles?: ReadonlyMap<string, Uint8Array>;
-  readonly serverFunctions: number;
-}
-
-export interface DeployResult extends DeploymentBuildResult {
-  readonly appUrl: string;
-  readonly deploymentId: DeploymentId;
-}
-
-export class BuildReplacementFailed extends Schema.TaggedError<BuildReplacementFailed>()(
-  "BuildReplacementFailed",
-  {
-    backupPath: Schema.String,
-    cause: Schema.Defect(),
-    message: Schema.String,
-  },
+export class VersionUploadInterrupted extends Schema.TaggedError<VersionUploadInterrupted>()(
+  "VersionUploadInterrupted",
+  { cause: Schema.Defect(), versionId: VersionId, message: Schema.String },
 ) {}
 
-export class DeploymentUploadInterrupted extends Schema.TaggedError<DeploymentUploadInterrupted>()(
-  "DeploymentUploadInterrupted",
+export class VersionActivationUnconfirmed extends Schema.TaggedError<VersionActivationUnconfirmed>()(
+  "VersionActivationUnconfirmed",
   {
     cause: Schema.Defect(),
-    deploymentId: DeploymentId,
-    message: Schema.String,
-  },
-) {}
-
-export class DeploymentActivationUnconfirmed extends Schema.TaggedError<DeploymentActivationUnconfirmed>()(
-  "DeploymentActivationUnconfirmed",
-  {
-    cause: Schema.Defect(),
-    deploymentId: DeploymentId,
+    versionId: VersionId,
+    versionNumber: VersionNumber,
     message: Schema.String,
   },
 ) {}
 
 const activationError = (
-  deploymentId: DeploymentId,
+  version: ControlVersion & { readonly number: VersionNumber },
   cause: ControlApiError | ControlClientUnavailable,
 ) =>
   cause._tag === "ControlClientUnavailable" || cause.status >= 500
-    ? DeploymentActivationUnconfirmed.make({
+    ? VersionActivationUnconfirmed.make({
         cause,
-        deploymentId,
-        message: `Deployment ${deploymentId} is ready, but activation could not be confirmed. Run ignotum deploy --resume ${deploymentId} to finish activation.`,
+        versionId: version.id,
+        versionNumber: version.number,
+        message: `Version ${version.number} (${version.id}) is ready, but activation could not be confirmed. Run ignotum deploy --resume ${version.id} to finish activation.`,
       })
     : cause;
 
-const replaceBuildDirectory = Effect.fn("Deploy.replaceBuildDirectory")(function* (
-  stateDirectory: string,
-  stagingDirectory: string,
-  buildDirectory: string,
-) {
-  const fileSystem = yield* FileSystem.FileSystem;
-  const currentExists = yield* fileSystem.exists(buildDirectory);
-  if (!currentExists) {
-    yield* fileSystem.rename(stagingDirectory, buildDirectory);
-    return;
-  }
-
-  const backupPath = yield* fileSystem.makeTempDirectory({
-    directory: stateDirectory,
-    prefix: ".build-backup-",
-  });
-  yield* fileSystem.remove(backupPath, { recursive: true });
-  yield* fileSystem.rename(buildDirectory, backupPath);
-
-  const replacement = yield* Effect.result(fileSystem.rename(stagingDirectory, buildDirectory));
-  if (Result.isSuccess(replacement)) {
-    yield* fileSystem.remove(backupPath, { recursive: true });
-    return;
-  }
-
-  const restoration = yield* Effect.result(fileSystem.rename(backupPath, buildDirectory));
-  if (Result.isFailure(restoration)) {
-    return yield* BuildReplacementFailed.make({
-      backupPath,
-      cause: restoration.failure,
-      message: `Could not install the new build or restore the previous build. The previous build remains at ${backupPath}.`,
-    });
-  }
-
-  return yield* replacement.failure;
-});
+const readyVersion = (version: ControlVersion) =>
+  version.status === "Ready" && version.number !== null
+    ? Effect.succeed({ ...version, number: version.number })
+    : Effect.fail(
+        ControlClientUnavailable.make({
+          cause: { versionId: version.id, status: version.status },
+          message: `Version ${version.id} is not ready for activation.`,
+        }),
+      );
 
-export const buildDeploymentArtifact = Effect.fn("Deploy.buildArtifact")(function* (
+export const buildVersionArtifact = Effect.fn("Deploy.buildArtifact")(function* (
   appDirectory: string,
 ) {
-  const fileSystem = yield* FileSystem.FileSystem;
   const path = yield* Path.Path;
-  const stateDirectory = path.join(appDirectory, ".ignotum");
-  const buildDirectory = path.join(stateDirectory, "build");
-
-  yield* fileSystem.makeDirectory(stateDirectory, { recursive: true });
-  const codegen = yield* generate(appDirectory);
-
-  return yield* Effect.scoped(
-    Effect.gen(function* () {
-      const stagingDirectory = yield* Effect.acquireRelease(
-        fileSystem.makeTempDirectory({
-          directory: stateDirectory,
-          prefix: ".build-staging-",
-        }),
-        (directory) =>
-          fileSystem.remove(directory, { force: true, recursive: true }).pipe(Effect.orDie),
-      );
-      const clientOutput = path.join(stagingDirectory, "client");
-      const serverOutput = path.join(stagingDirectory, "server");
-      const client = yield* buildClient(appDirectory, clientOutput);
-      const server = yield* buildServer(appDirectory, serverOutput, codegen.functionModules);
-      const diskPayloadFiles = yield* readArtifactDirectory(stagingDirectory);
-      const payloadFiles = [...diskPayloadFiles, server.environment];
-      const inventory = yield* makeDeploymentInventory(payloadFiles);
-      yield* fileSystem.writeFile(
-        path.join(stagingDirectory, deploymentInventoryPath),
-        inventory.bytes,
-      );
-      const diskArtifactFiles = yield* readArtifactDirectory(stagingDirectory);
-      const artifactFiles = [...diskArtifactFiles, server.environment];
-      yield* validateDeploymentArtifact(artifactFiles);
-      yield* Effect.logInfo("Built deployment artifact").pipe(
-        Effect.annotateLogs({
-          files: inventory.inventory.files.length,
-          functions: server.functions,
-        }),
-      );
-
-      yield* replaceBuildDirectory(stateDirectory, stagingDirectory, buildDirectory);
-
-      return {
-        clientAssets: client.assets,
-        inventory: inventory.inventory,
-        inventoryBytes: inventory.bytes,
-        memoryFiles: new Map([[server.environment.path, server.environment.bytes]]),
-        outputDirectory: buildDirectory,
-        serverFunctions: server.functions,
-      } satisfies DeploymentBuildResult;
-    }),
-  );
+  return yield* buildManagedVersion(appDirectory, { applicationName: path.basename(appDirectory) });
 });
 
-export const uploadDeployment = Effect.fn("Deploy.upload")(function* (
+export const uploadVersion = Effect.fn("Deploy.upload")(function* (
   configuration: AppConfiguration,
-  build: DeploymentBuildResult,
+  build: ManagedVersionBuildResult,
 ) {
   const control = yield* ControlClient;
-  const inventorySha256 = yield* sha256(build.inventoryBytes);
-  const files = yield* deploymentUploadFiles(
-    build.inventory,
-    inventorySha256,
-    build.inventoryBytes.byteLength,
-    build.outputDirectory,
-    build.memoryFiles,
-  );
-  const deployment = yield* control.beginDeployment(configuration.appId, build.inventory);
-
+  const versionId = yield* (yield* IdGenerator).generate(VersionId);
+  const admission = yield* control.beginVersion(configuration.appId, versionId, build.declaration);
+  const files = yield* Effect.forEach(admission.targets, (target) => {
+    const publicArtifact = build.declaration.definition.artifacts.find(
+      (artifact) => artifact.path === target.path,
+    );
+    const artifact = target.protected ? build.declaration.environment?.artifact : publicArtifact;
+    const bytes =
+      target.protected && target.path === build.environment.path
+        ? build.environment.bytes
+        : build.bytes.get(target.path);
+    if (
+      target.appId !== configuration.appId ||
+      target.versionId !== versionId ||
+      artifact === undefined ||
+      artifact.path !== target.path ||
+      artifact.size !== target.size ||
+      artifact.sha256 !== target.sha256 ||
+      bytes === undefined ||
+      bytes.byteLength !== target.size ||
+      (target.protected
+        ? target.contentType !== "application/json; charset=utf-8" ||
+          target.contentEncoding !== undefined
+        : publicArtifact === undefined ||
+          publicArtifact.contentType !== target.contentType ||
+          publicArtifact.contentEncoding !== target.contentEncoding)
+    ) {
+      return Effect.fail(
+        ControlClientUnavailable.make({
+          cause: { path: target.path },
+          message: "The API requested an artifact that does not match this build.",
+        }),
+      );
+    }
+    return Effect.succeed({ ...target, bytes } satisfies VersionUploadFile);
+  });
   yield* Effect.forEach(
     files,
-    (file) => control.uploadDeploymentFile(configuration.appId, deployment.id, file),
-    { concurrency: 4, discard: true },
+    (file) => control.uploadVersionFile(configuration.appId, versionId, file),
+    // The hosted control plane runs within Cloudflare's per-request CPU budget.
+    // Serialize uploads so several validation-heavy requests cannot contend in
+    // the same isolate and exhaust that budget together.
+    { concurrency: 1, discard: true },
   ).pipe(
     Effect.catchTags({
       ControlClientUnavailable: (cause) =>
-        DeploymentUploadInterrupted.make({
+        VersionUploadInterrupted.make({
           cause,
-          deploymentId: deployment.id,
-          message: `Deployment ${deployment.id} was interrupted during upload. The active deployment was not changed.`,
+          versionId,
+          message: `Version ${versionId} was interrupted during upload. The active version was not changed.`,
         }),
     }),
   );
-
-  yield* control.finalizeDeployment(configuration.appId, deployment.id).pipe(
+  const version = yield* control.finalizeVersion(configuration.appId, versionId).pipe(
     Effect.catchTags({
       ControlClientUnavailable: (cause) =>
-        DeploymentUploadInterrupted.make({
+        VersionUploadInterrupted.make({
           cause,
-          deploymentId: deployment.id,
-          message: `Deployment ${deployment.id} could not be finalized. The active deployment was not changed.`,
+          versionId,
+          message: `Version ${versionId} could not be finalized. The active version was not changed.`,
         }),
     }),
+    Effect.flatMap(readyVersion),
   );
-
-  yield* control
-    .activateDeployment(configuration.appId, deployment.id)
-    .pipe(Effect.mapError((cause) => activationError(deployment.id, cause)));
-
-  return deployment.id;
+  const selection = yield* control
+    .activateVersion(configuration.appId, versionId)
+    .pipe(Effect.mapError((cause) => activationError(version, cause)));
+  if (selection.appId !== configuration.appId || selection.versionId !== versionId) {
+    return yield* activationError(
+      version,
+      ControlClientUnavailable.make({
+        cause: selection,
+        message: "The API confirmed a different App Version.",
+      }),
+    );
+  }
+  return { versionId, versionNumber: version.number, selection };
 });
 
 export const deploy = Effect.fn("Deploy.run")(function* (
   appDirectory: string,
   requestedSlug: AppSlug | undefined,
 ) {
-  const build = yield* buildDeploymentArtifact(appDirectory);
+  const build = yield* buildVersionArtifact(appDirectory);
   const configuration = yield* configureApp(appDirectory, requestedSlug);
-  const deploymentId = yield* uploadDeployment(configuration, build);
-
-  return {
-    ...build,
-    appUrl: appUrl(configuration.slug),
-    deploymentId,
-  } satisfies DeployResult;
+  const activated = yield* uploadVersion(configuration, build);
+  return { ...activated, appUrl: appUrl(configuration.slug) };
 });
 
-export const resumeDeployment = Effect.fn("Deploy.resume")(function* (
+export const resumeVersion = Effect.fn("Deploy.resume")(function* (
   appDirectory: string,
-  deploymentId: DeploymentId,
+  versionId: VersionId,
   requestedSlug?: AppSlug,
 ) {
   const configuration = yield* configureApp(appDirectory, requestedSlug);
   const control = yield* ControlClient;
-  yield* control
-    .activateDeployment(configuration.appId, deploymentId)
-    .pipe(Effect.mapError((cause) => activationError(deploymentId, cause)));
-  return { appUrl: appUrl(configuration.slug), deploymentId };
+  const version = yield* control
+    .getVersion(configuration.appId, versionId)
+    .pipe(Effect.flatMap(readyVersion));
+  const selection = yield* control
+    .activateVersion(configuration.appId, versionId)
+    .pipe(Effect.mapError((cause) => activationError(version, cause)));
+  if (selection.appId !== configuration.appId || selection.versionId !== versionId) {
+    return yield* activationError(
+      version,
+      ControlClientUnavailable.make({
+        cause: selection,
+        message: "The API confirmed a different App Version.",
+      }),
+    );
+  }
+  return {
+    appUrl: appUrl(configuration.slug),
+    versionId,
+    versionNumber: version.number,
+    selection,
+  };
 });