openship 0.1.10 → 0.1.11

package/dist/server/index.js

@@ -53,7 +53,7 @@ var init_types = __esm(() => {
   DEFAULT_RESOURCE_CONFIG = {
     cpuCores: 1,
     memoryMb: 512,
-    diskMb: 4096
+    diskMb: 5120
   };
   DEFAULT_BUILD_RESOURCE_CONFIG = {
     cpuCores: 4,
@@ -62135,6 +62135,9 @@ class CloudComposeSupport {
     try {
       workspaceId = builtArtifact?.workspaceId ?? await this.createImageServiceWorkspace(config, log);
       const ws = this.deps.workspace(workspaceId);
+      if (builtArtifact?.workspaceId) {
+        await this.shrinkToRuntimeTier(ws, config, log);
+      }
       await withCloudOperationTimeout(ws.lifecycle.makePermanent(), `Making cloud service "${config.serviceName}" permanent`).catch((err2) => {
         throw new Error(`Failed to make service workspace permanent: ${errorMessage(err2)}`);
       });
@@ -62270,6 +62273,21 @@ class CloudComposeSupport {
       throw err2;
     }
   }
+  async shrinkToRuntimeTier(ws, config, log) {
+    const cpus = config.resources?.cpuCores ?? DEFAULT_RESOURCE_CONFIG.cpuCores;
+    const memory_mb = config.resources?.memoryMb ?? DEFAULT_RESOURCE_CONFIG.memoryMb;
+    try {
+      await withCloudOperationTimeout(ws.resources.update({ cpus, memory_mb, apply: true }), `Resizing service "${config.serviceName}" to its runtime tier`);
+    } catch (err2) {
+      throw new Error(`Failed to shrink service "${config.serviceName}" from the build tier to its runtime tier: ${errorMessage(err2)}`);
+    }
+    log({
+      timestamp: now(),
+      message: `Sized "${config.serviceName}" to its runtime tier (${cpus} vCPU · ${memory_mb} MB).
+`,
+      level: "info"
+    });
+  }
   async createImageServiceWorkspace(config, onLog) {
     const resources = {
       cpuCores: config.resources?.cpuCores ?? DEFAULT_RESOURCE_CONFIG.cpuCores,
@@ -234876,34 +234894,6 @@ function cloudClient(scope) {
         }
         const body2 = await readCloudJson(res);
         return body2 ?? null;
-      },
-      async requestVerification(target) {
-        const res = await fetchScoped("/api/cloud/edge-proxy/verify-request", {
-          method: "POST",
-          body: JSON.stringify({ target })
-        });
-        if (!res)
-          return null;
-        if (!res.ok) {
-          const text3 = await res.text().catch(() => "");
-          throw new Error(`Edge verification request failed (${res.status}): ${text3}`);
-        }
-        const body2 = await readCloudJson(res);
-        return body2?.verification ?? null;
-      },
-      async checkVerification(id2) {
-        const res = await fetchScoped("/api/cloud/edge-proxy/verify-check", {
-          method: "POST",
-          body: JSON.stringify({ id: id2 })
-        });
-        if (!res)
-          return null;
-        if (!res.ok) {
-          const text3 = await res.text().catch(() => "");
-          throw new Error(`Edge verification check failed (${res.status}): ${text3}`);
-        }
-        const body2 = await readCloudJson(res);
-        return body2 ?? null;
       }
     },
     analytics: {
@@ -278842,31 +278832,6 @@ var init_controller_helpers = __esm(async () => {
   await init_src3();
 });
 
-// ../api/src/lib/edge-challenge-store.ts
-async function armEdgeChallenge(token) {
-  if (!token)
-    return;
-  const store2 = await cacheStore(NS, { maxSize: 512 });
-  await store2.set(token, true, TTL_SECONDS);
-}
-async function disarmEdgeChallenge(token) {
-  if (!token)
-    return;
-  const store2 = await cacheStore(NS, { maxSize: 512 });
-  await store2.delete(token);
-}
-async function isEdgeChallengeArmed(token) {
-  if (!token)
-    return false;
-  const store2 = await cacheStore(NS, { maxSize: 512 });
-  return await store2.get(token) === true;
-}
-var NS = "oblien-edge-challenge", TTL_SECONDS;
-var init_edge_challenge_store = __esm(() => {
-  init_cache_store();
-  TTL_SECONDS = 10 * 60;
-});
-
 // ../api/src/middleware/internal-auth.ts
 import { timingSafeEqual as timingSafeEqual3 } from "node:crypto";
 async function internalAuth(c2, next) {
@@ -283704,23 +283669,6 @@ var init_server_target = __esm(async () => {
 });
 
 // ../api/src/lib/managed-edge-proxy.ts
-function isTargetUnverified(err2) {
-  return err2 instanceof Error && /target_unverified|ownership is not verified/i.test(err2.message);
-}
-async function verifyEdgeTarget(edge, target) {
-  const challenge = await edge.requestVerification(target);
-  if (!challenge)
-    throw new Error(NO_CLOUD_MEMBER);
-  await armEdgeChallenge(challenge.token);
-  try {
-    const check4 = await edge.checkVerification(challenge.id);
-    if (!check4 || check4.status !== "verified") {
-      throw new Error(`Edge target ownership verification failed: ${check4?.error ?? check4?.status ?? "unknown"}`);
-    }
-  } finally {
-    await disarmEdgeChallenge(challenge.token);
-  }
-}
 async function ensureManagedEdgeProxy(organizationId, slug, opts) {
   if (!slug.trim())
     return;
@@ -283728,20 +283676,9 @@ async function ensureManagedEdgeProxy(organizationId, slug, opts) {
   if (!target) {
     throw new Error("Cannot configure edge proxy: target host could not be resolved");
   }
-  const edge = cloudClient({ organizationId }).edgeProxy;
-  const sync = async () => {
-    const result = await edge.sync({ slug, target });
-    if (!result)
-      throw new Error(NO_CLOUD_MEMBER);
-  };
-  try {
-    await sync();
-  } catch (err2) {
-    if (!isTargetUnverified(err2))
-      throw err2;
-    await verifyEdgeTarget(edge, target);
-    await sync();
-  }
+  const result = await cloudClient({ organizationId }).edgeProxy.sync({ slug, target });
+  if (!result)
+    throw new Error(NO_CLOUD_MEMBER);
 }
 async function syncManagedEdgeRoutes(targets, opts) {
   const failures = [];
@@ -283765,7 +283702,6 @@ function edgeUnsyncedWarning(failures, retryHint) {
 var NO_CLOUD_MEMBER = "Cannot sync edge proxy: no member of this organization has linked Openship Cloud";
 var init_managed_edge_proxy = __esm(async () => {
   init_src();
-  init_edge_challenge_store();
   await __promiseAll([
     init_client5(),
     init_server_target()
@@ -296459,21 +296395,8 @@ var init_rollback = __esm(async () => {
 
 // ../api/src/modules/deployments/build-pipeline.ts
 import { posix as pathPosix4 } from "node:path";
-function buildScopedEnvVars(envVars, opts) {
-  const scoped = { ...envVars };
-  let ignoredNodeEnv;
-  if (opts?.forceProductionNodeEnv) {
-    ignoredNodeEnv = scoped.NODE_ENV;
-    delete scoped.NODE_ENV;
-  }
-  return {
-    envVars: {
-      ...BUILD_ENV_VARS,
-      ...scoped,
-      ...opts?.forceProductionNodeEnv ? { NODE_ENV: "production" } : {}
-    },
-    ignoredNodeEnv
-  };
+function buildScopedEnvVars(envVars) {
+  return { envVars: { ...BUILD_ENV_VARS, ...envVars } };
 }
 function resolveStaticOutputDirectory(outputDirectory, targetPath) {
   const normalizedTargetPath = normalizeTargetPath(targetPath);
@@ -296669,13 +296592,7 @@ async function executeBuildAndDeploy(project2, dep, buildSessionId) {
       logger4.log(`⚠ ${failedEnvKeys.length} environment variable(s) could not be decrypted and were skipped: ${failedEnvKeys.join(", ")}. The encryption key likely changed since they were saved — ` + `re-enter them in the project's Environment settings and redeploy.`, "warn");
     }
     const buildStrategy = await resolveStrategy(snapshot.framework, snapshot.buildStrategy, { deployTarget: snapshot.deployTarget });
-    const isLocalBuild = buildStrategy === "local";
-    const buildEnv = buildScopedEnvVars(envMap, {
-      forceProductionNodeEnv: isLocalBuild
-    });
-    if (isLocalBuild && buildEnv.ignoredNodeEnv && buildEnv.ignoredNodeEnv !== "production") {
-      logger4.log(`Ignoring deployment NODE_ENV=${buildEnv.ignoredNodeEnv} during local build and forcing NODE_ENV=production.`, "warn");
-    }
+    const buildEnv = buildScopedEnvVars(envMap);
     const orgOwner = await resolveOrgOwner(dep.organizationId).catch(() => null);
     const actorUserId = orgOwner?.userId ?? "";
     const useServicePipeline = (await resolveServicePipelineMode(project2, snapshot)).useServicePipeline;
@@ -300562,10 +300479,6 @@ var init_cloud_session_service = __esm(async () => {
 });
 
 // ../api/src/modules/cloud/cloud-edge-proxy.service.ts
-function normalizeEdgeTarget(target) {
-  const hostPart = target.trim().replace(/^https?:\/\//i, "");
-  return `https://${hostPart}`;
-}
 async function syncCloudEdgeProxy(organizationId, input) {
   const slug = input.slug.toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
   if (!slug) {
@@ -300573,7 +300486,7 @@ async function syncCloudEdgeProxy(organizationId, input) {
   }
   const baseDomain = SYSTEM.DOMAINS.CLOUD_DOMAIN;
   const hostname7 = `${slug}.${baseDomain}`;
-  const target = normalizeEdgeTarget(input.target);
+  const target = input.target.startsWith("http://") || input.target.startsWith("https://") ? input.target : `http://${input.target}`;
   const { client, namespace } = await getNamespaceClient(organizationId);
   const { proxies } = await client.edgeProxy.list();
   const existing = proxies.find((p4) => p4.slug === slug);
@@ -300589,17 +300502,6 @@ async function syncCloudEdgeProxy(organizationId, input) {
   }
   return { ok: true, hostname: hostname7 };
 }
-async function requestTargetVerification(organizationId, rawTarget2) {
-  const target = normalizeEdgeTarget(rawTarget2);
-  const { client } = await getNamespaceClient(organizationId);
-  const { verification: verification2 } = await client.edgeProxy.requestVerification(target);
-  return { id: verification2.id, token: verification2.token, path: verification2.path, target };
-}
-async function checkTargetVerification(organizationId, verificationId) {
-  const { client } = await getNamespaceClient(organizationId);
-  const { verification: verification2 } = await client.edgeProxy.checkVerification(verificationId);
-  return { status: verification2.status, error: verification2.error };
-}
 var init_cloud_edge_proxy_service = __esm(() => {
   init_src();
   init_openship_cloud();
@@ -301202,30 +301104,6 @@ async function syncEdgeProxy(c2) {
     return oblienErrorResponse(c2, err2, "Failed to sync edge proxy");
   }
 }
-async function requestEdgeVerification(c2) {
-  const ctx2 = getRequestContext(c2);
-  const body2 = await c2.req.json();
-  if (!body2.target)
-    return c2.json({ error: "target is required" }, 400);
-  try {
-    const verification2 = await requestTargetVerification(ctx2.organizationId, body2.target);
-    return c2.json({ ok: true, verification: verification2 });
-  } catch (err2) {
-    return oblienErrorResponse(c2, err2, "Failed to request target verification");
-  }
-}
-async function checkEdgeVerification(c2) {
-  const ctx2 = getRequestContext(c2);
-  const body2 = await c2.req.json();
-  if (typeof body2.id !== "number")
-    return c2.json({ error: "id is required" }, 400);
-  try {
-    const result2 = await checkTargetVerification(ctx2.organizationId, body2.id);
-    return c2.json({ ok: true, ...result2 });
-  } catch (err2) {
-    return oblienErrorResponse(c2, err2, "Failed to check target verification");
-  }
-}
 async function pagesProxy(c2) {
   const ctx2 = getRequestContext(c2);
   const body2 = await c2.req.json();
@@ -301568,10 +301446,6 @@ var init_cloud_saas_routes = __esm(async () => {
   r18.post("/preflight", { tag: "cloud:write" }, preflight2);
   r18.use("/edge-proxy", cloudSessionAuth);
   r18.post("/edge-proxy", { tag: "cloud:write" }, syncEdgeProxy);
-  r18.use("/edge-proxy/verify-request", cloudSessionAuth);
-  r18.post("/edge-proxy/verify-request", { tag: "cloud:write" }, requestEdgeVerification);
-  r18.use("/edge-proxy/verify-check", cloudSessionAuth);
-  r18.post("/edge-proxy/verify-check", { tag: "cloud:write" }, checkEdgeVerification);
   r18.use("/analytics", cloudSessionAuth);
   r18.post("/analytics", { tag: "cloud:write" }, analyticsProxy);
   r18.use("/pages", cloudSessionAuth);
@@ -309103,7 +308977,6 @@ async function forceMcpConsent(c2, next) {
 init_origin_guard();
 init_src2();
 init_request_store();
-init_edge_challenge_store();
 await __promiseAll([
   init_migration_guard(),
   init_controller_helpers()
@@ -321961,7 +321834,7 @@ import { hostname as hostname6, userInfo } from "node:os";
 // ../api/package.json
 var package_default = {
   name: "@repo/api",
-  version: "0.1.10",
+  version: "0.1.11",
   license: "Apache-2.0",
   private: true,
   type: "module",
@@ -326649,12 +326522,6 @@ app.route("/api/permissions", permissionsRoutes);
 app.route("/api/notifications", notificationsRoutes);
 app.get("/.well-known/oauth-authorization-server", (c2) => oauthAuthServerMetadata(c2.req.raw));
 app.get("/.well-known/oauth-protected-resource", (c2) => oauthProtectedResourceMetadata(c2.req.raw));
-app.get("/.well-known/oblien-proxy-challenge/:token", async (c2) => {
-  const token = c2.req.param("token");
-  if (await isEdgeChallengeArmed(token))
-    return c2.text(token, 200);
-  return c2.text("not found", 404);
-});
 var authCallbackHtml = `<!DOCTYPE html><html><head><title>Success</title></head><body><script>window.close();</script><p>Authentication successful. You can close this window.</p></body></html>`;
 app.get("/auth/callback/install", (c2) => {
   if (getGitHubAuthMode() === "app") {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "openship",
-  "version": "0.1.10",
+  "version": "0.1.11",
   "description": "Openship CLI - deploy, manage, and open your Openship platform from the terminal",
   "license": "Apache-2.0",
   "repository": {