urun-cli 0.7.6__tar.gz → 0.7.7__tar.gz

{urun_cli-0.7.6 → urun_cli-0.7.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: urun-cli
-Version: 0.7.6
+Version: 0.7.7
 Summary: End-user CLI for deploying apps to urun
 Project-URL: Homepage, https://urun.sh
 Project-URL: Repository, https://github.com/urun-sh/urun-cli

{urun_cli-0.7.6 → urun_cli-0.7.7}/pyproject.toml

@@ -20,7 +20,7 @@ name = "urun-cli"
 # so every merge remains on the already-published version until this value is
 # advanced. Wiring semantic-release into CI remains separate work; this patch
 # bump is the minimal release unblock (post-v0.6.3 fixes + the Rust feature minor).
-version = "0.7.6"
+version = "0.7.7"
 description = "End-user CLI for deploying apps to urun"
 readme = "README.md"
 requires-python = ">=3.11"

{urun_cli-0.7.6 → urun_cli-0.7.7}/src/urun/cli.py

@@ -2,6 +2,7 @@ from __future__ import annotations
 
 import argparse
 import getpass
+import hashlib
 import http.client
 import json
 import os
@@ -9,6 +10,7 @@ import re
 import shlex
 import shutil
 import sys
+import tempfile
 import time
 import urllib.parse
 import webbrowser
@@ -90,12 +92,19 @@ from .frontend_launch import (
     resolve_app_functions,
     resolve_demo_function,
 )
+from .hub_builds import HubBuildClient
 from .launch_auth import (
     FrontendLaunchAuth,
     frontend_dev_port,
     prepare_frontend_launch_auth,
 )
-from .manifest import manifest_hash, unique_blobs
+from .manifest import (
+    _NON_CONTENT_MANIFEST_FIELDS,
+    FileBlob,
+    canonical_json,
+    manifest_hash,
+    unique_blobs,
+)
 from .nodes import (
     NODE_GPU_TYPES,
     looks_like_node_id,
@@ -106,7 +115,13 @@ from .nodes import (
 from .retry import BackoffPolicy, is_transient_error
 from .runtime_health import RuntimeHealth, normalize_runtime_health, runtime_state, runtime_summary
 
-API_KEY_RE = re.compile(r"^urun_(?:[0-9a-f]{32}|sk_[A-Za-z0-9_-]{43})$")
+API_KEY_RE = re.compile(
+    # A JWT (hub client principal) is accepted alongside org API keys: the hub's
+    # client auth IS an asymmetric JWT (jwt-auth.ts); three dot-separated
+    # base64url segments is the cheap shape check, signature verified server-side.
+    r"^urun_(?:[0-9a-f]{32}|sk_[A-Za-z0-9_-]{43})$"
+    r"|^eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}$"
+)
 CONTROL_CHARS_RE = re.compile(r"[\x00-\x08\x0b-\x1f\x7f-\x9f]")
 MAX_TABLE_CELL_WIDTH = 80
 MAX_DETAIL_CELL_WIDTH = 96
@@ -1727,6 +1742,13 @@ def add_login_args(parser: argparse.ArgumentParser) -> None:
             "and prompts interactively"
         ),
     )
+    parser.add_argument(
+        "--hub-url",
+        help=(
+            "Regional hub base URL; saved into the login so `urun deploy` targets the "
+            "hub's /v1/builds flow. Defaults to URUN_HUB_URL; unset = the legacy path."
+        ),
+    )
     parser.add_argument(
         "--no-browser",
         action="store_true",
@@ -1759,6 +1781,16 @@ def add_api_args(parser: argparse.ArgumentParser, *, defer_to_parent: bool = Fal
         ),
     )
 
+    parser.add_argument(
+        "--hub-url",
+        **_deferred_default(defer_to_parent, None),
+        help=(
+            "Regional hub base URL (http(s)://host[:port]); routes `urun deploy`'s "
+            "build through the hub's /v1/builds flow instead of the control-plane "
+            "edge functions. Defaults to URUN_HUB_URL; unset = the legacy path."
+        ),
+    )
+
 
 # A transient retry that resolves on the next attempt is noise; a RUN of them is
 # an incident. At normal verbosity the first ``RETRY_NOTICE_AFTER - 1`` retries
@@ -1891,6 +1923,12 @@ def add_auth_trust_jwk_args(parser: argparse.ArgumentParser) -> None:
 def login(args: argparse.Namespace) -> int:
     api_url = args.api_url or os.getenv("URUN_API_URL") or DEFAULT_API_URL
     api_key = args.api_key or os.getenv("URUN_API_KEY")
+    # The hub region is part of the SAVED LOGIN, not an engineer-only flag: a
+    # user who logs into a hub region deploys to it with their normal
+    # credential (the hub resolves the synced key/JWT to the right tenant).
+    # Precedence matches deploy-time resolution: --hub-url > URUN_HUB_URL;
+    # unset = the legacy control-plane target, byte-for-byte unchanged.
+    hub_url = getattr(args, "hub_url", None) or os.getenv("URUN_HUB_URL")
     if not api_key:
         if not sys.stdin.isatty():
             raise UrunError(
@@ -1927,6 +1965,9 @@ def login(args: argparse.Namespace) -> int:
             "api_key": api_key,
             "org_id": org_id,
             "key_id": key_id,
+            # Written ONLY when a hub was chosen: a legacy login keeps the
+            # file free of hub fields (byte-identical to today's save).
+            **({"hub_url": hub_url} if hub_url else {}),
         }
     )
 
@@ -1935,6 +1976,8 @@ def login(args: argparse.Namespace) -> int:
     print(f"Org: {org_name} ({org_slug})")
     print(f"Org ID: {org_id}")
     print(f"Key ID: {key_id}")
+    if hub_url:
+        print(f"Hub URL: {hub_url}")
     print(f"Credentials: {path}")
     return 0
 
@@ -2181,9 +2224,80 @@ def deploy(args: argparse.Namespace) -> int:
     return deploy_once(args).exit_code
 
 
+def _hub_client_for_deploy(
+    args: argparse.Namespace, api_key: str, on_retry: Callable[[str], None] | None = None
+) -> HubBuildClient | None:
+    """The hub build client when hub mode is selected, else None.
+
+    Precedence: ``--hub-url`` flag > ``URUN_HUB_URL`` env > the SAVED LOGIN's
+    ``hub_url`` (written by ``urun login --hub-url`` — the hub region is part
+    of the login, not an engineer-only flag). Unset = the legacy
+    control-plane path, byte-for-byte unchanged.
+    """
+    hub_url = getattr(args, "hub_url", None) or os.getenv("URUN_HUB_URL")
+    if not hub_url:
+        saved = load_credentials().get("hub_url")
+        hub_url = saved if isinstance(saved, str) and saved else None
+    if not hub_url:
+        return None
+    return HubBuildClient(hub_url, api_key, on_retry=on_retry)
+
+
+def hub_deployment_doc(
+    hub: HubBuildClient, register: dict[str, Any], manifest_hash: str
+) -> dict[str, Any]:
+    """Commit the registered build; the reply as the legacy deploy doc.
+
+    Commit is the finalize hop, deleted: it creates + queues the build
+    session and answers the build view. ``poll_until_done`` (via the hub
+    client's ``deployment_status``) keeps watching from the same shape —
+    and a same-manifest redeploy whose session is already ``completed``
+    answers ready here, the legacy ``reused`` fast path's honest analogue
+    (the CLI's reuse messaging keys off ``reused is True``; the hub path
+    reports the status straight).
+    """
+    build_id = register.get("build_id")
+    if not isinstance(build_id, str) or not build_id:
+        raise UrunError("hub register reply carried no build_id")
+    hub.remember_build(manifest_hash, build_id)
+    view = hub.commit(build_id, manifest_hash, _hub_blobs_from_register(register))
+    doc = _legacy_status_doc_from_view(view)
+    if doc.get("status") == "ready":
+        doc["reused"] = True
+    return doc
+
+
+def _hub_blobs_from_register(register: dict[str, Any]) -> list[dict[str, Any]]:
+    blobs: list[dict[str, Any]] = []
+    for group in ("missing_blobs", "present_blobs"):
+        items = register.get(group)
+        if isinstance(items, list):
+            blobs.extend(
+                {"sha256": b["sha256"]} for b in items if isinstance(b, dict) and b.get("sha256")
+            )
+    return blobs
+
+
+def _legacy_status_doc_from_view(view: dict[str, Any]) -> dict[str, Any]:
+    """A hub build view as the legacy deploy doc (imported shape, no cycle)."""
+    from .hub_builds import _legacy_status_doc
+
+    return _legacy_status_doc(view)
+
+
 def deploy_once(args: argparse.Namespace) -> DeployOutcome:
     api_url, api_key = resolve_api_credentials(args)
     environment = resolve_environment(args)
+    # Hub mode resolved UP FRONT (not at the register hop): every pre-register
+    # decision — the credentials channel, the reused-release pause check — must
+    # know whether this deploy targets the hub, or it silently touches the
+    # legacy control plane behind a --hub-url deploy.
+    # Transient retry/backoff reporting (owner ruling 2026-07-17): silent at
+    # normal verbosity — a retried blip that succeeds is not the user's
+    # problem. --verbose shows every internal per-attempt line; a persistent
+    # streak gets one calm line so a slow deploy never looks like a hang.
+    log_retry = make_retry_logger(getattr(args, "verbose", False))
+    hub = _hub_client_for_deploy(args, api_key, on_retry=log_retry)
     if args.poll_interval <= 0:
         raise UrunError("--poll-interval must be greater than 0")
     if args.timeout <= 0:
@@ -2382,6 +2496,18 @@ def deploy_once(args: argparse.Namespace) -> DeployOutcome:
     creds_from_store: list[str] = []
     declared_credential_names: list[str] = []
     secret_client: ApiClient | None = None
+    if (required_env or optional_env) and hub is not None:
+        # HUB ISOLATION (owner ruling 2026-10-27): a hub deploy must never touch
+        # the legacy control plane — silently reading or pushing secrets to
+        # api_url is exactly the bug that created prod rows from hub-mode
+        # deploys. The hub has no secret surface yet, so fail loud; declaring
+        # creds on a hub deploy needs that surface first.
+        raise UrunError(
+            "deploy --hub-url cannot deliver declared Credentials(...) yet: the "
+            "hub has no secret surface, and pushing them to the legacy control "
+            "plane would silently touch prod. Remove the Credentials(...) "
+            "declaration, or deploy without --hub-url."
+        )
     if required_env or optional_env:
         secret_client = ApiClient(api_url, api_key)
         # Org-level secrets (``app_id`` null) plus this app's app-level secrets —
@@ -2559,23 +2685,67 @@ def deploy_once(args: argparse.Namespace) -> DeployOutcome:
                 f"secret(s) (app-scoped): {', '.join(delivered)}"
             )
 
-    # Transient retry/backoff reporting (owner ruling 2026-07-17): silent at
-    # normal verbosity — a retried blip that succeeds is not the user's
-    # problem. --verbose shows every internal per-attempt line; a persistent
-    # streak gets one calm line so a slow deploy never looks like a hang.
-    log_retry = make_retry_logger(getattr(args, "verbose", False))
-
-    client = ApiClient(api_url, api_key, on_retry=log_retry)
+    # HUB ISOLATION: in hub mode the legacy client is never even constructed —
+    # register/finalize/poll/log-tail all ride the hub client, and any stray
+    # legacy use below would be a real prod touch, not just a construction.
+    client: ApiClient | None = (
+        None if hub is not None else ApiClient(api_url, api_key, on_retry=log_retry)
+    )
+    # Hub mode (lane 42, docs/design/builds.md §1 row 15): the SAME client
+    # flow on the hub's /v1/builds wire — register/commit replace the two
+    # edge functions; uploads, poll, and the log tail keep their shape.
+    # HUB MODE — the manifest IS a content-addressed blob (coordinator ruling
+    # 2026-10-25): its sha256 is the manifest_hash, so the builder reads it
+    # from blobs/<tenant>/<manifest_hash> and the hub stays stateless (refs
+    # on the session, bytes in the store). The canonical JSON bytes are
+    # hashed here once; the same bytes go to the store, so the builder's
+    # re-hash of the fetched blob converges on the same manifest_hash.
+    hub_manifest_blob: FileBlob | None = None
+    if hub is not None:
+        # The blob's sha256 must BE the manifest_hash, so hash the SAME way
+        # manifest_hash does: canonical JSON of the manifest minus the
+        # non-content fields (created_at/client_version describe the
+        # deployer, not the content — they never reach the hash domain).
+        content = dict(manifest)
+        for field in _NON_CONTENT_MANIFEST_FIELDS:
+            content.pop(field, None)
+        manifest_bytes = canonical_json(content)
+        manifest_sha = hashlib.sha256(manifest_bytes).hexdigest()
+        if manifest_sha != mh:
+            raise UrunError(
+                f"manifest blob hash {manifest_sha} != manifest_hash {mh}; "
+                "the content-addressed manifest blob must converge on the "
+                "manifest hash"
+            )
+        tmp = tempfile.NamedTemporaryFile(prefix="urun-manifest-", suffix=".json", delete=False)
+        tmp.write(manifest_bytes)
+        tmp.close()
+        hub_manifest_blob = FileBlob(
+            path=f"manifests/{mh}.json",
+            source=Path(tmp.name),
+            sha256=mh,
+            size=len(manifest_bytes),
+            mode=0o100644,
+        )
+    hub_blobs = unique_blobs(all_blobs)
+    if hub_manifest_blob is not None:
+        hub_blobs.setdefault(hub_manifest_blob.sha256, hub_manifest_blob)
+    hub_blob_list = [{"sha256": b.sha256, "size": b.size} for b in hub_blobs.values()]
     mark_phase("collect")  # discovery + deps resolve + credentials + manifest hash
-    register = client.register_manifest(manifest)
+    if hub is not None:
+        register = hub.register(mh, hub_blob_list)
+    else:
+        register = client.register_manifest(manifest)
     server_hash = register.get("manifest_hash")
     if server_hash and server_hash != mh:
         raise UrunError(f"server manifest hash mismatch: local {mh}, server {server_hash}")
     mark_phase("register")
     missing = register.get("missing_blobs", [])
     print(f"Uploading {len(missing)} missing blob(s)")
-    upload_missing_blobs(missing, unique_blobs(all_blobs), on_retry=log_retry)
+    upload_missing_blobs(missing, hub_blobs, on_retry=log_retry)
     mark_phase("upload")
+    if hub_manifest_blob is not None:
+        Path(hub_manifest_blob.source).unlink(missing_ok=True)
 
     # ``deploy_kind`` is set ONLY by `urun dev` (resolved above, where it also
     # rewrote the identity to the dev app); the deploy verb never defines it,
@@ -2592,19 +2762,26 @@ def deploy_once(args: argparse.Namespace) -> DeployOutcome:
     # it re-activates its own app and retries ONCE, loudly. A standard deploy
     # never does this: there a disabled app is an operator ruling and the 409
     # stays a hard error.
-    try:
-        final = client.finalize(mh, environment=environment, deploy_kind=deploy_kind)
-    except ApiError as exc:
-        if not (
-            deploy_kind == DEV_DEPLOY_KIND and exc.status == 409 and exc.code == "app_disabled"
-        ):
-            raise
-        print(
-            f"dev app {app_name} was left disabled by the previous `urun dev` "
-            "exit; re-enabling it (dev apps belong to `urun dev`)"
-        )
-        client.activate_app(app_name, environment=environment)
-        final = client.finalize(mh, environment=environment, deploy_kind=deploy_kind)
+    if hub is not None:
+        # The finalize hop, deleted (docs/design/builds.md §2): commit
+        # creates + queues the build session; the reply IS the status doc
+        # (state translated by the client). No app_disabled dev dance —
+        # the hub owns no app rows.
+        final = hub_deployment_doc(hub, register, mh)
+    else:
+        try:
+            final = client.finalize(mh, environment=environment, deploy_kind=deploy_kind)
+        except ApiError as exc:
+            if not (
+                deploy_kind == DEV_DEPLOY_KIND and exc.status == 409 and exc.code == "app_disabled"
+            ):
+                raise
+            print(
+                f"dev app {app_name} was left disabled by the previous `urun dev` "
+                "exit; re-enabling it (dev apps belong to `urun dev`)"
+            )
+            client.activate_app(app_name, environment=environment)
+            final = client.finalize(mh, environment=environment, deploy_kind=deploy_kind)
     mark_phase("finalize")
     if final.get("reused") is True:
         # Same-manifest redeploy of an already-built release: the control
@@ -2613,13 +2790,21 @@ def deploy_once(args: argparse.Namespace) -> DeployOutcome:
         # cannot silently clear an operational safety decision. Surface that
         # state and its explicit recovery command before returning success.
         print(f"unchanged — reusing release {mh[:12]}")
-        pause_check_client = ApiClient(
-            api_url,
-            api_key,
-            timeout=DEMO_PREFLIGHT_TIMEOUT_S,
-            backoff=BackoffPolicy(max_attempts=1),
+        # HUB ISOLATION: the pause check reads the legacy control plane's
+        # function rows; the hub owns no app rows, so skip it entirely in hub
+        # mode rather than probing prod behind a --hub-url deploy.
+        pause_check_client = (
+            None
+            if hub is not None
+            else ApiClient(
+                api_url,
+                api_key,
+                timeout=DEMO_PREFLIGHT_TIMEOUT_S,
+                backoff=BackoffPolicy(max_attempts=1),
+            )
         )
-        warn_paused_functions(pause_check_client, app_name, environment=environment)
+        if pause_check_client is not None:
+            warn_paused_functions(pause_check_client, app_name, environment=environment)
         print(format_phase_timing(phases))
         return DeployOutcome(exit_code=0, manifest_hash=mh, deps=deps, status=dict(final))
     print(f"Deployment {final.get('status', 'queued')}: {mh}")
@@ -2635,7 +2820,7 @@ def deploy_once(args: argparse.Namespace) -> DeployOutcome:
     # lines are printed as their own `build | ` lane, riding the SAME status
     # poll (see urun.buildlogs). Degrades honestly: a control plane that
     # serves no logs for this deploy streams nothing — never fake output.
-    tailer = BuildLogTailer(client, mh)
+    tailer = BuildLogTailer(hub if hub is not None else client, mh)
     seen_states: set[str] = set()
     queued_reason_shown = False
 
@@ -2659,7 +2844,9 @@ def deploy_once(args: argparse.Namespace) -> DeployOutcome:
 
     def renew_dev_lease_on_poll() -> None:
         nonlocal dev_lease_last_renew, dev_lease_warned
-        if deploy_kind != DEV_DEPLOY_KIND:
+        if deploy_kind != DEV_DEPLOY_KIND or hub is not None:
+            # HUB ISOLATION: renew_dev_lease targets the legacy control plane;
+            # a hub deploy must never renew (or probe) it.
             return
         now = time.monotonic()
         if dev_lease_last_renew is not None and now - dev_lease_last_renew < (
@@ -2715,7 +2902,7 @@ def deploy_once(args: argparse.Namespace) -> DeployOutcome:
 
     try:
         status = poll_until_done(
-            client,
+            hub if hub is not None else client,
             mh,
             args.poll_interval,
             args.timeout,
@@ -2747,7 +2934,9 @@ def deploy_once(args: argparse.Namespace) -> DeployOutcome:
     # inline fast lane) rolls the serving pod: watch that rollout honestly
     # (rolling -> booting -> ready) instead of declaring victory the moment the
     # artifact exists. Inline/fast deploys skip this — instant and quiet.
-    if "building" in seen_states and status.get("build_lane") != "inline":
+    # (Hub mode: the serving rollout is lane 09's cutover world — the hub
+    # owns the build only; the legacy presence API is not wired to it yet.)
+    if "building" in seen_states and status.get("build_lane") != "inline" and hub is None:
         # Honest absence: a real build whose tailer streamed nothing gets ONE
         # calm note — silence would be indistinguishable from "nothing worth
         # showing" and hides a broken build-log path (owner, 2026-07-17).
@@ -3253,6 +3442,9 @@ def print_build_failure(status: dict[str, Any]) -> None:
             print(line, file=sys.stderr)
         return
     err = status.get("error") or {}
+    if not isinstance(err, dict):
+        # The hub's build view carries the failure as a plain reason string.
+        err = {"message": str(err)}
     code = string_value(err.get("code"))
     summary = _failure_summary(status) or _failure_summary(err) or "Build failed"
     print("Deployment failed: build did not succeed", file=sys.stderr)

{urun_cli-0.7.6 → urun_cli-0.7.7}/src/urun/deps.py

@@ -311,6 +311,22 @@ class _DepsEvaluator:
                     deps = self._extract_deps_from_call(dec)
                     if deps is not None:
                         calls.append(deps)
+        if calls:
+            return calls
+        # MODULE-LEVEL FALLBACK: the entrypoint declares Dependencies(...) but
+        # attaches it to NO ``@app.function`` in THIS file (the sense 2026-10-27
+        # live miss: SENSE_DEPS at module level while the App() registration
+        # lives in a sibling module). The decorator scan above finds nothing and
+        # the manifest used to ship deps={kind, python_version} with every
+        # declared package/torch_backend/file silently dropped — the builder then
+        # built a deps-less release. The declared Dependencies IS the app's
+        # declared dep info; collect it from module-level assignments. Only fires
+        # when NO function carries deps (an attached declaration always wins), so
+        # every previously-working app is byte-identical.
+        for value in self.assignments.values():
+            call = self._as_dependencies_call(value)
+            if call is not None:
+                calls.append(call)
         return calls
 
     @staticmethod

urun_cli-0.7.7/src/urun/hub_builds.py

@@ -0,0 +1,301 @@
+"""Hub build-flow client: `urun deploy` against the regional hub's /v1/builds.
+
+The hub path replaces the two Supabase edge functions the legacy path dials
+(`register-manifest` + `finalize`) with the hub's session-shaped verbs
+(docs/design/builds.md §2 in urun-sh/hub):
+
+* ``POST /v1/builds`` — register: probe + presign MISSING blobs only,
+  derive the deterministic ``build_id``.
+* presigned PUTs — the SAME ``upload_missing_blobs`` the legacy path uses;
+  the URLs are the only thing that changed.
+* ``POST /v1/builds/{id}:commit`` — the finalize hop, deleted: creates and
+  queues the build session.
+* ``GET /v1/builds/{id}`` — status; states map 1:1 onto the hub states.
+* ``GET /v1/builds/{id}/logs`` — the builder's fenced ``:logs`` lines.
+
+Wire classes are translated exactly once, here: the hub answers hub-state
+names (``queued``/``claimed``/``starting``/``running``/``terminating``/
+``completed``/``failed``), while the CLI's poll loop, tailer, and failure
+printer speak the legacy status doc (``status``: ready|failed|cancelled,
+``build_id``, ``logs``). No call-site changes on the deploy path.
+"""
+
+from __future__ import annotations
+
+import json
+import urllib.error
+import urllib.request
+from collections.abc import Callable
+from typing import Any
+
+from . import __version__
+from .errors import ApiError, UrunError, sanitize_error_text
+from .retry import DEPLOY_BACKOFF, BackoffPolicy, retry_call
+
+# Same read cap as ApiClient (a misbehaving server must not force an
+# unbounded allocation just to build an error message).
+_MAX_ERROR_BODY_READ_BYTES = 64 * 1024
+
+# Hub -> legacy status mapping (docs/design/builds.md §2). The build-phase
+# narrative (queued -> building -> ready) is preserved; `cancelled` is its own
+# terminal class the CLI already handles separately from `failed`.
+_HUB_STATE_TO_STATUS = {
+    "queued": "queued",
+    "claimed": "building",
+    "starting": "building",
+    "running": "building",
+    "terminating": "cancelled",
+    "completed": "ready",
+    "failed": "failed",
+    "retry_pending": "queued",
+}
+
+
+class HubBuildClient:
+    """The /v1/builds wire on the hub's client principal (org API key).
+
+    The request/retry/error shape mirrors :class:`urun.api.ApiClient`
+    (Bearer auth, ApiError by status, transient retry under the same
+    policy) so the deploy path's error handling carries over unchanged.
+    """
+
+    def __init__(
+        self,
+        base_url: str,
+        api_key: str,
+        timeout: float = 30.0,
+        backoff: BackoffPolicy = DEPLOY_BACKOFF,
+        on_retry: Callable[[str], None] | None = None,
+    ) -> None:
+        # Same hygiene as ApiClient.require_safe_url: fail loud at
+        # construction, not at first dial.
+        base = base_url.rstrip("/")
+        if "://" not in base or " " in base:
+            raise UrunError(f"invalid hub URL: {base_url!r} (expected http(s)://host[:port])")
+        self.base_url = base
+        self.api_key = api_key
+        self.timeout = timeout
+        self.backoff = backoff
+        self.on_retry = on_retry
+        # manifest_hash -> build_id bindings made by register(); the poll
+        # loop resolves through this instead of a builds-list call.
+        self._build_ids: dict[str, str] = {}
+
+    def register(
+        self, manifest_hash: str, blobs: list[dict[str, Any]], wheel_identity: str | None = None
+    ) -> dict[str, Any]:
+        body: dict[str, Any] = {"manifest_hash": manifest_hash, "blobs": blobs}
+        if wheel_identity:
+            body["wheel_identity"] = wheel_identity
+        reply = self._json("POST", "/v1/builds", body)
+        build_id = reply.get("build_id")
+        if isinstance(build_id, str) and build_id:
+            self.remember_build(manifest_hash, build_id)
+        return reply
+
+    def commit(
+        self,
+        build_id: str,
+        manifest_hash: str,
+        blobs: list[dict[str, Any]],
+        wheel_identity: str | None = None,
+    ) -> dict[str, Any]:
+        body: dict[str, Any] = {"manifest_hash": manifest_hash, "blobs": blobs}
+        if wheel_identity:
+            body["wheel_identity"] = wheel_identity
+        return self._json("POST", f"/v1/builds/{build_id}:commit", body)
+
+    def status(self, build_id: str) -> dict[str, Any]:
+        """The legacy status doc for one hub build.
+
+        ONE HTTP attempt, raw errors — the poll loop owns retry/backoff
+        (mirrors ``ApiClient.deployment_status``'s contract, for the same
+        reason: a nested retry ladder turns a front-door blip into a
+        false-fatal poll failure).
+        """
+        view = self._request("GET", f"/v1/builds/{build_id}", None, timeout=10.0)
+        return _legacy_status_doc(view)
+
+    def logs(self, build_id: str) -> dict[str, Any]:
+        """The hub's structured log lines as the legacy ``{logs: text}`` doc.
+
+        The tailer's incremental logic (emit only NEW complete lines, re-sync
+        on server-side tail trims) works on text; the hub's {ts, line}
+        entries joined with newlines preserve both properties, and the
+        5000-line oldest-dropped cap re-syncs through the same overlap
+        heuristic the legacy tail already has.
+        """
+        payload = self._request("GET", f"/v1/builds/{build_id}/logs", None, timeout=10.0)
+        entries = payload.get("lines") if isinstance(payload, dict) else None
+        text = (
+            "\n".join(str(e.get("line", "")) for e in entries if isinstance(e, dict))
+            if isinstance(entries, list)
+            else ""
+        )
+        return {"logs": text}
+
+    def cancel(self, build_id: str) -> dict[str, Any]:
+        return self._json("POST", f"/v1/builds/{build_id}:cancel", {})
+
+    # -- legacy-shape adapter (poll loop + tailer, unchanged call sites) ------
+
+    def deployment_status(self, manifest_hash: str) -> dict[str, Any]:
+        """``poll_until_done``'s read: the build registered for this deploy.
+
+        The hub's build_id is the session id DERIVED from (region, tenant,
+        (manifest_hash, wheel_identity)) — the register reply carries it, so
+        this is one GET, no resolve-by-hash list call. Pre-commit (or a
+        foreign hash) answers 404: the same not-yet-registered state the
+        legacy poller tolerates through its not_found grace window.
+        """
+        build_id = self._build_ids.get(manifest_hash)
+        if build_id is None:
+            raise ApiError(
+                404,
+                "not_found",
+                "build not registered on this hub",
+                method="GET",
+                url=f"{self.base_url}/v1/builds",
+            )
+        return self.status(build_id)
+
+    def logs_build(self, build_id: str, tail: int | None = None) -> dict[str, Any]:
+        """``BuildLogTailer``'s read — the tail is client-side anyway."""
+        return self.logs(build_id)
+
+    def remember_build(self, manifest_hash: str, build_id: str) -> None:
+        """Bind the register reply's build_id to this deploy's manifest hash.
+
+        ``register`` calls this itself (single writer); the binding is what
+        lets ``deployment_status(manifest_hash)`` resolve with no list
+        round-trip. Re-registering the same hash rebinds — a changed wheel
+        identity derives a different id, which is the propagation hole being
+        closed upstream.
+        """
+        self._build_ids[manifest_hash] = build_id
+
+    # -- transport ----------------------------------------------------------
+
+    def _json(
+        self,
+        method: str,
+        path: str,
+        body: dict[str, Any] | None,
+        timeout: float | None = None,
+    ) -> dict[str, Any]:
+        return self._request(method, path, body, timeout=timeout, retry=True)
+
+    def _request(
+        self,
+        method: str,
+        path: str,
+        body: dict[str, Any] | None,
+        timeout: float | None = None,
+        retry: bool = False,
+    ) -> dict[str, Any]:
+        url = self.base_url + path
+        data = (
+            None
+            if body is None
+            else json.dumps(body, sort_keys=True, separators=(",", ":")).encode()
+        )
+
+        def attempt() -> bytes:
+            req = urllib.request.Request(
+                url,
+                data=data,
+                method=method,
+                headers={
+                    "Authorization": f"Bearer {self.api_key}",
+                    "Accept": "application/json",
+                    **({"Content-Type": "application/json"} if data else {}),
+                    "User-Agent": f"urun-cli/{__version__}",
+                },
+            )
+            with urllib.request.urlopen(req, timeout=timeout or self.timeout) as resp:
+                payload = resp.read()
+                if resp.status >= 300:
+                    raise urllib.error.HTTPError(
+                        url, resp.status, "request rejected", resp.headers, None
+                    )
+                return payload
+
+        try:
+            if retry:
+                payload = retry_call(
+                    attempt,
+                    policy=self.backoff,
+                    on_retry=self.on_retry,
+                    description=f"{method} {path}",
+                )
+            else:
+                payload = attempt()
+        except urllib.error.HTTPError as exc:
+            raise _api_error(exc, method, url) from exc
+        except (urllib.error.URLError, TimeoutError) as exc:
+            reason = getattr(exc, "reason", exc)
+            raise UrunError(f"network error: {reason} ({method} {url})") from exc
+        if not payload:
+            return {}
+        try:
+            return json.loads(payload.decode("utf-8"))
+        except json.JSONDecodeError as exc:
+            snippet = sanitize_error_text(payload.decode("utf-8", "replace"), limit=200)
+            raise UrunError(
+                f"invalid JSON response from hub ({method} {url}): {snippet!r}"
+            ) from exc
+
+
+def _api_error(exc: urllib.error.HTTPError, method: str, url: str) -> ApiError:
+    """HTTP errors keep ApiClient's structured rendering (by status)."""
+    payload = exc.read(_MAX_ERROR_BODY_READ_BYTES)
+    code = "http_error"
+    message = sanitize_error_text(payload.decode("utf-8", "replace")) or str(exc.reason)
+    try:
+        parsed = json.loads(payload.decode("utf-8"))
+        err = parsed.get("error")
+        if isinstance(err, str):
+            code = err
+        elif isinstance(err, dict):
+            code = err.get("code") or code
+            if err.get("message"):
+                message = sanitize_error_text(str(err["message"]))
+    except Exception:  # noqa: BLE001 - best-effort structured parse
+        pass
+    return ApiError(exc.code, code, message, method=method, url=url)
+
+
+def _legacy_status_doc(view: dict[str, Any]) -> dict[str, Any]:
+    """Translate the hub build view into the legacy status-doc shape.
+
+    ``build_id`` reads ``build_id`` then ``session_id`` — the hub's build
+    view carries both spellings across its revisions (register replies
+    ``build_id``; the commit view is the raw session view).
+    """
+    state = str(view.get("state") or "")
+    status = _HUB_STATE_TO_STATUS.get(state, state)
+    doc: dict[str, Any] = {
+        "status": status,
+        "build_id": view.get("build_id") or view.get("session_id"),
+        "manifest_hash": view.get("manifest_hash"),
+        "state": state,
+        "attempt": view.get("attempt"),
+        "max_attempts": view.get("max_attempts"),
+    }
+    if status == "failed":
+        doc["error"] = view.get("terminal_reason") or view.get("last_error") or "build failed"
+    if status == "ready":
+        doc["release_ref"] = view.get("release_ref")
+    return doc
+
+
+def hub_base_url(api_url: str | None, hub_url: str | None = None) -> str | None:
+    """The hub to deploy through, or None for the legacy control-plane path.
+
+    EXPLICIT ONLY, never inferred: ``hub_url`` (``--hub-url`` /
+    ``URUN_HUB_URL``) selects hub mode; nothing else does. A host-shape
+    heuristic (``hub.`` prefix, localhost ports) would silently hijack
+    control-plane e2e runs that point ``--api-url`` at a hub-shaped host —
+    cutover (lane 09) flips the default once the hub IS the control plane.
+    """
+    return hub_url or None

{urun_cli-0.7.6 → urun_cli-0.7.7}/src/urun/serve.py

@@ -579,6 +579,9 @@ def _build_deploy_args(
         environment=getattr(args, "environment", None),
         api_url=getattr(args, "api_url", None),
         api_key=getattr(args, "api_key", None),
+        # The hub region (--hub-url): deploy() routes the build through the hub's
+        # /v1/builds flow only when this reaches it.
+        hub_url=getattr(args, "hub_url", None),
         no_wait=getattr(args, "no_wait", False),
         poll_interval=getattr(args, "poll_interval", 2.0),
         timeout=getattr(args, "timeout", 1800.0),