092b9ef07a
## Problem
The run-ops split mints NEW-store run ids as **27-char base62 KSUIDs**.
The supervisor writes the run id into the Kubernetes pod name
(`runner-<id>`), and pod names must be DNS-1123 labels (lowercase
`[a-z0-9-]`) — so uppercase base62 ids make k8s reject the pod (422) and
**those runs never launch** (they loop in `PENDING_EXECUTING` until the
heartbeat-stall handler nacks them, forever). `.toLowerCase()` can't fix
it: base62 has both `A`(10) and `a`(36) as distinct symbols, so folding
collides distinct ids and destroys sort order.
## Fix: change the encoding, not the structure
Mint a **26-char lowercase base32hex** run id:
```
run_<24-char base32hex core><region char><version char>
[ 6-byte ms timestamp ][ 9 CSPRNG bytes ]
```
- **base32hex** (RFC 4648 §7, alphabet `0-9a-v`): lowercase,
order-preserving, DNS-safe; 15 bytes → exactly 24 chars, no padding.
Hand-rolled encode/decode (no new dependency).
- **48-bit ms timestamp** in the leading bytes → plain string sort ==
creation order at millisecond resolution.
- **72 bits CSPRNG** entropy; PK unique constraint is the backstop (no
retry loop).
- **region / version** are raw positional chars (read via one `charAt`
before decoding/routing), version = `"1"`.
DNS-safe from birth and hyphen-free, so **firekeeper is unchanged** —
`runner-<id>-attempt-N` → strip `runner-`, cut at first hyphen still
recovers the exact id incl. region+version.
## Residency discriminator: length → version char
`classifyKind`/`classifyResidency` (`runOpsResidency.ts`) previously
distinguished NEW vs LEGACY by **id length**. That gets ambiguous with a
third format. It now discriminates on the **version char at a fixed
position** (`isRunOpsIdBody`: 26 chars, `[25] === "1"`, base32hex
alphabet) → NEW; everything else → LEGACY. Total, never throws. The
`Residency` (NEW/LEGACY) contract the routing store consumes is
unchanged; the `"ksuid"` `ResidencyKind` label is retained only because
it's the persisted `runOpsMintKsuid` feature-flag value.
## Scope / verification
- Generator + discriminator in `@trigger.dev/core` isomorphic; mint path
+ all id-shape call sites swept (~40 webapp files); changeset added
(`@trigger.dev/core` patch).
- Core unit tests (encode/decode round-trip + property, generator shape,
ms sort-order incl. intra-second, parse partitioned-vs-legacy,
firekeeper round-trip): **24 pass**. `@trigger.dev/core` builds; webapp
typechecks; format/lint clean.
## Open decisions (flagged, not silently chosen)
1. **Backward-compat**: existing 27-char base62 KSUID runs now classify
LEGACY. On test cloud these are the broken/looping runs that never
completed, so this is acceptable — but worth a conscious call before
prod. No transitional length-recognition added (keeps the discriminator
clean).
2. **Storage collation**: the sort guarantee is byte-order — if the
run-ops id column is `TEXT` with default locale collation it's silently
not honored. Confirm whether `COLLATE "C"` / `BYTEA` is needed on the
run-ops schema.
3. **Region sourcing** wiring — see `regionCharForRegion` /
`REGION_CODES`.
---
## ⚠️ Required migration — deploy in lockstep
This PR renames a persisted feature-flag key/value and an env var. These
are **not** changed by the code alone and must be migrated when this
deploys, or affected orgs silently fall back to `cuid` minting (no crash
— `defaultValue: "cuid"`):
1. **Env var** (terraform): `RUN_OPS_MINT_KSUID_ENABLED` →
`RUN_OPS_MINT_ENABLED` (carry the value over).
2. **DB** `organization.featureFlags`: migrate both the key and value
together:
- key `runOpsMintKsuid` → `runOpsMintKind`
- value `"ksuid"` → `"runOpsId"`
Until an org's flag row is migrated, its `runOpsMintKind` lookup misses
and it mints `cuid` (legacy) — so no NEW-store ids for that org until
the data lands.
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
134 lines
5.8 KiB
TypeScript
134 lines
5.8 KiB
TypeScript
import { z } from "zod";
|
|
|
|
export const FEATURE_FLAG = {
|
|
defaultWorkerInstanceGroupId: "defaultWorkerInstanceGroupId",
|
|
taskEventRepository: "taskEventRepository",
|
|
hasQueryAccess: "hasQueryAccess",
|
|
hasLogsPageAccess: "hasLogsPageAccess",
|
|
hasAiAccess: "hasAiAccess",
|
|
hasDashboardAgentAccess: "hasDashboardAgentAccess",
|
|
hasComputeAccess: "hasComputeAccess",
|
|
hasPrivateConnections: "hasPrivateConnections",
|
|
hasSso: "hasSso",
|
|
mollifierEnabled: "mollifierEnabled",
|
|
workerQueueScheduledSplitEnabled: "workerQueueScheduledSplitEnabled",
|
|
realtimeBackend: "realtimeBackend",
|
|
computeMigrationEnabled: "computeMigrationEnabled",
|
|
computeMigrationFreePercentage: "computeMigrationFreePercentage",
|
|
computeMigrationPaidPercentage: "computeMigrationPaidPercentage",
|
|
computeMigrationRequireTemplate: "computeMigrationRequireTemplate",
|
|
devBranchesEnabled: "devBranchesEnabled",
|
|
runOpsMintKind: "runOpsMintKind",
|
|
} as const;
|
|
|
|
export const FeatureFlagCatalog = {
|
|
[FEATURE_FLAG.defaultWorkerInstanceGroupId]: z.string(),
|
|
[FEATURE_FLAG.taskEventRepository]: z.enum(["clickhouse", "clickhouse_v2", "postgres"]),
|
|
[FEATURE_FLAG.hasQueryAccess]: z.coerce.boolean(),
|
|
[FEATURE_FLAG.hasLogsPageAccess]: z.coerce.boolean(),
|
|
[FEATURE_FLAG.hasAiAccess]: z.coerce.boolean(),
|
|
// Gates the in-dashboard AI agent panel. Controllable globally and per-org
|
|
// (org wins). Defaults off via DASHBOARD_AGENT_ENABLED.
|
|
[FEATURE_FLAG.hasDashboardAgentAccess]: z.coerce.boolean(),
|
|
[FEATURE_FLAG.hasComputeAccess]: z.coerce.boolean(),
|
|
[FEATURE_FLAG.hasPrivateConnections]: z.coerce.boolean(),
|
|
[FEATURE_FLAG.hasSso]: z.coerce.boolean(),
|
|
[FEATURE_FLAG.mollifierEnabled]: z.coerce.boolean(),
|
|
[FEATURE_FLAG.workerQueueScheduledSplitEnabled]: z.coerce.boolean(),
|
|
// Which backend serves the realtime run feed. Controllable
|
|
// globally and per-org (org wins). Defaults to "electric" when unset.
|
|
// "shadow" serves Electric but diffs the native path in the background.
|
|
[FEATURE_FLAG.realtimeBackend]: z.enum(["electric", "native", "shadow"]),
|
|
// Strict z.boolean() (not z.coerce.boolean()): coercion turns the string "false"
|
|
// into true, which would silently flip this kill switch / per-org exclude the wrong
|
|
// way if written as a string via the admin PAT route. The admin toggle sends a real
|
|
// boolean, so this only rejects the dangerous stringified case.
|
|
[FEATURE_FLAG.computeMigrationEnabled]: z.boolean(),
|
|
[FEATURE_FLAG.computeMigrationFreePercentage]: z.coerce.number().int().min(0).max(100),
|
|
[FEATURE_FLAG.computeMigrationPaidPercentage]: z.coerce.number().int().min(0).max(100),
|
|
// When on, migrated orgs build their compute template in required mode at deploy
|
|
// (fails the deploy on error) instead of shadow. Strict boolean (see above).
|
|
[FEATURE_FLAG.computeMigrationRequireTemplate]: z.boolean(),
|
|
// Per-org access to development branches. Off unless enabled for the org.
|
|
[FEATURE_FLAG.devBranchesEnabled]: z.coerce.boolean(),
|
|
// Per-org run-ops-id mint cutover. Defaults to "cuid"; only honored when
|
|
// RUN_OPS_MINT_ENABLED is on AND isSplitEnabled() is true.
|
|
[FEATURE_FLAG.runOpsMintKind]: z.enum(["cuid", "runOpsId"]),
|
|
};
|
|
|
|
export type FeatureFlagKey = keyof typeof FeatureFlagCatalog;
|
|
|
|
// Infrastructure flags that are read-only on the global flags page.
|
|
// Shown with current/resolved value but no controls.
|
|
export const GLOBAL_LOCKED_FLAGS: FeatureFlagKey[] = [
|
|
FEATURE_FLAG.defaultWorkerInstanceGroupId,
|
|
FEATURE_FLAG.taskEventRepository,
|
|
];
|
|
|
|
// Flags that are read-only on the org-level dialog.
|
|
// Shown with global value but no controls (org can't override these).
|
|
export const ORG_LOCKED_FLAGS: FeatureFlagKey[] = [
|
|
FEATURE_FLAG.defaultWorkerInstanceGroupId,
|
|
FEATURE_FLAG.taskEventRepository,
|
|
];
|
|
|
|
// Create a Zod schema from the existing catalog
|
|
export const FeatureFlagCatalogSchema = z.object(FeatureFlagCatalog);
|
|
export type FeatureFlagCatalog = z.infer<typeof FeatureFlagCatalogSchema>;
|
|
|
|
// Utility function to validate a feature flag value
|
|
export function validateFeatureFlagValue<T extends FeatureFlagKey>(
|
|
key: T,
|
|
value: unknown
|
|
): z.SafeParseReturnType<unknown, z.infer<(typeof FeatureFlagCatalog)[T]>> {
|
|
return FeatureFlagCatalog[key].safeParse(value);
|
|
}
|
|
|
|
// Utility function to validate all feature flags at once
|
|
export function validateAllFeatureFlags(values: Record<string, unknown>) {
|
|
return FeatureFlagCatalogSchema.safeParse(values);
|
|
}
|
|
|
|
// Utility function to validate partial feature flags (all keys optional)
|
|
export function validatePartialFeatureFlags(values: Record<string, unknown>) {
|
|
return FeatureFlagCatalogSchema.partial().safeParse(values);
|
|
}
|
|
|
|
// Utility types for catalog-driven UI rendering
|
|
export type FlagControlType =
|
|
| { type: "boolean" }
|
|
| { type: "enum"; options: string[] }
|
|
| { type: "number"; min?: number; max?: number }
|
|
| { type: "string" };
|
|
|
|
export function getFlagControlType(schema: z.ZodTypeAny): FlagControlType {
|
|
const typeName = schema._def.typeName;
|
|
|
|
if (typeName === "ZodBoolean") {
|
|
return { type: "boolean" };
|
|
}
|
|
|
|
if (typeName === "ZodEnum") {
|
|
return { type: "enum", options: schema._def.values as string[] };
|
|
}
|
|
|
|
// z.coerce.number() reports as ZodNumber; pull min/max out of its checks
|
|
// so the UI can render a constrained number input instead of free text.
|
|
if (typeName === "ZodNumber") {
|
|
const checks = (schema._def.checks ?? []) as Array<{ kind: string; value?: number }>;
|
|
const min = checks.find((c) => c.kind === "min")?.value;
|
|
const max = checks.find((c) => c.kind === "max")?.value;
|
|
return { type: "number", min, max };
|
|
}
|
|
|
|
return { type: "string" };
|
|
}
|
|
|
|
export function getAllFlagControlTypes(): Record<string, FlagControlType> {
|
|
const result: Record<string, FlagControlType> = {};
|
|
for (const [key, schema] of Object.entries(FeatureFlagCatalog)) {
|
|
result[key] = getFlagControlType(schema);
|
|
}
|
|
return result;
|
|
}
|