fix(deploy): package-app apex as zone route, never a custom domain by kentcdodds · Pull Request #1396 · kentcdodds/kody

kentcdodds · 2026-08-12T00:37:49Z

Intent

Prevent a repeat of the 2026-08-11 kodyapps.dev outage: replacing a zone's Worker route table detaches any Workers custom domain in that zone and deletes its DNS record. The per-user-subdomain deploy (#1395) published the wildcard zone route alongside the apex custom domain in the same zone, which took the apex dark for ~1.5h (status page showed "Package apps is down — HTTP 530"). The runtime-worker extraction (#1384) carries the same hazardous mix in tools/ci/runtime-worker-config.ts, so its next successful deploy would repeat the outage.

Summary

tools/ci/runtime-worker-config.ts publishes both package-app routes as zone routes: { pattern: "kodyapps.dev/*", zone_name } and { pattern: "*.kodyapps.dev/*", zone_name } — no custom domain in that zone, ever.
ensurePackageAppWildcardDnsRecord becomes ensurePackageAppDnsRecords: it idempotently provisions proxied placeholder AAAA 100:: records for both the apex and the wildcard (zone routes do not create DNS records).
Docs (setup-manifest.md, environment-variables.md) and code comments record the incident rationale: custom domains stay reserved for app-origin zones, whose route tables the deploy never publishes.

Production state (already remediated manually)

Production was restored at ~00:15–00:50 UTC by re-attaching, then deliberately migrating the apex to the exact state this PR's tooling generates: apex + wildcard proxied AAAA 100:: records, kodyapps.dev/* and *.kodyapps.dev/* zone routes, custom domain detached. Verified: apex / 302 → app origin, legacy /@user/packages/... 302 → per-user subdomain, subdomains serving. The ensure step in this PR is a no-op against that state.

Note: main production deploys are currently red for an unrelated reason — #1384's runtime config generation fails with main generated config env.production.queues.producers has no entry for binding "SCHEDULED_DISPATCH_QUEUE" (merge skew with the jobs-lane extraction #1389/#1394, which removed that producer from the main worker). This PR does not attempt to fix that; it should land before or with that fix so the recovery deploy does not re-trigger the custom-domain outage.

Testing

npm run typecheck, npm run format:check, lint — green.
vitest --project node-unit tools/ci/resource-utils.node.test.ts tools/ci/runtime-worker-config.node.test.ts — 16 tests green, covering: both routes generated as zone routes, apex+wildcard record creation sequence, reuse of existing records, conflict fail-closed (wrong type; conflict even when the required record exists).

Summary by CodeRabbit

Documentation
- Updated package-app deployment guidance to describe apex and wildcard zone routes.
- Added requirements for proxied DNS records and warnings about route replacement impacts.
Bug Fixes
- Improved production routing and DNS setup for package-app domains.
- Added reliable creation, reuse, and conflict detection for apex and wildcard DNS records.
- Updated validation to ensure both required routes are configured correctly.

…m domain The 2026-08-11 deploy took kodyapps.dev down: replacing a zone's Worker route table detaches any Workers custom domain in that zone and deletes its DNS record, and the generated config mixed the apex custom domain with the wildcard zone route in the same zone. Production was restored manually by re-creating the apex as a proxied AAAA 100:: record plus a kodyapps.dev/* zone route and detaching the custom domain. The runtime worker config now publishes both package-app routes as zone routes, and production-resources ensure idempotently provisions proxied placeholder AAAA records for both the apex and the wildcard (renamed ensurePackageAppDnsRecords). Custom domains stay reserved for app-origin zones, whose route tables the deploy never publishes. Docs updated with the incident rationale. Co-authored-by: Kent C. Dodds <me+github@kentcdodds.com>

coderabbitai · 2026-08-12T00:37:58Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 88785d55-f924-456d-8215-d43306e222dd

📥 Commits

Reviewing files that changed from the base of the PR and between ebe1568 and e57a47c.

📒 Files selected for processing (7)

docs/contributing/environment-variables.md
docs/contributing/setup-manifest.md
tools/ci/production-resources.ts
tools/ci/resource-utils.node.test.ts
tools/ci/resource-utils.ts
tools/ci/runtime-worker-config.node.test.ts
tools/ci/runtime-worker-config.ts

📝 Walkthrough

Walkthrough

Package-app deployment now uses apex and wildcard Cloudflare zone routes. Production CI provisions proxied AAAA records for both hostnames. Runtime route tests and deployment documentation reflect the new routing and DNS model.

Changes

Package-app routing and DNS

Layer / File(s)	Summary
Package-app DNS provisioning `tools/ci/resource-utils.ts`, `tools/ci/production-resources.ts`, `tools/ci/resource-utils.node.test.ts`	The CI helper provisions, reuses, and validates proxied AAAA records for both apex and wildcard hostnames. Tests cover creation, conflicts, and reuse.
Apex and wildcard zone routes `tools/ci/runtime-worker-config.ts`, `tools/ci/runtime-worker-config.node.test.ts`	Runtime configuration removes matching routes and adds apex and wildcard zone routes with `zone_name`.
Deployment contract documentation `docs/contributing/environment-variables.md`, `docs/contributing/setup-manifest.md`	Documentation describes the zone-route model, required DNS records, and custom-domain restrictions.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

kentcdodds/kody#1015: Introduced the package-app route generation and DNS provisioning that this PR revises.
kentcdodds/kody#1395: Directly relates to replacing the package-app custom-domain and wildcard-route setup.
kentcdodds/kody#1280: Also changes production domain and routing provisioning in the same CI resource files.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 33.33% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: publishing the package-app apex as a zone route instead of a custom domain.
Description check	✅ Passed	The description includes intent, summary, production state, testing evidence, and system impact details; the optional System changes heading is not required.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch cursor/package-app-apex-zone-route-1636

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-08-12T00:46:16Z

🔎 Preview deployed: https://kody-pr-1396.kody-a99.workers.dev

Worker: kody-pr-1396
Runtime worker: kody-pr-1396-runtime (https://kody-pr-1396-runtime.kody-a99.workers.dev)
D1: kody-pr-1396-db
KV: kody-pr-1396-oauth-kv

Mocks:

cloudflare: https://kody-pr-1396-mock-cloudflare.kody-a99.workers.dev/__mocks (kody-pr-1396-mock-cloudflare)

* chore(identity): remove the legacy underscore-username tier Production had exactly one underscore username (debs_obrien); it was renamed by hand on 2026-08-12 (users.username, email_inbox_addresses, saved_packages names -> debs-obrien), so the two-tier validation shipped in #1395/#1396 no longer guards anyone. Username validation is one strict DNS-label rule everywhere again: the lenient recognition pattern, the separate DNS-safe validator, the 409 rename prompt on the package-app entry, and the hosted-URL path-mount fallback for non-DNS-safe usernames are all removed. The shared dnsSafeUsernamePattern stays as the single source of truth (also validating wildcard-routed subdomain labels). Co-authored-by: Kent C. Dodds <me+github@kentcdodds.com> * docs(0017): drop the obsolete rename-before-hosting consequence The sole underscore account was already migrated; CodeRabbit caught the stale Consequences bullet still requiring renames before hosting. Co-authored-by: Kent C. Dodds <me+github@kentcdodds.com> * fix(preview): SQLite-backed DO namespaces for the mock cloudflare worker Cloudflare now rejects creating key-value backed Durable Object namespaces (error 10099). Every PR preview deploys a fresh kody-pr-<n>-mock-cloudflare script that runs these migrations from scratch, so preview resource deploys started failing repo-wide. Existing long-lived scripts already applied tags v1/v2 and are unaffected. Co-authored-by: Kent C. Dodds <me+github@kentcdodds.com> --------- Co-authored-by: Cursor Agent <cursoragent@cursor.com>

kentcdodds marked this pull request as ready for review August 12, 2026 00:43

kentcdodds merged commit c7cd824 into main Aug 12, 2026
22 of 24 checks passed

kentcdodds deleted the cursor/package-app-apex-zone-route-1636 branch August 12, 2026 01:15

kentcdodds mentioned this pull request Aug 12, 2026

chore(identity): remove the legacy underscore-username tier #1400

Merged

kentcdodds mentioned this pull request Aug 12, 2026

Submit kody.run to the Public Suffix List (defense-in-depth for per-user package-app subdomains) #1405

Open

8 tasks

github-actions Bot mentioned this pull request Aug 12, 2026

Upstream updates available (kentcdodds/kody) kornelov1cs/kody#1

Open

Navigation Menu

fix(deploy): package-app apex as zone route, never a custom domain - #1396

fix(deploy): package-app apex as zone route, never a custom domain#1396
kentcdodds merged 1 commit into
mainfrom
cursor/package-app-apex-zone-route-1636

kentcdodds commented Aug 12, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Aug 12, 2026 •

edited

Loading

Walkthrough

Changes

Possibly related PRs

❌ Failed checks (1 warning)

Uh oh!

github-actions Bot commented Aug 12, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

kentcdodds commented Aug 12, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Intent

Summary

Production state (already remediated manually)

Testing

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Aug 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Possibly related PRs

❌ Failed checks (1 warning)

Uh oh!

github-actions Bot commented Aug 12, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

kentcdodds commented Aug 12, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Aug 12, 2026 •

edited

Loading