fix(preview): align commit-id length with publish (16 hex) + use $contains

Two bugs found during E2E smoke (cloud :4000 + preview :3100, real CRM
project, real published artifact):

1. Host parser only matched 12-hex commit ids, but `publish` derives
   commitId via `sha256(artifact).slice(0,16)` (see routes/cloud.ts
   line 228). Result: every real preview URL was parsed as a branch
   slug, so the per-request HEAD revalidation flow tried to look up a
   16-hex string as a branch name and 404'd.
   Fix: HEX12_RE -> COMMIT_HEX_RE (^[0-9a-f]{16}$). Test fixtures
   extended; doc comments aligned. 25 host-parser tests still pass.

2. Short-id lookup endpoint used { id: { $like: '...%' } } but the SQL
   driver supports $contains (LIKE %x%), not $like. Result:
   /cloud/projects-by-short-id/<8hex> always returned 404 even for
   valid prefixes.
   Fix: switch to $contains; the existing post-filter
   (id.replace(/-/g,'').startsWith(raw)) keeps the result exact. With
   limit:16 candidates per query the over-fetch is negligible. Test
   FakeDriver updated to match.

Verified end-to-end (real cloud + preview):
  - GET /cloud/projects-by-short-id/67a5df1a -> 200 with full UUID
  - GET /api/v1/data/account on
      3ec1ad2bd2b8613d--67a5df1a.localhost:3100 -> 200, 5 seeded records
  - POST /api/v1/data/account on same host -> 200, list now 6
  - Same path on main--67a5df1a.localhost:3100 -> 200 (branch host)
  - Bad commit (deadbeefdeadbeef) -> 400 "artifact not found"
  - Browser navigation confirmed for both commit and branch hosts
121/121 service-cloud tests pass.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: hotlong

packages/services/service-cloud/src/preview/environment-registry.ts

@@ -31,7 +31,7 @@ type IDataDriver = Contracts.IDataDriver;
 interface CompositeProject {
     id: string;                     // composite key: `${projectId}:${commitId}`
     projectId: string;              // real project UUID
-    commitId: string;               // pinned 12-hex (or longer) commit id
+    commitId: string;               // pinned 16-hex commit id
     organization_id?: string;
     /** Set when the entry was resolved via a branch slug. */
     branchName?: string;

packages/services/service-cloud/src/preview/host-parser.ts

@@ -7,7 +7,8 @@
  *   • `pidShort` is exactly 8 lowercase hex chars (= first 8 hex chars of
  *     a project UUID, dashes stripped).
  *   • `ref` is either:
- *       - exactly 12 lowercase hex chars  → a commit-pinned preview, or
+ *       - exactly 16 lowercase hex chars  → a commit-pinned preview
+ *         (publish derives commitId = sha256(artifact).slice(0,16)), or
  *       - a branch slug (matches BRANCH_SLUG_RE elsewhere) → branch-tracking.
  *   • `<base>` is one of the configured preview base domains, e.g.
  *     `preview.objectstack.ai` (prod) or `localhost[:port]` (dev,
@@ -24,18 +25,18 @@
  * pure string function so it can be unit-tested without a registry.
  */
 
-const HEX12_RE = /^[0-9a-f]{12}$/;
+const COMMIT_HEX_RE = /^[0-9a-f]{16}$/;
 const PID_SHORT_RE = /^[0-9a-f]{8}$/;
 /** Same shape as BRANCH_SLUG_RE in routes/branches.ts. Duplicated here to
  *  avoid pulling that file into the parser's import graph. */
 const BRANCH_SLUG_RE = /^[a-z0-9][a-z0-9._/-]{0,62}$/;
 
 export interface PreviewHost {
-    /** 'commit' = ref is a 12-hex commit id; 'branch' = ref is a slug. */
+    /** 'commit' = ref is a 16-hex commit id; 'branch' = ref is a slug. */
     kind: 'commit' | 'branch';
     /** First 8 hex chars of the project's UUID (no dashes). */
     pidShort: string;
-    /** Either a 12-hex commit id or a branch slug. */
+    /** Either a 16-hex commit id or a branch slug. */
     ref: string;
 }
 
@@ -111,7 +112,7 @@ export function parsePreviewHost(host: string, config?: PreviewParseConfig): Pre
     if (!PID_SHORT_RE.test(pidShort)) return null;
     if (!ref) return null;
 
-    if (HEX12_RE.test(ref)) {
+    if (COMMIT_HEX_RE.test(ref)) {
         return { kind: 'commit', pidShort, ref };
     }
     if (BRANCH_SLUG_RE.test(ref)) {

packages/services/service-cloud/src/routes/cloud.ts

@@ -82,13 +82,15 @@ export function registerCloudRoutes(server: IHttpServer, deps: RouteDeps): void
 
         try {
             // The short id is a UUID prefix without dashes; the stored
-            // `sys_project.id` is a canonical UUID *with* dashes. Use a
-            // suffix-stripped LIKE: the first 8 hex chars of the UUID
-            // are always the bytes before the first dash, so we can
-            // match `${raw.slice(0,8)}%` and then post-filter exact.
+            // `sys_project.id` is a canonical UUID *with* dashes. The first
+            // 8 hex chars of the UUID are always the bytes before the first
+            // dash. Most drivers expose `$contains` (LIKE %x%); we use that
+            // to over-fetch a small candidate set, then post-filter to an
+            // exact prefix match. UUIDs make collisions on 8 hex chars rare,
+            // and we cap the candidate scan at 16 rows.
             const headHex = raw.slice(0, 8);
             const candidates = (await (driver.find as any)('sys_project', {
-                where: { id: { $like: `${headHex}%` } },
+                where: { id: { $contains: headHex } },
                 limit: 16,
             })) as Array<{ id: string; organization_id?: string }>;
             const matches = candidates.filter((p) => p.id.replace(/-/g, '').toLowerCase().startsWith(raw));

packages/services/service-cloud/test/cloud-artifact-api-plugin.test.ts

@@ -89,9 +89,14 @@ class FakeDriver {
         const where = query?.where ?? {};
         if (table === 'sys_project') {
             return this.projects.filter((p) => Object.entries(where).every(([k, v]) => {
-                if (v && typeof v === 'object' && '$like' in (v as any)) {
-                    const pattern = String((v as any).$like).replace(/%/g, '.*');
-                    return new RegExp(`^${pattern}$`).test(String((p as any)[k] ?? ''));
+                if (v && typeof v === 'object') {
+                    if ('$like' in (v as any)) {
+                        const pattern = String((v as any).$like).replace(/%/g, '.*');
+                        return new RegExp(`^${pattern}$`).test(String((p as any)[k] ?? ''));
+                    }
+                    if ('$contains' in (v as any)) {
+                        return String((p as any)[k] ?? '').includes(String((v as any).$contains));
+                    }
                 }
                 return (p as any)[k] === v;
             })).slice(0, query?.limit ?? 100);

packages/services/service-cloud/test/preview-environment-registry.test.ts

@@ -63,9 +63,9 @@ describe('PreviewEnvironmentRegistry', () => {
                 '7f3e9a01': { projectId: '7f3e9a01-1234-5678-9abc-def012345678' },
             });
             const reg = makeRegistry(client);
-            const r = await reg.resolveByHostname('abc123def456--7f3e9a01.preview.objectstack.ai');
+            const r = await reg.resolveByHostname('abc123def4567890--7f3e9a01.preview.objectstack.ai');
             expect(r).not.toBeNull();
-            expect(r!.projectId).toBe('7f3e9a01-1234-5678-9abc-def012345678:abc123def456');
+            expect(r!.projectId).toBe('7f3e9a01-1234-5678-9abc-def012345678:abc123def4567890');
             expect(client.lookups).toBe(1);
             expect(client.headLookups).toBe(0);
             expect(FakeDriver.instances).toBe(1);
@@ -76,7 +76,7 @@ describe('PreviewEnvironmentRegistry', () => {
                 '7f3e9a01': { projectId: '7f3e9a01-1234-5678-9abc-def012345678' },
             });
             const reg = makeRegistry(client);
-            const host = 'abc123def456--7f3e9a01.preview.objectstack.ai';
+            const host = 'abc123def4567890--7f3e9a01.preview.objectstack.ai';
             await reg.resolveByHostname(host);
             await reg.resolveByHostname(host);
             await reg.resolveByHostname(host);
@@ -89,10 +89,10 @@ describe('PreviewEnvironmentRegistry', () => {
                 '7f3e9a01': { projectId: '7f3e9a01-1234-5678-9abc-def012345678' },
             });
             const reg = makeRegistry(client);
-            await reg.resolveByHostname('abc123def456--7f3e9a01.preview.objectstack.ai');
-            const peek = reg.peekById('7f3e9a01-1234-5678-9abc-def012345678:abc123def456');
+            await reg.resolveByHostname('abc123def4567890--7f3e9a01.preview.objectstack.ai');
+            const peek = reg.peekById('7f3e9a01-1234-5678-9abc-def012345678:abc123def4567890');
             expect(peek).not.toBeNull();
-            expect(peek!.project.commitId).toBe('abc123def456');
+            expect(peek!.project.commitId).toBe('abc123def4567890');
             expect(peek!.project.projectId).toBe('7f3e9a01-1234-5678-9abc-def012345678');
         });
     });
@@ -101,18 +101,18 @@ describe('PreviewEnvironmentRegistry', () => {
         it('resolves a branch host using its current head', async () => {
             const client = new FakeClient(
                 { '7f3e9a01': { projectId: 'proj-1' } },
-                { 'proj-1': { main: { commitId: 'abc123def456' } } },
+                { 'proj-1': { main: { commitId: 'abc123def4567890' } } },
             );
             const reg = makeRegistry(client);
             const r = await reg.resolveByHostname('main--7f3e9a01.preview.objectstack.ai');
-            expect(r!.projectId).toBe('proj-1:abc123def456');
+            expect(r!.projectId).toBe('proj-1:abc123def4567890');
             expect(client.headLookups).toBe(1);
         });
 
         it('re-checks branch head on every request (per-request semantics)', async () => {
             const client = new FakeClient(
                 { '7f3e9a01': { projectId: 'proj-1' } },
-                { 'proj-1': { main: { commitId: 'abc123def456' } } },
+                { 'proj-1': { main: { commitId: 'abc123def4567890' } } },
             );
             const reg = makeRegistry(client);
             const host = 'main--7f3e9a01.preview.objectstack.ai';
@@ -128,18 +128,18 @@ describe('PreviewEnvironmentRegistry', () => {
         it('evicts and rebuilds when branch head advances', async () => {
             const client = new FakeClient(
                 { '7f3e9a01': { projectId: 'proj-1' } },
-                { 'proj-1': { main: { commitId: 'aaaaaaaaaaaa' } } },
+                { 'proj-1': { main: { commitId: 'aaaaaaaaaaaaaaaa' } } },
             );
             const reg = makeRegistry(client);
             const host = 'main--7f3e9a01.preview.objectstack.ai';
             const first = await reg.resolveByHostname(host);
-            expect(first!.projectId).toBe('proj-1:aaaaaaaaaaaa');
+            expect(first!.projectId).toBe('proj-1:aaaaaaaaaaaaaaaa');
 
             // Advance the head.
-            client.branches['proj-1']!.main = { commitId: 'bbbbbbbbbbbb' };
+            client.branches['proj-1']!.main = { commitId: 'bbbbbbbbbbbbbbbb' };
 
             const second = await reg.resolveByHostname(host);
-            expect(second!.projectId).toBe('proj-1:bbbbbbbbbbbb');
+            expect(second!.projectId).toBe('proj-1:bbbbbbbbbbbbbbbb');
             expect(client.artifactInvalidations).toBeGreaterThanOrEqual(1);
             expect(FakeDriver.instances).toBe(2); // fresh driver for the new commit
         });
@@ -167,7 +167,7 @@ describe('PreviewEnvironmentRegistry', () => {
         it('singleflights concurrent first-resolve requests', async () => {
             const client = new FakeClient(
                 { '7f3e9a01': { projectId: 'proj-1' } },
-                { 'proj-1': { main: { commitId: 'aaaaaaaaaaaa' } } },
+                { 'proj-1': { main: { commitId: 'aaaaaaaaaaaaaaaa' } } },
             );
             const reg = makeRegistry(client);
             const host = 'main--7f3e9a01.preview.objectstack.ai';
@@ -176,9 +176,9 @@ describe('PreviewEnvironmentRegistry', () => {
                 reg.resolveByHostname(host),
                 reg.resolveByHostname(host),
             ]);
-            expect(a!.projectId).toBe('proj-1:aaaaaaaaaaaa');
-            expect(b!.projectId).toBe('proj-1:aaaaaaaaaaaa');
-            expect(c!.projectId).toBe('proj-1:aaaaaaaaaaaa');
+            expect(a!.projectId).toBe('proj-1:aaaaaaaaaaaaaaaa');
+            expect(b!.projectId).toBe('proj-1:aaaaaaaaaaaaaaaa');
+            expect(c!.projectId).toBe('proj-1:aaaaaaaaaaaaaaaa');
             expect(client.lookups).toBe(1);
             // One head fetch during initial build, no per-request re-check
             // because all three calls dedupe through `pending`.
@@ -193,10 +193,10 @@ describe('PreviewEnvironmentRegistry', () => {
                 '7f3e9a01': { projectId: 'proj-1' },
             });
             const reg = makeRegistry(client);
-            await reg.resolveByHostname('abc123def456--7f3e9a01.localhost');
-            expect(reg.peekById('proj-1:abc123def456')).not.toBeNull();
+            await reg.resolveByHostname('abc123def4567890--7f3e9a01.localhost');
+            expect(reg.peekById('proj-1:abc123def4567890')).not.toBeNull();
             reg.clear();
-            expect(reg.peekById('proj-1:abc123def456')).toBeNull();
+            expect(reg.peekById('proj-1:abc123def4567890')).toBeNull();
         });
     });
 });

packages/services/service-cloud/test/preview-host-parser.test.ts

@@ -4,25 +4,25 @@ import { describe, it, expect } from 'vitest';
 import { parsePreviewHost, projectIdToShort } from '../src/preview/host-parser.js';
 
 describe('parsePreviewHost', () => {
-    describe('commit-pinned (12 hex)', () => {
+    describe('commit-pinned (16 hex)', () => {
         it('parses prod hostname', () => {
-            const r = parsePreviewHost('abc123def456--7f3e9a01.preview.objectstack.ai');
-            expect(r).toEqual({ kind: 'commit', pidShort: '7f3e9a01', ref: 'abc123def456' });
+            const r = parsePreviewHost('abc123def4567890--7f3e9a01.preview.objectstack.ai');
+            expect(r).toEqual({ kind: 'commit', pidShort: '7f3e9a01', ref: 'abc123def4567890' });
         });
 
         it('parses localhost hostname (RFC 6761)', () => {
-            const r = parsePreviewHost('abc123def456--7f3e9a01.localhost');
-            expect(r).toEqual({ kind: 'commit', pidShort: '7f3e9a01', ref: 'abc123def456' });
+            const r = parsePreviewHost('abc123def4567890--7f3e9a01.localhost');
+            expect(r).toEqual({ kind: 'commit', pidShort: '7f3e9a01', ref: 'abc123def4567890' });
         });
 
         it('strips :port', () => {
-            const r = parsePreviewHost('abc123def456--7f3e9a01.localhost:4100');
-            expect(r).toEqual({ kind: 'commit', pidShort: '7f3e9a01', ref: 'abc123def456' });
+            const r = parsePreviewHost('abc123def4567890--7f3e9a01.localhost:4100');
+            expect(r).toEqual({ kind: 'commit', pidShort: '7f3e9a01', ref: 'abc123def4567890' });
         });
 
         it('lowercases input', () => {
-            const r = parsePreviewHost('ABC123DEF456--7F3E9A01.PREVIEW.OBJECTSTACK.AI');
-            expect(r).toEqual({ kind: 'commit', pidShort: '7f3e9a01', ref: 'abc123def456' });
+            const r = parsePreviewHost('ABC123DEF4567890--7F3E9A01.PREVIEW.OBJECTSTACK.AI');
+            expect(r).toEqual({ kind: 'commit', pidShort: '7f3e9a01', ref: 'abc123def4567890' });
         });
     });
 
@@ -102,16 +102,16 @@ describe('parsePreviewHost', () => {
     });
 
     describe('commit/branch disambiguation', () => {
-        it('exactly 12 hex → commit', () => {
-            expect(parsePreviewHost('0123456789ab--7f3e9a01.localhost')?.kind).toBe('commit');
+        it('exactly 16 hex → commit', () => {
+            expect(parsePreviewHost('0123456789abcdef--7f3e9a01.localhost')?.kind).toBe('commit');
         });
 
         it('11 hex → branch (slug regex still matches)', () => {
             expect(parsePreviewHost('0123456789a--7f3e9a01.localhost')?.kind).toBe('branch');
         });
 
         it('13 hex → branch (slug regex still matches)', () => {
-            expect(parsePreviewHost('0123456789abc--7f3e9a01.localhost')?.kind).toBe('branch');
+            expect(parsePreviewHost('0123456789abcde--7f3e9a01.localhost')?.kind).toBe('branch');
         });
     });
 });