feat(webapp): let the deployment S2 client endpoints be overridden

apps/webapp/app/env.server.ts

@@ -79,6 +79,15 @@ const S2EnvSchema = z.preprocess(
       S2_ACCESS_TOKEN: z.string(),
       S2_DEPLOYMENT_LOGS_BASIN_NAME: z.string(),
       S2_DEPLOYMENT_STREAMS_LOCAL: z.string().default("0"),
+      // Points deployment event logs at an S2 service other than the hosted one, e.g. the
+      // local s2-lite in docker compose. One value covers both the account and basin
+      // endpoints: splitting them lets a half-set config send the access token to the
+      // hosted service while the operator believes they are entirely local.
+      S2_DEPLOYMENT_ENDPOINT: z
+        .string()
+        .url()
+        .optional()
+        .or(z.literal("").transform(() => undefined)),
     }),
     z.object({
       S2_ENABLED: z.literal("0"),

apps/webapp/app/presenters/v3/DeploymentPresenter.server.ts

@@ -13,7 +13,7 @@ import { type User } from "~/models/user.server";
 import { getUsername } from "~/utils/username";
 import { processGitMetadata } from "./BranchesPresenter.server";
 import { VercelProjectIntegrationDataSchema } from "~/v3/vercel/vercelProjectIntegrationSchema";
-import { S2 } from "@s2-dev/streamstore";
+import { createDeploymentS2Client } from "~/v3/s2Client.server";
 import { env } from "~/env.server";
 import { createRedisClient } from "~/redis.server";
 import { tryCatch } from "@trigger.dev/core";
@@ -30,7 +30,7 @@ const s2TokenRedis = createRedisClient("s2-token-cache", {
   clusterMode: env.CACHE_REDIS_CLUSTER_MODE_ENABLED === "1",
 });
 
-const s2 = env.S2_ENABLED === "1" ? new S2({ accessToken: env.S2_ACCESS_TOKEN }) : undefined;
+const s2 = createDeploymentS2Client();
 
 export type ErrorData = {
   name: string;

apps/webapp/app/v3/s2Client.server.ts

@@ -0,0 +1,28 @@
+import { S2 } from "@s2-dev/streamstore";
+import { env } from "~/env.server";
+
+export type DeploymentS2Config = {
+  accessToken: string;
+  endpoint?: string;
+};
+
+// One endpoint drives both the account and basin hosts. The SDK honours only endpoints passed
+// here (`S2Environment.parse()` is opt-in and we never call it), and overriding just one of the
+// two would send the access token to the hosted service while the other half went elsewhere.
+export function buildDeploymentS2Client({ accessToken, endpoint }: DeploymentS2Config): S2 {
+  return new S2({
+    accessToken,
+    endpoints: { account: endpoint, basin: endpoint },
+  });
+}
+
+export function createDeploymentS2Client(): S2 | undefined {
+  if (env.S2_ENABLED !== "1") {
+    return undefined;
+  }
+
+  return buildDeploymentS2Client({
+    accessToken: env.S2_ACCESS_TOKEN,
+    endpoint: env.S2_DEPLOYMENT_ENDPOINT,
+  });
+}

apps/webapp/app/v3/services/deployment.server.ts

@@ -23,7 +23,8 @@ import {
 import { FEATURE_FLAG, type FeatureFlagKey } from "../featureFlags";
 import { flags } from "../featureFlags.server";
 import { globalFlagsRegistry } from "../globalFlagsRegistry.server";
-import { AppendInput, AppendRecord, S2 } from "@s2-dev/streamstore";
+import { AppendInput, AppendRecord } from "@s2-dev/streamstore";
+import { createDeploymentS2Client } from "~/v3/s2Client.server";
 import { createRedisClient } from "~/redis.server";
 
 const S2_TOKEN_KEY_PREFIX = "s2-token:read:deployment-event-stream:project:";
@@ -35,7 +36,7 @@ const s2TokenRedis = createRedisClient("s2-token-cache", {
   tlsDisabled: env.CACHE_REDIS_TLS_DISABLED === "true",
   clusterMode: env.CACHE_REDIS_CLUSTER_MODE_ENABLED === "1",
 });
-const s2 = env.S2_ENABLED === "1" ? new S2({ accessToken: env.S2_ACCESS_TOKEN }) : undefined;
+const s2 = createDeploymentS2Client();
 
 const DEPLOY_BUILD_PATH_ENV_FLAG: Partial<Record<RuntimeEnvironmentType, FeatureFlagKey>> = {
   PREVIEW: FEATURE_FLAG.deployBuildPathPreview,

apps/webapp/test/s2Client.server.test.ts

@@ -0,0 +1,37 @@
+import { describe, expect, it } from "vitest";
+import { buildDeploymentS2Client } from "~/v3/s2Client.server";
+
+const BASIN = "trigger-local";
+
+describe("buildDeploymentS2Client", () => {
+  it("uses the SDK's hosted defaults when no endpoint is configured", () => {
+    const client = buildDeploymentS2Client({ accessToken: "token" });
+
+    expect(client.endpoints.accountBaseUrl()).toBe("https://a.s2.dev/v1");
+    expect(client.endpoints.basinBaseUrl(BASIN)).toBe(`https://${BASIN}.b.s2.dev/v1`);
+    expect(client.endpoints.includeBasinHeader).toBe(false);
+  });
+
+  it("points both the account and basin hosts at a configured endpoint", () => {
+    const client = buildDeploymentS2Client({
+      accessToken: "token",
+      endpoint: "http://localhost:4566",
+    });
+
+    expect(client.endpoints.accountBaseUrl()).toBe("http://localhost:4566/v1");
+    expect(client.endpoints.basinBaseUrl(BASIN)).toBe("http://localhost:4566/v1");
+    expect(client.endpoints.includeBasinHeader).toBe(true);
+  });
+
+  // A split configuration would send the access token to the hosted service while the operator
+  // believed the client was entirely local, so one value has to drive both hosts.
+  it("never leaves one host hosted while the other is overridden", () => {
+    const client = buildDeploymentS2Client({
+      accessToken: "token",
+      endpoint: "http://localhost:4566",
+    });
+
+    expect(client.endpoints.accountBaseUrl()).not.toContain("s2.dev");
+    expect(client.endpoints.basinBaseUrl(BASIN)).not.toContain("s2.dev");
+  });
+});