[azank1]

Adds GET /api/version, which returns {"commit": VERCEL_GIT_COMMIT_SHA, "source": "env:VERCEL_GIT_COMMIT_SHA", "ref": VERCEL_GIT_COMMIT_REF} with Cache-Control: no-store, so a deploy can be read back and checked against the history. A deployment without a full commit id answers 503 instead of guessing.

It is one more op on the existing api/site.ts router plus version in the /api/:op(...) rewrite, so no new function is added (Hobby cap of 12). /version is untouched and still reaches the page for a user named version.

Evidence. Typecheck clean; web suite 63 pass, 0 fail, 6 skipped (the existing live-network tests). New tests: the rewrite maps /api/version to /api/site?op=version, and the handler returns the commit when set and 503 when it is missing, empty or abbreviated.

Read back on the preview. GET /api/version on the Vercel preview for this head (read through Vercel's authenticated fetch) answered 200 with {"commit":"b38260939b404d3129ae5adfd70a75ec4ab251b8","source":"env:VERCEL_GIT_COMMIT_SHA","ref":"feat/version-route"} and cache-control: no-store, so the system environment variables do reach functions at runtime.

CI. web and python pass. viewer fails, and it fails on main at 5d37aae the same way: the build regenerates web/public/index.html and it differs from the committed copy. That predates this PR, which does not touch the viewer.

card: 1
intent: Serve the commit a deployment was built from at /api/version, so each deploy can be read back.
layers: [function, config]
targets: [web]
markers:
  - kind: version
    url: /api/version
releaseNote: commit.city now says which commit it runs, at /api/version.
risk: ship_alone

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
commit-city	Ready	Preview	Oct 15, 2026 9:28am UTC