@casecore/release-agent 0.1.6 → 0.1.7

package/README.md

@@ -13,7 +13,7 @@
 ## Подключение
 
 ```sh
-pnpm add --save-exact @casecore/release-agent@0.1.6
+pnpm add --save-exact @casecore/release-agent@0.1.7
 ```
 
 В проекте фиксируются точная версия и `pnpm-lock.yaml`. Поддерживается Node.js
@@ -323,3 +323,12 @@ production readback; новую установку или продление с
 принятого через существующий report, адаптер может предоставить
 `readTerminalReceipt(commandId)`. Неизвестный результат возвращает 404;
 неподтверждённые ошибки установки не получают такой результат.
+
+Отказ до push использует тот же guarded recovery с `kind: failed_before_source_push`,
+`stage: source_ready` и `sourceExecution` вместо GitHub `delivery`. Исходная sealed
+попытка имеет `schema: 1`, `kind: source_not_pushed`, `id`, `candidateId`,
+`sourceCommit`, `requestedAt`, `deadlineAt`, `policy: immediate`. Обязательный
+`verifyPublicationSourceFailure` подтверждает эту границу под удерживаемым guard.
+Любой bound delivery, артефакт или начатая следующая стадия отказывают. ACK сохраняет
+предыдущую рабочую установку и снимает блокировку без создания GitHub-статуса или
+publication-terminal receipt. Истёкший срок не продлевается.

package/dist/index.mjs

@@ -1,5 +1,5 @@
 export * from './pipeline.mjs';
 export * from './source-store.mjs';
 export * from './producer.mjs';
-export { publicationFailureProofDigest } from './producer-publication-failure.mjs';
+export { publicationFailureProofDigest, validateSourceRecoveryExecution } from './producer-publication-failure.mjs';
 export { createProtectedJsonStore } from './journal.mjs';

package/dist/producer-journal.mjs

@@ -100,6 +100,9 @@ export function validProducerState(state, installationKey, sourcePolicy) {
       if (reconciliation) {
         assert.equal(state.commands[run.commandId].command.action, 'publish');
         assert.ok(!state.commands[run.commandId].artifactIdentity);
+        if (reconciliation.fact?.kind === 'failed_before_source_push')
+          for (const stage of run.stages.filter((stage) => stage.id !== 'source_ready'))
+            assert.ok(stage.status === 'pending' && stage.startedAt === null);
         if (reconciliation.state === 'settled') {
           assert.equal(run.status, 'failed');
           assert.equal(run.recoveryState, 'verified');

package/dist/producer-publication-failure.mjs

@@ -4,6 +4,8 @@ import {
   hash,
   keys,
   timestamp,
+  uuid,
+  boundedText,
   completeIdentity,
   validateReadback,
 } from './protocol-internals.mjs';
@@ -18,14 +20,36 @@ export function publicationFailureProofDigest(fact, baselineReadback) {
   return `sha256:${hash(canonical({ fact, baselineReadback }))}`;
 }
 
+export function validateSourceRecoveryExecution(value, command) {
+  keys(value, ['schema', 'kind', 'id', 'candidateId', 'sourceCommit', 'requestedAt', 'deadlineAt', 'policy']);
+  assert.equal(value.schema, 1);
+  assert.equal(value.kind, 'source_not_pushed');
+  assert.match(value.id, uuid);
+  assert.match(value.sourceCommit, /^[a-f0-9]{40}$/);
+  boundedText(value.candidateId);
+  assert.equal(value.policy, 'immediate');
+  timestamp(value.requestedAt);
+  timestamp(value.deadlineAt);
+  assert.equal(Date.parse(value.deadlineAt) - Date.parse(value.requestedAt), 900000);
+  if (command) {
+    assert.equal(command.action, 'publish');
+    assert.equal(value.candidateId, command.candidateId);
+    assert.equal(value.sourceCommit, command.expectedSource.sourceCommit);
+    assert.equal(value.requestedAt, command.requestedAt);
+    assert.equal(value.deadlineAt, command.deadlineAt);
+  }
+  return value;
+}
+
 export function validatePublicationFailureFact(fact, command, delivery) {
+  const beforePush = fact?.kind === 'failed_before_source_push';
   keys(fact, [
     'schema',
     'kind',
     'commandId',
     'installationKey',
     'expectedSource',
-    'delivery',
+    beforePush ? 'sourceExecution' : 'delivery',
     'observedAt',
     'stage',
     'authenticated',
@@ -35,15 +59,21 @@ export function validatePublicationFailureFact(fact, command, delivery) {
     'installationNotStarted',
   ]);
   assert.equal(fact.schema, 1);
-  assert.equal(fact.kind, 'failed_before_installation');
+  assert.ok(beforePush || fact.kind === 'failed_before_installation');
   assert.equal(fact.commandId, command.commandId);
   assert.equal(fact.installationKey, command.installationKey);
   keys(fact.expectedSource, ['repository', 'ref', 'sourceCommit']);
   assert.equal(canonical(fact.expectedSource), canonical(command.expectedSource));
-  validateOriginalDelivery(fact.delivery, command.expectedSource.sourceCommit);
-  assert.equal(fact.delivery.requestedAt, command.requestedAt);
-  assert.equal(fact.delivery.deadlineAt, command.deadlineAt);
-  if (delivery) assert.deepEqual(fact.delivery, delivery);
+  if (beforePush) {
+    assert.ok(delivery == null, 'Source failure cannot replace an admitted GitHub delivery');
+    validateSourceRecoveryExecution(fact.sourceExecution, command);
+    assert.equal(fact.stage, 'source_ready');
+  } else {
+    validateOriginalDelivery(fact.delivery, command.expectedSource.sourceCommit);
+    assert.equal(fact.delivery.requestedAt, command.requestedAt);
+    assert.equal(fact.delivery.deadlineAt, command.deadlineAt);
+    if (delivery) assert.deepEqual(fact.delivery, delivery);
+  }
   timestamp(fact.observedAt);
   assert.ok(stages.includes(fact.stage));
   for (const field of [
@@ -209,7 +239,19 @@ export async function reconcilePublicationFailure(
       const { observedAt: _newTime, ...newIdentity } = fact;
       assert.deepEqual(newIdentity, oldIdentity, 'Publication failure reconciliation changed');
     }
-    await bounded(
+    const beforePush = fact.kind === 'failed_before_source_push';
+    if (beforePush) {
+      assert.ok(!item.deliveryExecution && !item.artifactIdentity);
+      for (const stage of run.stages.filter((stage) => stage.id !== 'source_ready'))
+        assert.ok(stage.status === 'pending' && stage.startedAt === null,
+          'Source failure cannot erase a started downstream stage');
+      assert.equal(typeof producer.provider.verifyPublicationSourceFailure, 'function',
+        'Source failure boundary verifier required');
+      assert.equal(await bounded(producer.provider.verifyPublicationSourceFailure(
+        structuredClone(item.command), structuredClone(fact.sourceExecution),
+        { signal: controller.signal, recoveryDeadlineAt }
+      )), true, 'Source failure boundary was not verified');
+    } else await bounded(
       verifyPublicationDelivery(producer, item.command, fact.delivery, { fresh: false })
     );
     await bounded(guard.assertOwned());
@@ -218,7 +260,7 @@ export async function reconcilePublicationFailure(
     assertFresh();
     item.publicationFailureReconciliation.fact = fact;
     item.publicationFailureReconciliation.baselineReadback = baselineReadback;
-    item.deliveryExecution = structuredClone(fact.delivery);
+    if (!beforePush) item.deliveryExecution = structuredClone(fact.delivery);
     run.readback = structuredClone(baselineReadback);
     await bounded(producer.save());
     const proofDigest = publicationFailureProofDigest(fact, baselineReadback);
@@ -280,5 +322,8 @@ export async function reconcilePublicationFailure(
     if (guard && !settled && !releasing && typeof guard.release === 'function') void cleanup(guard);
     lease.release({ resolved: settled });
   }
-  if (settled) await notifyPublicationTerminal(producer, item, run);
+  // Pre-push source recovery has no GitHub delivery or publication-terminal MAC.
+  // Its existing guarded acknowledgement is the sole settlement boundary.
+  if (settled && item.publicationFailureReconciliation.fact.kind !== 'failed_before_source_push')
+    await notifyPublicationTerminal(producer, item, run);
 }

package/dist/producer.d.ts

@@ -132,6 +132,11 @@ export interface ReleaseProvider {
     command: RunnerCommand,
     context: ProviderContext & { delivery: OriginalDelivery | null; recoveryDeadlineAt: number }
   ): Promise<PublicationFailureGuard | null>;
+  verifyPublicationSourceFailure?(
+    command: RunnerCommand,
+    execution: SourceRecoveryExecution,
+    context: ProviderContext & { recoveryDeadlineAt: number }
+  ): Promise<boolean>;
   validatePublicationResume?(
     command: RunnerCommand,
     item: Record<string, unknown>
@@ -150,13 +155,25 @@ export interface ReleaseProvider {
   ): Promise<Record<string, unknown>>;
   productionFailure?(fact: ProductionReadback): Error | undefined;
 }
-export interface PublicationFailureFact {
+export interface SourceRecoveryExecution {
+  schema: 1;
+  kind: 'source_not_pushed';
+  id: string;
+  candidateId: string;
+  sourceCommit: string;
+  requestedAt: string;
+  deadlineAt: string;
+  policy: 'immediate';
+}
+export function validateSourceRecoveryExecution(
+  execution: unknown,
+  command?: RunnerCommand
+): SourceRecoveryExecution;
+interface PublicationFailureCommon {
   schema: 1;
-  kind: 'failed_before_installation';
   commandId: string;
   installationKey: string;
   expectedSource: { repository: string; ref: string; sourceCommit: string };
-  delivery: OriginalDelivery;
   observedAt: string;
   stage: 'source_ready' | 'ci' | 'build' | 'verify' | 'publish';
   authenticated: true;
@@ -165,6 +182,15 @@ export interface PublicationFailureFact {
   publicationResolved: true;
   installationNotStarted: true;
 }
+export type PublicationFailureFact = PublicationFailureCommon &
+  (
+    | { kind: 'failed_before_installation'; delivery: OriginalDelivery }
+    | {
+        kind: 'failed_before_source_push';
+        sourceExecution: SourceRecoveryExecution;
+        stage: 'source_ready';
+      }
+  );
 export interface PublicationFailureGuard {
   fact: PublicationFailureFact;
   baselineReadback: ProductionReadback;

package/dist/producer.mjs

@@ -9,7 +9,7 @@ export {
   sealPublicationTerminalReceipt,
   verifyPublicationTerminalReceipt,
 } from './publication-terminal.mjs';
-export { publicationFailureProofDigest } from './producer-publication-failure.mjs';
+export { publicationFailureProofDigest, validateSourceRecoveryExecution } from './producer-publication-failure.mjs';
 export {
   sameIdentity,
   validateExpectedSource,

package/dist/provenance.json

@@ -1,29 +1,29 @@
 {
   "schema": 1,
   "package": "@casecore/release-agent",
-  "version": "0.1.6",
-  "sourceCommit": "70442860e0f89db88c78142c6f6a7e8073414af5",
+  "version": "0.1.7",
+  "sourceCommit": "517e8581d9e651cf4188c084e5a65e95b2e5bc82",
   "sourceVerified": true,
   "sourceDirty": false,
   "buildKind": "release",
-  "contentDigest": "sha256:a41148b8adf594a5da507b1f8495b5b8c63e32b514d815c7bbce2634b0e6fb89",
+  "contentDigest": "sha256:bd08880215c8d1203050961fa9971925b212d463354b847d1574d92c4720c524",
   "files": {
     "src/configuration-hook.mjs": "sha256:1171bf982cbf7cb0092f63b633ef0b0a0947d8ed1106f88c9175c8add33d81b1",
     "src/exclusive-operation.mjs": "sha256:d5c2718a2a4228d09559e914360329383ae276f034bb468c52642a4bd6aa0d99",
     "src/identity.mjs": "sha256:253021058fc79232d83f3ecba6f1023fd046f27aabdf9c129a103d3c9ccb07f5",
-    "src/index.mjs": "sha256:76bda5e1dc376bb7033d8fdbddb0afa85c7c68bbe028aea078ffceaaa35ec75e",
+    "src/index.mjs": "sha256:2df871905b31d8cb287dd0700765be6dd9d76fbb91d25b9275f37b07ab4669b5",
     "src/journal.mjs": "sha256:35a2620d56084ec1aa164e09d77b8e77096413d9572f7b601da8ef7149b996bd",
     "src/pipeline.mjs": "sha256:7a2d39d235ce7160441d177200389c5f3eae1cc494ec36082a23e8d64a0abe3f",
     "src/producer-admission.mjs": "sha256:03d868141daf92351b3e1a4e70997c87fc39044624644536a374aa86d108d12d",
     "src/producer-delivery.mjs": "sha256:04439a95afcb52d879cc83b99fa1d7716f4dff84bb7c07f88d31f534799e76a8",
     "src/producer-execution.mjs": "sha256:e78724fa2f2fd4946ae8103bb5165b363eb968fab42add4fed572155f51871d9",
-    "src/producer-journal.mjs": "sha256:9ec7c5e4ae6add8c0b64644673c3243946175fb5cc2dafcd5f1fdee2c6485ffd",
-    "src/producer-publication-failure.mjs": "sha256:9db4effbeae8287070e3c27133abecf2bf435a8c6917c3162f0efd3189ea9445",
+    "src/producer-journal.mjs": "sha256:d257e2042d92b828de44247b6affbe0b06e00263a1bb1939a1faa032daeaca9e",
+    "src/producer-publication-failure.mjs": "sha256:f077e62424cffb5123a81444e872fb2e2dec9b71dec89be7ca00b37227f8a648",
     "src/producer-publication.mjs": "sha256:c09fa07b37507093b71bbaff3af9df8ec2331c0cba24a4b936d247e9b35257f7",
     "src/producer-server.mjs": "sha256:fc67ceced78239a1d159ff1af82b0061a407891523ad2a1a9139a3d4d158619c",
     "src/producer-state.mjs": "sha256:61d6a914c268f94790c459562436bfe95efd07865ca1052b0b58760d9087d535",
     "src/producer-support.mjs": "sha256:0a10f6fa50cd8e729ba432640d0845004488ead2bcc1c9383f02548037f83d66",
-    "src/producer.mjs": "sha256:d5a9fca0bcb14f8c757d7219fcb8f2d39a2bf7af05c9cce3b8f654fa3060552c",
+    "src/producer.mjs": "sha256:50addd14e7ae0ae7fb41fb5a4c733f1876d0551befb6db909edeed6cb5f44c1a",
     "src/protocol-internals.mjs": "sha256:d08a0c72079d091792c5327adafac5ffc38ea20138a6c44b88879e7157a890b3",
     "src/protocol.mjs": "sha256:1fe135a2e60922b517886a392c2b0c2250b773abda8b1a1fcd9af86df2be6dae",
     "src/publication-terminal-receipt.mjs": "sha256:b4ecc620f7e4325ec9d42652b8f1620f609fad65b1400cd2810a0a2f7e7b6794",
@@ -36,7 +36,7 @@
     "types/index.d.ts": "sha256:92ef7b5600f05d52dcb646fc3e4d2b4944ead52ff1c9ee23bb9f4659bebf05a6",
     "types/journal.d.ts": "sha256:79beb61af50b00400588a87426a7f5b38bf38d4b8224284dc6e0631378aa244e",
     "types/pipeline.d.ts": "sha256:c9135e25fb852377c32a16ce781405393c5857886e3f77754b715747202c70a9",
-    "types/producer.d.ts": "sha256:f64ae58d8e5984caea148a97e2cdf7d52a77bc472fb17ec75b5af1350f763fcc",
+    "types/producer.d.ts": "sha256:16cc19bd45fbf0cec564c2d6ec5d5ad00f3f866c89eb8af94e6b5c33ed1be22f",
     "types/protocol.d.ts": "sha256:02c06986c81bfc4214169f62da8e0566704b71a5add58434dfca92c673fad4ce",
     "types/source-store.d.ts": "sha256:ce2086dd682e8f57bc5e1581b411ec9fe1cf1cfba8dccafe38c22d102c2b9904",
     "types/types.d.ts": "sha256:cdc6664854bffc371a3da45f29bf1b31f14fd61b66e8f8bae8309dd836f6de6e"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@casecore/release-agent",
-  "version": "0.1.6",
+  "version": "0.1.7",
   "description": "Общий движок поставки CaseCore с адаптерами продуктов",
   "license": "UNLICENSED",
   "repository": {