@delegance/claude-autopilot 5.5.2 → 7.2.0

package/README.md

@@ -4,7 +4,16 @@
 
 **Autonomous development pipeline for Claude Code. Brainstorm → spec → plan → implement → migrate → validate → PR → review → merge — all from your terminal, on your codebase, with your test suite.**
 
-**Open source, MIT-licensed, runs on your machine with your API keys.** No hosted agent, no per-seat subscription — `npm install -g @delegance/claude-autopilot` and you're done.
+**Open source, MIT-licensed, runs on your machine with your API keys.** No hosted agent, no per-seat subscription — `npm install -g @delegance/claude-autopilot@latest` and you're done.
+
+## Hosted product (v7)
+
+A hosted dashboard at **[autopilot.dev](https://autopilot.dev)** complements the self-hosted CLI. The CLI keeps doing all the work locally on your machine — running models, writing code, opening PRs — and optionally uploads each completed run's state + cost summary to the hosted dashboard so your team can see what's been shipped, audit cost, and manage memberships from the browser.
+
+- **CLI (this package)** — local-first, no telemetry by default, your machine + your API keys. Pipeline stays the same.
+- **Dashboard ([autopilot.dev](https://autopilot.dev))** — opt-in. After `claude-autopilot dashboard login` mints a personal API key via a loopback OAuth flow, every engine-on autopilot run uploads its `state.json` + `events.ndjson` + cost roll-up at run.complete. Org admin (members, billing, SSO) lives there.
+
+The CLI works offline; the dashboard is purely additive. See [docs/v7/runbook.md](./docs/v7/runbook.md) for operating the hosted product and [docs/v7/breaking-changes.md](./docs/v7/breaking-changes.md) for the v6→v7 migration checklist.
 
 ```bash
 claude-autopilot brainstorm "add SSO with SAML for enterprise tenants"
@@ -80,6 +89,34 @@ claude-autopilot brainstorm "add rate limiting to the public API"
 claude-autopilot run --pr 123
 ```
 
+## Run State Engine (v6)
+
+Persistent state for autopilot runs. Resume after crashes, enforce hard budget caps, and surface typed JSON events for CI consumers — all opt-in, all on disk.
+
+```yaml
+# guardrail.config.yaml
+engine:
+  enabled: true              # default in v6.1+; explicit `false` is deprecated and removed in v7
+budgets:
+  perRunUSD: 10              # hard stop; mandatory runtime guard
+  perPhaseUSD: 5
+```
+
+```bash
+claude-autopilot scan --all                  # any command — engine writes a per-run dir
+claude-autopilot runs list                   # newest-first, with status / cost / lastPhase
+claude-autopilot runs show 01HZK7P3D8Q9V…    # state snapshot + optional event tail
+claude-autopilot run resume 01HZK7P3D8Q9V…   # lookup-only today; live execution in a later v6.x
+claude-autopilot runs gc --older-than-days 7 # retire completed runs
+```
+
+Every state transition appends a typed event to `.guardrail-cache/runs/<ulid>/events.ndjson`; every CLI verb supports `--json` with strict stdout-envelope / stderr-NDJSON channel discipline. Side-effect phase replay consults persisted `externalRefs` plus a live provider read-back so resume is safe by construction.
+
+**v6.1+ ships with the engine ON by default** (flipped from v6.0's off-by-default after the stabilization criteria in [`docs/specs/v6.1-default-flip.md`](docs/specs/v6.1-default-flip.md) were met). Users who want the legacy v5.x output shape can opt out for one minor version via `--no-engine`, `CLAUDE_AUTOPILOT_ENGINE=off`, or `engine.enabled: false` — each prints a deprecation warning and is removed in v7.
+
+→ [`docs/v6/quickstart.md`](docs/v6/quickstart.md) — five-minute setup
+→ [`docs/v6/migration-guide.md`](docs/v6/migration-guide.md) — full v5.x → v6 walkthrough with precedence matrix, per-phase idempotency rules, and troubleshooting
+
 ## The pipeline, phase by phase
 
 Each phase is a Claude Code skill (`.claude/skills/<name>/SKILL.md`). You can invoke any phase directly (`/brainstorm`, `/plan`, `/migrate`, `/validate`) without running the full pipeline. You can also rewire the pipeline by editing the `autopilot` skill.
@@ -96,6 +133,7 @@ Each phase is a Claude Code skill (`.claude/skills/<name>/SKILL.md`). You can in
 | **PR** | `commit-push-pr` | Opens the PR with auto-generated title, summary, and test plan | Claude |
 | **Review** | `review-2pass` / `council` | Multi-model review of the diff (critical pass + informational pass) | Multiple |
 | **Triage** | `bugbot` | Fetches automated reviewer findings, auto-fixes real bugs, dismisses false positives | Claude |
+| **Deploy** | `deploy` | Deploys via configured adapter (`vercel` \| `fly` \| `render` \| `generic`) with optional log streaming, health check, and bounded auto-rollback (see [Deploy phase](#deploy-phase)) | Deterministic |
 
 ### Migrate phase
 
@@ -116,6 +154,32 @@ migrate:
 
 See `skills/migrate/SKILL.md` for examples covering Alembic, Django, Prisma, Drizzle, golang-migrate, dbmate, flyway, and custom scripts.
 
+### Deploy phase
+
+Configure your deploy target in `guardrail.config.yaml` under a `deploy:` block. Four adapters ship in 5.6:
+
+- **`vercel`** — Vercel v13 deployments API. SSE+NDJSON log streaming, native rollback via `/promote`. Auth: `VERCEL_TOKEN`.
+- **`fly`** — Fly.io Machines API. WebSocket log streaming, native rollback with simulated fallback. Auth: `FLY_API_TOKEN`. Requires the image to be pre-pushed (`fly deploy --build-only --push`).
+- **`render`** — Render REST API. Polling-based log stream with `(timestamp, logId)` cursor dedup, simulated rollback (re-deploys prior commit). Auth: `RENDER_API_KEY`.
+- **`generic`** — runs any shell `deployCommand` (`vercel --prod`, `kubectl apply`, `make deploy`, etc). No platform integration; `--watch` and `rollback` aren't supported.
+
+Each adapter speaks the same `DeployAdapter` contract: `deploy()`, optional `status()` / `rollback()` / `streamLogs()`, plus a `capabilities` block (`streamMode: 'websocket' | 'polling' | 'none'`, `nativeRollback: boolean`) so the CLI can degrade UX honestly (polling adapters print a one-line stderr notice under `--watch`). Auto-rollback is bounded: max one rollback per deploy attempt, with `runHealthCheck` capped at 5×6s. Log lines emitted into PR comments run through a redaction pass (`AKIA…`, `sk-…`, `eyJ…`, `ghp_`, `xoxb-`, plus configurable patterns) so build output can't leak secrets.
+
+Example (Fly):
+
+```yaml
+deploy:
+  adapter: fly
+  app: my-app
+  image: registry.fly.io/my-app:latest
+  region: ord
+  watchBuildLogs: true
+  healthCheckUrl: https://my-app.fly.dev/health
+  rollbackOn: [healthCheckFailure]
+```
+
+`claude-autopilot doctor` checks for the relevant auth env var when an adapter is configured. See `docs/specs/v5.6-fly-render-adapters.md` for the full adapter contract.
+
 ## What's distinctive
 
 Features that are hard or impossible to find in the competitive set:

package/bin/_launcher.js

@@ -31,44 +31,52 @@ function findTsx() {
   return 'tsx';
 }
 
-// Tracks per-terminal-session whether the deprecation notice has been shown.
-// Uses a temp file keyed by parent PID + stderr's tty so parallel CI jobs don't
-// collide. Falls back to always-emit if the stamp can't be written.
-const DEPRECATION_STAMP_DIR = path.join(os.tmpdir(), 'claude-autopilot');
-function hasShownDeprecation() {
+// v7.1.7 — Per-calendar-day deprecation dedup, keyed in the user's home dir.
+//
+// The previous (v6.3+) implementation used a temp file keyed by `process.ppid
+// + stderr.isTTY` to dedup once per "terminal session." That worked in
+// interactive shells but FAILED for the most common deprecation trigger —
+// the pre-commit/pre-push git hooks. Git spawns a fresh shell for each hook
+// invocation, so the parent PID is fresh on every commit, the stamp file
+// path is unique each time, and the notice printed on every single commit.
+// The v7.1.6 blank-repo benchmark agent surfaced this as the #1 paper cut.
+//
+// New strategy: stamp at `~/.claude-autopilot/.deprecation-shown`, contents =
+// `YYYY-MM-DD` (UTC). Show at most once per day per machine. Operator gets a
+// daily reminder of the rename without per-commit spam. Override env vars
+// (`CLAUDE_AUTOPILOT_DEPRECATION=always|never`) preserved.
+const DEPRECATION_STAMP_PATH = path.join(os.homedir(), '.claude-autopilot', '.deprecation-shown');
+function todayUtc() {
+  return new Date().toISOString().slice(0, 10);
+}
+function hasShownDeprecationToday() {
   try {
-    if (!fs.existsSync(DEPRECATION_STAMP_DIR)) {
-      fs.mkdirSync(DEPRECATION_STAMP_DIR, { recursive: true });
-    }
-    const key = `${process.ppid}-${process.stderr.isTTY ? 'tty' : 'pipe'}.stamp`;
-    const stampPath = path.join(DEPRECATION_STAMP_DIR, key);
-    if (fs.existsSync(stampPath)) return true;
-    fs.writeFileSync(stampPath, String(Date.now()));
-    // Best-effort cleanup of stamps older than 1h to keep tmpdir tidy.
-    const cutoff = Date.now() - 60 * 60 * 1000;
-    for (const f of fs.readdirSync(DEPRECATION_STAMP_DIR)) {
-      const p = path.join(DEPRECATION_STAMP_DIR, f);
-      try {
-        if (fs.statSync(p).mtimeMs < cutoff) fs.unlinkSync(p);
-      } catch { /* ignore */ }
-    }
-    return false;
+    if (!fs.existsSync(DEPRECATION_STAMP_PATH)) return false;
+    return fs.readFileSync(DEPRECATION_STAMP_PATH, 'utf8').trim() === todayUtc();
   } catch {
+    // Stamp unreadable — show notice (better than silently swallowing).
     return false;
   }
 }
+function markDeprecationShown() {
+  try {
+    const dir = path.dirname(DEPRECATION_STAMP_PATH);
+    if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
+    fs.writeFileSync(DEPRECATION_STAMP_PATH, todayUtc());
+  } catch { /* best-effort; missing stamp re-prints next invocation */ }
+}
 
 /**
  * Decide whether to emit the deprecation notice. Order:
  *   CLAUDE_AUTOPILOT_DEPRECATION=never   → never emit (CI/automation)
  *   CLAUDE_AUTOPILOT_DEPRECATION=always  → always emit (deterministic testing)
- *   otherwise                            → once per terminal session (stamp-based)
+ *   otherwise                            → at most once per UTC day
  */
 function shouldEmitDeprecation() {
   const override = process.env.CLAUDE_AUTOPILOT_DEPRECATION;
   if (override === 'never') return false;
   if (override === 'always') return true;
-  return !hasShownDeprecation();
+  return !hasShownDeprecationToday();
 }
 
 /**
@@ -83,6 +91,13 @@ export function launch(opts) {
       'Migration guide: https://github.com/axledbetter/claude-autopilot/blob/master/docs/migration/v4-to-v5.md\n' +
       'Silence: set CLAUDE_AUTOPILOT_DEPRECATION=never\n',
     );
+    // v7.1.7 — mark stamp AFTER successful emission so a write-failure on
+    // stderr still results in the next invocation re-trying. Skip when
+    // CLAUDE_AUTOPILOT_DEPRECATION=always (deterministic-testing override
+    // shouldn't write the stamp).
+    if (process.env.CLAUDE_AUTOPILOT_DEPRECATION !== 'always') {
+      markDeprecationShown();
+    }
   }
 
   const entry = resolveEntry();

package/dist/src/adapters/council/openai.js

@@ -1,22 +1,28 @@
 import { GuardrailError } from "../../core/errors.js";
 import { classifyError } from "../review-engine/prompt-builder.js";
 import { loadOpenAI } from "../sdk-loader.js";
+import { getModelPricing } from "../pricing.js";
 const SYSTEM_PROMPT = `You are a technical advisor reviewing a software design decision. Evaluate the provided context and question critically. Be direct and specific. Surface tradeoffs, risks, and your recommendation.`;
 const MAX_OUTPUT_TOKENS = 2048;
 // Models that ONLY work via the Responses API (not chat.completions).
 // Codex variants and the o-series reasoning models all 404 on chat.completions.
-// Without this branch, putting `gpt-5.3-codex` (the typical default) in
+// Without this branch, putting `gpt-5.3-codex` (the prior default) in
 // council.models throws model_not_found, AND the synthesizer (also typically
-// gpt-5.3-codex) fails the same way — so the whole council returns `partial`
+// the same model) fails the same way — so the whole council returns `partial`
 // with no synthesis. That regression made the marketed multi-model differentiator
 // unusable for any user who only had OPENAI_API_KEY.
+// gpt-5.5 (the new default, 2026-04-23) drops the `-codex` suffix and works
+// via standard chat.completions, so it is intentionally NOT matched here.
 function isResponsesOnlyModel(model) {
     return /codex|^o[1-9]|^gpt-5\.3-/i.test(model);
 }
-// Per-million-token rates for gpt-5.3-codex (override via env for other models).
-// Mirrors the review-engine codex adapter's pricing.
-const COST_PER_M_INPUT = Number(process.env.CODEX_COST_INPUT_PER_M ?? 1.25);
-const COST_PER_M_OUTPUT = Number(process.env.CODEX_COST_OUTPUT_PER_M ?? 10.0);
+// Per-million-token rates. Bugbot LOW PR #93: wired to read from the
+// canonical MODEL_PRICING table (no longer dead code). Resolution order:
+// env override → MODEL_PRICING entry for the council's default
+// (gpt-5.5) → numeric fallback. Mirrors the review-engine codex adapter.
+const _pricing = getModelPricing(process.env.CODEX_MODEL ?? 'gpt-5.5');
+const COST_PER_M_INPUT = Number(process.env.CODEX_COST_INPUT_PER_M ?? _pricing?.inputPer1M ?? 5.0);
+const COST_PER_M_OUTPUT = Number(process.env.CODEX_COST_OUTPUT_PER_M ?? _pricing?.outputPer1M ?? 30.0);
 export function makeOpenAICouncilAdapter(model, label) {
     return {
         label,

package/dist/src/adapters/deploy/_http.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Options for {@link fetchWithRetry}. `provider` is mandatory — it's the
+ * value baked into the `GuardrailError` thrown when retries exhaust, so
+ * callers must always identify themselves. `attempts`, `baseMs`, and
+ * `sleepImpl` are tuning knobs with sensible defaults that match the
+ * pre-extraction behavior of all three adapters.
+ */
+export interface FetchWithRetryOptions {
+    /** Adapter name baked into the GuardrailError thrown on exhaustion. */
+    provider: string;
+    /** Max attempts (inclusive). Default: 3. */
+    attempts?: number;
+    /** Base backoff in ms — exponential per attempt. Default: 500. */
+    baseMs?: number;
+    /** Injected sleep — adapters pass `this.sleep` so tests stay instant. */
+    sleepImpl?: (ms: number) => Promise<void>;
+}
+/**
+ * Free-function port of the per-adapter `fetchWithRetry` helper. Behavior
+ * is intentionally identical to the previous private copies:
+ * - 5xx responses are retried with exponential backoff (`baseMs * 2 ** i`).
+ * - 4xx responses are returned as-is so the per-adapter `assertOkOrThrow`
+ *   can classify them precisely (auth vs not_found vs invalid_config).
+ * - Network errors are retried unless `AbortError`, which is rethrown so
+ *   intentional cancellation is never silently retried.
+ * - On exhaustion, throws `GuardrailError({ code: 'transient_network',
+ *   provider })` with the last error's message embedded.
+ *
+ * Adapters call this as `await fetchWithRetry(this.fetchImpl, url, init,
+ * { sleepImpl: this.sleep, provider: 'fly' })` — passing both the fetch
+ * implementation and the sleep impl explicitly keeps the adapter's
+ * `nowImpl`/`sleepImpl` injection points working for tests.
+ */
+export declare function fetchWithRetry(fetchImpl: typeof fetch, url: string, init: RequestInit, opts: FetchWithRetryOptions): Promise<Response>;
+/**
+ * Read at most 500 bytes of a `Response` body as text. Used by the
+ * per-adapter `assertOkOrThrow` helpers to embed the API's error body in
+ * the thrown `GuardrailError` for debugging without dumping multi-MB HTML
+ * pages. Returns `<no body>` if the body is unreadable (e.g. already
+ * consumed, network error mid-read).
+ */
+export declare function safeReadBody(res: Response): Promise<string>;
+//# sourceMappingURL=_http.d.ts.map

package/dist/src/adapters/deploy/_http.js

@@ -0,0 +1,99 @@
+// src/adapters/deploy/_http.ts
+//
+// Shared HTTP plumbing extracted in v5.6 Phase 5 — see
+// docs/specs/v5.6-fly-render-adapters.md § "Implementation phases".
+//
+// Three identical copies of `fetchWithRetry` and `safeReadBody` lived in
+// `vercel.ts`, `fly.ts`, and `render.ts` before this module existed. Phase 5
+// consolidates them as free functions so each adapter imports them as
+// HTTP plumbing without `this` context. The deliberate decision (per the
+// spec and PR #72 review) was to wait until a third copy materialized
+// before reaching for shared abstractions, so each adapter's seam was
+// settled.
+//
+// Out of scope on purpose:
+// - `assertOkOrThrow` style HTTP-status mappers stay per-adapter. Each one
+//   composes a different error message (auth-token doc URL, 422 hint copy)
+//   and reads a different request-id header (`Fly-Request-Id` vs
+//   `x-request-id`). Sharing those would force a configuration object that's
+//   bigger than the function it replaces.
+// - The Vercel `fetchEventsWithRetry` SSE helper is still adapter-private —
+//   it has different retry rules (404 race retried, 5xx retried with
+//   different shape) and returns the last response rather than throwing on
+//   exhaustion.
+import { GuardrailError } from "../../core/errors.js";
+const DEFAULT_SLEEP = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+/**
+ * Free-function port of the per-adapter `fetchWithRetry` helper. Behavior
+ * is intentionally identical to the previous private copies:
+ * - 5xx responses are retried with exponential backoff (`baseMs * 2 ** i`).
+ * - 4xx responses are returned as-is so the per-adapter `assertOkOrThrow`
+ *   can classify them precisely (auth vs not_found vs invalid_config).
+ * - Network errors are retried unless `AbortError`, which is rethrown so
+ *   intentional cancellation is never silently retried.
+ * - On exhaustion, throws `GuardrailError({ code: 'transient_network',
+ *   provider })` with the last error's message embedded.
+ *
+ * Adapters call this as `await fetchWithRetry(this.fetchImpl, url, init,
+ * { sleepImpl: this.sleep, provider: 'fly' })` — passing both the fetch
+ * implementation and the sleep impl explicitly keeps the adapter's
+ * `nowImpl`/`sleepImpl` injection points working for tests.
+ */
+export async function fetchWithRetry(fetchImpl, url, init, opts) {
+    const attempts = opts.attempts ?? 3;
+    const baseMs = opts.baseMs ?? 500;
+    const sleep = opts.sleepImpl ?? DEFAULT_SLEEP;
+    let lastErr;
+    for (let i = 0; i < attempts; i++) {
+        try {
+            const res = await fetchImpl(url, init);
+            // 5xx is transient — retry. 4xx is the caller's problem — fail fast
+            // so the per-adapter error mapper can classify it precisely.
+            if (res.status >= 500 && res.status < 600 && i < attempts - 1) {
+                lastErr = new Error(`HTTP ${res.status}`);
+                await sleep(baseMs * 2 ** i);
+                continue;
+            }
+            return res;
+        }
+        catch (err) {
+            lastErr = err;
+            // AbortError is intentional cancellation — surface it directly without
+            // retry. Wrapping or retrying would silently defeat caller-side
+            // cancellation.
+            if (err instanceof Error && err.name === 'AbortError')
+                throw err;
+            if (i < attempts - 1) {
+                await sleep(baseMs * 2 ** i);
+                continue;
+            }
+        }
+    }
+    throw new GuardrailError(`${capitalize(opts.provider)} API unreachable after ${attempts} attempts: ${lastErr?.message ?? String(lastErr)}`, { code: 'transient_network', provider: opts.provider });
+}
+/**
+ * Read at most 500 bytes of a `Response` body as text. Used by the
+ * per-adapter `assertOkOrThrow` helpers to embed the API's error body in
+ * the thrown `GuardrailError` for debugging without dumping multi-MB HTML
+ * pages. Returns `<no body>` if the body is unreadable (e.g. already
+ * consumed, network error mid-read).
+ */
+export async function safeReadBody(res) {
+    try {
+        return (await res.text()).slice(0, 500);
+    }
+    catch {
+        return '<no body>';
+    }
+}
+/**
+ * Title-case the first letter of an adapter name so the exhaustion error
+ * reads "Vercel API unreachable…" instead of "vercel API unreachable…",
+ * matching the wording of the pre-extraction copies.
+ */
+function capitalize(s) {
+    if (!s)
+        return s;
+    return s.charAt(0).toUpperCase() + s.slice(1);
+}
+//# sourceMappingURL=_http.js.map

package/dist/src/adapters/deploy/fly.d.ts

@@ -0,0 +1,206 @@
+import type { DeployAdapter, DeployAdapterCapabilities, DeployInput, DeployLogLine, DeployResult, DeployRollbackInput, DeployStatusInput, DeployStatusResult, DeployStreamLogsInput } from './types.ts';
+/**
+ * Fly release lifecycle states.
+ *
+ * The first three are terminal; the rest are interim.  Fly's actual status
+ * vocabulary has evolved across the Nomad → Machines transition; this set
+ * is the conservative intersection that maps cleanly onto our
+ * `pass | fail | in-progress` tri-state. New states observed in the wild
+ * are treated as `in-progress` until the polling budget runs out.
+ */
+type FlyReleaseState = 'succeeded' | 'failed' | 'cancelled' | 'pending' | 'running' | 'starting';
+interface FlyReleaseResponse {
+    id: string;
+    /** Public hostname (e.g. `my-app.fly.dev`) — Fly returns this on the release. */
+    hostname?: string;
+    /** Terminal/interim state. */
+    status?: FlyReleaseState;
+    /** Newer Fly responses use `state`; older use `status`. We accept either. */
+    state?: FlyReleaseState;
+    /**
+     * Image reference the release was built from (e.g.
+     * `registry.fly.io/my-app:deployment-01`). Surfaced on list-releases
+     * responses and used by the simulated-rollback path to re-deploy a
+     * known-good image when native `/rollback` is unavailable.
+     */
+    image?: string;
+}
+export interface FlyDeployAdapterOptions {
+    /** Personal access token. Falls back to `process.env.FLY_API_TOKEN`. */
+    token?: string;
+    /** Fly app slug. Required. */
+    app: string;
+    /**
+     * Image reference (e.g. `registry.fly.io/my-app:deployment-01`).
+     * Required — the adapter never builds; the user pushes via
+     * `fly deploy --build-only --push` or equivalent.
+     */
+    image: string;
+    /** Optional region pin. Falls back to the app's default region. */
+    region?: string;
+    /** Polling interval (ms) when waiting for the release to reach a terminal state. Default: 2000. */
+    pollIntervalMs?: number;
+    /** Maximum total time to poll before returning `in-progress`. Default: 15 minutes. */
+    maxPollMs?: number;
+    /** Injected fetch implementation — defaults to `globalThis.fetch`. Tests pass a mock. */
+    fetchImpl?: typeof fetch;
+    /** Injected sleep implementation — tests pass a no-op so they don't actually wait. */
+    sleepImpl?: (ms: number) => Promise<void>;
+    /** Wall-clock source — tests pass a controllable counter. */
+    nowImpl?: () => number;
+    /**
+     * Optional caller-supplied redaction patterns (in addition to the
+     * built-in default set in `core/logging/redaction.ts`). Typically wired
+     * from `config.persistence.redactionPatterns` by the CLI; tests omit it.
+     */
+    redactionPatterns?: readonly string[];
+    /**
+     * Injected WebSocket constructor for `streamLogs` — defaults to Node 22's
+     * built-in `globalThis.WebSocket`. Tests pass a stub that emulates the
+     * standard `addEventListener('message' | 'error' | 'close')` surface.
+     *
+     * Phase 3 of v5.6 — Fly streams build logs over WS with NDJSON-encoded
+     * messages. The adapter never imports a WS library; we rely on Node's
+     * built-in (Node 22+) for production and the injected stub for unit tests.
+     */
+    wsImpl?: typeof WebSocket;
+    /**
+     * Optional override for the Fly log-streaming WebSocket URL builder.
+     * Defaults to the spec's stated path (see comment on `streamLogs` for
+     * the divergence-from-spec note that Phase 7 will reconcile against
+     * captured fixtures). Tests use this to point at a local stub.
+     */
+    buildLogsWsUrl?: (app: string, releaseId: string) => string;
+}
+/**
+ * Fly.io deploy adapter.
+ *
+ * Construct once per pipeline run. The adapter is stateless across calls —
+ * all configuration (token, app, image, region) is captured at construction
+ * time. Per the v5.6 spec, only `deploy()` and `status()` are wired in
+ * Phase 1; `streamLogs` (WebSocket) and `rollback` (native + simulated)
+ * land in Phases 3 and 4 respectively.
+ */
+export declare class FlyDeployAdapter implements DeployAdapter {
+    readonly name = "fly";
+    readonly capabilities: DeployAdapterCapabilities;
+    private readonly token;
+    private readonly app;
+    private readonly image;
+    private readonly region;
+    private readonly pollIntervalMs;
+    private readonly maxPollMs;
+    private readonly fetchImpl;
+    private readonly sleep;
+    private readonly now;
+    private readonly redactionPatterns;
+    private readonly wsImpl;
+    private readonly buildLogsWsUrlFn;
+    constructor(opts: FlyDeployAdapterOptions);
+    deploy(input: DeployInput): Promise<DeployResult>;
+    status(input: DeployStatusInput): Promise<DeployStatusResult>;
+    /**
+     * Phase 3 of v5.6 — subscribe to real-time build logs for a release via
+     * Fly's WebSocket log endpoint.
+     *
+     * Wire shape:
+     * - Connect to `wss://api.machines.dev/v1/apps/{app}/machines/{releaseId}/logs`
+     *   (intent-level URL per the v5.6 spec's "Logs" bullet — exact path will
+     *   be reconciled against captured fixtures in Phase 7; the `wsImpl` and
+     *   `buildLogsWsUrl` injection points keep this overridable until then).
+     * - Each WS message is a single NDJSON line containing one log entry.
+     *   Multiple lines per message are also tolerated (split on `\n`). Malformed
+     *   JSON lines are skipped silently rather than crashing the iterator.
+     * - Auth via `Authorization: Bearer <FLY_API_TOKEN>` is passed through the
+     *   `protocols` argument (Node's built-in WebSocket doesn't accept custom
+     *   `headers` directly the way `ws` does); Fly accepts the token as the
+     *   first protocol value. This is the documented pattern for browsers and
+     *   matches Node 22's WS surface.
+     * - One reconnect with exponential backoff (1s, 2s) on disconnect, then
+     *   yield a final `level: 'warn'` line referencing `buildLogsUrl` and
+     *   finish the iterator.
+     * - `signal.aborted` is honored at every await boundary; the underlying
+     *   socket is closed eagerly.
+     * - Every yielded line's `text` is run through `redactLogLines()` before
+     *   leaving the adapter.
+     */
+    streamLogs(input: DeployStreamLogsInput): AsyncGenerator<DeployLogLine>;
+    /**
+     * Phase 4 of v5.6 — roll back to a previous Fly release.
+     *
+     * Two modes per spec § "Fly.io adapter → Rollback":
+     *
+     * 1. Native: try `POST /v1/apps/{app}/releases/{releaseId}/rollback`.
+     *    This is the historical Fly API; the Machines-era replacement may
+     *    differ — Phase 7 fixture-capture reconciles. If the endpoint returns
+     *    404 / 405 / 410 (removed across the Nomad → Machines transition),
+     *    fall through to the simulated path. Any other non-OK status
+     *    (auth, invalid_config, etc.) propagates via `assertOkOrThrow`.
+     *
+     * 2. Simulated: list prior releases via
+     *    `GET /v1/apps/{app}/releases?limit=10`, find the most recent one
+     *    with `status === 'succeeded'` whose `id` differs from the one we'd
+     *    be rolling back from, and trigger a new deploy with that release's
+     *    `image`. Re-uses the same POST + poll machinery as `deploy()` via
+     *    `deployImage()`.
+     *
+     * When `input.to` is set we treat that as a specific release ID:
+     * - Native path uses it as the URL fragment.
+     * - Simulated path looks it up in the list to grab its `image`. If the
+     *   release is not present in the recent-10 window, throw
+     *   `not_found` — caller almost certainly typo'd the ID.
+     *
+     * Throws `GuardrailError({ code: 'no_previous_deploy', provider: 'fly' })`
+     * when the simulated path runs out of candidates (i.e. no prior release
+     * with `status === 'succeeded'` exists).
+     */
+    rollback(input: DeployRollbackInput): Promise<DeployResult>;
+    /**
+     * Private helper — re-uses the deploy() POST + poll machinery to deploy a
+     * specific image without going through the constructor-stamped image. Used
+     * by `rollback()`'s simulated path to redeploy a previous successful image.
+     */
+    private deployImage;
+    /**
+     * List the most recent releases for the configured app. Newest-first.
+     * `limit` caps the result set — defaults to 10 (the spec's recommended
+     * window for the rollback lookup). 4xx/5xx errors propagate via
+     * `assertOkOrThrow`.
+     */
+    listReleases(limit?: number, signal?: AbortSignal): Promise<FlyReleaseResponse[]>;
+    /**
+     * Find the most recent prior release with `status === 'succeeded'`. When
+     * `excludeId` is supplied, that release is skipped (used to ensure
+     * `rollback()` never returns "rolled back to the deploy I'm rolling back
+     * from" when the caller didn't supply `input.to`).
+     *
+     * Returns `null` when no candidate exists.
+     */
+    private findPreviousSucceededRelease;
+    /**
+     * Apply the adapter's redaction patterns to a log line's `text` field.
+     * Pure helper — keeps the streamLogs loop readable.
+     */
+    private redactLine;
+    private pollUntilTerminal;
+    private shapeResult;
+    private headers;
+    private buildLogsUrl;
+    /**
+     * HTTP-status-keyed error mapper. Per v5.6 spec:
+     *
+     * | Status | ErrorCode |
+     * |---|---|
+     * | 401 / 403 | `auth` |
+     * | 404 | `not_found` |
+     * | 422 / 400 | `invalid_config` |
+     * | 5xx | `transient_network` (retryable) |
+     * | other 4xx | `adapter_bug` |
+     *
+     * The `Fly-Request-Id` response header is captured into `details` whenever
+     * present so support tickets can quote it back to Fly.
+     */
+    private assertOkOrThrow;
+}
+export {};
+//# sourceMappingURL=fly.d.ts.map