@impeccable/reviews 0.1.0 → 0.1.1

package/dist/vercel.js

@@ -68,3 +68,80 @@ export async function waitForVercelAccess(vercel, deps) {
     }
     return result;
 }
+/**
+ * `vercel api` on the project this folder is linked to: GET /v9/projects/{id} reads it, and PATCH changes a setting
+ * through the update-project endpoint (https://vercel.com/docs/rest-api/projects/update-an-existing-project); a team's
+ * project needs its team on the request.
+ */
+const projectApi = (link, change) => [
+    'api',
+    `/v9/projects/${encodeURIComponent(link.projectId)}${link.orgId.startsWith('team_') ? `?teamId=${encodeURIComponent(link.orgId)}` : ''}`,
+    ...(change ? ['--method', 'PATCH', ...change] : []),
+    '--raw', '--non-interactive',
+];
+export const readProjectApi = (link) => projectApi(link);
+/**
+ * Vercel Authentication on All Deployments: Vercel's login in front of every address of the project, its production
+ * domains included (https://vercel.com/docs/deployment-protection#all-deployments), as the endpoint takes it
+ * (https://vercel.com/docs/deployment-protection/methods-to-protect-deployments/vercel-authentication#how-to-manage-vercel-authentication-with-the-api).
+ */
+export const lockProjectApi = (link) => projectApi(link, ['--field', 'ssoProtection={"deploymentType":"all"}']);
+const record = (value) => (value !== null && typeof value === 'object' && !Array.isArray(value) ? value : undefined);
+const printedProject = async (vercel, args) => {
+    const printed = await vercel(args);
+    return record(JSON.parse(printed.slice(printed.indexOf('{'), printed.lastIndexOf('}') + 1)));
+};
+const scope = (project) => record(project?.ssoProtection)?.deploymentType;
+/** The linked project as `vercel api` prints it: its production deployment (the production target, or one among the latest) unless every one failed or was cancelled, its Git link's production branch, its protection and its deployments' hosts. Null when the CLI could not read it. */
+export async function readVercelProject(vercel, link) {
+    let project;
+    try {
+        project = await printedProject(vercel, readProjectApi(link));
+    }
+    catch {
+        return null;
+    }
+    if (project?.id !== link.projectId)
+        return null;
+    const target = record(record(project.targets)?.production);
+    const latest = (Array.isArray(project.latestDeployments) ? project.latestDeployments : []).map(record).filter((d) => d !== undefined);
+    const failed = (d) => d.readyState === 'ERROR' || d.readyState === 'CANCELED';
+    const exists = (target !== undefined && !failed(target)) || latest.some((d) => d.target === 'production' && !failed(d));
+    const branch = record(project.link)?.productionBranch;
+    const protection = scope(project);
+    const hosts = [target, ...latest].flatMap((d) => (typeof d?.url === 'string' && d.url ? [d.url.replace(/^https?:\/\//, '').toLowerCase()] : []));
+    return { production: exists ? 'exists' : 'none', ...(typeof branch === 'string' && branch ? { productionBranch: branch } : {}), protection: typeof protection === 'string' ? protection : null, deploymentHosts: new Set(hosts) };
+}
+/**
+ * The linked project before its first push: read through `vercel api`, and, with no production deployment, locked
+ * behind Vercel's login at every address, since Vercel makes a new project's first deployment Production whatever
+ * branch it builds and Standard Protection serves production domains to anyone. A project that deploys production
+ * already (live or building), or is locked already, is left as it is.
+ */
+export async function prepareFirstDeployment(vercel, link) {
+    const project = await readVercelProject(vercel, link);
+    if (!project)
+        return { production: 'unknown', locked: false, reason: 'The Vercel CLI could not read the project (vercel api): it is signed out, or this CLI has no api command.' };
+    const branch = project.productionBranch ? { productionBranch: project.productionBranch } : {};
+    if (project.production === 'exists')
+        return { production: 'exists', ...branch };
+    if (project.protection === 'all')
+        return { production: 'none', locked: true, ...branch };
+    try {
+        if (scope(await printedProject(vercel, lockProjectApi(link))) === 'all')
+            return { production: 'none', locked: true, ...branch };
+    }
+    catch {
+        // What the answer below says.
+    }
+    return { production: 'none', locked: false, ...branch, reason: "Vercel did not put its login in front of the project's addresses: that takes the Member role or Project Administrator." };
+}
+/**
+ * The hosts of the linked project's deployments while Vercel's login stands in front of every address of it, read
+ * now: a Production deployment GitHub lists for a pushed branch is its preview only when it is one of these. Empty
+ * when the project is not locked at every address, or could not be read.
+ */
+export async function lockedDeploymentHosts(vercel, link) {
+    const project = await readVercelProject(vercel, link);
+    return project?.protection === 'all' ? project.deploymentHosts : new Set();
+}

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "@impeccable/reviews",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "Set up a repository for Impeccable for PRs from your terminal.",
-  "license": "UNLICENSED",
+  "license": "SEE LICENSE IN LICENSE",
   "private": false,
   "type": "module",
   "bin": {

package/dist/playbook/github-previews.js

@@ -1,101 +0,0 @@
-import { execFile } from 'node:child_process';
-import { promisify } from 'node:util';
-const execFileAsync = promisify(execFile);
-const LIMIT = 20;
-const COVERAGE = 'Only the 20 newest GitHub deployments, their latest statuses, and the 20 most recently updated pull requests are checked. A missing match does not prove previews are absent. Empty GitHub deployment history does not prove that a live app or host previews do not exist. A deployment URL does not prove the application rendered.';
-const FAILURE = 'GitHub preview evidence could not be read completely.';
-const STATES = ['error', 'failure', 'inactive', 'in_progress', 'queued', 'pending', 'success'];
-function record(value) {
-    return value !== null && typeof value === 'object' && !Array.isArray(value)
-        ? value
-        : undefined;
-}
-function positiveInteger(value) {
-    return typeof value === 'number' && Number.isSafeInteger(value) && value > 0;
-}
-function sha(value) {
-    return typeof value === 'string' && /^[a-f0-9]{40}$/.test(value);
-}
-function previewUrl(value) {
-    if (typeof value !== 'string' || value.length > 2048 || !/^https:\/\/[^\s\\?#]+$/i.test(value))
-        return null;
-    try {
-        const url = new URL(value);
-        if (url.username || url.password || url.search || url.hash || /^https:\/\/[^/]*@/i.test(value))
-            return null;
-        return url.href;
-    }
-    catch {
-        return null;
-    }
-}
-/** Read a bounded projection of GitHub evidence; never return response bodies or command errors. */
-export async function readHostedPreviews(owner, repo, dependencies = {}) {
-    if (!/^[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,37}[a-zA-Z0-9])?$/.test(owner)
-        || !/^[a-zA-Z0-9_.-]{1,100}$/.test(repo) || repo === '.' || repo === '..') {
-        return { coverage: COVERAGE, deployments: [], error: FAILURE };
-    }
-    const runGh = dependencies.runGh ?? (async (args) => {
-        const { stdout } = await execFileAsync('gh', args, {
-            encoding: 'utf8', timeout: 30_000, maxBuffer: 2 * 1024 * 1024, signal: dependencies.signal,
-        });
-        return stdout;
-    });
-    const base = `/repos/${owner}/${repo}`;
-    async function get(route) {
-        if (dependencies.signal?.aborted)
-            throw new Error(FAILURE);
-        const stdout = await runGh(['api', '--hostname', 'github.com', '--method', 'GET', route]);
-        if (dependencies.signal?.aborted)
-            throw new Error(FAILURE);
-        const data = JSON.parse(stdout);
-        if (!Array.isArray(data))
-            throw new Error(FAILURE);
-        return data.slice(0, LIMIT);
-    }
-    try {
-        const [deployments, pulls] = await Promise.all([
-            get(`${base}/deployments?per_page=${LIMIT}`),
-            get(`${base}/pulls?state=all&sort=updated&direction=desc&per_page=${LIMIT}`),
-        ]);
-        let incomplete = false;
-        const evidence = [];
-        for (const entry of deployments) {
-            if (dependencies.signal?.aborted) {
-                incomplete = true;
-                break;
-            }
-            const deployment = record(entry);
-            if (!deployment || !positiveInteger(deployment.id) || !sha(deployment.sha))
-                continue;
-            let latest;
-            try {
-                latest = record((await get(`${base}/deployments/${deployment.id}/statuses?per_page=1`))[0]);
-            }
-            catch {
-                incomplete = true;
-                if (dependencies.signal?.aborted)
-                    break;
-            }
-            const status = STATES.find((state) => state === latest?.state) ?? null;
-            const environment = typeof deployment.environment === 'string' && deployment.environment.length <= 100
-                && !/[\u0000-\u001f\u007f]/.test(deployment.environment) ? deployment.environment : null;
-            const pullRequests = [];
-            for (const item of pulls) {
-                const pull = record(item);
-                if (pull && positiveInteger(pull.number) && (pull.state === 'open' || pull.state === 'closed')
-                    && record(pull.head)?.sha === deployment.sha) {
-                    pullRequests.push({ number: pull.number, state: pull.state });
-                }
-            }
-            evidence.push({ id: deployment.id, sha: deployment.sha, environment, status,
-                previewUrl: status ? previewUrl(latest?.environment_url) : null, pullRequests });
-        }
-        incomplete ||= dependencies.signal?.aborted ?? false;
-        return { coverage: COVERAGE, deployments: evidence,
-            ...(incomplete ? { error: FAILURE } : { emptyDeploymentHistory: deployments.length === 0 }) };
-    }
-    catch {
-        return { coverage: COVERAGE, deployments: [], error: FAILURE };
-    }
-}

package/dist/playbook/netlify-pattern.js

@@ -1,24 +0,0 @@
-/** Keep Netlify's repository-wide pattern tied to successful discovery evidence. */
-export function netlifyPatternError(body, observed) {
-    const pattern = body.previewUrlPattern;
-    if (typeof pattern !== 'string')
-        return null;
-    let netlify = /netlify\.app|<site>/i.test(pattern);
-    try {
-        const hostname = new URL(pattern.replaceAll('{pr}', '1')).hostname;
-        netlify ||= hostname === 'netlify.app' || hostname.endsWith('.netlify.app');
-    }
-    catch { /* The canonical validation below rejects malformed Netlify patterns. */ }
-    if (!netlify)
-        return null;
-    const match = /^https:\/\/deploy-preview-\{pr\}--([a-z0-9](?:[a-z0-9-]*[a-z0-9])?)\.netlify\.app$/.exec(pattern);
-    if (!match || match[1].length > 63)
-        return 'Use a real Netlify site pattern from successful preview evidence; placeholders and malformed patterns are not saved.';
-    if (Object.hasOwn(body, 'appKey'))
-        return 'A Netlify preview URL pattern belongs to the repository; omit appKey.';
-    if (body.intendedMethod !== 'preview-deploy')
-        return 'Save a Netlify pattern with intendedMethod preview-deploy.';
-    if (!observed.has(pattern))
-        return 'Read this repository\'s Netlify previews first and choose a pattern backed by a successful current-head status.';
-    return null;
-}

package/dist/playbook/netlify-previews.js

@@ -1,144 +0,0 @@
-import { execFile } from 'node:child_process';
-import { promisify } from 'node:util';
-const execFileAsync = promisify(execFile);
-const FAILURE = 'Netlify preview evidence could not be read completely.';
-const COVERAGE = 'Only the 20 most recently updated pull requests, the newest 100 statuses on each exact head SHA, and the 100 most recently updated repository issue comments are checked. Context-derived URLs do not prove the application rendered. Bot comments are historical candidates, not current-head deployment proof. Missing evidence does not prove previews are absent.';
-const SITE = '[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?';
-const CONTEXT = new RegExp(`^netlify/(${SITE})/deploy-preview$`);
-const PREVIEW_HOST = new RegExp(`^deploy-preview-([1-9][0-9]*)--(${SITE})\\.netlify\\.app$`);
-const STATES = ['success', 'pending', 'failure', 'error'];
-function record(value) {
-    return value !== null && typeof value === 'object' && !Array.isArray(value)
-        ? value : undefined;
-}
-function cleanUrl(value) {
-    if (typeof value !== 'string' || value.length > 2048 || !/^https:\/\/[^\s\\?#@]+$/i.test(value))
-        return;
-    try {
-        const url = new URL(value);
-        if (!url.username && !url.password && !url.port && !url.search && !url.hash)
-            return url;
-    }
-    catch { /* Discard unsafe evidence without returning it. */ }
-}
-function urls(pull, site) {
-    if (`deploy-preview-${pull.number}--${site}`.length > 63)
-        return;
-    return {
-        previewUrl: `https://deploy-preview-${pull.number}--${site}.netlify.app/`,
-        previewUrlPattern: `https://deploy-preview-{pr}--${site}.netlify.app`,
-    };
-}
-function validTarget(value, pull, site) {
-    if (value === null || value === undefined || value === '')
-        return true;
-    const target = cleanUrl(value);
-    if (!target)
-        return false;
-    if (target.hostname === `deploy-preview-${pull.number}--${site}.netlify.app` && target.pathname === '/')
-        return true;
-    return target.hostname === 'app.netlify.com'
-        && new RegExp(`^/(?:sites|projects)/${site}/deploys(?:/[a-zA-Z0-9_-]+)?/?$`).test(target.pathname);
-}
-/** Read a bounded, repository-scoped projection; never expose comments, command errors or credentials. */
-export async function readNetlifyPreviews(owner, repo, dependencies = {}) {
-    const previews = [];
-    if (!/^[a-zA-Z0-9](?:[a-zA-Z0-9-]{0,37}[a-zA-Z0-9])?$/.test(owner)
-        || !/^[a-zA-Z0-9_.-]{1,100}$/.test(repo) || repo === '.' || repo === '..') {
-        return { coverage: COVERAGE, previews, error: FAILURE };
-    }
-    const runGh = dependencies.runGh ?? (async (args) => {
-        const { stdout } = await execFileAsync('gh', args, {
-            encoding: 'utf8', timeout: 30_000, maxBuffer: 2 * 1024 * 1024, signal: dependencies.signal,
-        });
-        return stdout;
-    });
-    const base = `/repos/${owner}/${repo}`;
-    async function get(route, limit) {
-        if (dependencies.signal?.aborted)
-            throw new Error();
-        const raw = await runGh(['api', '--hostname', 'github.com', '--method', 'GET', route]);
-        if (dependencies.signal?.aborted)
-            throw new Error();
-        const data = JSON.parse(raw);
-        if (!Array.isArray(data))
-            throw new Error();
-        return data.slice(0, limit);
-    }
-    const [pullRead, commentRead] = await Promise.allSettled([
-        get(`${base}/pulls?state=all&sort=updated&direction=desc&per_page=20`, 20),
-        get(`${base}/issues/comments?sort=updated&direction=desc&per_page=100`, 100),
-    ]);
-    if (pullRead.status === 'rejected')
-        return { coverage: COVERAGE, previews, error: FAILURE };
-    let incomplete = false;
-    const warnings = commentRead.status === 'rejected'
-        ? ['Historical Netlify bot comments could not be read. Current-head status evidence is still checked.'] : [];
-    const pulls = new Map();
-    for (const item of pullRead.value) {
-        const pull = record(item);
-        const headSha = record(pull?.head)?.sha;
-        if (!pull || typeof pull.number !== 'number' || !Number.isSafeInteger(pull.number) || pull.number <= 0
-            || (pull.state !== 'open' && pull.state !== 'closed') || typeof headSha !== 'string' || !/^[a-f0-9]{40}$/.test(headSha))
-            continue;
-        const issueUrl = `https://api.github.com${base}/issues/${pull.number}`;
-        if (!pulls.has(issueUrl))
-            pulls.set(issueUrl, { number: pull.number, state: pull.state, headSha });
-    }
-    const seen = new Set();
-    const statusesBySha = new Map();
-    for (const pull of pulls.values()) {
-        if (dependencies.signal?.aborted) {
-            incomplete = true;
-            break;
-        }
-        try {
-            if (!statusesBySha.has(pull.headSha)) {
-                statusesBySha.set(pull.headSha, get(`${base}/commits/${pull.headSha}/statuses?per_page=100`, 100));
-            }
-            for (const item of await statusesBySha.get(pull.headSha)) {
-                const status = record(item);
-                const site = typeof status?.context === 'string' ? CONTEXT.exec(status.context)?.[1] : undefined;
-                if (!site || seen.has(`${pull.number}:${site}`))
-                    continue;
-                // GitHub returns newest first: even an invalid latest entry must hide older success.
-                seen.add(`${pull.number}:${site}`);
-                const state = STATES.find((state) => state === status?.state);
-                const canonical = urls(pull, site);
-                if (!state || !canonical || !validTarget(status?.target_url, pull, site))
-                    continue;
-                previews.push({ pullRequest: pull.number, state: pull.state, headSha: pull.headSha, site,
-                    status: state, ...canonical, source: 'commit-status', matchesHead: true });
-            }
-        }
-        catch {
-            incomplete = true;
-        }
-    }
-    if (!dependencies.signal?.aborted && commentRead.status === 'fulfilled') {
-        for (const item of commentRead.value) {
-            const comment = record(item);
-            const author = record(comment?.user);
-            const pull = typeof comment?.issue_url === 'string' ? pulls.get(comment.issue_url) : undefined;
-            if (!pull || author?.login !== 'netlify[bot]' || author.type !== 'Bot'
-                || typeof comment?.body !== 'string' || comment.body.length > 65_536)
-                continue;
-            for (const match of comment.body.matchAll(/https:\/\/[^\s<>"'()[\]`]+/gi)) {
-                const url = cleanUrl(match[0].replace(/[.,;:]+$/, ''));
-                const parts = url ? PREVIEW_HOST.exec(url.hostname) : null;
-                if (!url || url.pathname !== '/' || !parts || parts[1] !== String(pull.number))
-                    continue;
-                const site = parts[2];
-                const canonical = urls(pull, site);
-                if (!canonical || seen.has(`${pull.number}:${site}`))
-                    continue;
-                seen.add(`${pull.number}:${site}`);
-                previews.push({ pullRequest: pull.number, state: pull.state, headSha: pull.headSha, site,
-                    status: null, ...canonical, source: 'bot-comment', matchesHead: false });
-            }
-        }
-    }
-    if (dependencies.signal?.aborted)
-        incomplete = true;
-    return { coverage: COVERAGE, previews, ...(warnings.length ? { warnings } : {}), ...(incomplete ? { error: FAILURE } : {}) };
-}

package/dist/playbook/probe-preview.js

@@ -1,67 +0,0 @@
-function redirectGate(location, source) {
-    if (!location)
-        return 'redirected';
-    try {
-        const target = new URL(location, source);
-        if (target.protocol !== 'https:')
-            return 'redirected';
-        if (target.origin === 'https://vercel.com' && target.pathname === '/sso-api'
-            && target.searchParams.has('url'))
-            return 'vercel-protection';
-        if ((target.hostname === 'vercel.com' || target.hostname.endsWith('.vercel.com'))
-            && /^\/login(?:\/|$)/.test(target.pathname))
-            return 'vercel-protection';
-        if (target.hostname.endsWith('.cloudflareaccess.com'))
-            return 'cloudflare-access';
-        if (target.origin === source.origin && /^\/(?:login|sign-in|signin)(?:\/|$)/.test(target.pathname)) {
-            return 'app-sign-in';
-        }
-    }
-    catch {
-        // A malformed redirect reveals nothing about preview protection.
-    }
-    return 'redirected';
-}
-/** An unauthenticated HTTP check only: reachable does not prove this is the intended app. */
-export async function probePreview(url, dependencies = {}) {
-    let target;
-    try {
-        target = new URL(url);
-        if (!isPlatformPreview(target)
-            || /[?#\\\s]/.test(url) || !/^https:\/\//i.test(url))
-            throw new Error();
-    }
-    catch {
-        return { status: null, gate: 'unavailable', error: 'invalid-preview-url' };
-    }
-    const controller = new AbortController();
-    const timeout = setTimeout(() => controller.abort(), 15_000);
-    const signal = dependencies.signal
-        ? AbortSignal.any([controller.signal, dependencies.signal])
-        : controller.signal;
-    try {
-        signal.throwIfAborted();
-        const response = dependencies.fetch ? await dependencies.fetch(target, {
-            method: 'GET',
-            headers: { accept: 'text/html' },
-            credentials: 'omit',
-            redirect: 'manual',
-            signal,
-        }) : await publicPreviewRequest(target, signal);
-        const status = response.status;
-        const gate = status === 401 && response.headers.get('x-vercel-error') === 'UNAUTHORIZED'
-            ? 'vercel-protection' : status >= 300 && status < 400
-            ? redirectGate(response.headers.get('location'), target)
-            : status >= 200 && status < 300 ? 'reachable' : 'unavailable';
-        // Bodies and redirect details may contain credentials; never read or return them.
-        await response.body?.cancel().catch(() => undefined);
-        return { status, gate };
-    }
-    catch {
-        return { status: null, gate: 'unavailable', error: 'request-failed' };
-    }
-    finally {
-        clearTimeout(timeout);
-    }
-}
-import { isPlatformPreview, publicPreviewRequest } from './public-preview-request.js';

package/dist/playbook/protection-secrets.js

@@ -1,15 +0,0 @@
-/** Register credential-shaped write fields before a message can be recorded.
- * Do not trust the requested path: even a refused or malformed destination must
- * keep its supplied credentials private. Values remain unchanged in memory.
- */
-export function protectionWriteSecrets(input) {
-    if (!input || typeof input !== 'object' || Array.isArray(input))
-        return [];
-    const body = input.body;
-    if (!body || typeof body !== 'object' || Array.isArray(body))
-        return [];
-    return ['value', 'clientId', 'clientSecret']
-        .map((key) => body[key])
-        .filter((value) => typeof value === 'string' && value.length > 0)
-        .sort((a, b) => b.length - a.length);
-}

package/dist/playbook/public-preview-request.js

@@ -1,96 +0,0 @@
-import { lookup } from 'node:dns/promises';
-import { request } from 'node:https';
-import { BlockList, isIP } from 'node:net';
-const blockedV4 = new BlockList();
-for (const [address, prefix] of [
-    ['0.0.0.0', 8], ['10.0.0.0', 8], ['100.64.0.0', 10], ['127.0.0.0', 8],
-    ['169.254.0.0', 16], ['172.16.0.0', 12], ['192.0.0.0', 24], ['192.0.2.0', 24],
-    ['192.88.99.0', 24], ['192.168.0.0', 16], ['198.18.0.0', 15], ['198.51.100.0', 24],
-    ['203.0.113.0', 24], ['224.0.0.0', 4], ['240.0.0.0', 4],
-])
-    blockedV4.addSubnet(address, prefix, 'ipv4');
-const publicV6 = new BlockList();
-publicV6.addSubnet('2000::', 3, 'ipv6');
-const blockedV6 = new BlockList();
-// Conservatively exclude special-purpose, transition and documentation prefixes.
-for (const [address, prefix] of [
-    ['2001::', 23], ['2001:db8::', 32], ['2002::', 16], ['3fff::', 20],
-])
-    blockedV6.addSubnet(address, prefix, 'ipv6');
-export function isPlatformPreview(target) {
-    return target.protocol === 'https:' && !target.username && !target.password && !target.port
-        && !/[?#]/.test(target.href)
-        && /^(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+(?:vercel|netlify)\.app$/.test(target.hostname);
-}
-function isPublicAddress(value) {
-    if (!value || typeof value.address !== 'string' || value.address.includes('%'))
-        return false;
-    const family = isIP(value.address);
-    if (family !== value.family)
-        return false;
-    if (family === 4)
-        return !blockedV4.check(value.address, 'ipv4');
-    return family === 6 && publicV6.check(value.address, 'ipv6') && !blockedV6.check(value.address, 'ipv6');
-}
-/** Resolve once, validate every answer, then connect only to the pinned public addresses. */
-export async function publicPreviewRequest(target, signal, dependencies = {}) {
-    try {
-        if (!isPlatformPreview(target))
-            throw new Error();
-        signal.throwIfAborted();
-        let abortDns = () => { };
-        const aborted = new Promise((_resolve, reject) => {
-            abortDns = () => reject(new Error());
-            signal.addEventListener('abort', abortDns, { once: true });
-        });
-        const addresses = await Promise.race([
-            (dependencies.lookup ?? lookup)(target.hostname, { all: true, verbatim: true }), aborted,
-        ]).finally(() => signal.removeEventListener('abort', abortDns));
-        signal.throwIfAborted();
-        if (!Array.isArray(addresses) || !addresses.length || !addresses.every(isPublicAddress))
-            throw new Error();
-        const pinned = addresses.map(({ address, family }) => ({ address, family }));
-        return await new Promise((resolve, reject) => {
-            const options = {
-                method: 'GET', headers: { accept: 'text/html' }, signal,
-                agent: false, autoSelectFamily: true, rejectUnauthorized: true,
-                lookup(hostname, options, callback) {
-                    if (hostname !== target.hostname)
-                        return callback(new Error('Preview request failed'), '');
-                    if (options.all)
-                        callback(null, pinned.map((address) => ({ ...address })));
-                    else
-                        callback(null, pinned[0].address, pinned[0].family);
-                },
-            };
-            const req = (dependencies.request ?? request)(target, options, (response) => {
-                response.once('error', () => { });
-                try {
-                    const status = response.statusCode;
-                    const headers = new Headers();
-                    for (const name of ['location', 'x-vercel-error']) {
-                        const value = response.headers[name];
-                        if (typeof value === 'string')
-                            headers.set(name, value);
-                    }
-                    if (!status)
-                        reject(new Error());
-                    else
-                        resolve({ status, headers, body: null });
-                }
-                catch {
-                    reject(new Error());
-                }
-                finally {
-                    response.destroy();
-                }
-            });
-            req.once('error', () => reject(new Error()));
-            req.once('upgrade', (_response, socket) => { socket.destroy(); reject(new Error()); });
-            req.end();
-        });
-    }
-    catch {
-        throw new Error('Preview request failed');
-    }
-}

package/dist/playbook/publication-wait.js

@@ -1,46 +0,0 @@
-import { setTimeout as sleep } from 'node:timers/promises';
-const INTERVAL_MS = 30_000;
-const DEADLINE_MS = 8 * 60_000;
-/** One publication deadline per setup PR, including time spent checking the preview. */
-export function createPublicationWait(dependencies = {}) {
-    const now = dependencies.now ?? (() => performance.now());
-    const pause = dependencies.sleep ?? ((ms, signal) => sleep(ms, undefined, { signal }));
-    const starts = new Map();
-    return {
-        begin(pr) {
-            if (!starts.has(pr))
-                starts.set(pr, now());
-        },
-        remainingMs(pr) {
-            const start = starts.get(pr);
-            return start === undefined ? null : Math.max(0, DEADLINE_MS - (now() - start));
-        },
-        async wait(pr, signal) {
-            const start = starts.get(pr);
-            if (start === undefined)
-                return null;
-            const result = (status) => {
-                const elapsed = Math.max(0, now() - start);
-                return {
-                    status,
-                    waited_seconds: Math.floor(elapsed / 1000),
-                    remaining_seconds: Math.ceil(Math.max(0, DEADLINE_MS - elapsed) / 1000),
-                };
-            };
-            if (signal?.aborted)
-                return result('cancelled');
-            const remaining = DEADLINE_MS - (now() - start);
-            if (remaining <= 0)
-                return result('timed-out');
-            try {
-                await pause(Math.min(INTERVAL_MS, remaining), signal);
-            }
-            catch {
-                return result('cancelled');
-            }
-            if (signal?.aborted)
-                return result('cancelled');
-            return result(now() - start >= DEADLINE_MS ? 'timed-out' : 'retry');
-        },
-    };
-}