@kungfu-tech/buildchain 4.0.1-alpha.2 → 4.0.1-alpha.21

package/scripts/dev-delivery-process-boundary.mjs

@@ -0,0 +1,260 @@
+#!/usr/bin/env node
+import fs from "node:fs";
+import path from "node:path";
+
+import {
+  createNativeExecutionTransfer,
+  createNativeExecutionSealBinding,
+  createProviderFinalizerBoundary,
+  stageNativeExecutionTransfer,
+  verifyNativeExecutionTransfer,
+  verifyProviderFailureSettlementBinding,
+} from "../packages/core/dev-delivery-process-boundary.js";
+
+function flag(args, name, fallback = "") {
+  const index = args.indexOf(`--${name}`);
+  return index === -1 ? fallback : args[index + 1] || "";
+}
+
+function readJson(file, label) {
+  if (!file) throw new Error(`${label} is required`);
+  return JSON.parse(fs.readFileSync(file, "utf8"));
+}
+
+function writeJson(file, value) {
+  fs.mkdirSync(path.dirname(file), { recursive: true });
+  fs.writeFileSync(file, `${JSON.stringify(value, null, 2)}\n`);
+}
+
+function warrantBinding(warrantResult) {
+  const warrant =
+    warrantResult.observation?.activeWarrant || warrantResult.warrant;
+  if (!warrant) throw new Error("active Warrant is missing from transfer");
+  return {
+    repository: warrant.repository || warrantResult.observation?.repository,
+    protectedBase:
+      warrant.protectedBase || warrantResult.observation?.protectedBase,
+    stateRoot:
+      warrantResult.observation?.stateRoot || warrantResult.after?.stateRoot,
+    candidateId: warrant.candidateId,
+    fencingToken: warrant.fencingToken,
+    generation: warrant.generation,
+    pullRequestNumber: warrant.pullRequestNumber,
+    sourceHead: warrant.sourceHead,
+  };
+}
+
+function nativeJobContext(args, environment) {
+  const outcome = flag(args, "outcome");
+  if (!["succeeded", "failed"].includes(outcome)) {
+    throw new Error("native job outcome must be succeeded or failed");
+  }
+  return {
+    schema: "kungfu.buildchain.native-job-context/v1",
+    workflowRunId: Number(environment.GITHUB_RUN_ID),
+    workflowRunAttempt: Number(environment.GITHUB_RUN_ATTEMPT),
+    job: flag(args, "job", "native-execution"),
+    runnerEnvironment: environment.BUILDCHAIN_RUNNER_ENVIRONMENT,
+    runnerName: environment.RUNNER_NAME,
+    runnerOs: environment.RUNNER_OS,
+    runnerArch: environment.RUNNER_ARCH,
+    outcome,
+    evidenceCompletedAt: new Date().toISOString(),
+  };
+}
+
+function recordNative(args, environment) {
+  const context = nativeJobContext(args, environment);
+  writeJson(flag(args, "output"), context);
+  return context;
+}
+
+function seal(args, environment) {
+  const directory = path.resolve(flag(args, "directory"));
+  const stagingDirectory = path.resolve(
+    flag(args, "staging-directory", `${directory}-transfer`),
+  );
+  const warrantResult = readJson(
+    path.join(directory, flag(args, "warrant", "warrant.json")),
+    "Warrant result",
+  );
+  const resultPath = flag(args, "result", "two-phase-native-result.json");
+  const failurePath = flag(args, "failure", "failure.json");
+  const succeeded = fs.existsSync(path.join(directory, resultPath));
+  const context = readJson(
+    path.join(directory, "native-job-context.json"),
+    "native job context",
+  );
+  const runtimeSelection = readJson(
+    path.join(directory, "runtime-selection.json"),
+    "runtime selection",
+  );
+  const isolation = createNativeExecutionSealBinding({
+    nativeContext: context,
+    sealJob: flag(args, "seal-job", "seal-native-execution"),
+    sealRunnerName: environment.RUNNER_NAME,
+    sealRunnerEnvironment: environment.BUILDCHAIN_RUNNER_ENVIRONMENT,
+    sealRunnerOs: environment.RUNNER_OS,
+    sealRunnerArch: environment.RUNNER_ARCH,
+    observedAt: new Date().toISOString(),
+  });
+  if (isolation.nativeOutcome !== (succeeded ? "succeeded" : "failed")) {
+    throw new Error("native job context outcome does not match raw evidence");
+  }
+  const files = [
+    "native-job-context.json",
+    "runtime-selection.json",
+    "warrant.json",
+  ];
+  let nativeProofRoot = null;
+  let nativeReuseDecisionRoot = null;
+  if (succeeded) {
+    const result = readJson(path.join(directory, resultPath), "native result");
+    nativeProofRoot = result.nativeProofRoot;
+    nativeReuseDecisionRoot = result.nativeReuseDecisionRoot;
+    files.push(resultPath, "native-proof.json", "native-reuse-decision.json");
+  } else {
+    if (!fs.existsSync(path.join(directory, failurePath))) {
+      throw new Error("failed native execution has no failure evidence");
+    }
+    if (
+      !fs.existsSync(path.join(directory, "failure-provider-settlement.json"))
+    ) {
+      throw new Error(
+        "failed native execution has no provider settlement binding",
+      );
+    }
+    files.push(failurePath, "failure-provider-settlement.json");
+  }
+  stageNativeExecutionTransfer({
+    sourceDirectory: directory,
+    stagingDirectory,
+    files,
+  });
+  const transfer = createNativeExecutionTransfer({
+    directory: stagingDirectory,
+    files,
+    outcome: succeeded ? "succeeded" : "failed",
+    producer: {
+      ...isolation.producer,
+    },
+    sealer: isolation.sealer,
+    runtime: {
+      repository: runtimeSelection.repository,
+      selector: runtimeSelection.selector,
+      resolvedSha: runtimeSelection.resolvedSha,
+      selectionRoot: flag(args, "runtime-selection-root"),
+    },
+    warrant: warrantBinding(warrantResult),
+    nativeProofRoot,
+    nativeReuseDecisionRoot,
+    completedAt: isolation.nativeCompletedAt,
+    sealedAt: isolation.sealedAt,
+  });
+  const output = flag(args, "output", "execution-transfer.json");
+  if (output !== "execution-transfer.json") {
+    throw new Error("native transfer manifest must be execution-transfer.json");
+  }
+  writeJson(path.join(stagingDirectory, output), transfer);
+  return verifyNativeExecutionTransfer(transfer, {
+    directory: stagingDirectory,
+  });
+}
+
+function verify(args, environment) {
+  const directory = path.resolve(flag(args, "directory"));
+  const transfer = verifyNativeExecutionTransfer(
+    readJson(
+      path.join(directory, flag(args, "transfer", "execution-transfer.json")),
+      "execution transfer",
+    ),
+    {
+      directory,
+      expected: {
+        "producer.workflowRunId": Number(environment.GITHUB_RUN_ID),
+        "producer.workflowRunAttempt": Number(environment.GITHUB_RUN_ATTEMPT),
+        "producer.job": flag(args, "native-job", "native-execution"),
+        "runtime.resolvedSha": flag(args, "runtime-sha"),
+        "runtime.selectionRoot": flag(args, "runtime-selection-root"),
+        "warrant.pullRequestNumber": Number(flag(args, "pull-request")),
+        "warrant.sourceHead": flag(args, "source-head"),
+      },
+    },
+  );
+  const jobs = readJson(flag(args, "jobs-readback"), "provider jobs readback");
+  const pullRequestReadback = readJson(
+    flag(args, "pull-request-readback"),
+    "pull request readback",
+  );
+  const baseRefReadback = readJson(
+    flag(args, "base-ref-readback"),
+    "protected base ref readback",
+  );
+  const boundary = createProviderFinalizerBoundary({
+    jobs,
+    executionTransfer: transfer,
+    workflowRunId: environment.GITHUB_RUN_ID,
+    workflowRunAttempt: environment.GITHUB_RUN_ATTEMPT,
+    nativeJobName: flag(
+      args,
+      "native-job-name",
+      "Credentialless native execution",
+    ),
+    sealJobName: flag(
+      args,
+      "seal-job-name",
+      "Credentialless native evidence seal",
+    ),
+    finalizerJobName: flag(
+      args,
+      "finalizer-job-name",
+      "Credentialed provider finalizer",
+    ),
+    finalizerRunnerName: environment.RUNNER_NAME,
+    finalizerRunnerEnvironment: environment.BUILDCHAIN_RUNNER_ENVIRONMENT,
+    pullRequestReadback,
+    baseRefReadback,
+    observedAt: new Date().toISOString(),
+  });
+  const boundaryOutput = flag(args, "output");
+  writeJson(boundaryOutput, boundary);
+  if (transfer.outcome === "failed") {
+    const settlement = verifyProviderFailureSettlementBinding(
+      boundary,
+      transfer,
+    );
+    writeJson(
+      flag(
+        args,
+        "failure-settlement-output",
+        path.join(
+          path.dirname(boundaryOutput),
+          "provider-failure-settlement.json",
+        ),
+      ),
+      settlement,
+    );
+  }
+  return boundary;
+}
+
+export function runDevDeliveryProcessBoundary(args, environment = process.env) {
+  const command = args[0];
+  if (command === "record-native")
+    return recordNative(args.slice(1), environment);
+  if (command === "seal") return seal(args.slice(1), environment);
+  if (command === "verify") return verify(args.slice(1), environment);
+  throw new Error("expected record-native, seal, or verify");
+}
+
+if (import.meta.url === `file://${process.argv[1]}`) {
+  try {
+    const result = runDevDeliveryProcessBoundary(process.argv.slice(2));
+    process.stdout.write(
+      `Dev delivery process boundary: ${result.transferRoot || result.boundaryRoot}\n`,
+    );
+  } catch (error) {
+    console.error(`buildchain dev boundary: ${error.message}`);
+    process.exit(1);
+  }
+}

package/scripts/dev-delivery-proof.mjs

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import fs from "node:fs";
 import path from "node:path";
-import { classifyDevDeliveryDelta, createIntegrationDeliveryProof, createProjectCutReplayPlan, createProjectCutReplayProof, createSourceQualificationProof, verifyIntegrationDeliveryProof, verifyProjectCutReplayProof, verifySourceQualificationProof } from "../packages/core/dev-delivery-warrant.js";
+import { classifyDevDeliveryDelta, createIntegrationDeliveryProof, createNativeProofReuseDecision, createNativeQualificationProof, createProjectCutReplayPlan, createProjectCutReplayProof, createSourceQualificationProof, verifyIntegrationDeliveryProof, verifyNativeProofReuseDecision, verifyNativeQualificationProof, verifyProjectCutReplayProof, verifySourceQualificationProof } from "../packages/core/dev-delivery-warrant.js";
 
 function flag(args, name, fallback = "") {
   const index = args.indexOf(`--${name}`);
@@ -49,9 +49,12 @@ export function devDeliveryProofCliOptions(args = [], environment = process.env)
     closureRoot: flag(rest, "closure-root", environment.BUILDCHAIN_DEV_DELIVERY_CLOSURE_ROOT),
     dependencyRoot: flag(rest, "dependency-root", environment.BUILDCHAIN_DEV_DELIVERY_DEPENDENCY_ROOT),
     toolchainRoot: flag(rest, "toolchain-root", environment.BUILDCHAIN_DEV_DELIVERY_TOOLCHAIN_ROOT),
+    environmentRoot: flag(rest, "environment-root", environment.BUILDCHAIN_DEV_DELIVERY_ENVIRONMENT_ROOT),
     affectedPaths: flag(rest, "affected-paths-json", environment.BUILDCHAIN_DEV_DELIVERY_AFFECTED_PATHS || "[]"),
     shardEvidenceRoots: flag(rest, "shard-evidence-roots-json", environment.BUILDCHAIN_DEV_DELIVERY_SHARD_EVIDENCE_ROOTS || "[]"),
     qualifiedAt: flag(rest, "qualified-at", environment.BUILDCHAIN_DEV_DELIVERY_QUALIFIED_AT),
+    qualifiedBase: flag(rest, "qualified-base", environment.BUILDCHAIN_DEV_DELIVERY_QUALIFIED_BASE),
+    nativeExecutionReceiptPath: flag(rest, "native-execution-receipt", environment.BUILDCHAIN_DEV_DELIVERY_NATIVE_EXECUTION_RECEIPT),
     sourceProofPath: flag(rest, "source-proof", environment.BUILDCHAIN_DEV_DELIVERY_SOURCE_PROOF),
     sourceProofRoot: flag(rest, "source-proof-root", environment.BUILDCHAIN_DEV_DELIVERY_SOURCE_PROOF_ROOT),
     warrantResultPath: flag(rest, "warrant-result", environment.BUILDCHAIN_DEV_DELIVERY_WARRANT_RESULT),
@@ -66,6 +69,8 @@ export function devDeliveryProofCliOptions(args = [], environment = process.env)
     pullRequestNumber: flag(rest, "pull-request", environment.BUILDCHAIN_DEV_DELIVERY_PR_NUMBER),
     changedPaths: flag(rest, "changed-paths-json", environment.BUILDCHAIN_DEV_DELIVERY_CHANGED_PATHS || "[]"),
     graphKnown: boolean(flag(rest, "graph-known", environment.BUILDCHAIN_DEV_DELIVERY_GRAPH_KNOWN), false),
+    attributionComplete: boolean(flag(rest, "attribution-complete", environment.BUILDCHAIN_DEV_DELIVERY_ATTRIBUTION_COMPLETE), false),
+    renames: flag(rest, "renames-json", environment.BUILDCHAIN_DEV_DELIVERY_RENAMES || "[]"),
     outputPath: flag(rest, "output", environment.BUILDCHAIN_DEV_DELIVERY_PROOF_OUTPUT || ".buildchain/dev-delivery/proof.json"),
     json: hasFlag(rest, "json"),
   };
@@ -117,6 +122,66 @@ export function runDevDeliveryProofCommand(options) {
       },
     });
   }
+  if (options.command === "native") {
+    return createNativeQualificationProof({
+      repository: options.repository,
+      protectedBase: options.protectedBase,
+      sourceIdentityRoot: options.sourceIdentityRoot,
+      sourcePatchRoot: options.sourcePatchRoot,
+      planRoot: options.planRoot,
+      closureRoot: options.closureRoot,
+      dependencyRoot: options.dependencyRoot,
+      toolchainRoot: options.toolchainRoot,
+      environmentRoot: options.environmentRoot,
+      sourceHead: options.sourceHead,
+      qualifiedBase: options.qualifiedBase,
+      nativeExecutionReceipt: jsonFile(options.nativeExecutionReceiptPath, "native execution receipt"),
+      affectedPaths: jsonList(options.affectedPaths, "affected paths"),
+      shardEvidenceRoots: jsonList(options.shardEvidenceRoots, "shard evidence roots", { required: true }),
+      qualifiedAt: options.qualifiedAt,
+    });
+  }
+  if (options.command === "verify-native") {
+    return verifyNativeQualificationProof(jsonFile(options.sourceProofPath, "native proof"));
+  }
+  if (options.command === "classify-native") {
+    return createNativeProofReuseDecision({
+      proof: jsonFile(options.sourceProofPath, "native proof"),
+      current: {
+        sourceIdentityRoot: options.sourceIdentityRoot,
+        sourcePatchRoot: options.sourcePatchRoot,
+        planRoot: options.planRoot,
+        closureRoot: options.closureRoot,
+        dependencyRoot: options.dependencyRoot,
+        toolchainRoot: options.toolchainRoot,
+        environmentRoot: options.environmentRoot,
+        currentBase: options.currentBase,
+        graphKnown: options.graphKnown,
+        attributionComplete: options.attributionComplete,
+        changedPaths: jsonList(options.changedPaths, "changed paths"),
+        renames: jsonList(options.renames, "renames"),
+      },
+    });
+  }
+  if (options.command === "verify-native-reuse") {
+    return verifyNativeProofReuseDecision(jsonFile(options.qualificationReceiptPath, "native reuse decision"), {
+      proof: jsonFile(options.sourceProofPath, "native proof"),
+      current: {
+        sourceIdentityRoot: options.sourceIdentityRoot,
+        sourcePatchRoot: options.sourcePatchRoot,
+        planRoot: options.planRoot,
+        closureRoot: options.closureRoot,
+        dependencyRoot: options.dependencyRoot,
+        toolchainRoot: options.toolchainRoot,
+        environmentRoot: options.environmentRoot,
+        currentBase: options.currentBase,
+        graphKnown: options.graphKnown,
+        attributionComplete: options.attributionComplete,
+        changedPaths: jsonList(options.changedPaths, "changed paths"),
+        renames: jsonList(options.renames, "renames"),
+      },
+    });
+  }
   if (options.command === "replay") {
     return createProjectCutReplayPlan({
       repository: options.repository,
@@ -168,7 +233,7 @@ export function runDevDeliveryProofCommand(options) {
 }
 
 function usage() {
-  return "Usage:\n  buildchain dev proof <source|verify-source|classify|replay|replay-proof|verify-replay|integration|verify-integration> [options] [--output FILE] [--json]\n";
+  return "Usage:\n  buildchain dev proof <source|verify-source|classify|native|verify-native|classify-native|verify-native-reuse|replay|replay-proof|verify-replay|integration|verify-integration> [options] [--output FILE] [--json]\n";
 }
 
 async function main() {

package/scripts/dev-delivery-provider-heartbeat.mjs

@@ -0,0 +1,215 @@
+#!/usr/bin/env node
+import fs from "node:fs";
+import path from "node:path";
+
+import {
+  runDevDeliveryProviderHeartbeat,
+  verifyDevDeliveryProviderHeartbeat,
+} from "../packages/core/dev-delivery-provider-heartbeat.js";
+import { runDevDeliveryCommand } from "./dev-delivery-warrant.mjs";
+
+function flag(args, name, fallback = "") {
+  const index = args.indexOf(`--${name}`);
+  return index === -1 ? fallback : args[index + 1] || "";
+}
+
+function readJson(file, label) {
+  if (!file) throw new Error(`${label} is required`);
+  return JSON.parse(fs.readFileSync(path.resolve(file), "utf8"));
+}
+
+function writeJson(file, value) {
+  fs.mkdirSync(path.dirname(path.resolve(file)), { recursive: true });
+  fs.writeFileSync(path.resolve(file), `${JSON.stringify(value, null, 2)}\n`);
+}
+
+async function githubJson(apiUrl, token, requestPath, method = "GET") {
+  if (!token) throw new Error("provider heartbeat requires GitHub credentials");
+  const response = await fetch(
+    `${String(apiUrl).replace(/\/$/u, "")}${requestPath}`,
+    {
+      method,
+      headers: {
+        accept: "application/vnd.github+json",
+        authorization: `Bearer ${token}`,
+        "x-github-api-version": "2022-11-28",
+      },
+    },
+  );
+  const bytes = await response.text();
+  const body = bytes ? JSON.parse(bytes) : {};
+  if (!response.ok) {
+    throw new Error(
+      `GitHub provider ${requestPath} failed with ${response.status}: ${body.message || "unknown error"}`,
+    );
+  }
+  return body;
+}
+
+function repositoryParts(value) {
+  const match = String(value || "").match(/^([^/\s]+)\/([^/\s]+)$/u);
+  if (!match) throw new Error("repository must be owner/repo");
+  return { owner: match[1], repo: match[2] };
+}
+
+export async function coordinateExactProviderAttemptAfterHeartbeatLoss(
+  { repository, workflowRunId, workflowRunAttempt },
+  { readRun },
+) {
+  const run = await readRun(workflowRunId);
+  if (
+    Number(run.id) !== workflowRunId ||
+    Number(run.run_attempt) !== workflowRunAttempt ||
+    run.repository?.full_name !== repository ||
+    run.status !== "in_progress"
+  ) {
+    throw new Error(
+      "heartbeat loss cannot coordinate a different provider attempt",
+    );
+  }
+  return {
+    action: "exact-attempt-heartbeat-loss-observed",
+    workflowRunId,
+    workflowRunAttempt,
+    cancellation: "withheld-run-scoped-api",
+    nextAction:
+      "Wait for terminal readback of this exact attempt; never cancel the run-scoped coordinate.",
+  };
+}
+
+export async function runProviderHeartbeatCommand(options) {
+  const { owner, repo } = repositoryParts(options.repository);
+  return runDevDeliveryProviderHeartbeat(
+    {
+      admission: options.admission,
+      workflowRunId: options.workflowRunId,
+      workflowRunAttempt: options.workflowRunAttempt,
+      leaseSeconds: options.leaseSeconds,
+      heartbeatSeconds: options.heartbeatSeconds,
+    },
+    {
+      heartbeat: ({
+        expectedOldStateRoot,
+        fencingToken,
+        leaseGeneration,
+        leaseSeconds,
+      }) =>
+        runDevDeliveryCommand({
+          command: "heartbeat",
+          repository: options.repository,
+          branch: options.branch,
+          expectedOldStateRoot,
+          fencingToken,
+          leaseGeneration,
+          leaseSeconds,
+          execute: true,
+          token: options.token,
+          apiUrl: options.apiUrl,
+        }),
+      readJobs: () =>
+        githubJson(
+          options.apiUrl,
+          options.token,
+          `/repos/${owner}/${repo}/actions/runs/${options.workflowRunId}/attempts/${options.workflowRunAttempt}/jobs?per_page=100`,
+        ),
+      onHeartbeatLoss:
+        options.onHeartbeatLoss ||
+        (async ({ workflowRunId, workflowRunAttempt }) => {
+          await coordinateExactProviderAttemptAfterHeartbeatLoss(
+            {
+              repository: options.repository,
+              workflowRunId,
+              workflowRunAttempt,
+            },
+            {
+              readRun: (runId) =>
+                githubJson(
+                  options.apiUrl,
+                  options.token,
+                  `/repos/${owner}/${repo}/actions/runs/${runId}`,
+                ),
+            },
+          );
+        }),
+    },
+  );
+}
+
+export async function verifyProviderHeartbeatCommand(options) {
+  const observed = await runDevDeliveryCommand({
+    command: "observe",
+    repository: options.repository,
+    branch: options.branch,
+    token: options.token,
+    apiUrl: options.apiUrl,
+  });
+  return verifyDevDeliveryProviderHeartbeat(options.receipt, {
+    admission: options.admission,
+    jobsReadback: options.jobsReadback,
+    liveObservation: observed.observation,
+    workflowRunId: options.workflowRunId,
+    workflowRunAttempt: options.workflowRunAttempt,
+    admissionJobName: options.admissionJobName,
+    heartbeatJobName: options.heartbeatJobName,
+    finalizerJobName: options.finalizerJobName,
+    observedAt: options.now,
+  });
+}
+
+async function main() {
+  const args = process.argv.slice(2);
+  const command = args[0] || "";
+  if (!new Set(["run", "verify"]).has(command)) {
+    process.stdout.write(
+      "Usage: dev-delivery-provider-heartbeat.mjs <run|verify> --admission FILE --repository owner/repo --branch dev/vN/vN.M --workflow-run-id N --workflow-run-attempt N --output FILE\n",
+    );
+    return;
+  }
+  const token = process.env.GITHUB_TOKEN || process.env.GH_TOKEN;
+  const common = {
+    repository: flag(args, "repository", process.env.GITHUB_REPOSITORY),
+    branch: flag(args, "branch", process.env.GITHUB_BASE_REF),
+    admission: readJson(flag(args, "admission"), "admission"),
+    workflowRunId: Number(process.env.GITHUB_RUN_ID),
+    workflowRunAttempt: Number(process.env.GITHUB_RUN_ATTEMPT),
+    token,
+    apiUrl: process.env.GITHUB_API_URL || "https://api.github.com",
+    now: new Date().toISOString(),
+    admissionJobName: flag(
+      args,
+      "admission-job-name",
+      "Reserve exact delivery candidate",
+    ),
+    heartbeatJobName: flag(
+      args,
+      "heartbeat-job-name",
+      "Credentialed independent Warrant heartbeat",
+    ),
+    finalizerJobName: flag(
+      args,
+      "finalizer-job-name",
+      "Credentialed provider finalizer",
+    ),
+  };
+  const result =
+    command === "run"
+      ? await runProviderHeartbeatCommand({
+          ...common,
+          leaseSeconds: Number(flag(args, "lease-seconds", "3600")),
+          heartbeatSeconds: Number(flag(args, "heartbeat-seconds", "30")),
+        })
+      : await verifyProviderHeartbeatCommand({
+          ...common,
+          receipt: readJson(flag(args, "receipt"), "heartbeat receipt"),
+          jobsReadback: readJson(flag(args, "jobs-readback"), "jobs readback"),
+        });
+  writeJson(flag(args, "output"), result);
+  process.stdout.write(`${JSON.stringify(result)}\n`);
+}
+
+if (import.meta.url === `file://${process.argv[1]}`) {
+  main().catch((error) => {
+    console.error(`dev delivery provider heartbeat: ${error.message}`);
+    process.exit(1);
+  });
+}