@miller-tech/uap 1.46.4 → 1.47.0

package/dist/delivery/ci-watcher.js

@@ -0,0 +1,221 @@
+/**
+ * CI watcher: the commit/push boundary between local convergence and CI/CD.
+ *
+ * Once the convergence loop reaches local-green, this module commits the
+ * applied files on the current worktree branch, pushes (never force), resolves
+ * the CI run triggered for that exact commit (matched by head SHA, not "latest
+ * run"), watches it to a conclusion, and — on failure — converts the failed
+ * logs into sanitized convergence feedback so the loop can re-converge against
+ * what CI/staging/prod actually reported.
+ *
+ * Honors the repo conventions:
+ *  - never pushes `master`/`main` directly (merge-to-master stays in the PR
+ *    flow); a protected branch yields `status: 'skipped'`.
+ *  - never force-pushes.
+ *  - sanitizes secrets out of CI logs before they enter a model prompt.
+ */
+import { execFile as execFileCb } from 'child_process';
+const PROTECTED_BRANCHES = new Set(['master', 'main']);
+const DEFAULT_POLL_MS = 15_000;
+const DEFAULT_TIMEOUT_MS = 20 * 60_000;
+const DEFAULT_RESOLVE_ATTEMPTS = 8;
+const DEFAULT_TAIL_CHARS = 4_000;
+const defaultExec = (command, args, opts = {}) => new Promise((resolve) => {
+    execFileCb(command, args, { cwd: opts.cwd, timeout: opts.timeoutMs, maxBuffer: 10 * 1024 * 1024, encoding: 'utf-8' }, (error, stdout, stderr) => {
+        const code = error && typeof error.code === 'number'
+            ? (error.code)
+            : error
+                ? 1
+                : 0;
+        resolve({ code, stdout: stdout ?? '', stderr: stderr ?? '' });
+    });
+});
+const defaultSleep = (ms) => new Promise((r) => setTimeout(r, ms));
+/**
+ * Strip secrets out of CI logs before they are injected into a model prompt.
+ * Masks common token shapes and `KEY=secret` assignments for sensitive keys.
+ */
+export function sanitizeCiLog(text) {
+    return (text
+        // GitHub tokens (PAT, OAuth, server, fine-grained) and generic gh* tokens
+        .replace(/\b(gh[pousr]|github_pat)_[A-Za-z0-9_]{20,}\b/g, '***')
+        // Provider tokens: Slack, Stripe, Google API, npm, OpenAI/Anthropic-style
+        .replace(/\bxox[baprs]-[A-Za-z0-9-]{10,}/g, '***')
+        .replace(/\bsk_(live|test)_[A-Za-z0-9]{16,}\b/g, '***')
+        .replace(/\bAIza[0-9A-Za-z_-]{35}\b/g, '***')
+        .replace(/\bnpm_[A-Za-z0-9]{36}\b/g, '***')
+        .replace(/\bsk-[A-Za-z0-9_-]{20,}\b/g, '***')
+        // JWTs (header.payload.signature) — contain '.'/'-', so the base64 rule misses them
+        .replace(/\beyJ[A-Za-z0-9._-]{20,}\b/g, '***')
+        // Bearer / token headers (allow base64 chars +/=)
+        .replace(/\b(Bearer|token)\s+[A-Za-z0-9._/+=-]{12,}/gi, '$1 ***')
+        // AWS access key ids
+        .replace(/\bAKIA[0-9A-Z]{16}\b/g, '***')
+        // KEY=value / KEY: value assignments for sensitive-looking keys
+        .replace(/\b([A-Z0-9_]*(?:API_?KEY|TOKEN|SECRET|PASSWORD|PASSWD|PWD|CREDENTIAL|PRIVATE_KEY|AUTH|ACCESS_KEY)[A-Z0-9_]*)\s*[=:]\s*\S+/gi, '$1=***')
+        // long base64-ish blobs (>=40 chars) that look like encoded secrets
+        .replace(/\b[A-Za-z0-9+/]{40,}={0,2}\b/g, '***'));
+}
+function truncateTail(text, maxChars) {
+    const trimmed = text.trim();
+    if (trimmed.length <= maxChars)
+        return trimmed;
+    return `…(truncated)…\n${trimmed.slice(-maxChars)}`;
+}
+/**
+ * Commit applied files on the worktree branch, push (non-force), then watch the
+ * triggered CI run and report a status the convergence loop can act on.
+ */
+export async function commitPushAndWatch(options) {
+    const exec = options.exec ?? defaultExec;
+    const sleep = options.sleep ?? defaultSleep;
+    const remote = options.remote ?? 'origin';
+    const cwd = options.projectRoot;
+    const progress = options.onProgress ?? (() => undefined);
+    const tailChars = options.outputTailChars ?? DEFAULT_TAIL_CHARS;
+    // 1. Resolve and guard the branch.
+    let branch = options.branch;
+    if (!branch) {
+        const head = await exec('git', ['rev-parse', '--abbrev-ref', 'HEAD'], { cwd });
+        branch = head.stdout.trim();
+    }
+    if (!branch || PROTECTED_BRANCHES.has(branch)) {
+        return {
+            pushed: false,
+            runId: null,
+            status: 'skipped',
+            feedback: `CI watch skipped: refusing to push protected branch '${branch || '(unknown)'}'. Merge to master via the PR flow.`,
+        };
+    }
+    // 2. Commit (tolerate "nothing to commit").
+    if (options.files.length > 0) {
+        await exec('git', ['add', '--', ...options.files], { cwd });
+    }
+    else {
+        await exec('git', ['add', '-A'], { cwd });
+    }
+    const commit = await exec('git', ['commit', '-m', options.commitMessage], { cwd });
+    if (commit.code !== 0 && !/nothing to commit/i.test(`${commit.stdout}\n${commit.stderr}`)) {
+        return {
+            pushed: false,
+            runId: null,
+            status: 'skipped',
+            feedback: `CI watch skipped: commit failed — ${sanitizeCiLog(truncateTail(commit.stderr, 500))}`,
+        };
+    }
+    // 3. Resolve the head SHA we are about to push.
+    const sha = (await exec('git', ['rev-parse', 'HEAD'], { cwd })).stdout.trim();
+    // 4. Push (non-force, never force-with-lease).
+    progress(`Pushing ${branch} to ${remote}…`);
+    const push = await exec('git', ['push', remote, branch], { cwd });
+    if (push.code !== 0) {
+        return {
+            pushed: false,
+            runId: null,
+            status: 'skipped',
+            feedback: `CI watch skipped: push failed — ${sanitizeCiLog(truncateTail(push.stderr, 500))}`,
+        };
+    }
+    // 5. Resolve the run for this exact commit (match by head SHA).
+    const run = await resolveRun(exec, cwd, branch, sha, options.resolveAttempts ?? DEFAULT_RESOLVE_ATTEMPTS, sleep, options.pollIntervalMs ?? DEFAULT_POLL_MS, progress);
+    if (!run) {
+        return {
+            pushed: true,
+            runId: null,
+            status: 'no-run',
+            feedback: `Pushed ${sha.slice(0, 8)} to ${branch}, but no CI run was found for it. CI may be disabled for this branch.`,
+        };
+    }
+    // 6. Watch to conclusion.
+    return watchRun(exec, cwd, run, {
+        pollIntervalMs: options.pollIntervalMs ?? DEFAULT_POLL_MS,
+        timeoutMs: options.timeoutMs ?? DEFAULT_TIMEOUT_MS,
+        watchEnvironments: options.watchEnvironments,
+        tailChars,
+        sleep,
+        progress,
+    });
+}
+async function resolveRun(exec, cwd, branch, sha, attempts, sleep, pollMs, progress) {
+    for (let i = 0; i < attempts; i++) {
+        const res = await exec('gh', ['run', 'list', '--branch', branch, '--json', 'databaseId,headSha,status,url', '--limit', '20'], { cwd });
+        if (res.code === 0) {
+            try {
+                const runs = JSON.parse(res.stdout);
+                const match = runs.find((r) => r.headSha === sha);
+                if (match)
+                    return match;
+            }
+            catch {
+                /* malformed json — retry */
+            }
+        }
+        progress(`Waiting for CI run on ${sha.slice(0, 8)} (attempt ${i + 1}/${attempts})…`);
+        if (i < attempts - 1)
+            await sleep(pollMs);
+    }
+    return null;
+}
+async function watchRun(exec, cwd, run, params) {
+    const runId = String(run.databaseId);
+    const deadline = params.timeoutMs;
+    let elapsed = 0;
+    for (;;) {
+        const res = await exec('gh', ['run', 'view', runId, '--json', 'status,conclusion,jobs,url'], { cwd });
+        let view = null;
+        if (res.code === 0) {
+            try {
+                view = JSON.parse(res.stdout);
+            }
+            catch {
+                view = null;
+            }
+        }
+        if (view && view.status === 'completed') {
+            const runUrl = view.url ?? run.url;
+            const envProblem = requiredEnvFailure(view.jobs ?? [], params.watchEnvironments);
+            if (view.conclusion === 'success' && !envProblem) {
+                return { pushed: true, runId, status: 'green', runUrl };
+            }
+            const feedback = await buildFailureFeedback(exec, cwd, runId, envProblem, params.tailChars);
+            return { pushed: true, runId, status: 'failed', feedback, runUrl };
+        }
+        if (elapsed >= deadline) {
+            return {
+                pushed: true,
+                runId,
+                status: 'timeout',
+                runUrl: view?.url ?? run.url,
+                feedback: `CI run ${runId} did not conclude within ${Math.round(deadline / 60000)} min. See ${view?.url ?? run.url ?? 'the run'} for status.`,
+            };
+        }
+        params.progress(`Watching CI run ${runId} (${view?.status ?? 'pending'})…`);
+        await params.sleep(params.pollIntervalMs);
+        elapsed += params.pollIntervalMs;
+    }
+}
+/** Returns a description when a required environment's deploy job is not green. */
+function requiredEnvFailure(jobs, envs) {
+    if (!envs || envs.length === 0)
+        return null;
+    for (const env of envs) {
+        const jobName = `deploy-${env}`;
+        const job = jobs.find((j) => j.name === jobName || j.name.startsWith(`${jobName} `));
+        if (!job)
+            return `Required ${env} deploy job ('${jobName}') was not found in the CI run.`;
+        if (job.conclusion !== 'success') {
+            return `Required ${env} deploy job ('${jobName}') concluded '${job.conclusion ?? job.status}'.`;
+        }
+    }
+    return null;
+}
+async function buildFailureFeedback(exec, cwd, runId, envProblem, tailChars) {
+    const logs = await exec('gh', ['run', 'view', runId, '--log-failed'], { cwd });
+    const raw = logs.code === 0 ? logs.stdout : `${logs.stdout}\n${logs.stderr}`;
+    const sanitized = sanitizeCiLog(truncateTail(raw, tailChars));
+    const header = envProblem
+        ? `ci-feedback: ${envProblem}`
+        : 'ci-feedback: the CI run failed after the change was pushed. Fix the failure below so dev/staging/prod verification passes.';
+    return `${header}\n\nFailed CI logs:\n\`\`\`\n${sanitized || '(no log output captured)'}\n\`\`\``;
+}
+//# sourceMappingURL=ci-watcher.js.map

package/dist/delivery/ci-watcher.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ci-watcher.js","sourceRoot":"","sources":["../../src/delivery/ci-watcher.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,QAAQ,IAAI,UAAU,EAAE,MAAM,eAAe,CAAC;AAsDvD,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;AACvD,MAAM,eAAe,GAAG,MAAM,CAAC;AAC/B,MAAM,kBAAkB,GAAG,EAAE,GAAG,MAAM,CAAC;AACvC,MAAM,wBAAwB,GAAG,CAAC,CAAC;AACnC,MAAM,kBAAkB,GAAG,KAAK,CAAC;AAEjC,MAAM,WAAW,GAAW,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,GAAG,EAAE,EAAE,EAAE,CACvD,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;IACtB,UAAU,CACR,OAAO,EACP,IAAI,EACJ,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,EAC1F,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;QACxB,MAAM,IAAI,GACR,KAAK,IAAI,OAAQ,KAAmD,CAAC,IAAI,KAAK,QAAQ;YACpF,CAAC,CAAC,CAAE,KAAqC,CAAC,IAAI,CAAC;YAC/C,CAAC,CAAC,KAAK;gBACL,CAAC,CAAC,CAAC;gBACH,CAAC,CAAC,CAAC,CAAC;QACV,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,IAAI,EAAE,EAAE,CAAC,CAAC;IAChE,CAAC,CACF,CAAC;AACJ,CAAC,CAAC,CAAC;AAEL,MAAM,YAAY,GAAG,CAAC,EAAU,EAAiB,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;AAE1F;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,OAAO,CACL,IAAI;QACF,0EAA0E;SACzE,OAAO,CAAC,+CAA+C,EAAE,KAAK,CAAC;QAChE,0EAA0E;SACzE,OAAO,CAAC,iCAAiC,EAAE,KAAK,CAAC;SACjD,OAAO,CAAC,sCAAsC,EAAE,KAAK,CAAC;SACtD,OAAO,CAAC,4BAA4B,EAAE,KAAK,CAAC;SAC5C,OAAO,CAAC,0BAA0B,EAAE,KAAK,CAAC;SAC1C,OAAO,CAAC,4BAA4B,EAAE,KAAK,CAAC;QAC7C,oFAAoF;SACnF,OAAO,CAAC,6BAA6B,EAAE,KAAK,CAAC;QAC9C,kDAAkD;SACjD,OAAO,CAAC,6CAA6C,EAAE,QAAQ,CAAC;QACjE,qBAAqB;SACpB,OAAO,CAAC,uBAAuB,EAAE,KAAK,CAAC;QACxC,gEAAgE;SAC/D,OAAO,CACN,6HAA6H,EAC7H,QAAQ,CACT;QACD,oEAAoE;SACnE,OAAO,CAAC,+BAA+B,EAAE,KAAK,CAAC,CACnD,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,QAAgB;IAClD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,OAAO,CAAC,MAAM,IAAI,QAAQ;QAAE,OAAO,OAAO,CAAC;IAC/C,OAAO,kBAAkB,OAAO,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;AACtD,CAAC;AAeD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAAuB;IAC9D,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,WAAW,CAAC;IACzC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,YAAY,CAAC;IAC5C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,QAAQ,CAAC;IAC1C,MAAM,GAAG,GAAG,OAAO,CAAC,WAAW,CAAC;IAChC,MAAM,QAAQ,GAAG,OAAO,CAAC,UAAU,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACzD,MAAM,SAAS,GAAG,OAAO,CAAC,eAAe,IAAI,kBAAkB,CAAC;IAEhE,mCAAmC;IACnC,IAAI,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC5B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QAC/E,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC9B,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAC9C,OAAO;YACL,MAAM,EAAE,KAAK;YACb,KAAK,EAAE,IAAI;YACX,MAAM,EAAE,SAAS;YACjB,QAAQ,EAAE,wDAAwD,MAAM,IAAI,WAAW,qCAAqC;SAC7H,CAAC;IACJ,CAAC;IAED,4CAA4C;IAC5C,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IAC9D,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IAC5C,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,aAAa,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IACnF,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC;QAC1F,OAAO;YACL,MAAM,EAAE,KAAK;YACb,KAAK,EAAE,IAAI;YACX,MAAM,EAAE,SAAS;YACjB,QAAQ,EAAE,qCAAqC,aAAa,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,EAAE;SACjG,CAAC;IACJ,CAAC;IAED,gDAAgD;IAChD,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAE9E,+CAA+C;IAC/C,QAAQ,CAAC,WAAW,MAAM,OAAO,MAAM,GAAG,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IAClE,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACpB,OAAO;YACL,MAAM,EAAE,KAAK;YACb,KAAK,EAAE,IAAI;YACX,MAAM,EAAE,SAAS;YACjB,QAAQ,EAAE,mCAAmC,aAAa,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,EAAE;SAC7F,CAAC;IACJ,CAAC;IAED,gEAAgE;IAChE,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,eAAe,IAAI,wBAAwB,EAAE,KAAK,EAAE,OAAO,CAAC,cAAc,IAAI,eAAe,EAAE,QAAQ,CAAC,CAAC;IACtK,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO;YACL,MAAM,EAAE,IAAI;YACZ,KAAK,EAAE,IAAI;YACX,MAAM,EAAE,QAAQ;YAChB,QAAQ,EAAE,UAAU,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,MAAM,uEAAuE;SACxH,CAAC;IACJ,CAAC;IAED,0BAA0B;IAC1B,OAAO,QAAQ,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE;QAC9B,cAAc,EAAE,OAAO,CAAC,cAAc,IAAI,eAAe;QACzD,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,kBAAkB;QAClD,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;QAC5C,SAAS;QACT,KAAK;QACL,QAAQ;KACT,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,IAAY,EACZ,GAAW,EACX,MAAc,EACd,GAAW,EACX,QAAgB,EAChB,KAAoC,EACpC,MAAc,EACd,QAA6B;IAE7B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,MAAM,GAAG,GAAG,MAAM,IAAI,CACpB,IAAI,EACJ,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,+BAA+B,EAAE,SAAS,EAAE,IAAI,CAAC,EAC/F,EAAE,GAAG,EAAE,CACR,CAAC;QACF,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACnB,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAmB,CAAC;gBACtD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,GAAG,CAAC,CAAC;gBAClD,IAAI,KAAK;oBAAE,OAAO,KAAK,CAAC;YAC1B,CAAC;YAAC,MAAM,CAAC;gBACP,4BAA4B;YAC9B,CAAC;QACH,CAAC;QACD,QAAQ,CAAC,yBAAyB,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,QAAQ,IAAI,CAAC,CAAC;QACrF,IAAI,CAAC,GAAG,QAAQ,GAAG,CAAC;YAAE,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAWD,KAAK,UAAU,QAAQ,CACrB,IAAY,EACZ,GAAW,EACX,GAAiB,EACjB,MAAmB;IAEnB,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACrC,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,CAAC;IAClC,IAAI,OAAO,GAAG,CAAC,CAAC;IAEhB,SAAS,CAAC;QACR,MAAM,GAAG,GAAG,MAAM,IAAI,CACpB,IAAI,EACJ,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,4BAA4B,CAAC,EAC9D,EAAE,GAAG,EAAE,CACR,CAAC;QACF,IAAI,IAAI,GAAuF,IAAI,CAAC;QACpG,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACnB,IAAI,CAAC;gBACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAChC,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,GAAG,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YACxC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC;YACnC,MAAM,UAAU,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC;YACjF,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,UAAU,EAAE,CAAC;gBACjD,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;YAC1D,CAAC;YACD,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;YAC5F,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;QACrE,CAAC;QAED,IAAI,OAAO,IAAI,QAAQ,EAAE,CAAC;YACxB,OAAO;gBACL,MAAM,EAAE,IAAI;gBACZ,KAAK;gBACL,MAAM,EAAE,SAAS;gBACjB,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,GAAG,CAAC,GAAG;gBAC5B,QAAQ,EAAE,UAAU,KAAK,4BAA4B,IAAI,CAAC,KAAK,CAAC,QAAQ,GAAG,KAAK,CAAC,aAAa,IAAI,EAAE,GAAG,IAAI,GAAG,CAAC,GAAG,IAAI,SAAS,cAAc;aAC9I,CAAC;QACJ,CAAC;QAED,MAAM,CAAC,QAAQ,CAAC,mBAAmB,KAAK,KAAK,IAAI,EAAE,MAAM,IAAI,SAAS,IAAI,CAAC,CAAC;QAC5E,MAAM,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QAC1C,OAAO,IAAI,MAAM,CAAC,cAAc,CAAC;IACnC,CAAC;AACH,CAAC;AAED,mFAAmF;AACnF,SAAS,kBAAkB,CAAC,IAAa,EAAE,IAA0B;IACnE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,UAAU,GAAG,EAAE,CAAC;QAChC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,OAAO,GAAG,CAAC,CAAC,CAAC;QACrF,IAAI,CAAC,GAAG;YAAE,OAAO,YAAY,GAAG,iBAAiB,OAAO,iCAAiC,CAAC;QAC1F,IAAI,GAAG,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YACjC,OAAO,YAAY,GAAG,iBAAiB,OAAO,iBAAiB,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC;QAClG,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,IAAY,EACZ,GAAW,EACX,KAAa,EACb,UAAyB,EACzB,SAAiB;IAEjB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IAC/E,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,EAAE,CAAC;IAC7E,MAAM,SAAS,GAAG,aAAa,CAAC,YAAY,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,UAAU;QACvB,CAAC,CAAC,gBAAgB,UAAU,EAAE;QAC9B,CAAC,CAAC,4HAA4H,CAAC;IACjI,OAAO,GAAG,MAAM,gCAAgC,SAAS,IAAI,0BAA0B,UAAU,CAAC;AACpG,CAAC"}

package/dist/delivery/deploy-dev-gate.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Local dev deploy + smoke gate (the `deploy-dev` tier).
+ *
+ * Runs a deploy-dev rung as a full lifecycle: optionally bring a docker-compose
+ * stack up (`docker compose up -d --wait`), run the smoke/health check, then
+ * ALWAYS tear the stack down (even on smoke failure or timeout). This gives the
+ * convergence loop real "does it actually run" feedback locally, before the
+ * change is ever committed.
+ *
+ * Safety:
+ *  - When the rung needs docker and docker is unavailable, the tier is reported
+ *    as SKIPPED (not failed) so a missing runtime never poisons convergence
+ *    feedback or blocks delivery.
+ *  - `UAP_DELIVER_NO_DEPLOY=1` force-skips the tier.
+ *  - The deploy command inherits {@link sanitizedEnv} (secrets stripped,
+ *    `CI=true`), exactly like the other gate rungs.
+ */
+import { type GateRung, type LadderOptions, type LadderResult, type RungResult } from './verifier-ladder.js';
+export interface DeployDevOptions {
+    /** Max chars of command output kept on failure (default 2000). */
+    outputTailChars?: number;
+    /** Compose bring-up timeout (default 120s). */
+    bringUpTimeoutMs?: number;
+    /** Teardown timeout (default 30s). */
+    teardownTimeoutMs?: number;
+    /**
+     * Override docker availability detection — primarily for tests. When
+     * undefined the runner probes `docker --version`.
+     */
+    dockerAvailable?: boolean;
+}
+/**
+ * Run one deploy-dev rung through its bring-up → smoke → teardown lifecycle.
+ * Teardown is best-effort and runs in `finally`; a teardown failure never
+ * flips a passing smoke result.
+ */
+export declare function runDeployDevRung(rung: GateRung, projectRoot: string, options?: DeployDevOptions): RungResult;
+/**
+ * LadderRunFn-compatible runner for the deploy-dev tier: runs each rung through
+ * {@link runDeployDevRung} and aggregates into a {@link LadderResult}. Wire this
+ * as `runTieredLadder`'s `deployDevRunner`.
+ */
+export declare function runDeployDevLadder(rungs: GateRung[], projectRoot: string, options?: LadderOptions): LadderResult;
+//# sourceMappingURL=deploy-dev-gate.d.ts.map

package/dist/delivery/deploy-dev-gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy-dev-gate.d.ts","sourceRoot":"","sources":["../../src/delivery/deploy-dev-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAGH,OAAO,EAKL,KAAK,QAAQ,EACb,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,UAAU,EAChB,MAAM,sBAAsB,CAAC;AAK9B,MAAM,WAAW,gBAAgB;IAC/B,kEAAkE;IAClE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,+CAA+C;IAC/C,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,sCAAsC;IACtC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AA6BD;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,IAAI,EAAE,QAAQ,EACd,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,gBAAqB,GAC7B,UAAU,CAoGZ;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,QAAQ,EAAE,EACjB,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,aAAkB,GAC1B,YAAY,CAqBd"}

package/dist/delivery/deploy-dev-gate.js

@@ -0,0 +1,175 @@
+/**
+ * Local dev deploy + smoke gate (the `deploy-dev` tier).
+ *
+ * Runs a deploy-dev rung as a full lifecycle: optionally bring a docker-compose
+ * stack up (`docker compose up -d --wait`), run the smoke/health check, then
+ * ALWAYS tear the stack down (even on smoke failure or timeout). This gives the
+ * convergence loop real "does it actually run" feedback locally, before the
+ * change is ever committed.
+ *
+ * Safety:
+ *  - When the rung needs docker and docker is unavailable, the tier is reported
+ *    as SKIPPED (not failed) so a missing runtime never poisons convergence
+ *    feedback or blocks delivery.
+ *  - `UAP_DELIVER_NO_DEPLOY=1` force-skips the tier.
+ *  - The deploy command inherits {@link sanitizedEnv} (secrets stripped,
+ *    `CI=true`), exactly like the other gate rungs.
+ */
+import { spawnSync } from 'child_process';
+import { DEFAULT_TAIL_CHARS, formatFeedback, sanitizedEnv, truncateTail, } from './verifier-ladder.js';
+const DEFAULT_BRINGUP_TIMEOUT_MS = 120_000;
+const DEFAULT_TEARDOWN_TIMEOUT_MS = 30_000;
+/** True when the rung's bring-up or teardown shells out to docker. */
+function needsDocker(rung) {
+    return rung.command === 'docker' || rung.teardown?.command === 'docker';
+}
+function dockerIsAvailable(override) {
+    if (typeof override === 'boolean')
+        return override;
+    try {
+        const res = spawnSync('docker', ['--version'], { timeout: 5_000, encoding: 'utf-8' });
+        return res.status === 0;
+    }
+    catch {
+        return false;
+    }
+}
+function skipped(rung, note) {
+    return {
+        id: rung.id,
+        name: rung.name,
+        passed: false,
+        skipped: true,
+        exitCode: null,
+        durationMs: 0,
+        outputTail: note,
+    };
+}
+/**
+ * Run one deploy-dev rung through its bring-up → smoke → teardown lifecycle.
+ * Teardown is best-effort and runs in `finally`; a teardown failure never
+ * flips a passing smoke result.
+ */
+export function runDeployDevRung(rung, projectRoot, options = {}) {
+    const tailChars = options.outputTailChars ?? DEFAULT_TAIL_CHARS;
+    if (process.env.UAP_DELIVER_NO_DEPLOY === '1') {
+        return skipped(rung, 'deploy-dev skipped (UAP_DELIVER_NO_DEPLOY=1)');
+    }
+    const usesDocker = needsDocker(rung);
+    if (usesDocker && !dockerIsAvailable(options.dockerAvailable)) {
+        // Missing runtime is not a code failure — degrade to skipped.
+        return skipped(rung, 'deploy-dev skipped (docker unavailable)');
+    }
+    const env = sanitizedEnv();
+    const start = Date.now();
+    const useCompose = usesDocker && !!rung.teardown;
+    try {
+        // 1. Bring up the compose stack (blocks on container healthchecks).
+        if (useCompose) {
+            const up = spawnSync('docker', ['compose', 'up', '-d', '--wait'], {
+                cwd: projectRoot,
+                encoding: 'utf-8',
+                timeout: options.bringUpTimeoutMs ?? DEFAULT_BRINGUP_TIMEOUT_MS,
+                maxBuffer: 16 * 1024 * 1024,
+                env,
+            });
+            if (up.status !== 0) {
+                const errCode = up.error?.code;
+                const timedOut = errCode === 'ETIMEDOUT' || (up.error && up.signal === 'SIGTERM');
+                const diag = timedOut
+                    ? `Compose bring-up timed out after ${options.bringUpTimeoutMs ?? DEFAULT_BRINGUP_TIMEOUT_MS}ms.`
+                    : 'Compose bring-up failed.';
+                return {
+                    id: rung.id,
+                    name: rung.name,
+                    passed: false,
+                    skipped: false,
+                    exitCode: up.status,
+                    failureReason: timedOut ? 'timeout' : 'exit',
+                    durationMs: Date.now() - start,
+                    outputTail: truncateTail(`${diag}\n${up.stdout ?? ''}\n${up.stderr ?? ''}`, tailChars),
+                };
+            }
+        }
+        // 2. Smoke / health check.
+        const smoke = spawnSync(rung.command, rung.args, {
+            cwd: projectRoot,
+            encoding: 'utf-8',
+            timeout: rung.timeoutMs,
+            maxBuffer: 16 * 1024 * 1024,
+            env,
+        });
+        const passed = smoke.status === 0;
+        let failureReason;
+        let diagnostic = '';
+        if (!passed) {
+            const errCode = smoke.error?.code;
+            if (errCode === 'ETIMEDOUT' || (smoke.error && smoke.signal === 'SIGTERM')) {
+                failureReason = 'timeout';
+                diagnostic = `Smoke check timed out after ${rung.timeoutMs}ms.`;
+            }
+            else if (smoke.error) {
+                failureReason = 'spawn-error';
+                diagnostic = `Smoke check could not run: ${smoke.error.message}`;
+            }
+            else if (smoke.signal) {
+                failureReason = 'signal';
+                diagnostic = `Smoke check killed by signal ${smoke.signal}.`;
+            }
+            else {
+                failureReason = 'exit';
+            }
+        }
+        return {
+            id: rung.id,
+            name: rung.name,
+            passed,
+            skipped: false,
+            exitCode: smoke.status,
+            failureReason,
+            durationMs: Date.now() - start,
+            outputTail: passed
+                ? ''
+                : truncateTail(`${diagnostic}\n${smoke.stdout ?? ''}\n${smoke.stderr ?? ''}`, tailChars),
+        };
+    }
+    finally {
+        // 3. Teardown — always, best-effort.
+        if (rung.teardown) {
+            try {
+                spawnSync(rung.teardown.command, rung.teardown.args, {
+                    cwd: projectRoot,
+                    encoding: 'utf-8',
+                    timeout: options.teardownTimeoutMs ?? rung.teardown.timeoutMs ?? DEFAULT_TEARDOWN_TIMEOUT_MS,
+                    maxBuffer: 16 * 1024 * 1024,
+                    env,
+                });
+            }
+            catch {
+                /* teardown is best-effort; never flips the rung result */
+            }
+        }
+    }
+}
+/**
+ * LadderRunFn-compatible runner for the deploy-dev tier: runs each rung through
+ * {@link runDeployDevRung} and aggregates into a {@link LadderResult}. Wire this
+ * as `runTieredLadder`'s `deployDevRunner`.
+ */
+export function runDeployDevLadder(rungs, projectRoot, options = {}) {
+    const tailChars = options.outputTailChars ?? DEFAULT_TAIL_CHARS;
+    const results = rungs.map((rung) => runDeployDevRung(rung, projectRoot, { outputTailChars: tailChars }));
+    // A skipped deploy-dev rung (docker missing / opted out) must not block
+    // delivery — treat it as a non-blocking pass for the gate aggregate.
+    const requiredRungs = rungs.filter((r) => r.required);
+    const requiredOk = requiredRungs.every((rung) => results.some((r) => r.id === rung.id && (r.passed || r.skipped)));
+    const passedCount = results.filter((r) => r.passed).length;
+    const score = results.length > 0 ? passedCount / results.length : 1;
+    return {
+        passed: requiredOk,
+        score,
+        results,
+        feedback: formatFeedback(results, rungs),
+    };
+}
+//# sourceMappingURL=deploy-dev-gate.js.map

package/dist/delivery/deploy-dev-gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy-dev-gate.js","sourceRoot":"","sources":["../../src/delivery/deploy-dev-gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC1C,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,YAAY,EACZ,YAAY,GAKb,MAAM,sBAAsB,CAAC;AAE9B,MAAM,0BAA0B,GAAG,OAAO,CAAC;AAC3C,MAAM,2BAA2B,GAAG,MAAM,CAAC;AAgB3C,sEAAsE;AACtE,SAAS,WAAW,CAAC,IAAc;IACjC,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,IAAI,IAAI,CAAC,QAAQ,EAAE,OAAO,KAAK,QAAQ,CAAC;AAC1E,CAAC;AAED,SAAS,iBAAiB,CAAC,QAAkB;IAC3C,IAAI,OAAO,QAAQ,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IACnD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,SAAS,CAAC,QAAQ,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC;QACtF,OAAO,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,IAAc,EAAE,IAAY;IAC3C,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,IAAI;QACb,QAAQ,EAAE,IAAI;QACd,UAAU,EAAE,CAAC;QACb,UAAU,EAAE,IAAI;KACjB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,IAAc,EACd,WAAmB,EACnB,UAA4B,EAAE;IAE9B,MAAM,SAAS,GAAG,OAAO,CAAC,eAAe,IAAI,kBAAkB,CAAC;IAEhE,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB,KAAK,GAAG,EAAE,CAAC;QAC9C,OAAO,OAAO,CAAC,IAAI,EAAE,8CAA8C,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,UAAU,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;QAC9D,8DAA8D;QAC9D,OAAO,OAAO,CAAC,IAAI,EAAE,yCAAyC,CAAC,CAAC;IAClE,CAAC;IAED,MAAM,GAAG,GAAG,YAAY,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,MAAM,UAAU,GAAG,UAAU,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC;IAEjD,IAAI,CAAC;QACH,oEAAoE;QACpE,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,EAAE,GAAG,SAAS,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,CAAC,EAAE;gBAChE,GAAG,EAAE,WAAW;gBAChB,QAAQ,EAAE,OAAO;gBACjB,OAAO,EAAE,OAAO,CAAC,gBAAgB,IAAI,0BAA0B;gBAC/D,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;gBAC3B,GAAG;aACJ,CAAC,CAAC;YACH,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACpB,MAAM,OAAO,GAAI,EAAE,CAAC,KAA2C,EAAE,IAAI,CAAC;gBACtE,MAAM,QAAQ,GAAG,OAAO,KAAK,WAAW,IAAI,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC;gBAClF,MAAM,IAAI,GAAG,QAAQ;oBACnB,CAAC,CAAC,oCAAoC,OAAO,CAAC,gBAAgB,IAAI,0BAA0B,KAAK;oBACjG,CAAC,CAAC,0BAA0B,CAAC;gBAC/B,OAAO;oBACL,EAAE,EAAE,IAAI,CAAC,EAAE;oBACX,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,MAAM,EAAE,KAAK;oBACb,OAAO,EAAE,KAAK;oBACd,QAAQ,EAAE,EAAE,CAAC,MAAM;oBACnB,aAAa,EAAE,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM;oBAC5C,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;oBAC9B,UAAU,EAAE,YAAY,CAAC,GAAG,IAAI,KAAK,EAAE,CAAC,MAAM,IAAI,EAAE,KAAK,EAAE,CAAC,MAAM,IAAI,EAAE,EAAE,EAAE,SAAS,CAAC;iBACvF,CAAC;YACJ,CAAC;QACH,CAAC;QAED,2BAA2B;QAC3B,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE;YAC/C,GAAG,EAAE,WAAW;YAChB,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,IAAI,CAAC,SAAS;YACvB,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;YAC3B,GAAG;SACJ,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC;QAClC,IAAI,aAA0C,CAAC;QAC/C,IAAI,UAAU,GAAG,EAAE,CAAC;QACpB,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,OAAO,GAAI,KAAK,CAAC,KAA2C,EAAE,IAAI,CAAC;YACzE,IAAI,OAAO,KAAK,WAAW,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,EAAE,CAAC;gBAC3E,aAAa,GAAG,SAAS,CAAC;gBAC1B,UAAU,GAAG,+BAA+B,IAAI,CAAC,SAAS,KAAK,CAAC;YAClE,CAAC;iBAAM,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;gBACvB,aAAa,GAAG,aAAa,CAAC;gBAC9B,UAAU,GAAG,8BAA8B,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACnE,CAAC;iBAAM,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;gBACxB,aAAa,GAAG,QAAQ,CAAC;gBACzB,UAAU,GAAG,gCAAgC,KAAK,CAAC,MAAM,GAAG,CAAC;YAC/D,CAAC;iBAAM,CAAC;gBACN,aAAa,GAAG,MAAM,CAAC;YACzB,CAAC;QACH,CAAC;QACD,OAAO;YACL,EAAE,EAAE,IAAI,CAAC,EAAE;YACX,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,MAAM;YACN,OAAO,EAAE,KAAK;YACd,QAAQ,EAAE,KAAK,CAAC,MAAM;YACtB,aAAa;YACb,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;YAC9B,UAAU,EAAE,MAAM;gBAChB,CAAC,CAAC,EAAE;gBACJ,CAAC,CAAC,YAAY,CAAC,GAAG,UAAU,KAAK,KAAK,CAAC,MAAM,IAAI,EAAE,KAAK,KAAK,CAAC,MAAM,IAAI,EAAE,EAAE,EAAE,SAAS,CAAC;SAC3F,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,qCAAqC;QACrC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,IAAI,CAAC;gBACH,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE;oBACnD,GAAG,EAAE,WAAW;oBAChB,QAAQ,EAAE,OAAO;oBACjB,OAAO,EAAE,OAAO,CAAC,iBAAiB,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,IAAI,2BAA2B;oBAC5F,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;oBAC3B,GAAG;iBACJ,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,0DAA0D;YAC5D,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,KAAiB,EACjB,WAAmB,EACnB,UAAyB,EAAE;IAE3B,MAAM,SAAS,GAAG,OAAO,CAAC,eAAe,IAAI,kBAAkB,CAAC;IAChE,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CACjC,gBAAgB,CAAC,IAAI,EAAE,WAAW,EAAE,EAAE,eAAe,EAAE,SAAS,EAAE,CAAC,CACpE,CAAC;IAEF,wEAAwE;IACxE,qEAAqE;IACrE,MAAM,aAAa,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IACtD,MAAM,UAAU,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAC9C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CACjE,CAAC;IACF,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC;IAC3D,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAEpE,OAAO;QACL,MAAM,EAAE,UAAU;QAClB,KAAK;QACL,OAAO;QACP,QAAQ,EAAE,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC;KACzC,CAAC;AACJ,CAAC"}

package/dist/delivery/verifier-ladder.d.ts

@@ -10,6 +10,16 @@
  * Detection is npm-centric (package.json scripts); callers targeting other
  * ecosystems can pass explicit rungs.
  */
+/**
+ * Cheap-first promotion tiers. The convergence loop runs the cheapest tier
+ * first and only promotes to the next, more expensive tier once the prior is
+ * green. `fast` is the existing build/typecheck/unit-test/lint band; the
+ * `ci`/`deploy-staging`/`deploy-prod` bands are NEVER run locally — they are
+ * consumed after commit via the CI watcher (see ci-watcher.ts).
+ */
+export type GateTier = 'fast' | 'integration' | 'deploy-dev' | 'ci' | 'deploy-staging' | 'deploy-prod';
+/** Cheap → expensive promotion order. */
+export declare const TIER_ORDER: GateTier[];
 export interface GateRung {
     /** Stable identifier, e.g. 'build', 'typecheck', 'test', 'lint' */
     id: string;
@@ -27,7 +37,24 @@ export interface GateRung {
     required: boolean;
     /** Per-rung timeout in milliseconds */
     timeoutMs: number;
+    /**
+     * Cheap-first promotion tier. Absent ⇒ 'fast' (back-compat: existing
+     * callers and detectors that predate tiering keep working).
+     */
+    tier?: GateTier;
+    /**
+     * Optional teardown run after the rung regardless of outcome (e.g. a
+     * deploy-dev compose down / server kill). Best-effort; a teardown failure
+     * never flips a passing rung to failed.
+     */
+    teardown?: {
+        command: string;
+        args: string[];
+        timeoutMs: number;
+    };
 }
+/** Effective tier for a rung — absent tier means the original `fast` band. */
+export declare function tierOf(rung: GateRung): GateTier;
 export type RungFailureReason = 'exit' | 'timeout' | 'signal' | 'spawn-error';
 export interface RungResult {
     id: string;
@@ -59,17 +86,37 @@ export interface LadderOptions {
     /** Default per-rung timeout in ms (default 300000) */
     timeoutMs?: number;
 }
+export declare const DEFAULT_TAIL_CHARS = 2000;
+export declare function sanitizedEnv(): NodeJS.ProcessEnv;
 /**
  * Detect the gate rungs available in a project from its package.json scripts.
  * Order matters: cheap/structural gates run before expensive ones so failure
  * feedback arrives fast.
  */
 export declare function detectRungs(projectRoot: string, timeoutMs?: number): GateRung[];
+/**
+ * Detect integration / end-to-end suites: npm `test:integration` / `test:e2e`
+ * scripts, or a pytest project declaring an `integration` marker. These cost
+ * more than unit tests, so they live in the `integration` tier and only run
+ * after the fast tier passes.
+ */
+export declare function detectIntegrationRungs(projectRoot: string, scripts: Record<string, string>, timeoutMs?: number): GateRung[];
+/**
+ * Detect a local dev deploy+smoke gate. Priority:
+ *   1. an explicit `deploy:dev` / `smoke:dev` / `smoke` npm script;
+ *   2. a docker-compose file paired with a `smoke` script (compose brought up
+ *      by the deploy-dev runner, torn down via the rung's teardown);
+ * Returns null when nothing is discoverable — the loop still converges on the
+ * fast + integration tiers. The deploy-dev tier is only RUN when the caller
+ * opts in (maxTier >= deploy-dev); detection is always safe.
+ */
+export declare function detectDeployDevRung(projectRoot: string, scripts: Record<string, string>, timeoutMs?: number): GateRung | null;
 /**
  * Detect real gates in non-npm projects: a Makefile test/check/build target,
  * a pytest suite, or a conventional shell test script. Ordered cheap→expensive.
  */
 export declare function detectNonNpmRungs(projectRoot: string, timeoutMs?: number): GateRung[];
+export declare function truncateTail(text: string, maxChars: number): string;
 /** Run a single rung synchronously in the project root. */
 export declare function runRung(rung: GateRung, projectRoot: string, tailChars?: number): RungResult;
 /**
@@ -80,4 +127,34 @@ export declare function runRung(rung: GateRung, projectRoot: string, tailChars?:
 export declare function formatFeedback(results: RungResult[], rungs: GateRung[]): string;
 /** Run the full ladder, honoring fail-fast for required rungs. */
 export declare function runLadder(rungs: GateRung[], projectRoot: string, options?: LadderOptions): LadderResult;
+/** A ladder runner: turns a set of rungs into a result. May be async. */
+export type LadderRunFn = (rungs: GateRung[], projectRoot: string, options?: LadderOptions) => LadderResult | Promise<LadderResult>;
+export interface TieredLadderOptions extends LadderOptions {
+    /**
+     * Highest tier to run locally. Default 'deploy-dev'. The `ci`,
+     * `deploy-staging` and `deploy-prod` tiers are never run locally — they are
+     * verified after commit via the CI watcher — so they are skipped here.
+     */
+    maxTier?: GateTier;
+    /**
+     * Inner per-tier runner. Defaults to {@link runLadder}. Injecting this lets
+     * the convergence loop's integrity wrapper compose around the whole tiered
+     * run while reusing the standard rung execution underneath.
+     */
+    runner?: LadderRunFn;
+    /**
+     * Specialized runner for `deploy-dev` rungs (bring-up + smoke + teardown
+     * lifecycle). When absent, deploy-dev rungs fall back to {@link runner},
+     * which simply spawns the smoke command without managing a compose stack.
+     */
+    deployDevRunner?: LadderRunFn;
+}
+/**
+ * Cheap-first tiered ladder. Runs the cheapest tier first and only promotes to
+ * the next, more expensive tier once the prior tier's required rungs pass. The
+ * result is aggregated into a single {@link LadderResult} so the convergence
+ * loop's per-turn contract (one ladder result, one feedback string) is
+ * unchanged — tier failures flow back through the existing feedback channel.
+ */
+export declare function runTieredLadder(rungs: GateRung[], projectRoot: string, options?: TieredLadderOptions): Promise<LadderResult>;
 //# sourceMappingURL=verifier-ladder.d.ts.map

package/dist/delivery/verifier-ladder.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verifier-ladder.d.ts","sourceRoot":"","sources":["../../src/delivery/verifier-ladder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAMH,MAAM,WAAW,QAAQ;IACvB,mEAAmE;IACnE,EAAE,EAAE,MAAM,CAAC;IACX,4CAA4C;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,iDAAiD;IACjD,OAAO,EAAE,MAAM,CAAC;IAChB,gCAAgC;IAChC,IAAI,EAAE,MAAM,EAAE,CAAC;IACf;;;;OAIG;IACH,QAAQ,EAAE,OAAO,CAAC;IAClB,uCAAuC;IACvC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,SAAS,GAAG,QAAQ,GAAG,aAAa,CAAC;AAE9E,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,CAAC;IAChB,2EAA2E;IAC3E,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,mEAAmE;IACnE,aAAa,CAAC,EAAE,iBAAiB,CAAC;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,qEAAqE;IACrE,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,YAAY;IAC3B,2CAA2C;IAC3C,MAAM,EAAE,OAAO,CAAC;IAChB,4EAA4E;IAC5E,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,sDAAsD;IACtD,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B,gFAAgF;IAChF,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,gFAAgF;IAChF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,sDAAsD;IACtD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAmBD;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,GAAE,MAA2B,GAAG,QAAQ,EAAE,CAwEnG;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,GAAE,MAA2B,GAAG,QAAQ,EAAE,CA8DzG;AAQD,2DAA2D;AAC3D,wBAAgB,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,GAAE,MAA2B,GAAG,UAAU,CA+C/G;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,UAAU,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,MAAM,CAqB/E;AAED,kEAAkE;AAClE,wBAAgB,SAAS,CACvB,KAAK,EAAE,QAAQ,EAAE,EACjB,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,aAAkB,GAC1B,YAAY,CA8Cd"}
+{"version":3,"file":"verifier-ladder.d.ts","sourceRoot":"","sources":["../../src/delivery/verifier-ladder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAMH;;;;;;GAMG;AACH,MAAM,MAAM,QAAQ,GAChB,MAAM,GACN,aAAa,GACb,YAAY,GACZ,IAAI,GACJ,gBAAgB,GAChB,aAAa,CAAC;AAElB,yCAAyC;AACzC,eAAO,MAAM,UAAU,EAAE,QAAQ,EAOhC,CAAC;AAEF,MAAM,WAAW,QAAQ;IACvB,mEAAmE;IACnE,EAAE,EAAE,MAAM,CAAC;IACX,4CAA4C;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,iDAAiD;IACjD,OAAO,EAAE,MAAM,CAAC;IAChB,gCAAgC;IAChC,IAAI,EAAE,MAAM,EAAE,CAAC;IACf;;;;OAIG;IACH,QAAQ,EAAE,OAAO,CAAC;IAClB,uCAAuC;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,IAAI,CAAC,EAAE,QAAQ,CAAC;IAChB;;;;OAIG;IACH,QAAQ,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,EAAE,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC;CACnE;AAED,8EAA8E;AAC9E,wBAAgB,MAAM,CAAC,IAAI,EAAE,QAAQ,GAAG,QAAQ,CAE/C;AAED,MAAM,MAAM,iBAAiB,GAAG,MAAM,GAAG,SAAS,GAAG,QAAQ,GAAG,aAAa,CAAC;AAE9E,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,CAAC;IAChB,2EAA2E;IAC3E,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,mEAAmE;IACnE,aAAa,CAAC,EAAE,iBAAiB,CAAC;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,qEAAqE;IACrE,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,YAAY;IAC3B,2CAA2C;IAC3C,MAAM,EAAE,OAAO,CAAC;IAChB,4EAA4E;IAC5E,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,sDAAsD;IACtD,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B,gFAAgF;IAChF,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,gFAAgF;IAChF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,sDAAsD;IACtD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAGD,eAAO,MAAM,kBAAkB,OAAQ,CAAC;AAOxC,wBAAgB,YAAY,IAAI,MAAM,CAAC,UAAU,CAOhD;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,GAAE,MAA2B,GAAG,QAAQ,EAAE,CAmFnG;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,SAAS,GAAE,MAA2B,GACrC,QAAQ,EAAE,CA2CZ;AAkBD;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC/B,SAAS,GAAE,MAA2B,GACrC,QAAQ,GAAG,IAAI,CAkDjB;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,GAAE,MAA2B,GAAG,QAAQ,EAAE,CA8DzG;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAInE;AAED,2DAA2D;AAC3D,wBAAgB,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,GAAE,MAA2B,GAAG,UAAU,CA+C/G;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,UAAU,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,GAAG,MAAM,CAqB/E;AAED,kEAAkE;AAClE,wBAAgB,SAAS,CACvB,KAAK,EAAE,QAAQ,EAAE,EACjB,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,aAAkB,GAC1B,YAAY,CA8Cd;AAED,yEAAyE;AACzE,MAAM,MAAM,WAAW,GAAG,CACxB,KAAK,EAAE,QAAQ,EAAE,EACjB,WAAW,EAAE,MAAM,EACnB,OAAO,CAAC,EAAE,aAAa,KACpB,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;AAE1C,MAAM,WAAW,mBAAoB,SAAQ,aAAa;IACxD;;;;OAIG;IACH,OAAO,CAAC,EAAE,QAAQ,CAAC;IACnB;;;;OAIG;IACH,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB;;;;OAIG;IACH,eAAe,CAAC,EAAE,WAAW,CAAC;CAC/B;AAYD;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,KAAK,EAAE,QAAQ,EAAE,EACjB,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,mBAAwB,GAChC,OAAO,CAAC,YAAY,CAAC,CAsEvB"}