@tokenoftrust/storefront-runner 2.0.2 → 2.0.3

package/apps/storefront/src/lib/publish/apex-readiness.ts

@@ -1,360 +0,0 @@
-/**
- * Machine-verifiable apex-cutover READINESS gate — the green
- * preconditions that MUST all pass before an owner apex (DNS) cutover is
- * permitted. It consumes the go-live apex machinery:
- * go-live owns the admin Domain Connect/Rollback button, the DNS cutover/rollback
- * CI (`www-domain.yml` → `cutover-dns.mjs`, prior-records persisted to
- * `s3://.../meta/`), and the HMAC completion callback; this gate CONSUMES those and
- * GATES them. Nothing here mutates DNS — it decides whether a cutover is ALLOWED.
- *
- * The gate is a PURE function over a signals bundle so the exact policy is
- * unit-testable independent of the runtime (mirrors `shipReadiness` in
- * `change/ship`'s CLI and the `acceptGate`/`apexCutoverGate` pure decisions). The
- * server endpoint (`GET /api/domain/readiness`) assembles the signals from the
- * live sources via {@link assembleApexReadinessSignals} — the owner capability
- * (`resolveShipCapabilities`), the per-tenant `DomainState` (in-flight run +
- * the CAPTURED revert target), and the consumed dual-run parity / target-health /
- * live-digest evidence record — and the admin Domain display + the `tot go-live`
- * CLI both read the SAME endpoint, so the enforcement gate and the surfaces never
- * diverge.
- *
- * EVIDENCE CONTRACT (the seam the go-live dual-run/health CI feeds): the parity,
- * target-health and live-digest signals are CONSUMED from a per-tenant evidence
- * record persisted at {@link readinessEvidenceKey} (KV). The gate does not RE-RUN
- * dual-run — it reads the record `scripts/publish/dual-run.mjs` + the health
- * probe produce. An absent/garbage record normalises fail-closed (no parity, no
- * digest, unhealthy), so readiness BLOCKS until the go-live CI writes real
- * evidence — never a false "ready" from a missing feed.
- *
- * FAIL-CLOSED throughout:
- * a missing, stale, or failed signal BLOCKS the cutover with an honest,
- * itemized reason — never a false "ready". Absence denies. The gate is
- * ADVISORY-vs-authoritative honest: it reports readiness, but the actual cutover
- * is still owner-gated at `apexCutoverGate`/`guardApexCutover` and executed
- * only by the go-live CI — a green readiness verdict never bypasses those.
- */
-
-/**
- * The consumed dual-run parity evidence (produced by `scripts/publish/dual-run.mjs`
- * — the CloudFront-vs-baseline structural diff the pending-dns-cutover gate
- * wants). This shape is consumed here; dual-run is not re-run. Green = the hard
- * gate dual-run itself enforces: zero CloudFront route failures. `statusMismatches`
- * are surfaced for review (content legitimately differs during a migration) but do
- * NOT block, exactly as `dual-run.mjs` treats them. `digest` ties the evidence to
- * the published bundle it validated, so freshness can be checked against the live
- * digest; `capturedAt` dates it.
- */
-export interface DualRunEvidence {
-  /** Number of routes that FAILED on CloudFront (the hard gate — must be 0). */
-  cfFailures: number;
-  /** Status mismatches vs the baseline — surfaced for review, non-blocking. */
-  statusMismatches: number;
-  /** Total routes probed (context for the itemization; 0 ⇒ no real run). */
-  routes: number;
-  /** The published-bundle digest this evidence was produced against, or null. */
-  digest: string | null;
-  /** When the dual-run evidence was produced (ISO), or null. */
-  capturedAt: string | null;
-}
-
-/** The captured revert target — prior DNS records persisted by a connect/rehearsal run. */
-export interface RevertTarget {
-  /** S3 key of the persisted prior DNS records (`meta/dns-prior-records.*.json`), or null. */
-  key: string | null;
-  /** When they were captured (ISO), or null if never. */
-  capturedAt: string | null;
-}
-
-/**
- * The concrete signals the readiness gate decides over. Assembled server-side
- * from the live sources; every field is fail-closed by construction (a null /
- * false / absent value denies its check).
- */
-export interface ApexReadinessSignals {
-  /**
-   * The acting principal holds the OWNER-ONLY apex-cutover capability
-   * (`resolveShipCapabilities(principal).apexCutover`). A `ship-on-behalf`
-   * developer or an unauthenticated caller is false → denied.
-   */
-  ownerCapable: boolean;
-  /**
-   * A domain connect/rollback run is currently in flight (`runInFlight(state)`).
-   * A cutover cannot start while one is pending its CI callback — the exact race
-   * `DomainState` exists to prevent.
-   */
-  runInFlight: boolean;
-  /**
-   * The consumed dual-run parity evidence, or null when none has been produced
-   * (fail-closed: no evidence ⇒ not green).
-   */
-  dualRun: DualRunEvidence | null;
-  /**
-   * The apex target's health probe passed (the CloudFront/static origin is
-   * serving). Distinct from parity; a false/failed probe blocks. Fail-closed
-   * default false when it could not be established.
-   */
-  targetHealthy: boolean;
-  /**
-   * The digest currently published live (the reviewed tree the cutover would
-   * point traffic at). Evidence must be tied to THIS digest to count as fresh.
-   * Null ⇒ freshness fails closed.
-   */
-  liveDigest: string | null;
-  /** The captured revert target — a rollback must have somewhere to restore FROM. */
-  revert: RevertTarget;
-}
-
-/** A stable id per readiness check, so surfaces can label/order them consistently. */
-export type ApexReadinessCheckId =
-  | "owner-capability"
-  | "no-run-in-flight"
-  | "dual-run-parity"
-  | "target-health"
-  | "evidence-fresh"
-  | "revert-captured";
-
-/** One itemized readiness check — ok/blocked plus an honest human-legible detail. */
-export interface ApexReadinessCheck {
-  id: ApexReadinessCheckId;
-  /** Short label for the surface (admin chip / CLI line). */
-  label: string;
-  /** True when this precondition is satisfied. */
-  ok: boolean;
-  /** Why it passed or, more importantly, why it's blocking — always actionable. */
-  detail: string;
-  /**
-   * The concrete action that clears this precondition when it's blocking — the
-   * "how to get ready" guide, carried on the gate itself so the admin panel and
-   * `tot go-live` surface identical remediation (never a divergent side doc). Only
-   * meaningful/shown when `ok` is false; the full operator walkthrough (secret
-   * provisioning, IAM) lives in `docs/runbooks/apex-cutover-readiness.md`.
-   */
-  remedy: string;
-}
-
-/** The full readiness verdict: ready iff EVERY check passed; itemized either way. */
-export interface ApexReadiness {
-  /** True only when all checks pass — fail-closed on any missing/failed signal. */
-  ready: boolean;
-  /** Every check, in a stable order, whether it passed or blocked. */
-  checks: ApexReadinessCheck[];
-  /** The details of the blocking checks only (empty ⇒ ready). Convenience for surfaces. */
-  blockedReasons: string[];
-}
-
-/**
- * Compute apex-cutover readiness from the signals — PURE, total, fail-closed. The
- * order is deliberate (owner → in-flight → parity → health → freshness → revert)
- * so the most fundamental blocker surfaces first, mirroring `shipReadiness`.
- *
- * The cutover is READY only when ALL checks pass. Any missing signal (null
- * evidence, null digest, absent revert key) is a BLOCK with an honest reason,
- * never a silent pass.
- */
-export function computeApexReadiness(signals: ApexReadinessSignals): ApexReadiness {
-  const checks: ApexReadinessCheck[] = [];
-
-  // 1. Owner-only capability. A non-owner is denied outright — this is the
-  //    same floor `apexCutoverGate` enforces, surfaced as a readiness item.
-  checks.push({
-    id: "owner-capability",
-    label: "Owner capability",
-    ok: signals.ownerCapable,
-    detail: signals.ownerCapable
-      ? "you hold the owner-only apex-cutover capability"
-      : "apex cutover is owner-only — a ship-on-behalf developer cannot cut over the apex",
-    remedy: "Sign in as the store owner — apex cutover cannot be delegated to a ship-on-behalf developer.",
-  });
-
-  // 2. No run in flight — two concurrent DNS mutations is the race DomainState guards.
-  checks.push({
-    id: "no-run-in-flight",
-    label: "No run in flight",
-    ok: !signals.runInFlight,
-    detail: signals.runInFlight
-      ? "a domain connect/rollback run is already in flight — wait for it to complete"
-      : "no domain run is in flight",
-    remedy: "Wait for the in-flight connect/rollback run to finish (watch the run log), then re-check.",
-  });
-
-  // 3. Dual-run parity — zero CloudFront route failures (the hard gate dual-run.mjs
-  //    itself enforces). Missing evidence fails closed. Status mismatches are
-  //    surfaced but do NOT block (content legitimately differs mid-migration).
-  const dr = signals.dualRun;
-  const parityOk = !!dr && dr.routes > 0 && dr.cfFailures === 0;
-  checks.push({
-    id: "dual-run-parity",
-    label: "Dual-run parity",
-    ok: parityOk,
-    detail: !dr
-      ? "no dual-run parity evidence — run the CloudFront-vs-baseline dual-run first"
-      : dr.routes === 0
-        ? "dual-run evidence covered 0 routes — not a real parity run"
-        : dr.cfFailures > 0
-          ? `dual-run parity failing: ${dr.cfFailures} CloudFront route failure(s) of ${dr.routes}`
-          : `dual-run green: 0 CloudFront failures across ${dr.routes} route(s)` +
-            (dr.statusMismatches > 0
-              ? ` (${dr.statusMismatches} status mismatch(es) surfaced for review — non-blocking)`
-              : ""),
-    remedy:
-      "Publish tokenoftrust.com (a www-publish run) so the dual-run records fresh evidence. " +
-      "First time only: provision the WWW_READINESS_EVIDENCE_URL variable + WWW_READINESS_EVIDENCE_SECRET " +
-      "secret (see the apex-cutover-readiness runbook).",
-  });
-
-  // 4. Target health — the apex target (CloudFront/static origin) is serving.
-  checks.push({
-    id: "target-health",
-    label: "Target health",
-    ok: signals.targetHealthy,
-    detail: signals.targetHealthy
-      ? "apex target health check passed"
-      : "apex target health check failing or unestablished",
-    remedy:
-      "Cleared by the same www-publish evidence run as Dual-run parity — every route serving " +
-      "correctly on CloudFront is what proves the target healthy.",
-  });
-
-  // 5. Evidence freshness — the parity evidence is tied to the CURRENT live digest.
-  //    Stale evidence (a different digest) or a missing digest on either side fails
-  //    closed.
-  const evidenceDigest = dr?.digest ?? null;
-  const freshOk =
-    !!evidenceDigest && !!signals.liveDigest && evidenceDigest === signals.liveDigest;
-  checks.push({
-    id: "evidence-fresh",
-    label: "Evidence fresh",
-    ok: freshOk,
-    detail: freshOk
-      ? `evidence is tied to the live digest (${short(signals.liveDigest)})`
-      : !signals.liveDigest
-        ? "no live digest to tie the evidence to"
-        : !evidenceDigest
-          ? "parity evidence carries no digest — cannot confirm it matches the live tree"
-          : `parity evidence is stale: it was produced against ${short(evidenceDigest)}, ` +
-            `not the live digest ${short(signals.liveDigest)}`,
-    remedy:
-      "Re-publish tokenoftrust.com so the dual-run evidence is re-tied to the current live digest.",
-  });
-
-  // 6. Captured revert target — a rollback must have persisted prior DNS records to
-  //    restore FROM. No captured target ⇒ the cutover has no tested one-line revert.
-  const revertOk = !!signals.revert.key;
-  checks.push({
-    id: "revert-captured",
-    label: "Revert captured",
-    ok: revertOk,
-    detail: revertOk
-      ? `captured revert target present (prior DNS records${
-          signals.revert.capturedAt ? ` @ ${signals.revert.capturedAt}` : ""
-        })`
-      : "no captured revert target — prior DNS records are not persisted, so there is no tested rollback",
-    remedy:
-      "Run a rehearsal (dry-run connect) from the Domain section — it captures the current DNS " +
-      "records as the rollback target without changing live DNS.",
-  });
-
-  const blockedReasons = checks.filter((c) => !c.ok).map((c) => c.detail);
-  return { ready: blockedReasons.length === 0, checks, blockedReasons };
-}
-
-/** Normalise a raw `dual-run.mjs --json` summary into {@link DualRunEvidence}. Pure.
- *  Tolerant of the shape the script prints (`{ summary: { routes, cfFailures,
- *  statusMismatches } }`) as well as a flattened record; returns null for anything
- *  unrecognisable so the gate fails closed on garbage. `digest`/`capturedAt` are
- *  read from the wrapping evidence record (the script itself doesn't stamp them). */
-export function normalizeDualRunEvidence(raw: unknown): DualRunEvidence | null {
-  if (!raw || typeof raw !== "object") return null;
-  const o = raw as Record<string, unknown>;
-  const summary =
-    o.summary && typeof o.summary === "object" ? (o.summary as Record<string, unknown>) : o;
-  const cfFailures = num(summary.cfFailures);
-  const routes = num(summary.routes);
-  const statusMismatches = num(summary.statusMismatches);
-  if (cfFailures === null || routes === null) return null;
-  return {
-    cfFailures,
-    routes,
-    statusMismatches: statusMismatches ?? 0,
-    digest: typeof o.digest === "string" ? o.digest : null,
-    capturedAt: typeof o.capturedAt === "string" ? o.capturedAt : null,
-  };
-}
-
-function num(v: unknown): number | null {
-  return typeof v === "number" && Number.isFinite(v) ? v : null;
-}
-
-// ─── Evidence record + signal assembly (the endpoint's non-pure boundary) ─────────
-
-/**
- * The consumed readiness-evidence record the go-live dual-run/health CI persists
- * per tenant. Bundles the three signals the gate
- * cannot derive from `DomainState` alone: the dual-run parity result, the apex
- * target's health, and the digest currently live (so freshness can be checked).
- * The gate READS it; it does not produce it.
- */
-export interface ReadinessEvidence {
-  dualRun: DualRunEvidence | null;
-  targetHealthy: boolean;
-  liveDigest: string | null;
-}
-
-/** KV key for a tenant's consumed readiness-evidence record. */
-export function readinessEvidenceKey(tenantId: string): string {
-  return `www-domain:readiness-evidence:${tenantId}`;
-}
-
-/**
- * Normalise a raw persisted evidence record into {@link ReadinessEvidence},
- * FAIL-CLOSED: anything unrecognisable yields no parity, an unhealthy target, and
- * no live digest — so the gate blocks rather than trusting a malformed feed. Pure.
- */
-export function normalizeReadinessEvidence(raw: unknown): ReadinessEvidence {
-  if (!raw || typeof raw !== "object") {
-    return { dualRun: null, targetHealthy: false, liveDigest: null };
-  }
-  const o = raw as Record<string, unknown>;
-  return {
-    dualRun: normalizeDualRunEvidence(o.dualRun ?? o),
-    targetHealthy: o.targetHealthy === true,
-    liveDigest: typeof o.liveDigest === "string" ? o.liveDigest : null,
-  };
-}
-
-/** The state fields the readiness signals draw from `DomainState` (structural, no import). */
-export interface ReadinessDomainState {
-  /** True when the last run is still awaiting its CI callback (`runInFlight`). */
-  runInFlight: boolean;
-  /** The captured prior-DNS-records pointer (`priorRecordsKey`), or null. */
-  priorRecordsKey: string | null;
-  /** When those prior records were captured (`priorCapturedAt`), or null. */
-  priorCapturedAt: string | null;
-}
-
-/**
- * Assemble the {@link ApexReadinessSignals} the gate decides over from the three
- * live sources — the owner capability, the per-tenant domain state (revert +
- * in-flight), and the consumed evidence record — PURE so the endpoint's mapping is
- * unit-testable without KV/session I/O. The endpoint does the reads; this does the
- * mapping.
- */
-export function assembleApexReadinessSignals(input: {
-  ownerCapable: boolean;
-  state: ReadinessDomainState;
-  evidence: ReadinessEvidence;
-}): ApexReadinessSignals {
-  return {
-    ownerCapable: input.ownerCapable,
-    runInFlight: input.state.runInFlight,
-    dualRun: input.evidence.dualRun,
-    targetHealthy: input.evidence.targetHealthy,
-    liveDigest: input.evidence.liveDigest,
-    revert: { key: input.state.priorRecordsKey, capturedAt: input.state.priorCapturedAt },
-  };
-}
-
-/** Short 12-char digest for legible details (full digest stays in the raw signal). */
-function short(digest: string | null): string {
-  return digest ? digest.slice(0, 12) : "(none)";
-}

package/apps/storefront/src/lib/publish/buildStream.ts

@@ -1,269 +0,0 @@
-/**
- * Pure logic for the admin Publish tab's real-time build/check streaming (SSE).
- *
- * The build endpoint (`POST /api/preview/build` with `Accept: text/event-stream`)
- * streams coarse lifecycle PHASES as it materializes a candidate — resolve head →
- * read+validate tenant files → publish the immutable version → run evidence checks —
- * then a terminal `result` event carrying the full outcome. This module is the tested
- * source of truth for:
- *   - parsing the raw SSE byte-frames into events (partial-chunk safe);
- *   - mapping a phase to its human label + rail position;
- *   - reducing the event sequence into a render-ready progress state;
- *   - assembling the "Copy for your AI agent" prompt from a build FAILURE.
- * The DOM wiring that drives the dialog from these is verified on a live preview, per
- * this codebase's client-island convention (see reviewReleaseWorkspace/controller.ts).
- */
-
-/** One decoded SSE event: its `event:` name and the concatenated `data:` payload. */
-export interface SseEvent {
-  event: string;
-  data: string;
-}
-
-/**
- * Parse an accumulated SSE text buffer into complete events, returning any trailing
- * INCOMPLETE frame as `rest` for the next chunk to prepend. Partial-chunk safe: a
- * frame is complete only once its blank-line terminator (`\n\n`) has arrived.
- * Lines with no field (`:` comments, stray blanks) are ignored; multiple `data:`
- * lines in one frame join with `\n` (the SSE spec). A frame with no fields yields
- * nothing.
- */
-export function parseSseChunk(buffer: string): { events: SseEvent[]; rest: string } {
-  const normalized = buffer.replace(/\r\n/g, "\n").replace(/\r/g, "\n");
-  const events: SseEvent[] = [];
-  const lastSep = normalized.lastIndexOf("\n\n");
-  if (lastSep === -1) return { events, rest: normalized };
-
-  const complete = normalized.slice(0, lastSep);
-  const rest = normalized.slice(lastSep + 2);
-
-  for (const frame of complete.split("\n\n")) {
-    let eventName = "message";
-    const dataLines: string[] = [];
-    let sawField = false;
-    for (const rawLine of frame.split("\n")) {
-      if (!rawLine || rawLine.startsWith(":")) continue;
-      const colon = rawLine.indexOf(":");
-      const field = colon === -1 ? rawLine : rawLine.slice(0, colon);
-      // Per spec a single leading space after the colon is stripped.
-      let value = colon === -1 ? "" : rawLine.slice(colon + 1);
-      if (value.startsWith(" ")) value = value.slice(1);
-      if (field === "event") {
-        eventName = value;
-        sawField = true;
-      } else if (field === "data") {
-        dataLines.push(value);
-        sawField = true;
-      }
-    }
-    if (sawField) events.push({ event: eventName, data: dataLines.join("\n") });
-  }
-  return { events, rest };
-}
-
-/** The ordered build lifecycle stages the flight rail renders (mirrors the dialog). */
-export const BUILD_STAGES = ["resolve", "read", "publish", "check"] as const;
-export type BuildStage = (typeof BUILD_STAGES)[number];
-
-/** The `phase` values the server emits, in lifecycle order. */
-export type BuildPhase = "resolving" | "reading" | "publishing" | "checking";
-
-const PHASE_TO_STAGE: Record<BuildPhase, BuildStage> = {
-  resolving: "resolve",
-  reading: "read",
-  publishing: "publish",
-  checking: "check",
-};
-
-const PHASE_LABEL: Record<BuildPhase, string> = {
-  resolving: "Locating the pull request's latest commit…",
-  reading: "Reading and validating your store's files…",
-  publishing: "Publishing this version's preview…",
-  checking: "Running the checks on this version…",
-};
-
-const STAGE_LABEL: Record<BuildStage, string> = {
-  resolve: "Locate commit",
-  read: "Read & validate",
-  publish: "Publish version",
-  check: "Run checks",
-};
-
-export function buildPhaseLabel(phase: BuildPhase): string {
-  return PHASE_LABEL[phase];
-}
-
-export function buildStageLabel(stage: BuildStage): string {
-  return STAGE_LABEL[stage];
-}
-
-export function isBuildPhase(value: unknown): value is BuildPhase {
-  return value === "resolving" || value === "reading" || value === "publishing" || value === "checking";
-}
-
-/** The terminal outcome the server reports on its `result` event. */
-export type BuildOutcome = "ok" | "blocked" | "failed";
-
-/** The full terminal payload of a build (mirrors the endpoint's JSON body). */
-export interface BuildResult {
-  ok: boolean;
-  outcome: BuildOutcome;
-  tenantId?: string | null;
-  changeId?: string | null;
-  headSha?: string | null;
-  prNumber?: number | null;
-  previewUrl?: string | null;
-  errors?: string[];
-  error?: string | null;
-  findings?: BuildFinding[];
-}
-
-export interface BuildFinding {
-  id?: string;
-  label?: string;
-  detail?: string;
-  disposition?: string;
-}
-
-/** Render-ready progress the dialog reads. `stageState` is a per-stage rail map. */
-export interface BuildProgress {
-  phase: BuildPhase | null;
-  liveLabel: string;
-  stageState: Record<BuildStage, "pending" | "active" | "done" | "fail">;
-  terminal: boolean;
-  result: BuildResult | null;
-}
-
-export function initialBuildProgress(): BuildProgress {
-  return {
-    phase: null,
-    liveLabel: "Starting…",
-    stageState: { resolve: "pending", read: "pending", publish: "pending", check: "pending" },
-    terminal: false,
-    result: null,
-  };
-}
-
-/**
- * Advance the flight rail to `stage`: everything before it is `done`, it is `active`,
- * everything after stays `pending`. A `fail` mark is never un-done. Pure.
- */
-function railTo(
-  prev: Record<BuildStage, "pending" | "active" | "done" | "fail">,
-  stage: BuildStage,
-): Record<BuildStage, "pending" | "active" | "done" | "fail"> {
-  const idx = BUILD_STAGES.indexOf(stage);
-  const next = { ...prev };
-  BUILD_STAGES.forEach((s, i) => {
-    if (next[s] === "fail") return;
-    next[s] = i < idx ? "done" : i === idx ? "active" : "pending";
-  });
-  return next;
-}
-
-/**
- * Fold one SSE event into the progress state. A `phase` event advances the rail + live
- * label; a `result` event is terminal (all reached stages `done` on success, the active
- * stage `fail` on a blocked/failed outcome). Unknown events are ignored (state
- * unchanged). Pure — the dialog calls this per event and re-renders from the result.
- */
-export function reduceBuildProgress(prev: BuildProgress, ev: SseEvent): BuildProgress {
-  if (ev.event === "phase") {
-    const parsed = safeParse(ev.data);
-    const phase = parsed && (parsed as { phase?: unknown }).phase;
-    if (!isBuildPhase(phase)) return prev;
-    const stage = PHASE_TO_STAGE[phase];
-    const label =
-      (parsed && typeof (parsed as { label?: unknown }).label === "string"
-        ? (parsed as { label: string }).label
-        : "") || buildPhaseLabel(phase);
-    return {
-      ...prev,
-      phase,
-      liveLabel: label,
-      stageState: railTo(prev.stageState, stage),
-    };
-  }
-
-  if (ev.event === "result") {
-    const parsed = (safeParse(ev.data) as BuildResult | null) ?? {
-      ok: false,
-      outcome: "failed",
-      errors: ["build ended without a result"],
-    };
-    const result: BuildResult = {
-      ...parsed,
-      outcome: parsed.outcome ?? (parsed.ok ? "ok" : "failed"),
-    };
-    let stageState = prev.stageState;
-    if (result.ok) {
-      stageState = { resolve: "done", read: "done", publish: "done", check: "done" };
-    } else {
-      // Fail the stage that was active (the phase we got furthest into); if none was
-      // active yet, fail the first stage so the rail shows an honest stop point.
-      const active = BUILD_STAGES.find((s) => prev.stageState[s] === "active") ?? BUILD_STAGES[0];
-      stageState = { ...prev.stageState, [active]: "fail" };
-    }
-    return {
-      ...prev,
-      liveLabel: result.ok ? "Done." : "Stopped.",
-      stageState,
-      terminal: true,
-      result,
-    };
-  }
-
-  return prev;
-}
-
-/** The human-readable failure detail (the honest reason), joined from errors/findings. */
-export function buildFailureDetail(result: BuildResult): string {
-  const parts: string[] = [];
-  for (const e of result.errors ?? []) if (e && e.trim()) parts.push(e.trim());
-  if (result.error && result.error.trim()) parts.push(result.error.trim());
-  for (const f of result.findings ?? []) {
-    const line = [f.label || f.id, f.detail].filter(Boolean).join(": ");
-    if (line) parts.push((f.disposition === "blocking-safety" ? "[blocking] " : "") + line);
-  }
-  return parts.join("\n");
-}
-
-/**
- * Assemble the "Copy for your AI agent" prompt from a build FAILURE — the honest,
- * paste-ready brief an operator hands to a coding agent to diagnose why the preview
- * build/checks failed. Mirrors the merge-conflict copy pattern (a framed ask + the
- * system's own words), never a bare error dump.
- */
-export function assembleBuildFailureCopy(input: {
-  tenant: string;
-  prNumber?: number | null;
-  changeId?: string | null;
-  result: BuildResult;
-}): string {
-  const { tenant, prNumber, changeId, result } = input;
-  const pr = prNumber != null ? `PR #${prNumber}` : changeId ? `change ${changeId}` : "my open candidate PR";
-  const stage = result.outcome === "blocked" ? "was blocked by a check" : "failed to build";
-  const detail = buildFailureDetail(result) || "(no detail was reported)";
-  return [
-    `In my ${tenant} store, the preview build for ${pr} ${stage}. ` +
-      `Diagnose why from the detail below, then tell me the exact file(s) to change and the fix.`,
-    "",
-    "What the build reported:",
-    detail,
-    "",
-    result.headSha ? `Head commit: ${result.headSha}` : "",
-    "Context: this is a Token of Trust storefront tenant repo — customization files are " +
-      "mapped to artifacts and validated against the tenant-editable manifest before the " +
-      "version is published. A blocking finding or a validation error stops the build.",
-  ]
-    .filter((l) => l !== "")
-    .join("\n");
-}
-
-function safeParse(text: string): unknown {
-  try {
-    return JSON.parse(text);
-  } catch {
-    return null;
-  }
-}