@vibesdotdev/infra-deploy 0.0.2 → 1.0.0-rc.4

package/dist/cli/run/deploy-smoke.js

@@ -0,0 +1,251 @@
+import { settle } from '@vibesdotdev/kernel';
+import * as z from 'zod/v4';
+import { infraDeployLogger } from "../../logger.js";
+function smokeTargetUrl(deployment, deployedUrl, environmentResolution) {
+    // Declared topology comes FIRST. An app whose ONLY origins are
+    // kind:'internal' is reached exclusively over service bindings / queues and
+    // has no public health surface BY DESIGN — probing its logical hostname can
+    // never connect (measured: vibes-forge-ci, 2026-07-26), and the
+    // wrangler-reported workers.dev URL must not override that: a queue-only
+    // worker exports no fetch handler at all, so that URL answers HTTP 500
+    // forever on a perfectly healthy deploy (measured: vibes-ai-jobs,
+    // 2026-07-26 — two false DEPLOY FAILED ledger rows on successful uploads).
+    // The schema requires >=1 origin, so this is deliberate topology, not a
+    // missing config.
+    if (deployment.origins.length > 0 &&
+        deployment.origins.every((origin) => origin.kind === 'internal')) {
+        return {
+            skip: 'all origins are kind:internal (service-binding only); nothing publicly probeable'
+        };
+    }
+    if (environmentResolution && environmentResolution.environment !== 'production') {
+        const origin = environmentResolution.selectedOrigin;
+        if (!origin || !URL.canParse(origin) || new URL(origin).protocol !== 'https:') {
+            return {
+                error: `No public origin for selected environment "${environmentResolution.environment}"; refusing production smoke fallback.`
+            };
+        }
+        return origin;
+    }
+    if (deployedUrl && deployedUrl.startsWith('https://'))
+        return deployedUrl;
+    const primary = deployment.origins.find((origin) => origin.kind === 'primary');
+    if (primary?.origin)
+        return primary.origin;
+    if (primary?.hostname)
+        return `https://${primary.hostname}`;
+    const first = deployment.origins[0];
+    if (first?.origin)
+        return first.origin;
+    if (first?.hostname)
+        return `https://${first.hostname}`;
+    return undefined;
+}
+/**
+ * A build identity is what `VIBES_BUILD_VERSION` carries: a commit sha. Only
+ * two sha-shaped values can be compared for freshness.
+ *
+ * Anything else an app happens to stamp into `version.name` — `createKitVersion`'s
+ * `Date.now()` fallback, or a hand-written app label — is not a build identity,
+ * and comparing it against a commit proves nothing about which build is serving.
+ *
+ * Measured 2026-08-20 on casework, whose config resolved
+ * `name ?? VIBES_BUILD_VERSION` and so stamped the constant `casework-app`
+ * on every build. The probe compared that to the deployed sha, could never match,
+ * and reported DEPLOY FAILED with `consider wrangler rollback` — against a deploy
+ * that had in fact succeeded and was serving correctly.
+ *
+ * SCOPE, deliberately narrow: this only enriches the DIAGNOSIS. The verdict is
+ * unchanged — a mismatch is still a stale failure, which is a contract an
+ * existing test states outright ("a NON-numeric mismatch is still a hard stale
+ * failure"). Flipping that would trade a false-fail for a false-pass, and a
+ * stale worker waved through is the more expensive error for everyone
+ * downstream. Whether an incomparable stamp should instead read UNVERIFIED —
+ * generalising the numeric-fallback branch — is a real question, but it is a
+ * contract change and belongs to whoever owns this gate, not to a drive-by.
+ */
+const BuildIdentitySchema = z.string().trim();
+export function isComparableBuildIdentity(value) {
+    const parsed = BuildIdentitySchema.safeParse(value);
+    if (!parsed.success)
+        return false;
+    const stamp = parsed.data;
+    // An all-digit stamp is `createKitVersion`'s documented `Date.now()` fallback.
+    // It has to be rejected EXPLICITLY: digits are hex characters, so a timestamp
+    // sails through a bare /^[0-9a-f]+$/ test and gets compared to a commit as
+    // though it were one — which is how `1785009445256 != 18d8e457…` was once
+    // reported as a stale worker.
+    if (/^\d+$/.test(stamp))
+        return false;
+    return /^[0-9a-f]{7,64}$/i.test(stamp);
+}
+const LiveVersionBodySchema = z.object({
+    version: z.string().optional()
+});
+/**
+ * Read the live origin's SvelteKit build identity. Returns `null` when the app
+ * does not publish one — treated as "cannot tell", never as "stale", because a
+ * non-SvelteKit or older app must not fail a deploy for lacking the file.
+ */
+async function readLiveVersion(origin, fetchImpl, runtime) {
+    const outcome = await settle(async () => {
+        const response = await fetchImpl(new URL('/_app/version.json', origin).toString(), {
+            headers: { 'User-Agent': 'vibes-infra-deploy-smoke/1.0' }
+        });
+        if (!response.ok)
+            return null;
+        const json = await response.json();
+        const parsed = LiveVersionBodySchema.safeParse(json);
+        return parsed.success ? (parsed.data.version ?? null) : null;
+    });
+    if (!outcome.ok) {
+        // Unreachable or unparseable version.json is not evidence of staleness;
+        // the reason is reported so "cannot tell" is never silent.
+        const reason = outcome.cause instanceof Error ? outcome.cause.message : outcome.cause.description;
+        infraDeployLogger(runtime).warn('Live /_app/version.json could not be read', {
+            origin,
+            reason
+        });
+        return null;
+    }
+    return outcome.value;
+}
+async function probe(url, fetchImpl) {
+    const response = await fetchImpl(url, {
+        headers: { 'User-Agent': 'vibes-infra-deploy-smoke/1.0' },
+        // `redirect: 'manual'` is the whole point of this probe.
+        //
+        // Following redirects made this instrument report something other than what
+        // it claimed. Measured against a real deploy of platform-web: the worker
+        // answers 302 to https://auth.vibes.dev/?client=platform&redirect_to=... ,
+        // the probe followed it, and reported `OK (HTTP 200; cf-ray ...)` — a status
+        // that came from AUTH-WEB, not from the app just deployed. Every auth-gated
+        // app was being certified by whatever its sign-in host happened to return,
+        // and a worker with no routes bound would have passed the same way.
+        //
+        // A 3xx from the deployed origin is a legitimate PASS: answering at all is
+        // what is being tested. What is not acceptable is judging someone else's
+        // response and calling it this app's.
+        redirect: 'manual'
+    });
+    const cfRay = response.headers.get('cf-ray');
+    if (response.status >= 500)
+        return { ok: false, detail: `HTTP ${response.status}` };
+    if (!cfRay)
+        return { ok: false, detail: `HTTP ${response.status}; missing cf-ray header` };
+    // Say where a redirect went. The status alone reads as healthy while hiding
+    // that the app handed the request to a different origin entirely.
+    const location = response.headers.get('location');
+    const redirectNote = response.status >= 300 && response.status < 400 && location ? `; -> ${location}` : '';
+    return { ok: true, detail: `HTTP ${response.status}${redirectNote}; cf-ray ${cfRay}` };
+}
+/**
+ * Post-deploy live probe: THE DEPLOYED ORIGIN ITSELF must answer below 500
+ * through Cloudflare (cf-ray present) within the retry window. This is the
+ * in-process home of scripts/cf-smoke-test.ts, which was only reachable from a
+ * dispatch-only workflow while the marker could report a false DEPLOY FAILED
+ * on rate-limited runs — the live probe is the counter-signal.
+ *
+ * What this probe does NOT establish, so nobody reads more into a green than it
+ * carries: `cf-ray` proves a Cloudflare edge answered, not that YOUR newly
+ * deployed worker answered. A stale worker, a route bound to the wrong script,
+ * or a Cloudflare error page all carry one. Proving provenance needs a
+ * deploy-stamped response header compared against the SHA just deployed, or a
+ * probe of an app-declared health path — `AppDeployment` carries neither today.
+ * Until it does, this reports liveness of the origin, not identity of the build.
+ */
+export async function runDeploySmokeProbe(options) {
+    const fetchImpl = options.fetchImpl ?? fetch;
+    const retryWindowMs = options.retryWindowMs ?? 30_000;
+    const pollIntervalMs = options.pollIntervalMs ?? 1_000;
+    // LIVENESS and FRESHNESS are different failure modes and deserve different
+    // patience. An origin that cannot answer in 30s is broken. An origin still
+    // serving the previous version for a minute or two is ordinary Cloudflare
+    // propagation — and reporting that as DEPLOY FAILED is worse than useless:
+    // it trains readers to disbelieve the smoke, and the next real stale worker
+    // gets waved through. Observed 2026-08-05 on platform-web, which reported
+    // `stale build serving` and was serving the new build minutes later.
+    // Derived from the liveness window rather than hardcoded, so every existing
+    // caller scales with it: production's 30s becomes 180s of propagation
+    // patience, while a test that shortens retryWindowMs stays fast instead of
+    // hanging for three minutes.
+    const freshnessWindowMs = options.freshnessWindowMs ?? retryWindowMs * 6;
+    const onLine = options.onLine ?? (() => undefined);
+    const target = smokeTargetUrl(options.deployment, options.deployedUrl, options.environmentResolution);
+    const TargetUrlSchema = z.string().min(1);
+    const parsedUrl = TargetUrlSchema.safeParse(target);
+    if (!parsedUrl.success) {
+        const SmokeTargetOutcomeSchema = z.union([
+            z.object({ skip: z.string() }),
+            z.object({ error: z.string() })
+        ]);
+        const targetOutcome = SmokeTargetOutcomeSchema.safeParse(target);
+        if (targetOutcome.success) {
+            if ('error' in targetOutcome.data)
+                return { ok: false, detail: targetOutcome.data.error };
+            onLine('stdout', `[smoke] ${options.deployment.appId} SKIPPED: ${targetOutcome.data.skip}`);
+            return { ok: true, skipped: true, detail: targetOutcome.data.skip };
+        }
+        return { ok: true, skipped: true, detail: 'no primary origin to probe' };
+    }
+    const url = parsedUrl.data;
+    const deadline = Date.now() + retryWindowMs;
+    // Starts when liveness passes, not at probe start — propagation time should
+    // not be spent waiting for the origin to come up.
+    let freshnessDeadline = null;
+    let lastDetail = 'not attempted';
+    for (;;) {
+        const probeOutcome = await settle(() => probe(url, fetchImpl));
+        if (!probeOutcome.ok) {
+            lastDetail = probeOutcome.cause instanceof Error ? probeOutcome.cause.message : probeOutcome.cause.description;
+        }
+        else {
+            const result = probeOutcome.value;
+            lastDetail = result.detail;
+            if (result.ok) {
+                // Liveness passed. Now FRESHNESS, when the caller told us what it
+                // shipped — a stale worker reaches this exact line with an identical
+                // result, so answering is not evidence the deploy took.
+                const expected = options.expectedVersion?.trim();
+                if (expected) {
+                    const live = await readLiveVersion(url, fetchImpl, options.runtime);
+                    // Coordinator policy (codex, 2026-08-20) closed the numeric fail-open
+                    // too: a `Date.now()` stamp is exactly as incomparable to a commit as
+                    // an app label is, so both are ONE case — the identity channel is
+                    // broken and the serving build cannot be named. The cost is accepted:
+                    // an app that does not plumb VIBES_BUILD_VERSION fails its seal until
+                    // it does, which is a producer fix of the kind casework just took.
+                    const isBrokenIdentityChannel = live !== null && !isComparableBuildIdentity(live);
+                    if (live && (isBrokenIdentityChannel || live !== expected)) {
+                        // Retry rather than fail outright: propagation is not instant, and
+                        // the deadline below decides. A mismatch that OUTLASTS the retry
+                        // window is a stale worker, which is the whole point.
+                        lastDetail = isBrokenIdentityChannel
+                            ? `build identity invalid: live stamp ${JSON.stringify(live)} is not a build identity (deployed ${expected}). This app is not stamping VIBES_BUILD_VERSION into version.name, so the serving build cannot be identified. This is NOT evidence of a stale worker — do not roll back; fix the producer, redeploy, and require version.json to equal the deployed commit.`
+                            : `stale build serving: live ${live} != deployed ${expected} — inspect active routes and traffic before rolling back`;
+                        freshnessDeadline ??= Date.now() + freshnessWindowMs;
+                        if (Date.now() >= freshnessDeadline)
+                            break;
+                        await options.runtime.lifecycle.delay(pollIntervalMs);
+                        continue;
+                    }
+                    if (live && !isBrokenIdentityChannel) {
+                        onLine('stdout', `[smoke] ${options.deployment.appId} ${url} OK (${result.detail}; build ${live} FRESH)`);
+                        return { ok: true, url, detail: `${result.detail}; build ${live} fresh` };
+                    }
+                    // No version.json — say so instead of implying freshness was checked.
+                    onLine('stdout', `[smoke] ${options.deployment.appId} ${url} OK (${result.detail}; build UNVERIFIED - no /_app/version.json)`);
+                    return { ok: true, url, detail: `${result.detail}; build unverified` };
+                }
+                onLine('stdout', `[smoke] ${options.deployment.appId} ${url} OK (${result.detail})`);
+                return { ok: true, url, detail: result.detail };
+            }
+        }
+        if (Date.now() >= deadline)
+            break;
+        await options.runtime.lifecycle.delay(pollIntervalMs);
+    }
+    onLine('stderr', `[smoke] ${options.deployment.appId} ${url} FAILED: ${lastDetail}`);
+    return { ok: false, url, detail: lastDetail };
+}
+//# sourceMappingURL=deploy-smoke.js.map

package/dist/cli/run/deploy-smoke.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy-smoke.js","sourceRoot":"","sources":["../../../src/cli/run/deploy-smoke.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,MAAM,EAAmB,MAAM,qBAAqB,CAAC;AAC9D,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAyCpD,SAAS,cAAc,CACtB,UAAyB,EACzB,WAA2B,EAC3B,qBAAuD;IAEvD,+DAA+D;IAC/D,4EAA4E;IAC5E,4EAA4E;IAC5E,gEAAgE;IAChE,yEAAyE;IACzE,uEAAuE;IACvE,kEAAkE;IAClE,2EAA2E;IAC3E,wEAAwE;IACxE,kBAAkB;IAClB,IACC,UAAU,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;QAC7B,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,UAAU,CAAC,EAC/D,CAAC;QACF,OAAO;YACN,IAAI,EAAE,kFAAkF;SACxF,CAAC;IACH,CAAC;IACD,IAAI,qBAAqB,IAAI,qBAAqB,CAAC,WAAW,KAAK,YAAY,EAAE,CAAC;QACjF,MAAM,MAAM,GAAG,qBAAqB,CAAC,cAAc,CAAC;QACpD,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC/E,OAAO;gBACN,KAAK,EAAE,8CAA8C,qBAAqB,CAAC,WAAW,wCAAwC;aAC9H,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IACf,CAAC;IACD,IAAI,WAAW,IAAI,WAAW,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,WAAW,CAAC;IAC1E,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC;IAC/E,IAAI,OAAO,EAAE,MAAM;QAAE,OAAO,OAAO,CAAC,MAAM,CAAC;IAC3C,IAAI,OAAO,EAAE,QAAQ;QAAE,OAAO,WAAW,OAAO,CAAC,QAAQ,EAAE,CAAC;IAC5D,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACpC,IAAI,KAAK,EAAE,MAAM;QAAE,OAAO,KAAK,CAAC,MAAM,CAAC;IACvC,IAAI,KAAK,EAAE,QAAQ;QAAE,OAAO,WAAW,KAAK,CAAC,QAAQ,EAAE,CAAC;IACxD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;AAC9C,MAAM,UAAU,yBAAyB,CAAC,KAAgC;IACzE,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAClC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC;IAC1B,+EAA+E;IAC/E,8EAA8E;IAC9E,2EAA2E;IAC3E,0EAA0E;IAC1E,8BAA8B;IAC9B,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,OAAO,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC9B,CAAC,CAAC;AAEH;;;;GAIG;AACH,KAAK,UAAU,eAAe,CAAC,MAAc,EAAE,SAAuB,EAAE,OAAmB;IAC1F,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,IAAI,EAAE;QACvC,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,IAAI,GAAG,CAAC,oBAAoB,EAAE,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE;YAClF,OAAO,EAAE,EAAE,YAAY,EAAE,8BAA8B,EAAE;SACzD,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QAC9B,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACrD,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QACjB,wEAAwE;QACxE,2DAA2D;QAC3D,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC;QAClG,iBAAiB,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,2CAA2C,EAAE;YAC5E,MAAM;YACN,MAAM;SACN,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACb,CAAC;IACD,OAAO,OAAO,CAAC,KAAK,CAAC;AACtB,CAAC;AAED,KAAK,UAAU,KAAK,CACnB,GAAW,EACX,SAAuB;IAEvB,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;QACrC,OAAO,EAAE,EAAE,YAAY,EAAE,8BAA8B,EAAE;QACzD,yDAAyD;QACzD,EAAE;QACF,4EAA4E;QAC5E,yEAAyE;QACzE,2EAA2E;QAC3E,6EAA6E;QAC7E,4EAA4E;QAC5E,2EAA2E;QAC3E,oEAAoE;QACpE,EAAE;QACF,2EAA2E;QAC3E,yEAAyE;QACzE,sCAAsC;QACtC,QAAQ,EAAE,QAAQ;KAClB,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;IACpF,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,QAAQ,CAAC,MAAM,yBAAyB,EAAE,CAAC;IAE3F,4EAA4E;IAC5E,kEAAkE;IAClE,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAClD,MAAM,YAAY,GACjB,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,IAAI,QAAQ,CAAC,CAAC,CAAC,QAAQ,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACvF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,QAAQ,CAAC,MAAM,GAAG,YAAY,YAAY,KAAK,EAAE,EAAE,CAAC;AACxF,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACxC,OAAmC;IAEnC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;IAC7C,MAAM,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,MAAM,CAAC;IACtD,MAAM,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,KAAK,CAAC;IACvD,2EAA2E;IAC3E,2EAA2E;IAC3E,0EAA0E;IAC1E,2EAA2E;IAC3E,4EAA4E;IAC5E,0EAA0E;IAC1E,qEAAqE;IACrE,4EAA4E;IAC5E,sEAAsE;IACtE,2EAA2E;IAC3E,6BAA6B;IAC7B,MAAM,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,IAAI,aAAa,GAAG,CAAC,CAAC;IACzE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAEnD,MAAM,MAAM,GAAG,cAAc,CAC5B,OAAO,CAAC,UAAU,EAClB,OAAO,CAAC,WAAW,EACnB,OAAO,CAAC,qBAAqB,CAC7B,CAAC;IACF,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,eAAe,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACpD,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;QACxB,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC;YACxC,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;YAC9B,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;SAC/B,CAAC,CAAC;QACH,MAAM,aAAa,GAAG,wBAAwB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACjE,IAAI,aAAa,CAAC,OAAO,EAAE,CAAC;YAC3B,IAAI,OAAO,IAAI,aAAa,CAAC,IAAI;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAC1F,MAAM,CAAC,QAAQ,EAAE,WAAW,OAAO,CAAC,UAAU,CAAC,KAAK,aAAa,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YAC5F,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACrE,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;IAC1E,CAAC;IACD,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC;IAE3B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,CAAC;IAC5C,4EAA4E;IAC5E,kDAAkD;IAClD,IAAI,iBAAiB,GAAkB,IAAI,CAAC;IAC5C,IAAI,UAAU,GAAG,eAAe,CAAC;IAEjC,SAAS,CAAC;QACT,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC;QAC/D,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;YACtB,UAAU,GAAG,YAAY,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,WAAW,CAAC;QAChH,CAAC;aAAM,CAAC;YACP,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC;YAClC,UAAU,GAAG,MAAM,CAAC,MAAM,CAAC;YAC3B,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,kEAAkE;gBAClE,qEAAqE;gBACrE,wDAAwD;gBACxD,MAAM,QAAQ,GAAG,OAAO,CAAC,eAAe,EAAE,IAAI,EAAE,CAAC;gBACjD,IAAI,QAAQ,EAAE,CAAC;oBACd,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;oBACpE,sEAAsE;oBACtE,sEAAsE;oBACtE,kEAAkE;oBAClE,sEAAsE;oBACtE,sEAAsE;oBACtE,mEAAmE;oBACnE,MAAM,uBAAuB,GAAG,IAAI,KAAK,IAAI,IAAI,CAAC,yBAAyB,CAAC,IAAI,CAAC,CAAC;oBAClF,IAAI,IAAI,IAAI,CAAC,uBAAuB,IAAI,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;wBAC5D,mEAAmE;wBACnE,iEAAiE;wBACjE,sDAAsD;wBACtD,UAAU,GAAG,uBAAuB;4BACnC,CAAC,CAAC,sCAAsC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,sCAAsC,QAAQ,6PAA6P;4BACvW,CAAC,CAAC,6BAA6B,IAAI,gBAAgB,QAAQ,0DAA0D,CAAC;wBACvH,iBAAiB,KAAK,IAAI,CAAC,GAAG,EAAE,GAAG,iBAAiB,CAAC;wBACrD,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,iBAAiB;4BAAE,MAAM;wBAC3C,MAAM,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;wBACtD,SAAS;oBACV,CAAC;oBACD,IAAI,IAAI,IAAI,CAAC,uBAAuB,EAAE,CAAC;wBACtC,MAAM,CACL,QAAQ,EACR,WAAW,OAAO,CAAC,UAAU,CAAC,KAAK,IAAI,GAAG,QAAQ,MAAM,CAAC,MAAM,WAAW,IAAI,SAAS,CACvF,CAAC;wBACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,WAAW,IAAI,QAAQ,EAAE,CAAC;oBAC3E,CAAC;oBACD,sEAAsE;oBACtE,MAAM,CACL,QAAQ,EACR,WAAW,OAAO,CAAC,UAAU,CAAC,KAAK,IAAI,GAAG,QAAQ,MAAM,CAAC,MAAM,6CAA6C,CAC5G,CAAC;oBACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,oBAAoB,EAAE,CAAC;gBACxE,CAAC;gBACD,MAAM,CAAC,QAAQ,EAAE,WAAW,OAAO,CAAC,UAAU,CAAC,KAAK,IAAI,GAAG,QAAQ,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;gBACrF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;YACjD,CAAC;QACF,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ;YAAE,MAAM;QAClC,MAAM,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;IACvD,CAAC;IAED,MAAM,CAAC,QAAQ,EAAE,WAAW,OAAO,CAAC,UAAU,CAAC,KAAK,IAAI,GAAG,YAAY,UAAU,EAAE,CAAC,CAAC;IACrF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;AAC/C,CAAC"}

package/dist/cli/run/deployment-marker.d.ts

@@ -0,0 +1,74 @@
+import type { AppDeployment } from '@vibesdotdev/infra-core';
+import * as z from 'zod/v4';
+import { type VibesRuntime } from '@vibesdotdev/kernel';
+/** The vendors the platform's deployment records name; any other reads as `other`. */
+declare const MarkerProviderSchema: z.ZodEnum<{
+    other: "other";
+    cloudflare: "cloudflare";
+    digitalocean: "digitalocean";
+}>;
+type MarkerProvider = z.infer<typeof MarkerProviderSchema>;
+type MarkerEnvironment = 'development' | 'staging' | 'production';
+export type DeploymentMarkerPayload = {
+    appId: string;
+    provider: MarkerProvider;
+    environment: MarkerEnvironment;
+    status: 'succeeded' | 'failed' | 'rolled_back' | 'in_progress';
+    version?: string;
+    commit?: string;
+    branch?: string;
+    deployedBy?: string;
+    deployedUrl?: string;
+    externalDeploymentId?: string;
+    deploymentRunId?: string;
+    logsRef?: string;
+    providerTraceRef?: string;
+    remediationUrl?: string;
+    notes?: string;
+    deployedAt: string;
+};
+export type EmitDeploymentMarkerOptions = {
+    deployment: AppDeployment;
+    /** The deployment provider id the release went through. */
+    provider: string;
+    environment?: string;
+    status?: DeploymentMarkerPayload['status'];
+    deployedUrl?: string;
+    externalDeploymentId?: string;
+    version?: string;
+    commit?: string;
+    branch?: string;
+    deployedBy?: string;
+    notes?: string;
+    deploymentRunId?: string;
+    logsRef?: string;
+    providerTraceRef?: string;
+    remediationUrl?: string;
+    /** The runtime the marker's environment facts and internal token resolve through. */
+    runtime: VibesRuntime;
+    token?: string;
+    systemOrigin?: string;
+    fetchImpl?: typeof fetch | ((input: string | URL | Request, init?: RequestInit) => Promise<Response>);
+};
+export type EmitDeploymentMarkerResult = {
+    status: 'sent';
+    markerId?: string;
+    appId: string;
+} | {
+    status: 'skipped';
+    reason: string;
+} | {
+    status: 'failed';
+    reason: string;
+};
+export declare function deploymentMarkerNotes(value: unknown, maxLength?: number): string | undefined;
+/** The vendor a release is attributed to: what the provider's descriptor declares (`vendor`). */
+export declare function deploymentMarkerProvider(runtime: Pick<VibesRuntime, 'hasKind' | 'query'>, provider: string): MarkerProvider;
+export declare function deploymentMarkerEnvironment(value: string | undefined): MarkerEnvironment;
+export declare function systemOriginForDeployment(runtime: VibesRuntime, deployment: AppDeployment, explicit?: string): Promise<string>;
+export declare function buildDeploymentMarkerPayload(runtime: Pick<VibesRuntime, 'getEnv' | 'hasKind' | 'query'>, options: Omit<EmitDeploymentMarkerOptions, 'runtime' | 'token' | 'systemOrigin' | 'fetchImpl'>): DeploymentMarkerPayload;
+export declare function resolveDeploymentMarkerTokens(runtime: VibesRuntime, environment?: string, explicit?: string): Promise<string[]>;
+export declare function resolveDeploymentMarkerToken(runtime: VibesRuntime, environment?: string, explicit?: string): Promise<string | undefined>;
+export declare function emitDeploymentMarker(options: EmitDeploymentMarkerOptions): Promise<EmitDeploymentMarkerResult>;
+export {};
+//# sourceMappingURL=deployment-marker.d.ts.map

package/dist/cli/run/deployment-marker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deployment-marker.d.ts","sourceRoot":"","sources":["../../../src/cli/run/deployment-marker.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,OAAO,EAAU,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAShE,sFAAsF;AACtF,QAAA,MAAM,oBAAoB;;;;EAAkD,CAAC;AAC7E,KAAK,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAC3D,KAAK,iBAAiB,GAAG,aAAa,GAAG,SAAS,GAAG,YAAY,CAAC;AAElE,MAAM,MAAM,uBAAuB,GAAG;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,cAAc,CAAC;IACzB,WAAW,EAAE,iBAAiB,CAAC;IAC/B,MAAM,EAAE,WAAW,GAAG,QAAQ,GAAG,aAAa,GAAG,aAAa,CAAC;IAC/D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACzC,UAAU,EAAE,aAAa,CAAC;IAC1B,2DAA2D;IAC3D,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,uBAAuB,CAAC,QAAQ,CAAC,CAAC;IAC3C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,qFAAqF;IACrF,OAAO,EAAE,YAAY,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,OAAO,KAAK,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,GAAG,GAAG,OAAO,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;CACtG,CAAC;AAEF,MAAM,MAAM,0BAA0B,GACnC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACpD;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACrC;IAAE,MAAM,EAAE,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAkBxC,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,EAAE,SAAS,SAAM,GAAG,MAAM,GAAG,SAAS,CAOzF;AAED,iGAAiG;AACjG,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE,SAAS,GAAG,OAAO,CAAC,EAAE,QAAQ,EAAE,MAAM,GAAG,cAAc,CAK3H;AAED,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,iBAAiB,CAKxF;AAED,wBAAsB,yBAAyB,CAC9C,OAAO,EAAE,YAAY,EACrB,UAAU,EAAE,aAAa,EACzB,QAAQ,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,CAiBjB;AAUD,wBAAgB,4BAA4B,CAC3C,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE,QAAQ,GAAG,SAAS,GAAG,OAAO,CAAC,EAC3D,OAAO,EAAE,IAAI,CAAC,2BAA2B,EAAE,SAAS,GAAG,OAAO,GAAG,cAAc,GAAG,WAAW,CAAC,GAC5F,uBAAuB,CAiCzB;AA0CD,wBAAsB,6BAA6B,CAClD,OAAO,EAAE,YAAY,EACrB,WAAW,CAAC,EAAE,MAAM,EACpB,QAAQ,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,EAAE,CAAC,CAoBnB;AAED,wBAAsB,4BAA4B,CACjD,OAAO,EAAE,YAAY,EACrB,WAAW,CAAC,EAAE,MAAM,EACpB,QAAQ,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAE7B;AAyBD,wBAAsB,oBAAoB,CACzC,OAAO,EAAE,2BAA2B,GAClC,OAAO,CAAC,0BAA0B,CAAC,CA4DrC"}

package/dist/cli/run/deployment-marker.js

@@ -0,0 +1,237 @@
+import { serviceOrigin } from '@vibesdotdev/infra-core/service';
+import * as z from 'zod/v4';
+import { infraDeployLogger } from "../../logger.js";
+import { settle } from '@vibesdotdev/kernel';
+import { DeploymentProviderDescriptorSchema } from '@vibesdotdev/infra-core/kinds';
+import { isGenericSecretsStoreDescriptor, resolveSecretsEnvironment } from '@vibesdotdev/secrets';
+/** The vendors the platform's deployment records name; any other reads as `other`. */
+const MarkerProviderSchema = z.enum(['cloudflare', 'digitalocean', 'other']);
+const INTERNAL_TOKEN_KEYS = [
+    'VIBES_INTERNAL_SERVICE_TOKEN',
+    'VIBES_AUTH_INTERNAL_TOKEN'
+];
+const SENSITIVE_ASSIGNMENT_PATTERN = /\b([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|CREDENTIAL|API_KEY|PRIVATE_KEY)[A-Z0-9_]*)\b\s*[:=]\s*["']?[^"',\s]+["']?/gi;
+const BEARER_PATTERN = /\bBearer\s+[^\s,;]+/gi;
+const NonEmptyStringSchema = z.string().trim().min(1);
+function nonEmpty(value) {
+    const parsed = NonEmptyStringSchema.safeParse(value);
+    if (parsed.success)
+        return parsed.data;
+    return undefined;
+}
+export function deploymentMarkerNotes(value, maxLength = 500) {
+    const parsed = NonEmptyStringSchema.safeParse(value);
+    if (!parsed.success)
+        return undefined;
+    return parsed.data
+        .replace(BEARER_PATTERN, 'Bearer [redacted]')
+        .replace(SENSITIVE_ASSIGNMENT_PATTERN, '$1=[redacted]')
+        .slice(0, maxLength);
+}
+/** The vendor a release is attributed to: what the provider's descriptor declares (`vendor`). */
+export function deploymentMarkerProvider(runtime, provider) {
+    if (!runtime.hasKind('infra/deployment-provider'))
+        return 'other';
+    const [descriptor] = runtime.query('infra/deployment-provider').withId(provider).descriptors();
+    const vendor = descriptor ? DeploymentProviderDescriptorSchema.parse(descriptor).vendor : undefined;
+    return MarkerProviderSchema.catch('other').parse(vendor);
+}
+export function deploymentMarkerEnvironment(value) {
+    if (value === 'production')
+        return 'production';
+    if (value === 'staging')
+        return 'staging';
+    if (value === 'development' || value === 'dev' || value === 'local')
+        return 'development';
+    return 'production';
+}
+export async function systemOriginForDeployment(runtime, deployment, explicit) {
+    const fromExplicit = nonEmpty(explicit);
+    if (fromExplicit)
+        return fromExplicit.replace(/\/$/, '');
+    const fromEnv = nonEmpty(runtime.getEnv('PUBLIC_VIBES_SYSTEM_ORIGIN'));
+    if (fromEnv)
+        return fromEnv.replace(/\/$/, '');
+    const declared = deployment.env.find((entry) => entry.name === 'PUBLIC_VIBES_SYSTEM_ORIGIN');
+    const fromDeploymentEnv = nonEmpty(declared?.value);
+    if (fromDeploymentEnv)
+        return fromDeploymentEnv.replace(/\/$/, '');
+    if (deployment.appId === 'system') {
+        const primary = deployment.origins.find((origin) => origin.kind === 'primary') ?? deployment.origins[0];
+        if (primary?.origin)
+            return primary.origin.replace(/\/$/, '');
+    }
+    return serviceOrigin(runtime, 'system');
+}
+function currentActor(runtime) {
+    return (nonEmpty(runtime.getEnv('VIBES_DEPLOY_ACTOR')) ??
+        nonEmpty(runtime.getEnv('GITHUB_ACTOR')) ??
+        nonEmpty(runtime.getEnv('USER')));
+}
+export function buildDeploymentMarkerPayload(runtime, options) {
+    // VIBES_SOURCE_SHA is NOT consulted: the CLI republishes its own compile-time
+    // bake into it at boot, so falling back to it records the CLI's commit as the
+    // app's. `options.commit` already carries the resolved app identity; the CI
+    // vars below genuinely name the checked-out app repository.
+    const commit = nonEmpty(options.commit) ??
+        nonEmpty(runtime.getEnv('GITHUB_SHA')) ??
+        nonEmpty(runtime.getEnv('CI_COMMIT_SHA'));
+    const branch = nonEmpty(options.branch) ??
+        nonEmpty(runtime.getEnv('VIBES_SOURCE_BRANCH')) ??
+        nonEmpty(runtime.getEnv('GITHUB_REF_NAME')) ??
+        nonEmpty(runtime.getEnv('CI_COMMIT_BRANCH'));
+    return {
+        appId: options.deployment.appId,
+        provider: deploymentMarkerProvider(runtime, options.provider),
+        environment: deploymentMarkerEnvironment(options.environment),
+        status: options.status ?? 'succeeded',
+        version: nonEmpty(options.version) ?? commit,
+        commit,
+        branch,
+        deployedBy: nonEmpty(options.deployedBy) ?? currentActor(runtime),
+        deployedUrl: nonEmpty(options.deployedUrl),
+        externalDeploymentId: nonEmpty(options.externalDeploymentId),
+        deploymentRunId: deploymentMarkerNotes(options.deploymentRunId, 300),
+        logsRef: deploymentMarkerNotes(options.logsRef, 300),
+        providerTraceRef: deploymentMarkerNotes(options.providerTraceRef, 300),
+        remediationUrl: deploymentMarkerNotes(options.remediationUrl, 300),
+        notes: deploymentMarkerNotes(options.notes),
+        deployedAt: new Date().toISOString()
+    };
+}
+async function resolveInternalTokenFromRuntime(runtime, environment) {
+    const tokens = [];
+    if (!runtime.hasKind('secrets/store'))
+        return tokens;
+    const resolvedEnvironment = await resolveSecretsEnvironment(runtime, null, environment);
+    const tierCandidates = new Set([resolvedEnvironment.tier]);
+    if (resolvedEnvironment.tier === 'local' || resolvedEnvironment.tier === 'dev') {
+        tierCandidates.add('staging');
+        tierCandidates.add('production');
+    }
+    const descriptors = runtime
+        .assets('secrets/store')
+        .descriptors()
+        .filter((descriptor) => {
+        if (!isGenericSecretsStoreDescriptor(descriptor))
+            return false;
+        if (environment)
+            return true;
+        if (!descriptor.tiers || descriptor.tiers.length === 0)
+            return true;
+        return descriptor.tiers.some((tier) => tierCandidates.has(tier));
+    })
+        .sort((a, b) => (b.priority ?? 0) - (a.priority ?? 0));
+    for (const descriptor of descriptors) {
+        const store = await runtime
+            .query('secrets/store')
+            .withId(descriptor.id)
+            .resolve();
+        for (const key of INTERNAL_TOKEN_KEYS) {
+            const value = await store.get(resolvedEnvironment.name, key);
+            const token = nonEmpty(value);
+            if (token && !tokens.includes(token))
+                tokens.push(token);
+        }
+    }
+    return tokens;
+}
+export async function resolveDeploymentMarkerTokens(runtime, environment, explicit) {
+    const fromExplicit = nonEmpty(explicit);
+    if (fromExplicit)
+        return [fromExplicit];
+    const tokens = [];
+    // Credentials resolve through the runtime, never the host environment; an
+    // unresolved key is one absent candidate, and the store loop below asks next.
+    for (const key of INTERNAL_TOKEN_KEYS) {
+        const resolved = await runtime.resolveCredential({ source: 'secret', key });
+        if (!resolved.ok)
+            continue;
+        const value = nonEmpty(resolved.value);
+        if (value && !tokens.includes(value))
+            tokens.push(value);
+    }
+    for (const token of await resolveInternalTokenFromRuntime(runtime, environment)) {
+        if (!tokens.includes(token))
+            tokens.push(token);
+    }
+    return tokens;
+}
+export async function resolveDeploymentMarkerToken(runtime, environment, explicit) {
+    return (await resolveDeploymentMarkerTokens(runtime, environment, explicit))[0];
+}
+/**
+ * The marker endpoint's answer, read at this boundary: the two fields a sent
+ * marker reports, each still checked by `nonEmpty`. A JSON value that is not
+ * an object (`null`, an array, a string) carries neither.
+ */
+const MarkerBodySchema = z.object({ id: z.unknown(), appId: z.unknown() }).partial();
+/** The marker endpoint's JSON body; an unreadable or non-object body is logged and the marker still counts as sent. */
+async function readMarkerBody(response, runtime) {
+    const jsonOutcome = await settle(() => response.json());
+    if (!jsonOutcome.ok) {
+        const failureName = jsonOutcome.cause instanceof Error ? jsonOutcome.cause.name : 'SyntaxError';
+        // The parse error's message can quote the body, so only its class is logged.
+        infraDeployLogger(runtime).warn(`Deployment marker response body was not JSON (${failureName})`);
+        return {};
+    }
+    const parsed = MarkerBodySchema.safeParse(jsonOutcome.value);
+    if (parsed.success)
+        return parsed.data;
+    infraDeployLogger(runtime).warn('Deployment marker response body was not a JSON object; no marker id was read');
+    return {};
+}
+export async function emitDeploymentMarker(options) {
+    if (options.status === 'in_progress') {
+        return { status: 'skipped', reason: 'in-progress markers are not emitted after deploy completion' };
+    }
+    const tokens = await resolveDeploymentMarkerTokens(options.runtime, options.environment, options.token);
+    if (tokens.length === 0) {
+        return { status: 'skipped', reason: 'internal service token unavailable' };
+    }
+    const payload = buildDeploymentMarkerPayload(options.runtime, options);
+    const origin = await systemOriginForDeployment(options.runtime, options.deployment, options.systemOrigin);
+    const fetcher = options.fetchImpl ?? fetch;
+    let lastAuthFailure;
+    for (const token of tokens) {
+        const sendOutcome = await settle(async () => {
+            return await fetcher(`${origin}/api/internal/deploy/marker`, {
+                method: 'POST',
+                headers: {
+                    authorization: `Bearer ${token}`,
+                    'content-type': 'application/json'
+                },
+                body: JSON.stringify(payload)
+            });
+        });
+        if (!sendOutcome.ok) {
+            const failureName = sendOutcome.cause instanceof Error ? sendOutcome.cause.name : 'Error';
+            const failureText = sendOutcome.cause instanceof Error ? sendOutcome.cause.message : sendOutcome.cause.description;
+            // A transport error can echo request headers; the reason passes the marker redactor.
+            return {
+                status: 'failed',
+                reason: deploymentMarkerNotes(failureText) ?? failureName
+            };
+        }
+        const response = sendOutcome.value;
+        if (!response.ok) {
+            const result = {
+                status: 'failed',
+                reason: `system marker endpoint returned ${response.status}`
+            };
+            if (response.status === 401 || response.status === 403) {
+                lastAuthFailure = result;
+                continue;
+            }
+            return result;
+        }
+        const data = await readMarkerBody(response, options.runtime);
+        return {
+            status: 'sent',
+            markerId: nonEmpty(data.id),
+            appId: nonEmpty(data.appId) ?? payload.appId
+        };
+    }
+    return lastAuthFailure ?? { status: 'failed', reason: 'system marker endpoint rejected all tokens' };
+}
+//# sourceMappingURL=deployment-marker.js.map

package/dist/cli/run/deployment-marker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deployment-marker.js","sourceRoot":"","sources":["../../../src/cli/run/deployment-marker.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAEhE,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAE,MAAM,EAAqB,MAAM,qBAAqB,CAAC;AAChE,OAAO,EAAE,kCAAkC,EAAqC,MAAM,+BAA+B,CAAC;AACtH,OAAO,EACN,+BAA+B,EAC/B,yBAAyB,EAGzB,MAAM,sBAAsB,CAAC;AAE9B,sFAAsF;AACtF,MAAM,oBAAoB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,cAAc,EAAE,OAAO,CAAC,CAAC,CAAC;AAoD7E,MAAM,mBAAmB,GAAG;IAC3B,8BAA8B;IAC9B,2BAA2B;CAClB,CAAC;AACX,MAAM,4BAA4B,GACjC,mHAAmH,CAAC;AACrH,MAAM,cAAc,GAAG,uBAAuB,CAAC;AAE/C,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAEtD,SAAS,QAAQ,CAAC,KAAc;IAC/B,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACrD,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC;IACvC,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,KAAc,EAAE,SAAS,GAAG,GAAG;IACpE,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACrD,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IACtC,OAAO,MAAM,CAAC,IAAI;SAChB,OAAO,CAAC,cAAc,EAAE,mBAAmB,CAAC;SAC5C,OAAO,CAAC,4BAA4B,EAAE,eAAe,CAAC;SACtD,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;AACvB,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,wBAAwB,CAAC,OAAgD,EAAE,QAAgB;IAC1G,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,2BAA2B,CAAC;QAAE,OAAO,OAAO,CAAC;IAClE,MAAM,CAAC,UAAU,CAAC,GAAG,OAAO,CAAC,KAAK,CAA+B,2BAA2B,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;IAC7H,MAAM,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,kCAAkC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IACpG,OAAO,oBAAoB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,KAAyB;IACpE,IAAI,KAAK,KAAK,YAAY;QAAE,OAAO,YAAY,CAAC;IAChD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IAAI,KAAK,KAAK,aAAa,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,OAAO;QAAE,OAAO,aAAa,CAAC;IAC1F,OAAO,YAAY,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC9C,OAAqB,EACrB,UAAyB,EACzB,QAAiB;IAEjB,MAAM,YAAY,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACxC,IAAI,YAAY;QAAE,OAAO,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAEzD,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,4BAA4B,CAAC,CAAC,CAAC;IACvE,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAE/C,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,4BAA4B,CAAC,CAAC;IAC7F,MAAM,iBAAiB,GAAG,QAAQ,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACpD,IAAI,iBAAiB;QAAE,OAAO,iBAAiB,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAEnE,IAAI,UAAU,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACxG,IAAI,OAAO,EAAE,MAAM;YAAE,OAAO,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC/D,CAAC;IAED,OAAO,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,YAAY,CAAC,OAAqC;IAC1D,OAAO,CACN,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;QAC9C,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QACxC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAChC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,4BAA4B,CAC3C,OAA2D,EAC3D,OAA8F;IAE9F,8EAA8E;IAC9E,8EAA8E;IAC9E,4EAA4E;IAC5E,4DAA4D;IAC5D,MAAM,MAAM,GACX,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC;QACxB,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACtC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC;IAC3C,MAAM,MAAM,GACX,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC;QACxB,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC;QAC/C,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;QAC3C,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAE9C,OAAO;QACN,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC,KAAK;QAC/B,QAAQ,EAAE,wBAAwB,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC;QAC7D,WAAW,EAAE,2BAA2B,CAAC,OAAO,CAAC,WAAW,CAAC;QAC7D,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,WAAW;QACrC,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,MAAM;QAC5C,MAAM;QACN,MAAM;QACN,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,YAAY,CAAC,OAAO,CAAC;QACjE,WAAW,EAAE,QAAQ,CAAC,OAAO,CAAC,WAAW,CAAC;QAC1C,oBAAoB,EAAE,QAAQ,CAAC,OAAO,CAAC,oBAAoB,CAAC;QAC5D,eAAe,EAAE,qBAAqB,CAAC,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC;QACpE,OAAO,EAAE,qBAAqB,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC;QACpD,gBAAgB,EAAE,qBAAqB,CAAC,OAAO,CAAC,gBAAgB,EAAE,GAAG,CAAC;QACtE,cAAc,EAAE,qBAAqB,CAAC,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC;QAClE,KAAK,EAAE,qBAAqB,CAAC,OAAO,CAAC,KAAK,CAAC;QAC3C,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,+BAA+B,CAC7C,OAAqB,EACrB,WAAoB;IAEpB,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC;QAAE,OAAO,MAAM,CAAC;IAErD,MAAM,mBAAmB,GAAG,MAAM,yBAAyB,CAAC,OAAO,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;IACxF,MAAM,cAAc,GAAG,IAAI,GAAG,CAAS,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC;IACnE,IAAI,mBAAmB,CAAC,IAAI,KAAK,OAAO,IAAI,mBAAmB,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAChF,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC9B,cAAc,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAClC,CAAC;IAED,MAAM,WAAW,GAAG,OAAO;SACzB,MAAM,CAAqD,eAAe,CAAC;SAC3E,WAAW,EAAE;SACb,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE;QACtB,IAAI,CAAC,+BAA+B,CAAC,UAAU,CAAC;YAAE,OAAO,KAAK,CAAC;QAC/D,IAAI,WAAW;YAAE,OAAO,IAAI,CAAC;QAC7B,IAAI,CAAC,UAAU,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACpE,OAAO,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAClE,CAAC,CAAC;SACD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC;IAExD,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,MAAM,OAAO;aACzB,KAAK,CAAqD,eAAe,CAAC;aAC1E,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;aACrB,OAAO,EAAE,CAAC;QACZ,KAAK,MAAM,GAAG,IAAI,mBAAmB,EAAE,CAAC;YACvC,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAC7D,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC9B,IAAI,KAAK,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1D,CAAC;IACF,CAAC;IAED,OAAO,MAAM,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAClD,OAAqB,EACrB,WAAoB,EACpB,QAAiB;IAEjB,MAAM,YAAY,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACxC,IAAI,YAAY;QAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAExC,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,0EAA0E;IAC1E,8EAA8E;IAC9E,KAAK,MAAM,GAAG,IAAI,mBAAmB,EAAE,CAAC;QACvC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;QAC5E,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,SAAS;QAC3B,MAAM,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,KAAK,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1D,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,MAAM,+BAA+B,CAAC,OAAO,EAAE,WAAW,CAAC,EAAE,CAAC;QACjF,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjD,CAAC;IAED,OAAO,MAAM,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CACjD,OAAqB,EACrB,WAAoB,EACpB,QAAiB;IAEjB,OAAO,CAAC,MAAM,6BAA6B,CAAC,OAAO,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACjF,CAAC;AAED;;;;GAIG;AACH,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;AAGrF,uHAAuH;AACvH,KAAK,UAAU,cAAc,CAAC,QAAkB,EAAE,OAAqB;IACtE,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IACxD,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;QACrB,MAAM,WAAW,GAAG,WAAW,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC;QAChG,6EAA6E;QAC7E,iBAAiB,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,iDAAiD,WAAW,GAAG,CAAC,CAAC;QACjG,OAAO,EAAE,CAAC;IACX,CAAC;IACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAC7D,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC;IACvC,iBAAiB,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,8EAA8E,CAAC,CAAC;IAChH,OAAO,EAAE,CAAC;AACX,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACzC,OAAoC;IAEpC,IAAI,OAAO,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;QACtC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,6DAA6D,EAAE,CAAC;IACrG,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,6BAA6B,CACjD,OAAO,CAAC,OAAO,EACf,OAAO,CAAC,WAAW,EACnB,OAAO,CAAC,KAAK,CACb,CAAC;IACF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,oCAAoC,EAAE,CAAC;IAC5E,CAAC;IAED,MAAM,OAAO,GAAG,4BAA4B,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACvE,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1G,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;IAE3C,IAAI,eAAuD,CAAC;IAC5D,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC5B,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,KAAK,IAAI,EAAE;YAC3C,OAAO,MAAM,OAAO,CAAC,GAAG,MAAM,6BAA6B,EAAE;gBAC5D,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACR,aAAa,EAAE,UAAU,KAAK,EAAE;oBAChC,cAAc,EAAE,kBAAkB;iBAClC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;aAC7B,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;YACrB,MAAM,WAAW,GAAG,WAAW,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;YAC1F,MAAM,WAAW,GAAG,WAAW,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,WAAW,CAAC;YACnH,qFAAqF;YACrF,OAAO;gBACN,MAAM,EAAE,QAAQ;gBAChB,MAAM,EAAE,qBAAqB,CAAC,WAAW,CAAC,IAAI,WAAW;aACzD,CAAC;QACH,CAAC;QACD,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC;QACnC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAClB,MAAM,MAAM,GAA+B;gBAC1C,MAAM,EAAE,QAAQ;gBAChB,MAAM,EAAE,mCAAmC,QAAQ,CAAC,MAAM,EAAE;aAC5D,CAAC;YACF,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACxD,eAAe,GAAG,MAAM,CAAC;gBACzB,SAAS;YACV,CAAC;YACD,OAAO,MAAM,CAAC;QACf,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;QAC7D,OAAO;YACN,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,KAAK;SAC5C,CAAC;IACH,CAAC;IAED,OAAO,eAAe,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,4CAA4C,EAAE,CAAC;AACtG,CAAC"}