@vypdev/copilot 3.5.1 → 3.5.3

package/build/cli/index.js

@@ -44015,7 +44015,7 @@ exports.ENGLISH_MERGE_QUEUE_MESSAGES = Object.freeze({
     'mergeQueue.decision.queueNotExposed': 'The target does not expose a required merge queue.',
     'mergeQueue.decision.autoMergeConfigured': 'Native auto-merge was explicitly configured.',
     'mergeQueue.decision.autoMergeDisabled': 'Native auto-merge is disabled for this repository.',
-    'mergeQueue.decision.immediatelyMergeable': 'GitHub reports the pull request ready; native auto-merge preserves branch protection.',
+    'mergeQueue.decision.immediatelyMergeable': 'GitHub reports the pull request ready; merge its verified head with branch protection enforced.',
     'mergeQueue.decision.autoMergeAvailable': 'GitHub will merge after checks and reviews complete.',
     'mergeQueue.decision.createOnlyRequired': 'Repository auto-merge is unavailable; maintainer merge is required.',
 });
@@ -44040,7 +44040,7 @@ exports.SPANISH_MERGE_QUEUE_MESSAGES = Object.freeze({
     'mergeQueue.decision.queueNotExposed': 'El destino no expone una merge queue obligatoria.',
     'mergeQueue.decision.autoMergeConfigured': 'El auto-merge nativo se ha configurado explícitamente.',
     'mergeQueue.decision.autoMergeDisabled': 'El auto-merge nativo está deshabilitado en este repositorio.',
-    'mergeQueue.decision.immediatelyMergeable': 'GitHub indica que la pull request está lista; el auto-merge nativo preserva la protección de rama.',
+    'mergeQueue.decision.immediatelyMergeable': 'GitHub indica que la pull request está lista; fusionar su head verificado respetando la protección de rama.',
     'mergeQueue.decision.autoMergeAvailable': 'GitHub hará merge cuando terminen los checks y las revisiones.',
     'mergeQueue.decision.createOnlyRequired': 'El auto-merge del repositorio no está disponible; se requiere el merge de una persona mantenedora.',
 });
@@ -51946,7 +51946,14 @@ class DeploymentOrchestrationRuntime {
             selectedPrMode: inspection.decision.mode,
         };
         await this.persist(context, managed);
-        await this.applyMergeBehavior(context, operation, pullRequest, inspection);
+        try {
+            await this.applyMergeBehavior(context, operation, pullRequest, inspection);
+        }
+        catch (cause) {
+            const message = `GitHub could not configure automatic merge for PR #${pullRequest.number}. Check the PR and retry the stored ${category} phase.`;
+            const error = new application_error_1.ApplicationError("provider.unavailable", message, { cause, retryable: true });
+            return { kind: "blocked", result: await this.block(context, managed, category, message, true, error) };
+        }
         await this.publishDashboard(context, managed);
         return { kind: "configured", operation: managed };
     }
@@ -52014,7 +52021,7 @@ class DeploymentOrchestrationRuntime {
     }
     async applyAutoMerge(context, operation, pullRequest, capabilities) {
         if (operation.prMode === "auto" && capabilities.immediatelyMergeable) {
-            await this.dependencies.pullRequests.mergePullRequest(pullRequest.number);
+            await this.dependencies.pullRequests.mergePullRequest(pullRequest.number, pullRequest.headSha);
             return;
         }
         if (!pullRequest.autoMergeEnabled) {
@@ -52876,22 +52883,19 @@ const application_error_1 = __nccwpck_require__(75999);
 const deployment_plan_policy_1 = __nccwpck_require__(8352);
 const deployment_operation_1 = __nccwpck_require__(92730);
 const deployment_orchestration_runtime_1 = __nccwpck_require__(77658);
+const deployment_continuation_guard_1 = __nccwpck_require__(1779);
 class ConfirmPublicationHandler {
     constructor(runtime, reconciliation) {
         this.runtime = runtime;
         this.reconciliation = reconciliation;
     }
     async invoke(context) {
-        const operation = await this.resumeRetryableBlock(context, (0, deployment_orchestration_runtime_1.requireDeploymentOperation)(context));
-        if (operation.phase === "reconciliation_pending" && operation.publicationVerified) {
-            return await this.reconciliation.plan(context, operation)
-                ?? (0, deployment_orchestration_runtime_1.deploymentSuccess)(`Publication for ${operation.tag} was already verified; reconciliation state was recovered.`);
-        }
-        if (operation.phase === "completed" && operation.publicationVerified) {
-            await this.runtime.publishDashboard(context, operation);
-            return (0, deployment_orchestration_runtime_1.deploymentSuccess)(`Publication for ${operation.tag} was already verified; duplicate notification ignored.`);
-        }
-        assertPublicationPhase(operation);
+        const current = (0, deployment_orchestration_runtime_1.requireDeploymentOperation)(context);
+        const invalid = (0, deployment_continuation_guard_1.validateDeploymentContinuation)(current, context.singleAction.operationId, ["published", "publishing", "promoted", "reconciliation_pending", "completed"], context.singleAction.version);
+        if (invalid)
+            throw new application_error_1.ApplicationError("workflow.stale", invalid);
+        // Verify external receipts before clearing a block or retrying any merge/cleanup effect.
+        const operation = current;
         const productionSha = requireProductionSha(operation);
         const publication = await this.runtime.dependencies.publication.inspect({
             tag: operation.tag,
@@ -52908,8 +52912,18 @@ class ConfirmPublicationHandler {
         if (!reachable) {
             return await this.runtime.block(context, operation, "publication", "Published SHA is not reachable from the stored production branch.", false);
         }
+        const resumed = await this.resumeRetryableBlock(context, operation);
+        if (resumed.phase === "reconciliation_pending" && resumed.publicationVerified) {
+            return await this.reconciliation.plan(context, resumed)
+                ?? (0, deployment_orchestration_runtime_1.deploymentSuccess)(`Publication for ${resumed.tag} was already verified; reconciliation state was recovered.`);
+        }
+        if (resumed.phase === "completed" && resumed.publicationVerified) {
+            await this.runtime.publishDashboard(context, resumed);
+            return (0, deployment_orchestration_runtime_1.deploymentSuccess)(`Publication for ${resumed.tag} was already verified; duplicate notification ignored.`);
+        }
+        assertPublicationPhase(resumed);
         const published = {
-            ...operation,
+            ...resumed,
             phase: "published",
             publicationVerified: true,
             publicationReceipt: publication.receipt,
@@ -53228,6 +53242,7 @@ Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.ReconciliationHandler = void 0;
 const deployment_plan_policy_1 = __nccwpck_require__(8352);
 const deployment_operation_1 = __nccwpck_require__(92730);
+const managed_pull_request_1 = __nccwpck_require__(95914);
 const deployment_orchestration_runtime_1 = __nccwpck_require__(77658);
 class ReconciliationHandler {
     constructor(runtime) {
@@ -53264,10 +53279,12 @@ class ReconciliationHandler {
         return await this.complete(context, updated, ` after reconciliation PR #${pullRequest.number}`);
     }
     async plan(context, operation) {
-        const index = operation.reconciliationTargets.findIndex((target) => target.status === "pending" && target.pullRequest === undefined);
+        const index = operation.reconciliationTargets.findIndex((target) => target.status === "pending");
         if (index < 0)
             return await this.finishOrPresent(context, operation);
         let target = operation.reconciliationTargets[index];
+        if (target.pullRequest !== undefined)
+            return await this.resumePullRequest(context, operation, target);
         const targetRole = (0, deployment_orchestration_runtime_1.reconciliationTargetRole)(operation, target.targetBranch);
         const preflight = await this.runtime.inspectMergeBehavior(context, operation, target.targetBranch, targetRole, target.sourceSha);
         if (preflight.kind === "blocked") {
@@ -53324,6 +53341,26 @@ class ReconciliationHandler {
         await this.runtime.publishMilestone(context, completed, { kind: "orchestration-complete", tag: completed.tag });
         return (0, deployment_orchestration_runtime_1.deploymentSuccess)(`Deployment ${completed.tag} completed${completionContext}.`);
     }
+    async resumePullRequest(context, operation, target) {
+        const pullRequest = await this.runtime.dependencies.pullRequests.getPullRequest(target.pullRequest);
+        const identity = (0, managed_pull_request_1.parseManagedPullRequestMarker)(pullRequest.body);
+        const expectedHead = target.syncBranch ? target.syncSha : target.sourceSha;
+        if (!identity || identity.operationId !== operation.operationId || identity.phase !== "reconciliation"
+            || identity.issue !== context.singleAction.issue || pullRequest.number !== target.pullRequest
+            || pullRequest.repositoryFullName.toLowerCase() !== `${context.owner}/${context.repo}`.toLowerCase()
+            || pullRequest.baseBranch !== target.targetBranch
+            || pullRequest.headBranch !== (target.syncBranch ?? target.sourceBranch)
+            || !expectedHead || pullRequest.headSha !== expectedHead) {
+            return await this.runtime.block(context, operation, "reconciliation", "The recorded reconciliation PR no longer matches its durable identity and head SHA.", false);
+        }
+        if (pullRequest.merged)
+            return await this.accept(context, operation, pullRequest);
+        if (pullRequest.state === "closed") {
+            return await this.runtime.block(context, operation, "reconciliation", `Reconciliation PR #${pullRequest.number} was closed without merge.`, true);
+        }
+        const configured = await this.runtime.configureMergeBehavior(context, operation, pullRequest, "reconciliation", (0, deployment_orchestration_runtime_1.reconciliationTargetRole)(operation, target.targetBranch));
+        return configured.kind === "blocked" ? configured.result : undefined;
+    }
     async finishOrPresent(context, operation) {
         if (operation.reconciliationTargets.length > 0
             && operation.reconciliationTargets.every((target) => target.status === "completed")) {
@@ -79383,12 +79420,13 @@ class GithubManagedPullRequestRepository {
             throw new Error("GitHub did not confirm that the pull request entered the merge queue.");
         }
     }
-    async mergePullRequest(owner, repository, pullRequest, token) {
+    async mergePullRequest(owner, repository, pullRequest, expectedHeadSha, token) {
         const { data } = await this.clientProvider.getClient(token).rest.pulls.merge({
             owner,
             repo: repository,
             pull_number: pullRequest,
             merge_method: "merge",
+            sha: expectedHeadSha,
         });
         if (!data.merged || !data.sha)
             throw new Error(data.message ?? `Pull request #${pullRequest} was not merged.`);
@@ -79413,6 +79451,43 @@ function mapPullRequest(value, owner, repository) {
 }
 
 
+/***/ }),
+
+/***/ 33371:
+/***/ ((__unused_webpack_module, exports) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.observePullRequestReadiness = observePullRequestReadiness;
+async function observePullRequestReadiness(client, owner, repository, pullRequest) {
+    try {
+        const response = await client.graphql(`query DeploymentPullRequestReadiness($owner: String!, $repository: String!, $pullRequest: Int!) {
+        repository(owner: $owner, name: $repository) {
+          pullRequest(number: $pullRequest) { headRefOid mergeable mergeStateStatus isDraft }
+        }
+      }`, { owner, repository, pullRequest });
+        const state = response?.repository?.pullRequest;
+        if (!state || typeof state.headRefOid !== "string" || !/^[a-f0-9]{40}$/i.test(state.headRefOid)
+            || typeof state.mergeable !== "string" || !["MERGEABLE", "CONFLICTING", "UNKNOWN"].includes(state.mergeable)
+            || typeof state.mergeStateStatus !== "string" || state.mergeStateStatus.length === 0
+            || typeof state.isDraft !== "boolean") {
+            return { problem: { area: "workflow-contract", message: "GitHub returned incomplete pull-request merge readiness." } };
+        }
+        return {
+            value: {
+                headSha: state.headRefOid,
+                immediatelyMergeable: !state.isDraft && state.mergeable === "MERGEABLE"
+                    && ["CLEAN", "UNSTABLE"].includes(state.mergeStateStatus),
+            },
+        };
+    }
+    catch {
+        return { problem: { area: "workflow-contract", message: "GitHub pull-request merge readiness could not be inspected." } };
+    }
+}
+
+
 /***/ }),
 
 /***/ 55527:
@@ -79456,6 +79531,7 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.GithubTargetMergeCapabilitiesInspector = void 0;
 const yaml = __importStar(__nccwpck_require__(783));
+const github_pull_request_readiness_query_1 = __nccwpck_require__(33371);
 class GithubTargetMergeCapabilitiesInspector {
     constructor(clientProvider) {
         this.clientProvider = clientProvider;
@@ -79468,8 +79544,8 @@ class GithubTargetMergeCapabilitiesInspector {
             observeEffectiveRules(client, owner, repository, targetBranch),
             observeBranchMergeQueue(client, owner, repository, targetBranch),
             options.pullRequest === undefined
-                ? Promise.resolve(undefined)
-                : client.rest.pulls.get({ owner, repo: repository, pull_number: options.pullRequest }).then(({ data }) => data),
+                ? Promise.resolve({ value: undefined, problem: undefined })
+                : (0, github_pull_request_readiness_query_1.observePullRequestReadiness)(client, owner, repository, options.pullRequest),
         ]);
         const candidateProblem = options.candidateHeadSha !== undefined && !/^[a-f0-9]{40}$/i.test(options.candidateHeadSha)
             ? {
@@ -79479,25 +79555,26 @@ class GithubTargetMergeCapabilitiesInspector {
             : undefined;
         const candidateHeadChangedProblem = options.candidateHeadSha !== undefined
             && candidateProblem === undefined
-            && pullRequestState !== undefined
-            && pullRequestState.head.sha !== options.candidateHeadSha
+            && pullRequestState.value !== undefined
+            && pullRequestState.value.headSha !== options.candidateHeadSha
             ? {
                 area: "workflow-contract",
                 message: "The pull request head changed during readiness inspection, so the observed workflow contract is stale.",
             }
             : undefined;
         const effective = normalizeEffectiveRules(classic.value, rulesets.value);
-        const problems = [classic.problem, rulesets.problem, queue.problem, candidateProblem, candidateHeadChangedProblem, ...effective.problems]
+        const problems = [classic.problem, rulesets.problem, queue.problem, pullRequestState.problem,
+            candidateProblem, candidateHeadChangedProblem, ...effective.problems]
             .filter((problem) => problem !== undefined);
         const mergeQueueRequired = queue.value === true || effective.mergeQueueRequired;
-        const candidateHeadSha = options.candidateHeadSha ?? pullRequestState?.head.sha;
+        const candidateHeadSha = options.candidateHeadSha ?? pullRequestState.value?.headSha;
         const producerInspection = mergeQueueRequired
             ? await inspectMergeQueueProducers(client, owner, repository, repositoryData.id, targetBranch, candidateHeadSha, effective.requiredChecks, effective.requiredWorkflows)
             : { producers: [], problems: [] };
         return {
             autoMergeAllowed: repositoryData.allow_auto_merge === true,
             mergeQueueRequired,
-            immediatelyMergeable: pullRequestState?.mergeable === true && pullRequestState.mergeable_state === "clean",
+            immediatelyMergeable: problems.length === 0 && pullRequestState.value?.immediatelyMergeable === true,
             requiresStrictStatusChecks: effective.requiresStrictStatusChecks,
             mergeQueueProducers: producerInspection.producers,
             mergeQueueObservationProblems: [...problems, ...producerInspection.problems],
@@ -92399,7 +92476,7 @@ function bindManagedPullRequests(port, binding) {
         enableAutoMerge: (pullRequestNodeId) => port.enableAutoMerge(binding.owner, binding.repository, pullRequestNodeId, binding.token),
         isPullRequestQueued: (pullRequestNodeId) => port.isPullRequestQueued(binding.owner, binding.repository, pullRequestNodeId, binding.token),
         enqueuePullRequest: (pullRequestNodeId, expectedHeadSha) => port.enqueuePullRequest(binding.owner, binding.repository, pullRequestNodeId, expectedHeadSha, binding.token),
-        mergePullRequest: (pullRequest) => port.mergePullRequest(binding.owner, binding.repository, pullRequest, binding.token),
+        mergePullRequest: (pullRequest, expectedHeadSha) => port.mergePullRequest(binding.owner, binding.repository, pullRequest, expectedHeadSha, binding.token),
     });
 }
 function bindDeploymentTargetRules(port, binding) {

package/build/github_action/index.js

@@ -45553,7 +45553,7 @@ exports.ENGLISH_MERGE_QUEUE_MESSAGES = Object.freeze({
     'mergeQueue.decision.queueNotExposed': 'The target does not expose a required merge queue.',
     'mergeQueue.decision.autoMergeConfigured': 'Native auto-merge was explicitly configured.',
     'mergeQueue.decision.autoMergeDisabled': 'Native auto-merge is disabled for this repository.',
-    'mergeQueue.decision.immediatelyMergeable': 'GitHub reports the pull request ready; native auto-merge preserves branch protection.',
+    'mergeQueue.decision.immediatelyMergeable': 'GitHub reports the pull request ready; merge its verified head with branch protection enforced.',
     'mergeQueue.decision.autoMergeAvailable': 'GitHub will merge after checks and reviews complete.',
     'mergeQueue.decision.createOnlyRequired': 'Repository auto-merge is unavailable; maintainer merge is required.',
 });
@@ -45578,7 +45578,7 @@ exports.SPANISH_MERGE_QUEUE_MESSAGES = Object.freeze({
     'mergeQueue.decision.queueNotExposed': 'El destino no expone una merge queue obligatoria.',
     'mergeQueue.decision.autoMergeConfigured': 'El auto-merge nativo se ha configurado explícitamente.',
     'mergeQueue.decision.autoMergeDisabled': 'El auto-merge nativo está deshabilitado en este repositorio.',
-    'mergeQueue.decision.immediatelyMergeable': 'GitHub indica que la pull request está lista; el auto-merge nativo preserva la protección de rama.',
+    'mergeQueue.decision.immediatelyMergeable': 'GitHub indica que la pull request está lista; fusionar su head verificado respetando la protección de rama.',
     'mergeQueue.decision.autoMergeAvailable': 'GitHub hará merge cuando terminen los checks y las revisiones.',
     'mergeQueue.decision.createOnlyRequired': 'El auto-merge del repositorio no está disponible; se requiere el merge de una persona mantenedora.',
 });
@@ -50260,7 +50260,14 @@ class DeploymentOrchestrationRuntime {
             selectedPrMode: inspection.decision.mode,
         };
         await this.persist(context, managed);
-        await this.applyMergeBehavior(context, operation, pullRequest, inspection);
+        try {
+            await this.applyMergeBehavior(context, operation, pullRequest, inspection);
+        }
+        catch (cause) {
+            const message = `GitHub could not configure automatic merge for PR #${pullRequest.number}. Check the PR and retry the stored ${category} phase.`;
+            const error = new application_error_1.ApplicationError("provider.unavailable", message, { cause, retryable: true });
+            return { kind: "blocked", result: await this.block(context, managed, category, message, true, error) };
+        }
         await this.publishDashboard(context, managed);
         return { kind: "configured", operation: managed };
     }
@@ -50328,7 +50335,7 @@ class DeploymentOrchestrationRuntime {
     }
     async applyAutoMerge(context, operation, pullRequest, capabilities) {
         if (operation.prMode === "auto" && capabilities.immediatelyMergeable) {
-            await this.dependencies.pullRequests.mergePullRequest(pullRequest.number);
+            await this.dependencies.pullRequests.mergePullRequest(pullRequest.number, pullRequest.headSha);
             return;
         }
         if (!pullRequest.autoMergeEnabled) {
@@ -51190,22 +51197,19 @@ const application_error_1 = __nccwpck_require__(75999);
 const deployment_plan_policy_1 = __nccwpck_require__(8352);
 const deployment_operation_1 = __nccwpck_require__(92730);
 const deployment_orchestration_runtime_1 = __nccwpck_require__(77658);
+const deployment_continuation_guard_1 = __nccwpck_require__(1779);
 class ConfirmPublicationHandler {
     constructor(runtime, reconciliation) {
         this.runtime = runtime;
         this.reconciliation = reconciliation;
     }
     async invoke(context) {
-        const operation = await this.resumeRetryableBlock(context, (0, deployment_orchestration_runtime_1.requireDeploymentOperation)(context));
-        if (operation.phase === "reconciliation_pending" && operation.publicationVerified) {
-            return await this.reconciliation.plan(context, operation)
-                ?? (0, deployment_orchestration_runtime_1.deploymentSuccess)(`Publication for ${operation.tag} was already verified; reconciliation state was recovered.`);
-        }
-        if (operation.phase === "completed" && operation.publicationVerified) {
-            await this.runtime.publishDashboard(context, operation);
-            return (0, deployment_orchestration_runtime_1.deploymentSuccess)(`Publication for ${operation.tag} was already verified; duplicate notification ignored.`);
-        }
-        assertPublicationPhase(operation);
+        const current = (0, deployment_orchestration_runtime_1.requireDeploymentOperation)(context);
+        const invalid = (0, deployment_continuation_guard_1.validateDeploymentContinuation)(current, context.singleAction.operationId, ["published", "publishing", "promoted", "reconciliation_pending", "completed"], context.singleAction.version);
+        if (invalid)
+            throw new application_error_1.ApplicationError("workflow.stale", invalid);
+        // Verify external receipts before clearing a block or retrying any merge/cleanup effect.
+        const operation = current;
         const productionSha = requireProductionSha(operation);
         const publication = await this.runtime.dependencies.publication.inspect({
             tag: operation.tag,
@@ -51222,8 +51226,18 @@ class ConfirmPublicationHandler {
         if (!reachable) {
             return await this.runtime.block(context, operation, "publication", "Published SHA is not reachable from the stored production branch.", false);
         }
+        const resumed = await this.resumeRetryableBlock(context, operation);
+        if (resumed.phase === "reconciliation_pending" && resumed.publicationVerified) {
+            return await this.reconciliation.plan(context, resumed)
+                ?? (0, deployment_orchestration_runtime_1.deploymentSuccess)(`Publication for ${resumed.tag} was already verified; reconciliation state was recovered.`);
+        }
+        if (resumed.phase === "completed" && resumed.publicationVerified) {
+            await this.runtime.publishDashboard(context, resumed);
+            return (0, deployment_orchestration_runtime_1.deploymentSuccess)(`Publication for ${resumed.tag} was already verified; duplicate notification ignored.`);
+        }
+        assertPublicationPhase(resumed);
         const published = {
-            ...operation,
+            ...resumed,
             phase: "published",
             publicationVerified: true,
             publicationReceipt: publication.receipt,
@@ -51542,6 +51556,7 @@ Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.ReconciliationHandler = void 0;
 const deployment_plan_policy_1 = __nccwpck_require__(8352);
 const deployment_operation_1 = __nccwpck_require__(92730);
+const managed_pull_request_1 = __nccwpck_require__(95914);
 const deployment_orchestration_runtime_1 = __nccwpck_require__(77658);
 class ReconciliationHandler {
     constructor(runtime) {
@@ -51578,10 +51593,12 @@ class ReconciliationHandler {
         return await this.complete(context, updated, ` after reconciliation PR #${pullRequest.number}`);
     }
     async plan(context, operation) {
-        const index = operation.reconciliationTargets.findIndex((target) => target.status === "pending" && target.pullRequest === undefined);
+        const index = operation.reconciliationTargets.findIndex((target) => target.status === "pending");
         if (index < 0)
             return await this.finishOrPresent(context, operation);
         let target = operation.reconciliationTargets[index];
+        if (target.pullRequest !== undefined)
+            return await this.resumePullRequest(context, operation, target);
         const targetRole = (0, deployment_orchestration_runtime_1.reconciliationTargetRole)(operation, target.targetBranch);
         const preflight = await this.runtime.inspectMergeBehavior(context, operation, target.targetBranch, targetRole, target.sourceSha);
         if (preflight.kind === "blocked") {
@@ -51638,6 +51655,26 @@ class ReconciliationHandler {
         await this.runtime.publishMilestone(context, completed, { kind: "orchestration-complete", tag: completed.tag });
         return (0, deployment_orchestration_runtime_1.deploymentSuccess)(`Deployment ${completed.tag} completed${completionContext}.`);
     }
+    async resumePullRequest(context, operation, target) {
+        const pullRequest = await this.runtime.dependencies.pullRequests.getPullRequest(target.pullRequest);
+        const identity = (0, managed_pull_request_1.parseManagedPullRequestMarker)(pullRequest.body);
+        const expectedHead = target.syncBranch ? target.syncSha : target.sourceSha;
+        if (!identity || identity.operationId !== operation.operationId || identity.phase !== "reconciliation"
+            || identity.issue !== context.singleAction.issue || pullRequest.number !== target.pullRequest
+            || pullRequest.repositoryFullName.toLowerCase() !== `${context.owner}/${context.repo}`.toLowerCase()
+            || pullRequest.baseBranch !== target.targetBranch
+            || pullRequest.headBranch !== (target.syncBranch ?? target.sourceBranch)
+            || !expectedHead || pullRequest.headSha !== expectedHead) {
+            return await this.runtime.block(context, operation, "reconciliation", "The recorded reconciliation PR no longer matches its durable identity and head SHA.", false);
+        }
+        if (pullRequest.merged)
+            return await this.accept(context, operation, pullRequest);
+        if (pullRequest.state === "closed") {
+            return await this.runtime.block(context, operation, "reconciliation", `Reconciliation PR #${pullRequest.number} was closed without merge.`, true);
+        }
+        const configured = await this.runtime.configureMergeBehavior(context, operation, pullRequest, "reconciliation", (0, deployment_orchestration_runtime_1.reconciliationTargetRole)(operation, target.targetBranch));
+        return configured.kind === "blocked" ? configured.result : undefined;
+    }
     async finishOrPresent(context, operation) {
         if (operation.reconciliationTargets.length > 0
             && operation.reconciliationTargets.every((target) => target.status === "completed")) {
@@ -71651,12 +71688,13 @@ class GithubManagedPullRequestRepository {
             throw new Error("GitHub did not confirm that the pull request entered the merge queue.");
         }
     }
-    async mergePullRequest(owner, repository, pullRequest, token) {
+    async mergePullRequest(owner, repository, pullRequest, expectedHeadSha, token) {
         const { data } = await this.clientProvider.getClient(token).rest.pulls.merge({
             owner,
             repo: repository,
             pull_number: pullRequest,
             merge_method: "merge",
+            sha: expectedHeadSha,
         });
         if (!data.merged || !data.sha)
             throw new Error(data.message ?? `Pull request #${pullRequest} was not merged.`);
@@ -71681,6 +71719,43 @@ function mapPullRequest(value, owner, repository) {
 }
 
 
+/***/ }),
+
+/***/ 33371:
+/***/ ((__unused_webpack_module, exports) => {
+
+"use strict";
+
+Object.defineProperty(exports, "__esModule", ({ value: true }));
+exports.observePullRequestReadiness = observePullRequestReadiness;
+async function observePullRequestReadiness(client, owner, repository, pullRequest) {
+    try {
+        const response = await client.graphql(`query DeploymentPullRequestReadiness($owner: String!, $repository: String!, $pullRequest: Int!) {
+        repository(owner: $owner, name: $repository) {
+          pullRequest(number: $pullRequest) { headRefOid mergeable mergeStateStatus isDraft }
+        }
+      }`, { owner, repository, pullRequest });
+        const state = response?.repository?.pullRequest;
+        if (!state || typeof state.headRefOid !== "string" || !/^[a-f0-9]{40}$/i.test(state.headRefOid)
+            || typeof state.mergeable !== "string" || !["MERGEABLE", "CONFLICTING", "UNKNOWN"].includes(state.mergeable)
+            || typeof state.mergeStateStatus !== "string" || state.mergeStateStatus.length === 0
+            || typeof state.isDraft !== "boolean") {
+            return { problem: { area: "workflow-contract", message: "GitHub returned incomplete pull-request merge readiness." } };
+        }
+        return {
+            value: {
+                headSha: state.headRefOid,
+                immediatelyMergeable: !state.isDraft && state.mergeable === "MERGEABLE"
+                    && ["CLEAN", "UNSTABLE"].includes(state.mergeStateStatus),
+            },
+        };
+    }
+    catch {
+        return { problem: { area: "workflow-contract", message: "GitHub pull-request merge readiness could not be inspected." } };
+    }
+}
+
+
 /***/ }),
 
 /***/ 55527:
@@ -71724,6 +71799,7 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", ({ value: true }));
 exports.GithubTargetMergeCapabilitiesInspector = void 0;
 const yaml = __importStar(__nccwpck_require__(783));
+const github_pull_request_readiness_query_1 = __nccwpck_require__(33371);
 class GithubTargetMergeCapabilitiesInspector {
     constructor(clientProvider) {
         this.clientProvider = clientProvider;
@@ -71736,8 +71812,8 @@ class GithubTargetMergeCapabilitiesInspector {
             observeEffectiveRules(client, owner, repository, targetBranch),
             observeBranchMergeQueue(client, owner, repository, targetBranch),
             options.pullRequest === undefined
-                ? Promise.resolve(undefined)
-                : client.rest.pulls.get({ owner, repo: repository, pull_number: options.pullRequest }).then(({ data }) => data),
+                ? Promise.resolve({ value: undefined, problem: undefined })
+                : (0, github_pull_request_readiness_query_1.observePullRequestReadiness)(client, owner, repository, options.pullRequest),
         ]);
         const candidateProblem = options.candidateHeadSha !== undefined && !/^[a-f0-9]{40}$/i.test(options.candidateHeadSha)
             ? {
@@ -71747,25 +71823,26 @@ class GithubTargetMergeCapabilitiesInspector {
             : undefined;
         const candidateHeadChangedProblem = options.candidateHeadSha !== undefined
             && candidateProblem === undefined
-            && pullRequestState !== undefined
-            && pullRequestState.head.sha !== options.candidateHeadSha
+            && pullRequestState.value !== undefined
+            && pullRequestState.value.headSha !== options.candidateHeadSha
             ? {
                 area: "workflow-contract",
                 message: "The pull request head changed during readiness inspection, so the observed workflow contract is stale.",
             }
             : undefined;
         const effective = normalizeEffectiveRules(classic.value, rulesets.value);
-        const problems = [classic.problem, rulesets.problem, queue.problem, candidateProblem, candidateHeadChangedProblem, ...effective.problems]
+        const problems = [classic.problem, rulesets.problem, queue.problem, pullRequestState.problem,
+            candidateProblem, candidateHeadChangedProblem, ...effective.problems]
             .filter((problem) => problem !== undefined);
         const mergeQueueRequired = queue.value === true || effective.mergeQueueRequired;
-        const candidateHeadSha = options.candidateHeadSha ?? pullRequestState?.head.sha;
+        const candidateHeadSha = options.candidateHeadSha ?? pullRequestState.value?.headSha;
         const producerInspection = mergeQueueRequired
             ? await inspectMergeQueueProducers(client, owner, repository, repositoryData.id, targetBranch, candidateHeadSha, effective.requiredChecks, effective.requiredWorkflows)
             : { producers: [], problems: [] };
         return {
             autoMergeAllowed: repositoryData.allow_auto_merge === true,
             mergeQueueRequired,
-            immediatelyMergeable: pullRequestState?.mergeable === true && pullRequestState.mergeable_state === "clean",
+            immediatelyMergeable: problems.length === 0 && pullRequestState.value?.immediatelyMergeable === true,
             requiresStrictStatusChecks: effective.requiresStrictStatusChecks,
             mergeQueueProducers: producerInspection.producers,
             mergeQueueObservationProblems: [...problems, ...producerInspection.problems],
@@ -84833,7 +84910,7 @@ function bindManagedPullRequests(port, binding) {
         enableAutoMerge: (pullRequestNodeId) => port.enableAutoMerge(binding.owner, binding.repository, pullRequestNodeId, binding.token),
         isPullRequestQueued: (pullRequestNodeId) => port.isPullRequestQueued(binding.owner, binding.repository, pullRequestNodeId, binding.token),
         enqueuePullRequest: (pullRequestNodeId, expectedHeadSha) => port.enqueuePullRequest(binding.owner, binding.repository, pullRequestNodeId, expectedHeadSha, binding.token),
-        mergePullRequest: (pullRequest) => port.mergePullRequest(binding.owner, binding.repository, pullRequest, binding.token),
+        mergePullRequest: (pullRequest, expectedHeadSha) => port.mergePullRequest(binding.owner, binding.repository, pullRequest, expectedHeadSha, binding.token),
     });
 }
 function bindDeploymentTargetRules(port, binding) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vypdev/copilot",
-  "version": "3.5.1",
+  "version": "3.5.3",
   "packageManager": "pnpm@10.12.4",
   "pnpm": {
     "overrides": {

package/setup/workflows/hotfix_workflow.yml

@@ -8,7 +8,7 @@ on:
         required: true
         default: prepare
         type: choice
-        options: [prepare, publish]
+        options: [prepare, publish, resume]
       operation-id:
         description: 'Internal durable operation identifier'
         required: false
@@ -66,10 +66,10 @@ jobs:
               if (operationId) errors.push('Operation ID must be empty in prepare mode.');
               if (!title || title.length > 1000) errors.push('Title must contain 1-1000 characters.');
               if (!changelog || changelog.length > 50000) errors.push('Changelog must contain 1-50000 characters.');
-            } else if (mode === 'publish') {
+            } else if (mode === 'publish' || mode === 'resume') {
               if (!/^[A-Za-z0-9][A-Za-z0-9._-]{7,127}$/.test(operationId)) errors.push('Operation ID is invalid.');
-              if (title || changelog) errors.push('Title and changelog must be empty in publish mode.');
-            } else errors.push('Mode must be prepare or publish.');
+              if (title || changelog) errors.push('Title and changelog must be empty in publish or resume mode.');
+            } else errors.push('Mode must be prepare, publish, or resume.');
             if (errors.length) core.setFailed(errors.join(' '));
 
   prepare-version-files:
@@ -185,17 +185,66 @@ jobs:
           single-action-version: ${{ inputs.version }}
           token: ${{ secrets.PAT }}
 
+  resume-reconciliation:
+    name: Resume published deployment
+    if: ${{ inputs.mode == 'resume' }}
+    runs-on: ubuntu-latest
+    needs: validate
+    timeout-minutes: 15
+    permissions:
+      issues: write
+      pull-requests: write
+    steps:
+      - name: Verify published operation before recovery
+        uses: actions/github-script@v9
+        env:
+          ISSUE: ${{ inputs.issue }}
+          OPERATION_ID: ${{ inputs.operation-id }}
+          VERSION: ${{ inputs.version }}
+        with:
+          script: |
+            const response = await github.rest.issues.get({ ...context.repo, issue_number: Number(process.env.ISSUE) });
+            if (response.data.pull_request) throw new Error('The launcher must be an issue.');
+            const body = response.data.body || '';
+            const start = '<!-- copilot-configuration-start';
+            const end = 'copilot-configuration-end -->';
+            const first = body.indexOf(start);
+            const last = body.indexOf(end, first + start.length);
+            if (first < 0 || last < 0 || body.indexOf(start, first + start.length) >= 0) throw new Error('A unique durable configuration is required.');
+            const payload = JSON.parse(body.slice(first + start.length, last));
+            const state = payload?.deploymentOrchestration;
+            const receipt = state?.publicationReceipt;
+            const phase = state?.phase === 'blocked' && state?.lastFailure?.retryable === true
+              ? state.lastFailure.previousPhase : state?.phase;
+            if (payload?.schemaVersion !== 3 || state?.stateVersion !== 1
+              || !Number.isSafeInteger(state?.revision) || state.revision < 1
+              || state.operationId !== process.env.OPERATION_ID || state.version !== process.env.VERSION
+              || !['reconciliation_pending', 'completed'].includes(phase) || state.publicationVerified !== true
+              || !/^[a-f0-9]{40}$/i.test(state.productionSha || '') || state.tag !== `v${process.env.VERSION}`
+              || receipt?.operationId !== state.operationId || receipt?.productionSha !== state.productionSha
+              || receipt?.tag !== state.tag) throw new Error('Recovery requires the matching, already verified publication and reconciliation state.');
+      - name: Resume reconciliation from verified receipts
+        uses: vypdev/copilot@v3
+        with:
+          single-action: published_deployment_action
+          single-action-issue: ${{ inputs.issue }}
+          issue-workflow-profile: ${{ vars.COPILOT_ISSUE_WORKFLOW_PROFILE || '' }}
+          single-action-operation-id: ${{ inputs.operation-id }}
+          single-action-version: ${{ inputs.version }}
+          merge-queue-check-attestations: ${{ vars.MERGE_QUEUE_CHECK_ATTESTATIONS || '[]' }}
+          token: ${{ secrets.PAT }}
+
   report-failure:
     name: Report orchestration failure
     runs-on: ubuntu-latest
     timeout-minutes: 5
-    needs: [validate, prepare-version-files, promote, publish]
+    needs: [validate, prepare-version-files, promote, publish, resume-reconciliation]
     if: ${{ failure() && needs.validate.result == 'success' }}
     permissions:
       issues: write
     steps:
       - name: Persist publication failure
-        if: ${{ inputs.mode == 'publish' }}
+        if: ${{ inputs.mode == 'publish' || inputs.mode == 'resume' }}
         uses: vypdev/copilot@v3
         with:
           single-action: failed_deployment_action

package/setup/workflows/release_workflow.yml

@@ -8,7 +8,7 @@ on:
         required: true
         default: prepare
         type: choice
-        options: [prepare, publish]
+        options: [prepare, publish, resume]
       operation-id:
         description: 'Internal durable operation identifier'
         required: false
@@ -66,10 +66,10 @@ jobs:
               if (operationId) errors.push('Operation ID must be empty in prepare mode.');
               if (!title || title.length > 1000) errors.push('Title must contain 1-1000 characters.');
               if (!changelog || changelog.length > 50000) errors.push('Changelog must contain 1-50000 characters.');
-            } else if (mode === 'publish') {
+            } else if (mode === 'publish' || mode === 'resume') {
               if (!/^[A-Za-z0-9][A-Za-z0-9._-]{7,127}$/.test(operationId)) errors.push('Operation ID is invalid.');
-              if (title || changelog) errors.push('Title and changelog must be empty in publish mode.');
-            } else errors.push('Mode must be prepare or publish.');
+              if (title || changelog) errors.push('Title and changelog must be empty in publish or resume mode.');
+            } else errors.push('Mode must be prepare, publish, or resume.');
             if (errors.length) core.setFailed(errors.join(' '));
 
   prepare-version-files:
@@ -185,17 +185,66 @@ jobs:
           single-action-version: ${{ inputs.version }}
           token: ${{ secrets.PAT }}
 
+  resume-reconciliation:
+    name: Resume published deployment
+    if: ${{ inputs.mode == 'resume' }}
+    runs-on: ubuntu-latest
+    needs: validate
+    timeout-minutes: 15
+    permissions:
+      issues: write
+      pull-requests: write
+    steps:
+      - name: Verify published operation before recovery
+        uses: actions/github-script@v9
+        env:
+          ISSUE: ${{ inputs.issue }}
+          OPERATION_ID: ${{ inputs.operation-id }}
+          VERSION: ${{ inputs.version }}
+        with:
+          script: |
+            const response = await github.rest.issues.get({ ...context.repo, issue_number: Number(process.env.ISSUE) });
+            if (response.data.pull_request) throw new Error('The launcher must be an issue.');
+            const body = response.data.body || '';
+            const start = '<!-- copilot-configuration-start';
+            const end = 'copilot-configuration-end -->';
+            const first = body.indexOf(start);
+            const last = body.indexOf(end, first + start.length);
+            if (first < 0 || last < 0 || body.indexOf(start, first + start.length) >= 0) throw new Error('A unique durable configuration is required.');
+            const payload = JSON.parse(body.slice(first + start.length, last));
+            const state = payload?.deploymentOrchestration;
+            const receipt = state?.publicationReceipt;
+            const phase = state?.phase === 'blocked' && state?.lastFailure?.retryable === true
+              ? state.lastFailure.previousPhase : state?.phase;
+            if (payload?.schemaVersion !== 3 || state?.stateVersion !== 1
+              || !Number.isSafeInteger(state?.revision) || state.revision < 1
+              || state.operationId !== process.env.OPERATION_ID || state.version !== process.env.VERSION
+              || !['reconciliation_pending', 'completed'].includes(phase) || state.publicationVerified !== true
+              || !/^[a-f0-9]{40}$/i.test(state.productionSha || '') || state.tag !== `v${process.env.VERSION}`
+              || receipt?.operationId !== state.operationId || receipt?.productionSha !== state.productionSha
+              || receipt?.tag !== state.tag) throw new Error('Recovery requires the matching, already verified publication and reconciliation state.');
+      - name: Resume reconciliation from verified receipts
+        uses: vypdev/copilot@v3
+        with:
+          single-action: published_deployment_action
+          single-action-issue: ${{ inputs.issue }}
+          issue-workflow-profile: ${{ vars.COPILOT_ISSUE_WORKFLOW_PROFILE || '' }}
+          single-action-operation-id: ${{ inputs.operation-id }}
+          single-action-version: ${{ inputs.version }}
+          merge-queue-check-attestations: ${{ vars.MERGE_QUEUE_CHECK_ATTESTATIONS || '[]' }}
+          token: ${{ secrets.PAT }}
+
   report-failure:
     name: Report orchestration failure
     runs-on: ubuntu-latest
     timeout-minutes: 5
-    needs: [validate, prepare-version-files, promote, publish]
+    needs: [validate, prepare-version-files, promote, publish, resume-reconciliation]
     if: ${{ failure() && needs.validate.result == 'success' }}
     permissions:
       issues: write
     steps:
       - name: Persist publication failure
-        if: ${{ inputs.mode == 'publish' }}
+        if: ${{ inputs.mode == 'publish' || inputs.mode == 'resume' }}
         uses: vypdev/copilot@v3
         with:
           single-action: failed_deployment_action