deepline 0.3.89 → 0.3.91

package/dist/bundling-sources/shared_libs/play-runtime/deployment/vercel-fly-rollback-alignment.ts

@@ -0,0 +1,280 @@
+import { createHmac, timingSafeEqual } from 'node:crypto';
+
+const ROLLBACK_EVENT_TYPES = new Set([
+  'deployment.rollback',
+  'deployment-rollback',
+]);
+const TRACKED_EVENT_TYPES = new Set([
+  'deployment.succeeded',
+  'deployment.promoted',
+  ...ROLLBACK_EVENT_TYPES,
+]);
+
+export type AlignmentStatus =
+  | 'ignored'
+  | 'tracked'
+  | 'rollback_tracked'
+  | 'rollback_needs_manual_mapping';
+
+export interface VercelWebhookEvent {
+  type?: string;
+  id?: string;
+  createdAt?: number;
+  payload?: Record<string, unknown>;
+}
+
+export interface VercelDeploymentSummary {
+  id: string;
+  url?: string;
+  meta?: Record<string, unknown>;
+}
+
+export interface VercelRollbackNotice {
+  status: AlignmentStatus;
+  eventType: string;
+  deliveryId: string | null;
+  vercelProject: string | null;
+  fromDeploymentId: string | null;
+  toDeploymentId: string | null;
+  toDeploymentUrl: string | null;
+  gitSha: string | null;
+  workerBuildId: string | null;
+}
+
+export interface VercelDeploymentEventSummary {
+  status: 'ignored' | 'tracked';
+  eventType: string;
+  deliveryId: string | null;
+  vercelProject: string | null;
+  deploymentId: string | null;
+  deploymentUrl: string | null;
+  target: string | null;
+  gitSha: string | null;
+  workerBuildId: string | null;
+}
+
+function readRecord(value: unknown): Record<string, unknown> | null {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return null;
+  return value as Record<string, unknown>;
+}
+
+function readString(value: unknown): string | null {
+  return typeof value === 'string' && value.trim() ? value.trim() : null;
+}
+
+function readNestedString(
+  record: Record<string, unknown> | null,
+  path: string[],
+): string | null {
+  let current: unknown = record;
+  for (const key of path) {
+    const next = readRecord(current);
+    if (!next) return null;
+    current = next[key];
+  }
+  return readString(current);
+}
+
+function normalizeGitSha(value: string | null): string | null {
+  if (!value) return null;
+  const trimmed = value.trim();
+  return /^[a-f0-9]{7,40}$/i.test(trimmed) ? trimmed : null;
+}
+
+export function verifyVercelSignature(input: {
+  rawBody: string;
+  signature: string | null;
+  secret: string;
+}): boolean {
+  const signature = input.signature?.trim();
+  if (!signature) return false;
+  const expected = createHmac('sha1', input.secret)
+    .update(input.rawBody)
+    .digest('hex');
+  const expectedBuffer = Buffer.from(expected, 'hex');
+  const actualBuffer = Buffer.from(signature, 'hex');
+  if (expectedBuffer.byteLength !== actualBuffer.byteLength) return false;
+  return timingSafeEqual(expectedBuffer, actualBuffer);
+}
+
+export function extractVercelDeploymentEvent(event: VercelWebhookEvent): {
+  eventType: string;
+  deliveryId: string | null;
+  deploymentId: string | null;
+  fromDeploymentId: string | null;
+  toDeploymentId: string | null;
+  vercelProject: string | null;
+  deploymentUrl: string | null;
+  target: string | null;
+} {
+  const payload = readRecord(event.payload);
+  const eventType = readString(event.type) ?? 'unknown';
+  const deployment = readRecord(payload?.deployment);
+  const previousDeployment = readRecord(payload?.previousDeployment);
+  const targetDeployment = readRecord(payload?.targetDeployment);
+  const rollback = readRecord(payload?.rollback);
+
+  return {
+    eventType,
+    deliveryId: readString(event.id),
+    deploymentId:
+      readNestedString(deployment, ['id']) ?? readString(payload?.deploymentId),
+    fromDeploymentId:
+      readString(payload?.fromDeploymentId) ??
+      readNestedString(rollback, ['fromDeploymentId']) ??
+      readNestedString(previousDeployment, ['id']) ??
+      readNestedString(deployment, ['id']),
+    toDeploymentId:
+      readString(payload?.toDeploymentId) ??
+      readString(payload?.targetDeploymentId) ??
+      readNestedString(rollback, ['toDeploymentId']) ??
+      readNestedString(targetDeployment, ['id']),
+    vercelProject:
+      readNestedString(payload, ['project', 'name']) ??
+      readString(payload?.projectName) ??
+      readString(payload?.projectId) ??
+      readNestedString(deployment, ['name']),
+    deploymentUrl:
+      readNestedString(deployment, ['url']) ??
+      readNestedString(payload, ['links', 'deployment']),
+    target: readString(payload?.target),
+  };
+}
+
+export const extractVercelRollbackIds = extractVercelDeploymentEvent;
+
+export function extractGitShaFromVercelDeployment(
+  deployment: VercelDeploymentSummary | null,
+): string | null {
+  const meta = deployment?.meta ?? {};
+  return normalizeGitSha(
+    readString(meta.githubCommitSha) ??
+      readString(meta.githubCommitSHA) ??
+      readString(meta.gitCommitSha) ??
+      readString(meta.commitSha) ??
+      readString(meta.VERCEL_GIT_COMMIT_SHA),
+  );
+}
+
+export function extractDeploymentSummaryFromVercelEvent(
+  event: VercelWebhookEvent,
+): VercelDeploymentSummary | null {
+  const payload = readRecord(event.payload);
+  const ids = extractVercelDeploymentEvent(event);
+  const deployment =
+    readRecord(payload?.targetDeployment) ?? readRecord(payload?.deployment);
+  if (!deployment) return null;
+
+  const id =
+    readString(deployment.id) ?? ids.toDeploymentId ?? ids.deploymentId;
+  if (!id) return null;
+
+  return {
+    id,
+    url: readString(deployment.url) ?? ids.deploymentUrl ?? undefined,
+    meta: readRecord(deployment.meta) ?? undefined,
+  };
+}
+
+export function buildVercelRollbackNotice(input: {
+  event: VercelWebhookEvent;
+  targetDeployment: VercelDeploymentSummary | null;
+}): VercelRollbackNotice {
+  const ids = extractVercelDeploymentEvent(input.event);
+  if (!ROLLBACK_EVENT_TYPES.has(ids.eventType)) {
+    return {
+      status: 'ignored',
+      eventType: ids.eventType,
+      deliveryId: ids.deliveryId,
+      vercelProject: ids.vercelProject,
+      fromDeploymentId: ids.fromDeploymentId,
+      toDeploymentId: ids.toDeploymentId,
+      toDeploymentUrl: input.targetDeployment?.url ?? null,
+      gitSha: null,
+      workerBuildId: null,
+    };
+  }
+
+  const gitSha = extractGitShaFromVercelDeployment(input.targetDeployment);
+  if (!gitSha) {
+    return {
+      status: 'rollback_needs_manual_mapping',
+      eventType: ids.eventType,
+      deliveryId: ids.deliveryId,
+      vercelProject: ids.vercelProject,
+      fromDeploymentId: ids.fromDeploymentId,
+      toDeploymentId: ids.toDeploymentId,
+      toDeploymentUrl: input.targetDeployment?.url ?? null,
+      gitSha: null,
+      workerBuildId: null,
+    };
+  }
+
+  const workerBuildId = `git-${gitSha}`;
+
+  return {
+    status: 'rollback_tracked',
+    eventType: ids.eventType,
+    deliveryId: ids.deliveryId,
+    vercelProject: ids.vercelProject,
+    fromDeploymentId: ids.fromDeploymentId,
+    toDeploymentId: ids.toDeploymentId,
+    toDeploymentUrl: input.targetDeployment?.url ?? null,
+    gitSha,
+    workerBuildId,
+  };
+}
+
+export function buildVercelDeploymentEventSummary(input: {
+  event: VercelWebhookEvent;
+  deployment: VercelDeploymentSummary | null;
+}): VercelDeploymentEventSummary {
+  const ids = extractVercelDeploymentEvent(input.event);
+  const gitSha = extractGitShaFromVercelDeployment(input.deployment);
+  return {
+    status: TRACKED_EVENT_TYPES.has(ids.eventType) ? 'tracked' : 'ignored',
+    eventType: ids.eventType,
+    deliveryId: ids.deliveryId,
+    vercelProject: ids.vercelProject,
+    deploymentId: ids.deploymentId,
+    deploymentUrl: input.deployment?.url ?? ids.deploymentUrl,
+    target: ids.target,
+    gitSha,
+    workerBuildId: gitSha ? `git-${gitSha}` : null,
+  };
+}
+
+export function buildVercelRollbackSlackText(
+  plan: VercelRollbackNotice,
+): string {
+  const lines = [
+    plan.status === 'rollback_tracked'
+      ? ':warning: Vercel rollback detected; runtime rollback is manual.'
+      : ':warning: Vercel rollback detected; runtime build mapping needs manual lookup.',
+    plan.vercelProject ? `Project: ${plan.vercelProject}` : null,
+    plan.fromDeploymentId ? `From: ${plan.fromDeploymentId}` : null,
+    plan.toDeploymentId ? `To: ${plan.toDeploymentId}` : null,
+    plan.workerBuildId ? `Worker build: ${plan.workerBuildId}` : null,
+  ];
+  return lines.filter(Boolean).join('\n');
+}
+
+export function buildVercelDeploymentSlackText(
+  summary: VercelDeploymentEventSummary,
+): string {
+  const title =
+    summary.eventType === 'deployment.succeeded'
+      ? ':white_check_mark: Vercel deployment succeeded.'
+      : ':large_green_circle: Vercel deployment promoted.';
+  const lines = [
+    title,
+    summary.vercelProject ? `Project: ${summary.vercelProject}` : null,
+    summary.deploymentId ? `Deployment: ${summary.deploymentId}` : null,
+    summary.deploymentUrl ? `URL: ${summary.deploymentUrl}` : null,
+    summary.target ? `Target: ${summary.target}` : null,
+    summary.workerBuildId
+      ? `Aligned worker build: ${summary.workerBuildId}`
+      : null,
+  ];
+  return lines.filter(Boolean).join('\n');
+}

package/dist/bundling-sources/shared_libs/play-runtime/deployment/vercel-production-gate.ts

@@ -0,0 +1,159 @@
+export type VercelDeployment = {
+  id?: string;
+  /** Vercel's deployment-list endpoint names this same identifier `uid`. */
+  uid?: string;
+  url?: string;
+  gitSource?: { sha?: string };
+  meta?: { githubCommitSha?: string };
+  readyState?: string;
+  target?: string;
+};
+
+export type VercelGateDecision =
+  | { kind: 'ready' }
+  | { kind: 'superseded'; activeSha: string }
+  | { kind: 'assert-mismatch'; activeSha?: string }
+  | { kind: 'wait' };
+
+export type VercelStagedProductionDecision =
+  | { kind: 'ready'; deployment: VercelDeployment }
+  | { kind: 'auto-assigned' }
+  | { kind: 'vercel-failed'; description?: string; targetUrl?: string }
+  | { kind: 'wait' };
+
+export type VercelStagedProductionPolicyDecision =
+  | { kind: 'ready' }
+  | { kind: 'auto-assign-enabled' };
+
+/**
+ * The release controller only owns the Vercel alias while Vercel is configured
+ * to leave Production builds staged. Treat an absent or legacy project setting
+ * as unsafe rather than hoping the candidate gate catches an alias move later.
+ */
+export function decideVercelStagedProductionPolicy(input: {
+  autoAssignCustomDomains?: boolean;
+}): VercelStagedProductionPolicyDecision {
+  return input.autoAssignCustomDomains === false
+    ? { kind: 'ready' }
+    : { kind: 'auto-assign-enabled' };
+}
+
+function deploymentSha(deployment: VercelDeployment): string | undefined {
+  return deployment.meta?.githubCommitSha ?? deployment.gitSource?.sha;
+}
+
+export function deploymentId(deployment: VercelDeployment): string | undefined {
+  return deployment.id ?? deployment.uid;
+}
+
+/**
+ * Git creates the production build; the release controller only promotes the
+ * already-staged deployment after its runtime proof has passed. Keep that one
+ * provider mutation shared by normal release and panic recovery.
+ */
+export async function promoteVercelProductionDeployment(input: {
+  deploymentId: string;
+  fetchImpl?: typeof fetch;
+  projectId: string;
+  teamId: string;
+  token: string;
+}): Promise<Response> {
+  return await (input.fetchImpl ?? fetch)(
+    `https://api.vercel.com/v10/projects/${encodeURIComponent(input.projectId)}/promote/${encodeURIComponent(input.deploymentId)}?teamId=${encodeURIComponent(input.teamId)}`,
+    {
+      method: 'POST',
+      headers: {
+        authorization: `Bearer ${input.token}`,
+        'content-type': 'application/json',
+      },
+      body: '{}',
+    },
+  );
+}
+
+/**
+ * A staged production deployment is the exact production build we will
+ * promote later, but it must not yet own the public production alias. This is
+ * deliberately separate from decideVercelProductionGate: accepting an active
+ * alias here would make the release controller silently lose traffic control.
+ */
+export function decideVercelStagedProductionGate(input: {
+  expectedSha: string;
+  activeDeployment: VercelDeployment;
+  deployments: VercelDeployment[];
+  vercelStatus?: {
+    state?: string;
+    description?: string;
+    target_url?: string;
+  };
+}): VercelStagedProductionDecision {
+  if (
+    input.vercelStatus?.state === 'failure' ||
+    input.vercelStatus?.state === 'error'
+  ) {
+    return {
+      kind: 'vercel-failed',
+      description: input.vercelStatus.description,
+      targetUrl: input.vercelStatus.target_url,
+    };
+  }
+  const activeServesExpectedSha =
+    deploymentSha(input.activeDeployment) === input.expectedSha;
+  if (activeServesExpectedSha) {
+    return { kind: 'auto-assigned' };
+  }
+
+  const candidates = input.deployments.filter(
+    (deployment) =>
+      deploymentSha(deployment) === input.expectedSha &&
+      deployment.target === 'production' &&
+      deploymentId(deployment) !== deploymentId(input.activeDeployment),
+  );
+  const staged = candidates.find(
+    (deployment) =>
+      deployment.readyState === 'READY' &&
+      Boolean(deploymentId(deployment)) &&
+      Boolean(deployment.url),
+  );
+  if (staged) return { kind: 'ready', deployment: staged };
+
+  if (candidates.some((deployment) => deployment.readyState === 'ERROR')) {
+    return {
+      kind: 'vercel-failed',
+      description: input.vercelStatus?.description,
+      targetUrl: input.vercelStatus?.target_url,
+    };
+  }
+  return { kind: 'wait' };
+}
+
+/**
+ * Decide whether a shared-plane mutation may proceed from the deployment that
+ * is actually behind the production alias. Kept pure so the race cases are
+ * tested without making Vercel or GitHub API calls.
+ */
+export function decideVercelProductionGate(input: {
+  expectedSha: string;
+  activeDeployment: VercelDeployment;
+  activeRevisionIsNewer: boolean;
+  mode: 'wait' | 'assert';
+}): VercelGateDecision {
+  const activeSha =
+    input.activeDeployment.meta?.githubCommitSha ??
+    input.activeDeployment.gitSource?.sha;
+
+  if (
+    activeSha === input.expectedSha &&
+    input.activeDeployment.readyState === 'READY' &&
+    input.activeDeployment.target === 'production'
+  ) {
+    return { kind: 'ready' };
+  }
+  if (input.activeRevisionIsNewer && activeSha) {
+    return { kind: 'superseded', activeSha };
+  }
+  if (input.mode === 'assert') {
+    return { kind: 'assert-mismatch', activeSha };
+  }
+  return { kind: 'wait' };
+}

package/dist/bundling-sources/shared_libs/play-runtime/durable-call-cache.ts

@@ -34,6 +34,35 @@ export function durableCacheStaleBucket(input: {
 
 export const durableCallStaleBucket = durableCacheStaleBucket;
 
+/**
+ * An exact completed tool receipt owned by a source run. The opaque key keeps
+ * request data out of storage keys while still giving a replay one stable,
+ * deterministic lookup per logical tool call.
+ */
+export function buildSourceRunToolReceiptManifestKey(input: {
+  orgId?: string | null;
+  sourceRunId: string;
+  logicalCallId: string;
+}): string {
+  const orgId = input.orgId?.trim() || 'org';
+  const sourceRunId = input.sourceRunId.trim();
+  const logicalCallId = input.logicalCallId.trim();
+  if (!sourceRunId || !logicalCallId) {
+    throw new Error(
+      'Source-run tool receipt manifest key requires sourceRunId and logicalCallId.',
+    );
+  }
+  const digest = sha256Hex(
+    stableStringify({
+      kind: 'source-run-tool-receipt-manifest-v1',
+      orgId,
+      sourceRunId,
+      logicalCallId,
+    }),
+  );
+  return `ctx:${orgId}:source-run-tool-receipt:${digest}`;
+}
+
 export function buildDurableToolCallCacheKey(input: {
   orgId?: string | null;
   toolId: string;

package/dist/bundling-sources/shared_libs/play-runtime/execution-capabilities.ts

@@ -63,6 +63,12 @@ export type RuntimeAuthorityDescriptor = {
    * the pre-feature behavior, which is the whole point of the switch.
    */
   docflowEnabled?: boolean | null;
+  /**
+   * Expand-before-enable fence for async-child attempt proof. Missing is the
+   * historic compatibility behavior; writers may enable it only after every
+   * worker can refresh an attempt token carrying a lease claim.
+   */
+  asyncChildAdmissionAttemptRequired?: boolean | null;
   capabilities: RuntimeExecutionCapability[];
 };
 
@@ -89,6 +95,21 @@ export function normalizeRuntimeExecutionCapabilities(
   return [...new Set(values.filter(isRuntimeExecutionCapability))].sort();
 }
 
+/**
+ * A backend may impose a smaller execution surface, but it can never turn a
+ * durable run authority into a broader one. Keep this policy primitive beside
+ * the descriptor rather than letting token issuers reconstruct it ad hoc.
+ */
+export function intersectRuntimeExecutionCapabilities(
+  persisted: readonly unknown[] | null | undefined,
+  backendAllowed: readonly RuntimeExecutionCapability[],
+): RuntimeExecutionCapability[] {
+  const allowed = new Set(backendAllowed);
+  return normalizeRuntimeExecutionCapabilities(persisted).filter((capability) =>
+    allowed.has(capability),
+  );
+}
+
 export function hasRuntimeExecutionCapability(
   values: readonly string[] | null | undefined,
   capability: RuntimeExecutionCapability,
@@ -152,6 +173,8 @@ export function requireRuntimeAuthorityDescriptor(
     // read back through, so anything that is not an explicit yes — missing,
     // null, a string that survived a JSON round trip — denies.
     docflowEnabled: descriptor.docflowEnabled === true,
+    asyncChildAdmissionAttemptRequired:
+      descriptor.asyncChildAdmissionAttemptRequired === true,
     capabilities,
   };
 }