deepline 0.3.90 → 0.3.91

package/dist/bundling-sources/shared_libs/play-runtime/deployment/vercel-fly-rollback-alignment.ts

@@ -0,0 +1,280 @@
+import { createHmac, timingSafeEqual } from 'node:crypto';
+
+const ROLLBACK_EVENT_TYPES = new Set([
+  'deployment.rollback',
+  'deployment-rollback',
+]);
+const TRACKED_EVENT_TYPES = new Set([
+  'deployment.succeeded',
+  'deployment.promoted',
+  ...ROLLBACK_EVENT_TYPES,
+]);
+
+export type AlignmentStatus =
+  | 'ignored'
+  | 'tracked'
+  | 'rollback_tracked'
+  | 'rollback_needs_manual_mapping';
+
+export interface VercelWebhookEvent {
+  type?: string;
+  id?: string;
+  createdAt?: number;
+  payload?: Record<string, unknown>;
+}
+
+export interface VercelDeploymentSummary {
+  id: string;
+  url?: string;
+  meta?: Record<string, unknown>;
+}
+
+export interface VercelRollbackNotice {
+  status: AlignmentStatus;
+  eventType: string;
+  deliveryId: string | null;
+  vercelProject: string | null;
+  fromDeploymentId: string | null;
+  toDeploymentId: string | null;
+  toDeploymentUrl: string | null;
+  gitSha: string | null;
+  workerBuildId: string | null;
+}
+
+export interface VercelDeploymentEventSummary {
+  status: 'ignored' | 'tracked';
+  eventType: string;
+  deliveryId: string | null;
+  vercelProject: string | null;
+  deploymentId: string | null;
+  deploymentUrl: string | null;
+  target: string | null;
+  gitSha: string | null;
+  workerBuildId: string | null;
+}
+
+function readRecord(value: unknown): Record<string, unknown> | null {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return null;
+  return value as Record<string, unknown>;
+}
+
+function readString(value: unknown): string | null {
+  return typeof value === 'string' && value.trim() ? value.trim() : null;
+}
+
+function readNestedString(
+  record: Record<string, unknown> | null,
+  path: string[],
+): string | null {
+  let current: unknown = record;
+  for (const key of path) {
+    const next = readRecord(current);
+    if (!next) return null;
+    current = next[key];
+  }
+  return readString(current);
+}
+
+function normalizeGitSha(value: string | null): string | null {
+  if (!value) return null;
+  const trimmed = value.trim();
+  return /^[a-f0-9]{7,40}$/i.test(trimmed) ? trimmed : null;
+}
+
+export function verifyVercelSignature(input: {
+  rawBody: string;
+  signature: string | null;
+  secret: string;
+}): boolean {
+  const signature = input.signature?.trim();
+  if (!signature) return false;
+  const expected = createHmac('sha1', input.secret)
+    .update(input.rawBody)
+    .digest('hex');
+  const expectedBuffer = Buffer.from(expected, 'hex');
+  const actualBuffer = Buffer.from(signature, 'hex');
+  if (expectedBuffer.byteLength !== actualBuffer.byteLength) return false;
+  return timingSafeEqual(expectedBuffer, actualBuffer);
+}
+
+export function extractVercelDeploymentEvent(event: VercelWebhookEvent): {
+  eventType: string;
+  deliveryId: string | null;
+  deploymentId: string | null;
+  fromDeploymentId: string | null;
+  toDeploymentId: string | null;
+  vercelProject: string | null;
+  deploymentUrl: string | null;
+  target: string | null;
+} {
+  const payload = readRecord(event.payload);
+  const eventType = readString(event.type) ?? 'unknown';
+  const deployment = readRecord(payload?.deployment);
+  const previousDeployment = readRecord(payload?.previousDeployment);
+  const targetDeployment = readRecord(payload?.targetDeployment);
+  const rollback = readRecord(payload?.rollback);
+
+  return {
+    eventType,
+    deliveryId: readString(event.id),
+    deploymentId:
+      readNestedString(deployment, ['id']) ?? readString(payload?.deploymentId),
+    fromDeploymentId:
+      readString(payload?.fromDeploymentId) ??
+      readNestedString(rollback, ['fromDeploymentId']) ??
+      readNestedString(previousDeployment, ['id']) ??
+      readNestedString(deployment, ['id']),
+    toDeploymentId:
+      readString(payload?.toDeploymentId) ??
+      readString(payload?.targetDeploymentId) ??
+      readNestedString(rollback, ['toDeploymentId']) ??
+      readNestedString(targetDeployment, ['id']),
+    vercelProject:
+      readNestedString(payload, ['project', 'name']) ??
+      readString(payload?.projectName) ??
+      readString(payload?.projectId) ??
+      readNestedString(deployment, ['name']),
+    deploymentUrl:
+      readNestedString(deployment, ['url']) ??
+      readNestedString(payload, ['links', 'deployment']),
+    target: readString(payload?.target),
+  };
+}
+
+export const extractVercelRollbackIds = extractVercelDeploymentEvent;
+
+export function extractGitShaFromVercelDeployment(
+  deployment: VercelDeploymentSummary | null,
+): string | null {
+  const meta = deployment?.meta ?? {};
+  return normalizeGitSha(
+    readString(meta.githubCommitSha) ??
+      readString(meta.githubCommitSHA) ??
+      readString(meta.gitCommitSha) ??
+      readString(meta.commitSha) ??
+      readString(meta.VERCEL_GIT_COMMIT_SHA),
+  );
+}
+
+export function extractDeploymentSummaryFromVercelEvent(
+  event: VercelWebhookEvent,
+): VercelDeploymentSummary | null {
+  const payload = readRecord(event.payload);
+  const ids = extractVercelDeploymentEvent(event);
+  const deployment =
+    readRecord(payload?.targetDeployment) ?? readRecord(payload?.deployment);
+  if (!deployment) return null;
+
+  const id =
+    readString(deployment.id) ?? ids.toDeploymentId ?? ids.deploymentId;
+  if (!id) return null;
+
+  return {
+    id,
+    url: readString(deployment.url) ?? ids.deploymentUrl ?? undefined,
+    meta: readRecord(deployment.meta) ?? undefined,
+  };
+}
+
+export function buildVercelRollbackNotice(input: {
+  event: VercelWebhookEvent;
+  targetDeployment: VercelDeploymentSummary | null;
+}): VercelRollbackNotice {
+  const ids = extractVercelDeploymentEvent(input.event);
+  if (!ROLLBACK_EVENT_TYPES.has(ids.eventType)) {
+    return {
+      status: 'ignored',
+      eventType: ids.eventType,
+      deliveryId: ids.deliveryId,
+      vercelProject: ids.vercelProject,
+      fromDeploymentId: ids.fromDeploymentId,
+      toDeploymentId: ids.toDeploymentId,
+      toDeploymentUrl: input.targetDeployment?.url ?? null,
+      gitSha: null,
+      workerBuildId: null,
+    };
+  }
+
+  const gitSha = extractGitShaFromVercelDeployment(input.targetDeployment);
+  if (!gitSha) {
+    return {
+      status: 'rollback_needs_manual_mapping',
+      eventType: ids.eventType,
+      deliveryId: ids.deliveryId,
+      vercelProject: ids.vercelProject,
+      fromDeploymentId: ids.fromDeploymentId,
+      toDeploymentId: ids.toDeploymentId,
+      toDeploymentUrl: input.targetDeployment?.url ?? null,
+      gitSha: null,
+      workerBuildId: null,
+    };
+  }
+
+  const workerBuildId = `git-${gitSha}`;
+
+  return {
+    status: 'rollback_tracked',
+    eventType: ids.eventType,
+    deliveryId: ids.deliveryId,
+    vercelProject: ids.vercelProject,
+    fromDeploymentId: ids.fromDeploymentId,
+    toDeploymentId: ids.toDeploymentId,
+    toDeploymentUrl: input.targetDeployment?.url ?? null,
+    gitSha,
+    workerBuildId,
+  };
+}
+
+export function buildVercelDeploymentEventSummary(input: {
+  event: VercelWebhookEvent;
+  deployment: VercelDeploymentSummary | null;
+}): VercelDeploymentEventSummary {
+  const ids = extractVercelDeploymentEvent(input.event);
+  const gitSha = extractGitShaFromVercelDeployment(input.deployment);
+  return {
+    status: TRACKED_EVENT_TYPES.has(ids.eventType) ? 'tracked' : 'ignored',
+    eventType: ids.eventType,
+    deliveryId: ids.deliveryId,
+    vercelProject: ids.vercelProject,
+    deploymentId: ids.deploymentId,
+    deploymentUrl: input.deployment?.url ?? ids.deploymentUrl,
+    target: ids.target,
+    gitSha,
+    workerBuildId: gitSha ? `git-${gitSha}` : null,
+  };
+}
+
+export function buildVercelRollbackSlackText(
+  plan: VercelRollbackNotice,
+): string {
+  const lines = [
+    plan.status === 'rollback_tracked'
+      ? ':warning: Vercel rollback detected; runtime rollback is manual.'
+      : ':warning: Vercel rollback detected; runtime build mapping needs manual lookup.',
+    plan.vercelProject ? `Project: ${plan.vercelProject}` : null,
+    plan.fromDeploymentId ? `From: ${plan.fromDeploymentId}` : null,
+    plan.toDeploymentId ? `To: ${plan.toDeploymentId}` : null,
+    plan.workerBuildId ? `Worker build: ${plan.workerBuildId}` : null,
+  ];
+  return lines.filter(Boolean).join('\n');
+}
+
+export function buildVercelDeploymentSlackText(
+  summary: VercelDeploymentEventSummary,
+): string {
+  const title =
+    summary.eventType === 'deployment.succeeded'
+      ? ':white_check_mark: Vercel deployment succeeded.'
+      : ':large_green_circle: Vercel deployment promoted.';
+  const lines = [
+    title,
+    summary.vercelProject ? `Project: ${summary.vercelProject}` : null,
+    summary.deploymentId ? `Deployment: ${summary.deploymentId}` : null,
+    summary.deploymentUrl ? `URL: ${summary.deploymentUrl}` : null,
+    summary.target ? `Target: ${summary.target}` : null,
+    summary.workerBuildId
+      ? `Aligned worker build: ${summary.workerBuildId}`
+      : null,
+  ];
+  return lines.filter(Boolean).join('\n');
+}

package/dist/bundling-sources/shared_libs/play-runtime/deployment/vercel-production-gate.ts

@@ -0,0 +1,159 @@
+export type VercelDeployment = {
+  id?: string;
+  /** Vercel's deployment-list endpoint names this same identifier `uid`. */
+  uid?: string;
+  url?: string;
+  gitSource?: { sha?: string };
+  meta?: { githubCommitSha?: string };
+  readyState?: string;
+  target?: string;
+};
+
+export type VercelGateDecision =
+  | { kind: 'ready' }
+  | { kind: 'superseded'; activeSha: string }
+  | { kind: 'assert-mismatch'; activeSha?: string }
+  | { kind: 'wait' };
+
+export type VercelStagedProductionDecision =
+  | { kind: 'ready'; deployment: VercelDeployment }
+  | { kind: 'auto-assigned' }
+  | { kind: 'vercel-failed'; description?: string; targetUrl?: string }
+  | { kind: 'wait' };
+
+export type VercelStagedProductionPolicyDecision =
+  | { kind: 'ready' }
+  | { kind: 'auto-assign-enabled' };
+
+/**
+ * The release controller only owns the Vercel alias while Vercel is configured
+ * to leave Production builds staged. Treat an absent or legacy project setting
+ * as unsafe rather than hoping the candidate gate catches an alias move later.
+ */
+export function decideVercelStagedProductionPolicy(input: {
+  autoAssignCustomDomains?: boolean;
+}): VercelStagedProductionPolicyDecision {
+  return input.autoAssignCustomDomains === false
+    ? { kind: 'ready' }
+    : { kind: 'auto-assign-enabled' };
+}
+
+function deploymentSha(deployment: VercelDeployment): string | undefined {
+  return deployment.meta?.githubCommitSha ?? deployment.gitSource?.sha;
+}
+
+export function deploymentId(deployment: VercelDeployment): string | undefined {
+  return deployment.id ?? deployment.uid;
+}
+
+/**
+ * Git creates the production build; the release controller only promotes the
+ * already-staged deployment after its runtime proof has passed. Keep that one
+ * provider mutation shared by normal release and panic recovery.
+ */
+export async function promoteVercelProductionDeployment(input: {
+  deploymentId: string;
+  fetchImpl?: typeof fetch;
+  projectId: string;
+  teamId: string;
+  token: string;
+}): Promise<Response> {
+  return await (input.fetchImpl ?? fetch)(
+    `https://api.vercel.com/v10/projects/${encodeURIComponent(input.projectId)}/promote/${encodeURIComponent(input.deploymentId)}?teamId=${encodeURIComponent(input.teamId)}`,
+    {
+      method: 'POST',
+      headers: {
+        authorization: `Bearer ${input.token}`,
+        'content-type': 'application/json',
+      },
+      body: '{}',
+    },
+  );
+}
+
+/**
+ * A staged production deployment is the exact production build we will
+ * promote later, but it must not yet own the public production alias. This is
+ * deliberately separate from decideVercelProductionGate: accepting an active
+ * alias here would make the release controller silently lose traffic control.
+ */
+export function decideVercelStagedProductionGate(input: {
+  expectedSha: string;
+  activeDeployment: VercelDeployment;
+  deployments: VercelDeployment[];
+  vercelStatus?: {
+    state?: string;
+    description?: string;
+    target_url?: string;
+  };
+}): VercelStagedProductionDecision {
+  if (
+    input.vercelStatus?.state === 'failure' ||
+    input.vercelStatus?.state === 'error'
+  ) {
+    return {
+      kind: 'vercel-failed',
+      description: input.vercelStatus.description,
+      targetUrl: input.vercelStatus.target_url,
+    };
+  }
+  const activeServesExpectedSha =
+    deploymentSha(input.activeDeployment) === input.expectedSha;
+  if (activeServesExpectedSha) {
+    return { kind: 'auto-assigned' };
+  }
+
+  const candidates = input.deployments.filter(
+    (deployment) =>
+      deploymentSha(deployment) === input.expectedSha &&
+      deployment.target === 'production' &&
+      deploymentId(deployment) !== deploymentId(input.activeDeployment),
+  );
+  const staged = candidates.find(
+    (deployment) =>
+      deployment.readyState === 'READY' &&
+      Boolean(deploymentId(deployment)) &&
+      Boolean(deployment.url),
+  );
+  if (staged) return { kind: 'ready', deployment: staged };
+
+  if (candidates.some((deployment) => deployment.readyState === 'ERROR')) {
+    return {
+      kind: 'vercel-failed',
+      description: input.vercelStatus?.description,
+      targetUrl: input.vercelStatus?.target_url,
+    };
+  }
+  return { kind: 'wait' };
+}
+
+/**
+ * Decide whether a shared-plane mutation may proceed from the deployment that
+ * is actually behind the production alias. Kept pure so the race cases are
+ * tested without making Vercel or GitHub API calls.
+ */
+export function decideVercelProductionGate(input: {
+  expectedSha: string;
+  activeDeployment: VercelDeployment;
+  activeRevisionIsNewer: boolean;
+  mode: 'wait' | 'assert';
+}): VercelGateDecision {
+  const activeSha =
+    input.activeDeployment.meta?.githubCommitSha ??
+    input.activeDeployment.gitSource?.sha;
+
+  if (
+    activeSha === input.expectedSha &&
+    input.activeDeployment.readyState === 'READY' &&
+    input.activeDeployment.target === 'production'
+  ) {
+    return { kind: 'ready' };
+  }
+  if (input.activeRevisionIsNewer && activeSha) {
+    return { kind: 'superseded', activeSha };
+  }
+  if (input.mode === 'assert') {
+    return { kind: 'assert-mismatch', activeSha };
+  }
+  return { kind: 'wait' };
+}

package/dist/bundling-sources/shared_libs/play-runtime/integration-operation-reader-fence/memory-store.ts

@@ -0,0 +1,114 @@
+import type {
+  ReaderFenceApplyOutcome,
+  RuntimeGatewayReaderFence,
+  RuntimeGatewayReaderFenceCandidate,
+} from '../integration-operation-reader-fence/contracts';
+import type { RuntimeGatewayReaderFenceStore } from '../integration-operation-reader-fence/ports';
+
+/**
+ * Recording adapter for contract tests and local assembly. It implements the
+ * same atomic compare-and-advance law required of the Runtime Postgres mirror.
+ */
+export function createMemoryRuntimeGatewayReaderFenceStore(
+  initial: readonly RuntimeGatewayReaderFence[] = [],
+): RuntimeGatewayReaderFenceStore {
+  const fences = new Map(
+    initial.map((fence) => [fence.schema, copyFence(fence)]),
+  );
+
+  return {
+    async read({ schema }) {
+      const fence = fences.get(schema);
+      return fence ? copyFence(fence) : null;
+    },
+
+    async apply(candidate): Promise<ReaderFenceApplyOutcome> {
+      const next = copyFence(candidate);
+      const current = fences.get(next.schema);
+      if (!current) {
+        fences.set(next.schema, next);
+        return { kind: 'advanced', fence: copyFence(next) };
+      }
+      if (next.epoch < current.epoch) {
+        return {
+          kind: 'rejected',
+          reason: 'stale_epoch',
+          current: copyFence(current),
+        };
+      }
+      if (next.epoch === current.epoch) {
+        if (sameFence(next, current)) {
+          return { kind: 'already_applied', fence: copyFence(current) };
+        }
+        return {
+          kind: 'rejected',
+          reason: 'epoch_conflict',
+          current: copyFence(current),
+        };
+      }
+      if (current.mode === 'canonical_v1' && next.mode !== 'canonical_v1') {
+        return {
+          kind: 'rejected',
+          reason: 'unsafe_mode_downgrade',
+          current: copyFence(current),
+        };
+      }
+      fences.set(next.schema, next);
+      return { kind: 'advanced', fence: copyFence(next) };
+    },
+  };
+}
+
+function sameFence(
+  left: RuntimeGatewayReaderFence,
+  right: RuntimeGatewayReaderFence,
+): boolean {
+  if (
+    left.schema !== right.schema ||
+    left.epoch !== right.epoch ||
+    left.mode !== right.mode
+  ) {
+    return false;
+  }
+  if (!left.canonicalReaderProof || !right.canonicalReaderProof) {
+    return left.canonicalReaderProof === right.canonicalReaderProof;
+  }
+  return (
+    left.canonicalReaderProof.capability ===
+      right.canonicalReaderProof.capability &&
+    left.canonicalReaderProof.sourceSha ===
+      right.canonicalReaderProof.sourceSha &&
+    sameMachineSet(
+      left.canonicalReaderProof.machineIds.receipt,
+      right.canonicalReaderProof.machineIds.receipt,
+    ) &&
+    sameMachineSet(
+      left.canonicalReaderProof.machineIds.execution,
+      right.canonicalReaderProof.machineIds.execution,
+    )
+  );
+}
+
+function sameMachineSet(
+  left: readonly string[],
+  right: readonly string[],
+): boolean {
+  return left.length === right.length && left.every((id) => right.includes(id));
+}
+
+function copyFence(
+  fence: RuntimeGatewayReaderFenceCandidate,
+): RuntimeGatewayReaderFence {
+  return {
+    ...fence,
+    canonicalReaderProof: fence.canonicalReaderProof
+      ? {
+          ...fence.canonicalReaderProof,
+          machineIds: {
+            receipt: [...fence.canonicalReaderProof.machineIds.receipt],
+            execution: [...fence.canonicalReaderProof.machineIds.execution],
+          },
+        }
+      : null,
+  };
+}

package/dist/bundling-sources/shared_libs/play-runtime/run-ledger.ts

@@ -20,6 +20,7 @@ import {
   normalizeDatasetBornFrom,
   type PlayDatasetBornFrom,
 } from './cell-provenance';
+import { isLedgerTerminalResultRef } from './output-size-limits';
 
 export type PlayRunLedgerStatus =
   | 'queued'
@@ -1019,6 +1020,32 @@ function conflictingTerminalSnapshot(
   );
 }
 
+/**
+ * A legacy out-of-line terminal reference did not prove that its Postgres
+ * value was written in full. A later ref bearing that proof is an enrichment
+ * of the same terminal result, not a competing outcome or payload.
+ */
+function canPromoteTerminalResultReference(
+  current: unknown,
+  next: unknown,
+): boolean {
+  return (
+    isLedgerTerminalResultRef(current) &&
+    current.content !== 'full' &&
+    isLedgerTerminalResultRef(next) &&
+    next.content === 'full'
+  );
+}
+
+function mergeTerminalResult(input: {
+  current: unknown;
+  next: unknown;
+}): unknown {
+  return canPromoteTerminalResultReference(input.current, input.next)
+    ? input.next
+    : (input.next ?? input.current);
+}
+
 function retryablePlatformDeployFailureSnapshot(
   base: PlayRunLedgerSnapshot,
   eventError?: string | null,
@@ -1249,6 +1276,7 @@ export function reducePlayRunLedgerEvent(
         conflictingTerminalSnapshot(base, event.type, occurredAt, null, {
           allowStaleSameStatusPayloadMerge:
             (base.result === undefined && event.result !== undefined) ||
+            canPromoteTerminalResultReference(base.result, event.result) ||
             (base.resultSummary === undefined &&
               event.resultSummary !== undefined),
         }) ??
@@ -1261,7 +1289,10 @@ export function reducePlayRunLedgerEvent(
           activeStepId: null,
           activeActivityId: null,
           activeArtifactTableNamespace: null,
-          result: event.result ?? base.result,
+          result: mergeTerminalResult({
+            current: base.result,
+            next: event.result,
+          }),
           resultSummary: event.resultSummary ?? base.resultSummary,
           terminalSource: nextTerminalSource(base, event.source),
         })
@@ -1272,7 +1303,8 @@ export function reducePlayRunLedgerEvent(
         conflictingTerminalSnapshot(base, event.type, occurredAt, event.error, {
           allowStaleSameStatusPayloadMerge:
             (base.error == null && event.error != null) ||
-            (base.result === undefined && event.result !== undefined),
+            (base.result === undefined && event.result !== undefined) ||
+            canPromoteTerminalResultReference(base.result, event.result),
         }) ??
         withTiming({
           ...settleRunningStepsOnTerminal(base, 'failed', occurredAt),
@@ -1286,7 +1318,10 @@ export function reducePlayRunLedgerEvent(
           activeStepId: null,
           activeActivityId: null,
           activeArtifactTableNamespace: null,
-          result: event.result ?? base.result,
+          result: mergeTerminalResult({
+            current: base.result,
+            next: event.result,
+          }),
           terminalSource: nextTerminalSource(base, event.source),
         })
       );
@@ -1295,7 +1330,8 @@ export function reducePlayRunLedgerEvent(
         conflictingTerminalSnapshot(base, event.type, occurredAt, event.error, {
           allowStaleSameStatusPayloadMerge:
             (base.error == null && event.error != null) ||
-            (base.result === undefined && event.result !== undefined),
+            (base.result === undefined && event.result !== undefined) ||
+            canPromoteTerminalResultReference(base.result, event.result),
         }) ??
         withTiming({
           ...settleRunningStepsOnTerminal(base, 'failed', occurredAt),
@@ -1309,7 +1345,10 @@ export function reducePlayRunLedgerEvent(
           activeStepId: null,
           activeActivityId: null,
           activeArtifactTableNamespace: null,
-          result: event.result ?? base.result,
+          result: mergeTerminalResult({
+            current: base.result,
+            next: event.result,
+          }),
           terminalSource: nextTerminalSource(base, event.source),
         })
       );

package/dist/bundling-sources/shared_libs/play-runtime/runner-app/child-play-resolver.ts

@@ -0,0 +1,26 @@
+import { createSingleFlight } from '../single-flight';
+
+/**
+ * Cache authorized child metadata for one Node runner execution. The caller
+ * owns this resolver beside the root PlayContext, so all map rows share it and
+ * the cache becomes unreachable as soon as the run settles.
+ */
+export function createRunScopedChildPlayResolver<T>(input: {
+  resolvePlay: (playRef: string) => Promise<T | null>;
+}): (playRef: string) => Promise<T | null> {
+  const resolved = new Map<string, T>();
+  const flights = createSingleFlight<string, T | null>();
+
+  return async (playRef) => {
+    const cached = resolved.get(playRef);
+    if (cached) return cached;
+
+    return flights.run(playRef, async () => {
+      const cachedAfterAdmission = resolved.get(playRef);
+      if (cachedAfterAdmission) return cachedAfterAdmission;
+      const play = await input.resolvePlay(playRef);
+      if (play) resolved.set(playRef, play);
+      return play;
+    });
+  };
+}