openship 0.1.0 → 0.1.1

package/apps/api/src/modules/deployments/build.service.ts

@@ -0,0 +1,791 @@
+/**
+ * Build service — build session lifecycle + build→deploy pipeline.
+ */
+
+import { repos, type Project, type Deployment } from "@repo/db";
+import { NotFoundError, ForbiddenError, BUILD_ENV_VARS, SYSTEM, STACKS, type StackId } from "@repo/core";
+import type { BuildConfig, BuildStrategy, DeployConfig, DeployEnvironment, LogEntry, ResourceConfig } from "@repo/adapters";
+import { BuildLogger, CloudRuntime, DEFAULT_BUILD_RESOURCE_CONFIG, runDeployPipeline, createPlatform } from "@repo/adapters";
+import { platform } from "../../lib/controller-helpers";
+import { env } from "../../config";
+import { encrypt, decrypt } from "../../lib/encryption";
+import { withDefaults } from "../../lib/resources";
+import { resolveToken } from "../github/github.auth";
+import * as sessionManager from "./session-manager";
+import { onFailure, onSuccess, onCancelled, type LifecycleContext } from "./deployment-lifecycle";
+import { runPreflightChecks } from "./preflight";
+import * as settingsService from "../settings/settings.service";
+
+// ─── Terminal output collapsing ──────────────────────────────────────────────
+
+/**
+ * Collapse raw log entries into their final terminal-rendered state.
+ *
+ * During live streaming, xterm handles \r (carriage return) to overwrite lines
+ * in-place (e.g., git progress "Counting objects:  42%\r...100%").
+ * When persisting to DB we don't want all intermediate lines — just the final
+ * rendered result, as a terminal would show.
+ *
+ * Step events (entries with `step` field) pass through unchanged — they're
+ * structured metadata for the stepper UI, not terminal output.
+ */
+function collapseTerminalLogs(entries: LogEntry[]): LogEntry[] {
+  const result: LogEntry[] = [];
+  // Virtual line buffer — simulates one terminal line
+  let currentLine = "";
+  let currentLevel: LogEntry["level"] = "info";
+  let currentTimestamp = "";
+
+  const flushLine = () => {
+    const trimmed = currentLine.trimEnd();
+    if (trimmed) {
+      result.push({ timestamp: currentTimestamp, message: trimmed, level: currentLevel });
+    }
+    currentLine = "";
+  };
+
+  for (const entry of entries) {
+    // Step events pass through as-is
+    if (entry.step) {
+      flushLine();
+      result.push(entry);
+      continue;
+    }
+
+    const text = entry.message;
+    currentLevel = entry.level;
+    currentTimestamp = entry.timestamp;
+
+    for (let i = 0; i < text.length; i++) {
+      const ch = text[i];
+      if (ch === "\r") {
+        // Check for \r\n (treat as plain newline)
+        if (i + 1 < text.length && text[i + 1] === "\n") {
+          flushLine();
+          i++; // skip the \n
+        } else {
+          // Bare \r — overwrite: reset current line (don't flush)
+          currentLine = "";
+        }
+      } else if (ch === "\n") {
+        flushLine();
+      } else {
+        currentLine += ch;
+      }
+    }
+  }
+
+  // Flush any remaining content
+  flushLine();
+  return result;
+}
+
+// ─── Types ───────────────────────────────────────────────────────────────────
+
+/** Config snapshot stored in deployment.meta — self-contained build+deploy config. */
+export interface DeploymentConfigSnapshot {
+  repoUrl: string;
+  branch: string;
+  framework: string;
+  buildImage: string;
+  packageManager: string;
+  installCommand: string;
+  buildCommand: string;
+  outputDirectory: string;
+  productionPaths: string[];
+  rootDirectory: string;
+  port: number;
+  startCommand: string;
+  resources: ResourceConfig | null;
+  buildResources: ResourceConfig | null;
+  /** Whether the project needs a running server (false = static, deploy via Pages) */
+  hasServer: boolean;
+  /** Whether the project needs a build step (false = deploy source directly) */
+  hasBuild: boolean;
+  /** Custom domain from deploy input (e.g. "app.example.com") */
+  customDomain?: string;
+  /** Absolute path to a local project directory (alternative to repoUrl) */
+  localPath?: string;
+  /** Build strategy: "server" (build in workspace) or "local" (build on host) */
+  buildStrategy?: BuildStrategy;
+}
+
+export interface BuildAccessInput {
+  projectId: string;
+  branch?: string;
+  environment?: string;
+  envVars?: Record<string, string>;
+  customDomain?: string;
+  buildStrategy?: BuildStrategy;
+}
+
+// ─── Helpers ─────────────────────────────────────────────────────────────────
+
+/** Build a config snapshot from the project — pure pass-through, no fallbacks.
+ *  All values must be set by prepare / ensureProject before this is called. */
+function buildConfigSnapshot(project: Project, branch?: string, customDomain?: string): DeploymentConfigSnapshot {
+  return {
+    repoUrl: project.gitUrl ?? "",
+    branch: branch || project.gitBranch || "main",
+    framework: project.framework!,
+    buildImage: project.buildImage!,
+    packageManager: project.packageManager!,
+    installCommand: project.installCommand!,
+    buildCommand: project.buildCommand!,
+    outputDirectory: project.outputDirectory!,
+    productionPaths: parseProductionPaths(project.productionPaths, project.framework),
+    rootDirectory: project.rootDirectory || "",
+    port: project.port!,
+    startCommand: project.startCommand!,
+    resources: (project.resources as ResourceConfig) || null,
+    buildResources: (project.buildResources as ResourceConfig) || null,
+    hasServer: !!project.startCommand?.trim(),
+    hasBuild: project.hasBuild ?? true,
+    customDomain: customDomain || undefined,
+    localPath: project.localPath || undefined,
+  };
+}
+
+/** Parse productionPaths from DB text (comma-separated) with STACKS fallback. */
+function parseProductionPaths(raw: string | null | undefined, framework: string | null | undefined): string[] {
+  if (raw) return raw.split(",").map((s) => s.trim()).filter(Boolean);
+  if (framework && framework in STACKS) {
+    const paths = STACKS[framework as StackId] as import("@repo/core").StackDefinition;
+    return paths.productionPaths ? [...paths.productionPaths] : [];
+  }
+  return [];
+}
+
+/** Encrypt a plaintext key-value map. Returns null if empty. */
+function encryptEnvVars(envVars?: Record<string, string>): Record<string, string> | null {
+  if (!envVars || Object.keys(envVars).length === 0) return null;
+  const encrypted: Record<string, string> = {};
+  for (const [k, v] of Object.entries(envVars)) {
+    encrypted[k] = encrypt(v);
+  }
+  return encrypted;
+}
+
+/** Decrypt an encrypted env var map from deployment.envVars. */
+function decryptEnvVars(encrypted: unknown): Record<string, string> {
+  const map: Record<string, string> = {};
+  if (!encrypted || typeof encrypted !== "object") return map;
+  for (const [k, v] of Object.entries(encrypted as Record<string, string>)) {
+    try { map[k] = decrypt(v); } catch { map[k] = v; }
+  }
+  return map;
+}
+
+// ─── Shared helpers ──────────────────────────────────────────────────────────
+
+/** Load a deployment + its project, verifying the user owns it. */
+async function loadDeploymentForUser(deploymentId: string, userId: string) {
+  const dep = await repos.deployment.findById(deploymentId);
+  if (!dep) throw new NotFoundError("Deployment", deploymentId);
+
+  const project = await repos.project.findById(dep.projectId);
+  if (!project || project.userId !== userId) {
+    throw new NotFoundError("Deployment", deploymentId);
+  }
+
+  return { dep, project };
+}
+
+/** Throw if the project already has an in-progress deployment. */
+async function checkNoActiveBuild(projectId: string) {
+  const { rows } = await repos.deployment.listByProject(projectId, {
+    page: 1,
+    perPage: SYSTEM.DEPLOYMENTS.MAX_CONCURRENT_PER_PROJECT + 1,
+  });
+  const active = rows.find((d) =>
+    ["queued", "building", "deploying"].includes(d.status),
+  );
+  if (active) {
+    throw new ForbiddenError(
+      `A deployment is already in progress (${active.id}). Cancel it first or wait for it to complete.`,
+    );
+  }
+}
+
+/**
+ * Create a queued deployment + build session atomically.
+ * If the build session insert fails, the deployment is cleaned up.
+ */
+async function createQueuedDeployment(opts: {
+  projectId: string;
+  userId: string;
+  branch: string;
+  environment: string;
+  framework: string;
+  meta: DeploymentConfigSnapshot;
+  envVars: Record<string, string> | null;
+  commitSha?: string;
+}) {
+  const dep = await repos.deployment.create({
+    projectId: opts.projectId,
+    userId: opts.userId,
+    branch: opts.branch,
+    commitSha: opts.commitSha,
+    environment: opts.environment,
+    framework: opts.framework,
+    status: "queued",
+    meta: opts.meta,
+    envVars: opts.envVars,
+  });
+
+  try {
+    await repos.deployment.createBuildSession({
+      deploymentId: dep.id,
+      projectId: opts.projectId,
+      status: "queued",
+    });
+  } catch (err) {
+    // Atomicity: clean up orphaned deployment
+    await repos.deployment.deleteDeployment(dep.id).catch(() => {});
+    throw err;
+  }
+
+  return dep;
+}
+
+// ─── SSE streaming (re-export) ───────────────────────────────────────────────
+
+/** Subscribe to live build logs by deployment ID (dep_xxx). */
+export { subscribe as subscribeToBuildSession } from "./session-manager";
+
+// ─── Build access (create deployment with config snapshot) ───────────────────
+
+/**
+ * Create a deployment + build session for an existing project.
+ * Snapshots project config into deployment.meta,
+ * encrypts env vars into deployment.envVars.
+ *
+ * Project MUST exist before calling this.
+ */
+export async function requestBuildAccess(userId: string, input: BuildAccessInput) {
+  const { projectId, branch, environment, envVars, customDomain, buildStrategy } = input;
+
+  const project = await repos.project.findById(projectId);
+  if (!project || project.userId !== userId) {
+    throw new NotFoundError("Project", projectId);
+  }
+
+  await checkNoActiveBuild(project.id);
+
+  const snapshot = buildConfigSnapshot(project, branch, customDomain);
+
+  // Resolve effective build strategy via settings service
+  snapshot.buildStrategy = await settingsService.resolveStrategy(
+    userId,
+    snapshot.framework,
+    buildStrategy ?? snapshot.buildStrategy,
+  );
+
+  // ── Preflight: validate config + domain before creating any resources ──
+  const preflight = await runPreflightChecks(snapshot, {
+    customDomain: snapshot.customDomain,
+    slug: project.slug,
+  });
+  if (!preflight.ok) {
+    const failures = preflight.checks
+      .filter((c) => c.status === "fail")
+      .map((c) => `${c.label}: ${c.message}`)
+      .join("; ");
+    throw new ForbiddenError(`Pre-deploy checks failed: ${failures}`);
+  }
+  const env = environment || "production";
+
+  const dep = await createQueuedDeployment({
+    projectId: project.id,
+    userId,
+    branch: snapshot.branch,
+    environment: env,
+    framework: snapshot.framework,
+    meta: snapshot,
+    envVars: encryptEnvVars(envVars),
+  });
+
+  // Store env vars on project as "latest defaults"
+  if (envVars && Object.keys(envVars).length > 0) {
+    const vars = Object.entries(envVars).map(([key, value]) => ({
+      key,
+      value: encrypt(value),
+      isSecret: false,
+    }));
+    await repos.project.bulkSetEnvVars(project.id, env, vars);
+  }
+
+  return {
+    success: true,
+    deployment_id: dep.id,
+    project_id: project.id,
+  };
+}
+
+// ─── Build session status ────────────────────────────────────────────────────
+
+export async function getBuildSessionStatus(deploymentId: string, userId: string) {
+  const { dep, project } = await loadDeploymentForUser(deploymentId, userId);
+
+  const buildSessionRow = await repos.deployment.findBuildSessionByDeploymentId(deploymentId);
+
+  const memSession = sessionManager.getSession(deploymentId);
+  const isActive = memSession != null &&
+    !["ready", "failed", "cancelled"].includes(memSession.status);
+
+  const logEntries = (buildSessionRow?.logs as LogEntry[] | null) ?? memSession?.logs ?? [];
+  // Filter out step-metadata entries — they drive the progress bar, not the terminal
+  const terminalEntries = logEntries.filter((l) => !(l.step && l.stepStatus));
+  const logsText = terminalEntries.map((l) => l.message).join("\n");
+
+  // In-memory session is real-time truth (updated every phase transition).
+  // DB build-session row only moves queued → building → final, so it's stale during deploy.
+  const effectiveStatus = memSession
+    ? memSession.status
+    : buildSessionRow
+      ? buildSessionRow.status
+      : dep.status;
+
+  // Return config from deployment snapshot (self-contained)
+  const snapshot = dep.meta as DeploymentConfigSnapshot | null;
+
+  // Derive step progress from persisted log entries when no active session
+  let currentStep = 0;
+  let progress = 0;
+  if (isActive) {
+    // Truly active session — frontend gets live progress via SSE, don't override
+    currentStep = undefined as unknown as number;
+    progress = undefined as unknown as number;
+  } else if (effectiveStatus === "ready") {
+    currentStep = 4; // past deploy
+    progress = 100;
+  } else {
+    // Scan persisted logs for step events to find where it got to
+    const STEP_INDEX: Record<string, number> = { clone: 0, install: 1, build: 2, deploy: 3 };
+    const STEP_PROGRESS: Record<string, number> = { clone: 5, install: 25, build: 50, deploy: 75 };
+    for (const entry of logEntries) {
+      if (entry.step && entry.step in STEP_INDEX) {
+        const idx = STEP_INDEX[entry.step];
+        if (idx >= currentStep) {
+          currentStep = idx;
+          progress = STEP_PROGRESS[entry.step];
+          // If this step completed, advance progress beyond it
+          if (entry.stepStatus === "completed") {
+            progress = STEP_PROGRESS[entry.step] + 10;
+          }
+        }
+      }
+    }
+    // For failed/cancelled, keep progress where it stopped
+  }
+
+  return {
+    success: true,
+    deployment_id: dep.id,
+    project_id: project.id,
+    status: effectiveStatus,
+    is_active: isActive,
+    logs: logsText,
+    config: {
+      repo: project.gitRepo,
+      owner: project.gitOwner,
+      projectName: project.name,
+      framework: snapshot?.framework || project.framework,
+      branch: dep.branch ?? project.gitBranch,
+      domain: "",
+      buildCommand: snapshot?.buildCommand,
+      outputDirectory: snapshot?.outputDirectory,
+      installCommand: snapshot?.installCommand,
+      startCommand: snapshot?.startCommand,
+      productionPort: snapshot?.port ? String(snapshot.port) : undefined,
+      rootDirectory: snapshot?.rootDirectory,
+      hasServer: snapshot?.hasServer ?? !!snapshot?.startCommand?.trim(),
+    },
+    progress,
+    currentStep,
+    screenshots: [],
+    buildDurationMs: buildSessionRow?.durationMs ?? null,
+    buildStartedAt: buildSessionRow?.startedAt?.toISOString() ?? null,
+  };
+}
+
+// ─── Cancel build session ────────────────────────────────────────────────────
+
+export async function cancelBuildSession(deploymentId: string, userId: string) {
+  const { dep } = await loadDeploymentForUser(deploymentId, userId);
+
+  if (!["queued", "building", "deploying"].includes(dep.status)) {
+    throw new ForbiddenError("Cannot cancel a deployment that is not in progress");
+  }
+
+  const buildSession = await repos.deployment.findBuildSessionByDeploymentId(deploymentId);
+  sessionManager.updateStatus(dep.id, "cancelled");
+
+  const { runtime } = platform();
+  if (dep.status === "building") {
+    await runtime.cancelBuild(dep.id).catch(() => {});
+  }
+  if (dep.containerId) {
+    await runtime.destroy(dep.containerId).catch(() => {});
+  }
+
+  await repos.deployment.updateStatus(dep.id, "cancelled");
+  if (buildSession) {
+    await repos.deployment.finishBuildSession(buildSession.id, "cancelled", 0);
+  }
+
+  return { success: true, message: "Deployment cancelled" };
+}
+
+// ─── Redeploy build session ─────────────────────────────────────────────────
+
+export async function redeployBuildSession(deploymentId: string, userId: string) {
+  const { dep: oldDep, project } = await loadDeploymentForUser(deploymentId, userId);
+
+  // Prefer the old deployment's snapshot; fall back to a fresh one from the project
+  const meta = (oldDep.meta as DeploymentConfigSnapshot | null)
+    ?? buildConfigSnapshot(project, oldDep.branch);
+
+  const dep = await createQueuedDeployment({
+    projectId: project.id,
+    userId,
+    branch: oldDep.branch,
+    environment: oldDep.environment,
+    framework: oldDep.framework || meta.framework,
+    meta,
+    envVars: oldDep.envVars as Record<string, string> | null,
+  });
+
+  return {
+    success: true,
+    deployment_id: dep.id,
+    project_id: project.id,
+  };
+}
+
+// ─── Start build from session ID (direct — no token) ─────────────────────────
+
+export async function startBuild(deploymentId: string, userId: string) {
+  const { dep, project } = await loadDeploymentForUser(deploymentId, userId);
+
+  if (!["queued"].includes(dep.status)) {
+    throw new ForbiddenError("Build session is not in queued state");
+  }
+
+  const buildSession = await repos.deployment.findBuildSessionByDeploymentId(deploymentId);
+  if (!buildSession) throw new NotFoundError("BuildSession for deployment", deploymentId);
+
+  // Create SSE session keyed by deployment ID
+  sessionManager.createSession(dep.id, project.id);
+
+  void executeBuildAndDeploy(project, dep, buildSession.id).catch((err) => {
+    console.error(`[DEPLOY] Fatal error for ${dep.id}:`, err);
+  });
+
+  return {
+    success: true,
+    deployment_id: dep.id,
+    project_id: project.id,
+  };
+}
+
+// ─── Trigger deployment (internal build pipeline) ────────────────────────────
+
+export async function triggerDeployment(userId: string, data: { projectId: string; branch?: string; commitSha?: string; environment?: string }) {
+  const project = await repos.project.findById(data.projectId);
+  if (!project || project.userId !== userId) {
+    throw new NotFoundError("Project", data.projectId);
+  }
+
+  if (!project.gitUrl && !project.localPath) {
+    throw new ForbiddenError("Project has no git repository or local path configured");
+  }
+
+  const branch = data.branch ?? project.gitBranch ?? "main";
+  const environment = data.environment ?? "production";
+
+  await checkNoActiveBuild(project.id);
+
+  const snapshot = buildConfigSnapshot(project, branch);
+
+  // ── Preflight: validate config before creating any resources ────
+  const preflight = await runPreflightChecks(snapshot, { slug: project.slug });
+  if (!preflight.ok) {
+    const failures = preflight.checks
+      .filter((c) => c.status === "fail")
+      .map((c) => `${c.label}: ${c.message}`)
+      .join("; ");
+    throw new ForbiddenError(`Pre-deploy checks failed: ${failures}`);
+  }
+
+  // Copy env vars from project (already encrypted in env_var table)
+  const rawEnvMap = await repos.project.getEnvMap(project.id, environment);
+  const encryptedEnvVars = Object.keys(rawEnvMap).length > 0 ? rawEnvMap : null;
+
+  const dep = await createQueuedDeployment({
+    projectId: project.id,
+    userId,
+    branch,
+    commitSha: data.commitSha,
+    environment,
+    framework: snapshot.framework,
+    meta: snapshot,
+    envVars: encryptedEnvVars,
+  });
+
+  const buildSess = await repos.deployment.findBuildSessionByDeploymentId(dep.id);
+  if (!buildSess) throw new Error("Build session was not created");
+
+  // Create SSE session keyed by deployment ID
+  sessionManager.createSession(dep.id, project.id);
+
+  void executeBuildAndDeploy(project, dep, buildSess.id).catch((err) => {
+    console.error(`[DEPLOY] Fatal error for ${dep.id}:`, err);
+  });
+
+  return {
+    deployment: dep,
+  };
+}
+
+// ─── Build & Deploy pipeline (private) ───────────────────────────────────────
+
+async function executeBuildAndDeploy(
+  project: Project,
+  dep: Deployment,
+  buildSessionId: string,
+) {
+  // In cloud mode the singleton platform has master creds.
+  // In local mode deploying to cloud, we fetch a namespace token
+  // from the SaaS API and create a per-deploy cloud platform.
+  const plat = platform();
+  let { runtime, routing } = plat;
+
+  if (!env.CLOUD_MODE && plat.target === "cloud") {
+    const { getCloudToken } = await import("../../lib/cloud-client");
+    const result = await getCloudToken(dep.userId);
+    if (result) {
+      const cloudPlatform = await createPlatform({ target: "cloud", cloudToken: result.token });
+      runtime = cloudPlatform.runtime;
+      routing = cloudPlatform.routing;
+    }
+  }
+
+  const logs: LogEntry[] = [];
+  const MAX_LOG_ENTRIES = 50_000;
+
+  const logCallback = (entry: LogEntry) => {
+    if (logs.length < MAX_LOG_ENTRIES) logs.push(entry);
+    sessionManager.appendLog(dep.id, entry);
+  };
+
+  // Single logger instance for the entire build→deploy lifecycle
+  const logger = new BuildLogger(logCallback);
+
+  /** Collapsed logs for DB persistence — resolves \r overwrites to final state. */
+  const persistLogs = () => collapseTerminalLogs(logs);
+
+  // ── Lifecycle context — shared across all phases ───────────────────
+  const provisioned: { imageRef?: string } = {};
+  const ctx: LifecycleContext = {
+    runtime,
+    project,
+    dep,
+    buildSessionId,
+    persistLogs,
+    provisioned,
+  };
+
+  try {
+    // ── Read config from deployment snapshot ─────────────────────────
+    const snapshot = dep.meta as DeploymentConfigSnapshot | null;
+    if (!snapshot) {
+      throw new Error("Deployment has no config snapshot (meta is empty)");
+    }
+
+    // ── Build phase ──────────────────────────────────────────────────
+    await repos.deployment.updateStatus(dep.id, "building");
+    await repos.deployment.updateBuildSession(buildSessionId, {
+      status: "building",
+      startedAt: new Date(),
+    });
+    sessionManager.updateStatus(dep.id, "building");
+
+    const prodResources = withDefaults(snapshot.resources);
+    const buildResources = withDefaults(
+      snapshot.buildResources,
+      DEFAULT_BUILD_RESOURCE_CONFIG,
+    );
+
+    // Decrypt env vars from deployment (self-contained)
+    const envMap = decryptEnvVars(dep.envVars);
+
+    // Resolve a fresh GitHub token for cloning (private repos)
+    const gitToken = await resolveToken({
+      userId: dep.userId,
+      owner: project.gitOwner ?? undefined,
+    }).catch(() => null);
+
+    const buildConfig: BuildConfig = {
+      sessionId: buildSessionId,
+      projectId: project.id,
+      slug: project.slug ?? undefined,
+      repoUrl: snapshot.repoUrl,
+      branch: dep.branch,
+      commitSha: dep.commitSha ?? undefined,
+      localPath: snapshot.localPath,
+      buildStrategy: snapshot.buildStrategy,
+      stack: snapshot.framework,
+      buildImage: snapshot.buildImage,
+      packageManager: snapshot.packageManager,
+      installCommand: snapshot.hasBuild ? snapshot.installCommand : "",
+      buildCommand: snapshot.hasBuild ? snapshot.buildCommand : "",
+      outputDirectory: snapshot.outputDirectory,
+      envVars: { ...BUILD_ENV_VARS, ...envMap },
+      resources: buildResources,
+      gitToken: gitToken ?? undefined,
+    };
+
+    if (!snapshot.hasBuild) {
+      logger.step("build", "completed", "Build disabled — skipping install & build, using source directly");
+    }
+
+    const buildResult = await runtime.build(buildConfig, logger);
+    provisioned.imageRef = buildResult.imageRef;
+
+    if (buildResult.status === "cancelled") {
+      await onCancelled(ctx, buildResult.durationMs);
+      return;
+    }
+
+    if (buildResult.status === "failed") {
+      await onFailure(ctx, undefined, buildResult.durationMs);
+      return;
+    }
+
+    // Guard: build must produce an imageRef to proceed to deploy
+    if (buildResult.status !== "deploying" || !buildResult.imageRef) {
+      const msg = "Build completed but did not produce a deployable artifact";
+      logger.step("build", "failed", msg);
+      await onFailure(ctx, msg, buildResult.durationMs);
+      return;
+    }
+
+    // ── Deploy phase ─────────────────────────────────────────────────
+    await repos.deployment.updateStatus(dep.id, "deploying", {
+      imageRef: buildResult.imageRef,
+      buildDurationMs: buildResult.durationMs,
+    });
+    sessionManager.updateStatus(dep.id, "deploying");
+
+    // ── Branch: static (Pages) vs server (VM) ────────────────────────
+    if (!snapshot.hasServer && runtime instanceof CloudRuntime) {
+      // ── Static deploy via Oblien Pages ─────────────────────────────
+      logger.step("deploy", "running", "Deploying to edge (static)...");
+
+      const staticResult = await runtime.deployStatic({
+        deploymentId: dep.id,
+        projectId: project.id,
+        buildSessionId,
+        imageRef: buildResult.imageRef,
+        environment: dep.environment,
+        port: snapshot.port,
+        startCommand: snapshot.startCommand,
+        stack: snapshot.framework,
+        envVars: envMap,
+        resources: prodResources,
+        restartPolicy: "no",
+        slug: project.slug,
+        customDomain: snapshot.customDomain,
+        outputDirectory: snapshot.outputDirectory,
+        projectName: project.name,
+      });
+
+      if (staticResult.status === "failed" || !staticResult.containerId) {
+        logger.step("deploy", "failed", "Static deploy failed");
+        await onFailure(ctx, "Failed to deploy static site to edge", buildResult.durationMs);
+        return;
+      }
+
+      logger.step("deploy", "completed", "Deployed to edge successfully");
+
+      await onSuccess(ctx, {
+        containerId: staticResult.containerId,
+        url: staticResult.url,
+        durationMs: buildResult.durationMs ?? 0,
+      });
+    } else {
+      // ── Server deploy (existing VM pipeline) ───────────────────────
+      const deployConfig: DeployConfig = {
+        deploymentId: dep.id,
+        projectId: project.id,
+        buildSessionId,
+        imageRef: buildResult.imageRef,
+        environment: dep.environment,
+        port: snapshot.port,
+        startCommand: snapshot.startCommand,
+        stack: snapshot.framework,
+        envVars: envMap,
+        resources: prodResources,
+        restartPolicy: "always",
+        slug: project.slug,
+        productionPaths: snapshot.productionPaths.length
+          ? snapshot.productionPaths
+          : undefined,
+      };
+
+      // Compose deploy environment from runtime adapter
+      const deployEnv: DeployEnvironment = {
+        activate: async (cfg, onLog) => {
+          const r = await runtime.deploy(cfg, onLog);
+          if (!r.containerId) throw new Error("Deploy produced no container");
+          return { containerId: r.containerId, url: r.url };
+        },
+        deactivate: (id) => runtime.destroy(id),
+        resolveTargetUrl: runtime.supports("containerIp")
+          ? async (id, port) => {
+              const ip = await runtime.getContainerIp(id);
+              return ip ? `http://${ip}:${port}` : null;
+            }
+          : undefined,
+      };
+
+      // Gather inputs for the deploy pipeline
+      const prevDep = project.activeDeploymentId
+        ? await repos.deployment.findById(project.activeDeploymentId)
+        : null;
+
+      // Attach custom domain from snapshot (passed through from input)
+      if (snapshot.customDomain) {
+        deployConfig.customDomain = snapshot.customDomain;
+      }
+
+      const verifiedDomains = snapshot.customDomain
+        ? [{ hostname: snapshot.customDomain, tls: true }]
+        : [];
+
+      const deployResult = await runDeployPipeline(deployEnv, {
+        config: deployConfig,
+        previousContainerId: prevDep?.containerId ?? undefined,
+        domains: verifiedDomains,
+        routing,
+      }, logger);
+
+      if (deployResult.status === "failed") {
+        await onFailure(ctx, deployResult.error, buildResult.durationMs);
+        return;
+      }
+
+      // ── Success ──────────────────────────────────────────────────────
+      await onSuccess(ctx, {
+        containerId: deployResult.containerId!,
+        url: deployResult.url,
+        durationMs: buildResult.durationMs ?? 0,
+      });
+    }
+  } catch (err) {
+    const message = err instanceof Error ? err.message : "Unknown error";
+    logger.log(`Error: ${message}`, "error");
+    await onFailure(ctx, message);
+  }
+}