p-dev-harness 0.3.0 → 0.3.1

package/workspace-snapshot/files/src/setup/vercel-bridge-redeploy-state.ts

@@ -0,0 +1,46 @@
+import { randomUUID } from "node:crypto";
+import type {
+  VercelBridgeCandidateSecretSource,
+  VercelBridgePreviewFingerprintInputs,
+  VercelBridgeRedeployVerification,
+} from "./control-plane-types.js";
+import { DEFAULT_REDEPLOY_TIMEOUT_MS } from "./vercel-production-redeploy.js";
+
+export function createPendingRedeployVerification(input: {
+  projectId: string;
+  projectName: string;
+  teamId?: string;
+  webhookUrl: string;
+  fingerprint: string;
+  fingerprintInputs?: VercelBridgePreviewFingerprintInputs;
+  candidateSecretSource?: VercelBridgeCandidateSecretSource;
+  sourceDeploymentId?: string;
+  newDeploymentId: string;
+  message?: string;
+  writtenEnvKeys?: string[];
+  skippedEnvKeys?: string[];
+}): VercelBridgeRedeployVerification {
+  const startedAt = new Date().toISOString();
+  return {
+    actionId: `vercel-redeploy-${randomUUID()}`,
+    projectId: input.projectId,
+    projectName: input.projectName,
+    teamId: input.teamId,
+    webhookUrl: input.webhookUrl,
+    fingerprint: input.fingerprint,
+    fingerprintInputs: input.fingerprintInputs,
+    candidateSecretSource: input.candidateSecretSource,
+    sourceDeploymentId: input.sourceDeploymentId,
+    newDeploymentId: input.newDeploymentId,
+    status: "triggered",
+    startedAt,
+    updatedAt: startedAt,
+    deadlineAt: new Date(Date.now() + DEFAULT_REDEPLOY_TIMEOUT_MS).toISOString(),
+    verifyAttempted: false,
+    message:
+      input.message ??
+      "Production redeploy triggered. Waiting for Vercel deployment READY.",
+    writtenEnvKeys: input.writtenEnvKeys,
+    skippedEnvKeys: input.skippedEnvKeys,
+  };
+}

package/workspace-snapshot/files/src/setup/vercel-bridge-structured-log.ts

@@ -0,0 +1,86 @@
+import type { VercelEnvWritePlanEntry } from "./vercel-setup-plan.js";
+
+const SECRET_KEY_PATTERN =
+  /LINEAR_WEBHOOK_SECRET|GITHUB_TOKEN|LINEAR_API_KEY|VERCEL_TOKEN|GITHUB_DISPATCH_TOKEN|linear-signature|signature/i;
+
+export type VercelBridgeLogPhase =
+  | "apply_start"
+  | "apply_complete"
+  | "redeploy_trigger"
+  | "poll"
+  | "poll_reconstruct"
+  | "verify_claim"
+  | "verify_retry"
+  | "signed_probe"
+  | "linear_webhook_url_reconcile"
+  | "blocked";
+
+export interface VercelBridgeStructuredLogEvent {
+  phase: VercelBridgeLogPhase;
+  actionId?: string;
+  projectId?: string;
+  projectName?: string;
+  teamId?: string;
+  fingerprint?: string;
+  candidateSecretSource?: string;
+  hasLocalWebhookSecret?: boolean;
+  envWritePlan?: Array<Pick<VercelEnvWritePlanEntry, "key" | "action" | "source">>;
+  pollStatus?: string;
+  verifyAttempted?: boolean;
+  verifyOnly?: boolean;
+  signedProbeResult?: string;
+  signedProbeReason?: string;
+  signedProbeStatusCode?: number;
+  setupBlockedMessage?: string;
+  setupBlockedNextSteps?: string[];
+  expectedFingerprint?: string;
+  reconstructedFingerprint?: string;
+  fingerprintMatch?: boolean;
+  differingFingerprintKeys?: string[];
+  message?: string;
+  webhookUrlDrift?: boolean;
+  reconciliationAttempted?: boolean;
+  reconciliationSucceeded?: boolean;
+  matchingPreviousWebhookFound?: boolean;
+  canonicalWebhookExists?: boolean;
+}
+
+function containsSecretLikeValue(value: string): boolean {
+  return SECRET_KEY_PATTERN.test(value);
+}
+
+function sanitizeString(value: string): string {
+  if (containsSecretLikeValue(value)) {
+    return "[redacted]";
+  }
+  return value;
+}
+
+export function sanitizeVercelBridgeLogEvent(
+  event: VercelBridgeStructuredLogEvent,
+): Record<string, unknown> {
+  const sanitized: Record<string, unknown> = {
+    event: "vercel_bridge_setup",
+    ...event,
+  };
+
+  if (event.setupBlockedMessage) {
+    sanitized.setupBlockedMessage = sanitizeString(event.setupBlockedMessage);
+  }
+  if (event.setupBlockedNextSteps) {
+    sanitized.setupBlockedNextSteps = event.setupBlockedNextSteps.map((step) =>
+      sanitizeString(step),
+    );
+  }
+  if (event.message) {
+    sanitized.message = sanitizeString(event.message);
+  }
+
+  return sanitized;
+}
+
+export function logVercelBridgeEvent(event: VercelBridgeStructuredLogEvent): void {
+  console.log(
+    `[setup:vercel-bridge] ${JSON.stringify(sanitizeVercelBridgeLogEvent(event))}`,
+  );
+}

package/workspace-snapshot/files/src/setup/vercel-bridge-verification.ts

@@ -0,0 +1,63 @@
+import { createHash } from "node:crypto";
+import type { VercelEnvWritePlanEntry } from "./vercel-setup-plan.js";
+import type { VercelSignedProbeEvidence } from "./vercel-webhook-probe.js";
+import { tokenizeSecretInput } from "./secret-change-token.js";
+
+export interface VercelBridgeVerificationInputs {
+  projectId?: string;
+  linearTeamId?: string;
+  productionUrl?: string;
+  webhookUrl?: string;
+  envWritePlan?: VercelEnvWritePlanEntry[];
+  candidateSecretToken?: string;
+}
+
+export function buildVercelBridgeVerificationFingerprint(
+  input: VercelBridgeVerificationInputs,
+): string {
+  return createHash("sha256")
+    .update(
+      JSON.stringify({
+        projectId: input.projectId ?? "",
+        linearTeamId: input.linearTeamId ?? "",
+        productionUrl: input.productionUrl ?? "",
+        webhookUrl: input.webhookUrl ?? "",
+        envWritePlan: (input.envWritePlan ?? []).map((entry) => ({
+          key: entry.key,
+          action: entry.action,
+          source: entry.source,
+        })),
+        candidateSecretToken: input.candidateSecretToken ?? "",
+      }),
+    )
+    .digest("hex")
+    .slice(0, 16);
+}
+
+export function tokenizeCandidateWebhookSecret(secret?: string): string {
+  return tokenizeSecretInput(secret);
+}
+
+export function shouldInvalidateSignedProbeEvidence(input: {
+  previousFingerprint?: string;
+  nextFingerprint: string;
+}): boolean {
+  if (!input.previousFingerprint) {
+    return false;
+  }
+  return input.previousFingerprint !== input.nextFingerprint;
+}
+
+export function isSignedProbeEvidenceCurrent(input: {
+  signedProbe?: VercelSignedProbeEvidence;
+  verificationFingerprint?: string;
+  currentFingerprint: string;
+}): boolean {
+  if (!input.signedProbe?.passed) {
+    return false;
+  }
+  if (!input.verificationFingerprint) {
+    return false;
+  }
+  return input.verificationFingerprint === input.currentFingerprint;
+}

package/workspace-snapshot/files/src/setup/vercel-production-redeploy.ts

@@ -0,0 +1,298 @@
+import {
+  getVercelDeployment,
+  isVercelDeploymentReady,
+  listVercelProductionDeployments,
+  triggerVercelProductionRedeploy,
+  type VercelDeploymentSummary,
+} from "./vercel-setup-client.js";
+import type { VercelSignedProbeEvidence } from "./vercel-webhook-probe.js";
+
+export const DEFAULT_REDEPLOY_POLL_INTERVAL_MS = 5_000;
+export const DEFAULT_REDEPLOY_TIMEOUT_MS = 300_000;
+
+export type ProductionRedeployStatus =
+  | "not_triggered"
+  | "triggered"
+  | "building"
+  | "ready"
+  | "failed"
+  | "timeout"
+  | "no_source_deployment";
+
+export interface ProductionRedeployResult {
+  status: ProductionRedeployStatus;
+  sourceDeploymentId?: string;
+  newDeploymentId?: string;
+  message?: string;
+  state?: string;
+  readyState?: string;
+}
+
+export function isStaleDeploymentSignatureProbeFailure(
+  probe: Pick<VercelSignedProbeEvidence, "passed" | "result" | "reason">,
+): boolean {
+  return (
+    !probe.passed &&
+    probe.result === "auth_failed" &&
+    probe.reason === "invalid_signature"
+  );
+}
+
+export function isAutoRedeployEligible(input: {
+  writtenEnvKeys: string[];
+  signedProbe: Pick<VercelSignedProbeEvidence, "passed" | "result" | "reason">;
+  sourceDeploymentId?: string;
+}): boolean {
+  return (
+    input.writtenEnvKeys.length > 0 &&
+    isStaleDeploymentSignatureProbeFailure(input.signedProbe) &&
+    Boolean(input.sourceDeploymentId?.trim())
+  );
+}
+
+export async function findLatestReadyProductionDeploymentId(input: {
+  vercelToken: string;
+  projectId: string;
+  teamId?: string;
+  listDeployments?: typeof listVercelProductionDeployments;
+}): Promise<string | undefined> {
+  const listDeployments =
+    input.listDeployments ?? listVercelProductionDeployments;
+  const deployments = await listDeployments(
+    input.vercelToken,
+    input.projectId,
+    input.teamId,
+    { state: "READY", limit: 5 },
+  );
+  const readyDeployment = deployments.find((deployment) =>
+    isVercelDeploymentReady(deployment),
+  );
+  return readyDeployment?.id;
+}
+
+export function isDeploymentFailed(
+  deployment: Pick<VercelDeploymentSummary, "state" | "readyState">,
+): boolean {
+  const state = deployment.readyState ?? deployment.state;
+  return state === "ERROR" || state === "CANCELED";
+}
+
+export async function triggerProductionRedeployOnce(input: {
+  vercelToken: string;
+  projectId: string;
+  projectName: string;
+  teamId?: string;
+  sourceDeploymentId?: string;
+  listDeployments?: typeof listVercelProductionDeployments;
+  triggerRedeploy?: typeof triggerVercelProductionRedeploy;
+}): Promise<ProductionRedeployResult> {
+  const listDeployments =
+    input.listDeployments ?? listVercelProductionDeployments;
+  const triggerRedeploy = input.triggerRedeploy ?? triggerVercelProductionRedeploy;
+
+  const sourceDeploymentId =
+    input.sourceDeploymentId?.trim() ??
+    (await findLatestReadyProductionDeploymentId({
+      vercelToken: input.vercelToken,
+      projectId: input.projectId,
+      teamId: input.teamId,
+      listDeployments,
+    }));
+
+  if (!sourceDeploymentId) {
+    return {
+      status: "no_source_deployment",
+      message:
+        "No READY production deployment was found to redeploy. Deploy the project in Vercel before applying settings.",
+    };
+  }
+
+  try {
+    const triggered = await triggerRedeploy(input.vercelToken, {
+      projectName: input.projectName,
+      sourceDeploymentId,
+      teamId: input.teamId,
+    });
+
+    return {
+      status: "triggered",
+      sourceDeploymentId,
+      newDeploymentId: triggered.id,
+      state: triggered.state,
+      readyState: triggered.readyState,
+      message: "Production redeploy triggered. Waiting for Vercel deployment READY.",
+    };
+  } catch (error) {
+    return {
+      status: "failed",
+      sourceDeploymentId,
+      message:
+        error instanceof Error
+          ? error.message
+          : "Vercel production redeploy request failed.",
+    };
+  }
+}
+
+export async function inspectProductionRedeployStatus(input: {
+  vercelToken: string;
+  newDeploymentId: string;
+  teamId?: string;
+  sourceDeploymentId?: string;
+  deadlineAt: string;
+  getDeployment?: typeof getVercelDeployment;
+}): Promise<ProductionRedeployResult> {
+  const getDeployment = input.getDeployment ?? getVercelDeployment;
+  const deployment = await getDeployment(
+    input.vercelToken,
+    input.newDeploymentId,
+    input.teamId,
+  );
+
+  if (isVercelDeploymentReady(deployment)) {
+    return {
+      status: "ready",
+      sourceDeploymentId: input.sourceDeploymentId,
+      newDeploymentId: input.newDeploymentId,
+      state: deployment.state,
+      readyState: deployment.readyState,
+      message: "Production redeploy completed and deployment is READY.",
+    };
+  }
+
+  if (isDeploymentFailed(deployment)) {
+    return {
+      status: "failed",
+      sourceDeploymentId: input.sourceDeploymentId,
+      newDeploymentId: input.newDeploymentId,
+      state: deployment.state,
+      readyState: deployment.readyState,
+      message: `Production redeploy failed with state ${deployment.readyState ?? deployment.state}.`,
+    };
+  }
+
+  if (Date.now() > Date.parse(input.deadlineAt)) {
+    return {
+      status: "timeout",
+      sourceDeploymentId: input.sourceDeploymentId,
+      newDeploymentId: input.newDeploymentId,
+      state: deployment.state,
+      readyState: deployment.readyState,
+      message:
+        "Production redeploy did not reach READY before the timeout. Retry verification after Vercel finishes building.",
+    };
+  }
+
+  return {
+    status: "building",
+    sourceDeploymentId: input.sourceDeploymentId,
+    newDeploymentId: input.newDeploymentId,
+    state: deployment.state,
+    readyState: deployment.readyState,
+    message: "Waiting for Vercel deployment READY…",
+  };
+}
+
+export async function triggerAndWaitForProductionRedeploy(input: {
+  vercelToken: string;
+  projectId: string;
+  projectName: string;
+  teamId?: string;
+  sourceDeploymentId?: string;
+  pollIntervalMs?: number;
+  timeoutMs?: number;
+  sleep?: (ms: number) => Promise<void>;
+  listDeployments?: typeof listVercelProductionDeployments;
+  triggerRedeploy?: typeof triggerVercelProductionRedeploy;
+  getDeployment?: typeof getVercelDeployment;
+}): Promise<ProductionRedeployResult> {
+  const listDeployments =
+    input.listDeployments ?? listVercelProductionDeployments;
+  const triggerRedeploy = input.triggerRedeploy ?? triggerVercelProductionRedeploy;
+  const getDeployment = input.getDeployment ?? getVercelDeployment;
+  const sleep =
+    input.sleep ??
+    ((ms: number) => new Promise<void>((resolve) => setTimeout(resolve, ms)));
+  const pollIntervalMs = input.pollIntervalMs ?? DEFAULT_REDEPLOY_POLL_INTERVAL_MS;
+  const timeoutMs = input.timeoutMs ?? DEFAULT_REDEPLOY_TIMEOUT_MS;
+
+  const sourceDeploymentId =
+    input.sourceDeploymentId?.trim() ??
+    (await findLatestReadyProductionDeploymentId({
+      vercelToken: input.vercelToken,
+      projectId: input.projectId,
+      teamId: input.teamId,
+      listDeployments,
+    }));
+
+  if (!sourceDeploymentId) {
+    return {
+      status: "no_source_deployment",
+      message:
+        "No READY production deployment was found to redeploy. Deploy the project in Vercel before applying settings.",
+    };
+  }
+
+  let triggered: VercelDeploymentSummary;
+  try {
+    triggered = await triggerRedeploy(input.vercelToken, {
+      projectName: input.projectName,
+      sourceDeploymentId,
+      teamId: input.teamId,
+    });
+  } catch (error) {
+    return {
+      status: "failed",
+      sourceDeploymentId,
+      message:
+        error instanceof Error
+          ? error.message
+          : "Vercel production redeploy request failed.",
+    };
+  }
+
+  const newDeploymentId = triggered.id;
+  const deadline = Date.now() + timeoutMs;
+
+  while (Date.now() < deadline) {
+    const deployment = await getDeployment(
+      input.vercelToken,
+      newDeploymentId,
+      input.teamId,
+    );
+
+    if (isVercelDeploymentReady(deployment)) {
+      return {
+        status: "ready",
+        sourceDeploymentId,
+        newDeploymentId,
+        state: deployment.state,
+        readyState: deployment.readyState,
+        message: "Production redeploy completed and deployment is READY.",
+      };
+    }
+
+    if (isDeploymentFailed(deployment)) {
+      return {
+        status: "failed",
+        sourceDeploymentId,
+        newDeploymentId,
+        state: deployment.state,
+        readyState: deployment.readyState,
+        message: `Production redeploy failed with state ${deployment.readyState ?? deployment.state}.`,
+      };
+    }
+
+    await sleep(pollIntervalMs);
+  }
+
+  return {
+    status: "timeout",
+    sourceDeploymentId,
+    newDeploymentId,
+    state: triggered.state,
+    readyState: triggered.readyState,
+    message:
+      "Production redeploy did not reach READY before the timeout. Retry verification after Vercel finishes building.",
+  };
+}