run402 4.105.5 → 4.106.0

package/lib/command-manifest.mjs

@@ -206,6 +206,7 @@ export const COMMAND_MANIFEST = [
   { path: ["transfer", "preview"], positionals: [p("transfer_id")], projectScoped: false, legacyPositionalProject: false, minimalArgs: ["tr_gate1"] },
   { path: ["transfer", "list"], positionals: [], projectScoped: false, legacyPositionalProject: false, minimalArgs: [] },
   { path: ["transfer", "accept"], positionals: [p("transfer_id")], projectScoped: false, legacyPositionalProject: false, minimalArgs: ["tr_gate1"] },
+  { path: ["transfer", "handover"], positionals: [p("transfer_id")], projectScoped: false, legacyPositionalProject: false, minimalArgs: ["tr_gate1"] },
   { path: ["transfer", "cancel"], positionals: [p("transfer_id")], projectScoped: false, legacyPositionalProject: false, minimalArgs: ["tr_gate1"] },
 
   // ── orgs ──────────────────────────────────────────────────────────────────
@@ -310,6 +311,7 @@ export const COMMAND_MANIFEST = [
   { path: ["repos", "access"], positionals: [], projectScoped: true, legacyPositionalProject: false, minimalArgs: [], runStyle: "sub", skipBehavioral: "reads the live org encryption-key directory + vault envelope recipients" },
   { path: ["repos", "access", "repair"], positionals: [], projectScoped: true, legacyPositionalProject: false, minimalArgs: ["--recipient-state-version", "0", "--recipient-revocation-version", "0"], runStyle: "sub", skipBehavioral: "owner+step-up-gated epoch rotation (D193-D203, rev 42) — samples a fresh epoch key and re-seals a live vault's recipients" },
   { path: ["repos", "access", "revoke-key"], positionals: [p("principal_id")], projectScoped: true, legacyPositionalProject: false, minimalArgs: ["prin_00000000000000000000000000000000"], runStyle: "sub", skipBehavioral: "owner+step-up-gated: declares a recipient's key revoked (org-scoped watermark) and drives a real epoch rotation off it" },
+  { path: ["repos", "access", "retire-previous-owner"], positionals: [], projectScoped: true, legacyPositionalProject: false, minimalArgs: [], runStyle: "sub", skipBehavioral: "owner+step-up-gated: blocks the previous owner's writer keys after a project transfer and drives a real epoch rotation" },
   { path: ["repos", "access", "declare-exposure"], positionals: [], projectScoped: true, legacyPositionalProject: false, minimalArgs: [], runStyle: "sub", skipBehavioral: "owner+step-up-gated: declares this vault's epoch secret exposed, forcing every subsequent ordinary push to refuse until a rotation lands" },
   { path: ["repos", "access", "sync"], positionals: [], projectScoped: true, legacyPositionalProject: false, minimalArgs: [], runStyle: "sub", skipBehavioral: "vault-multi-writer (rev 47): on-demand writer-admission reconcile — resolves pending candidates' signing keys via the live org encryption-key directory and publishes a real add_writer_key head per candidate" },
   { path: ["repos", "recover"], positionals: [p("source")], projectScoped: false, legacyPositionalProject: false, minimalArgs: ["s3://example-mirror-bucket", "--out", "__SCRATCH_DIR__/recover-out"], runStyle: "sub", skipBehavioral: "materializes a git repository from a mirror source, offline, with no server call" },

package/lib/repos.mjs

@@ -107,6 +107,7 @@ Maintenance:
   run402 repos access [--project <project_id>] [--repo <repo_id>] [--human]
   run402 repos access repair [--project <project_id>] [--repo <repo_id>] --recipient-state-version <n> --recipient-revocation-version <n>
   run402 repos access revoke-key <principal_id> [--project <project_id>] [--repo <repo_id>]
+  run402 repos access retire-previous-owner [--project <project_id>] [--repo <repo_id>]
   run402 repos access declare-exposure [--project <project_id>] [--repo <repo_id>]
   run402 repos access repin   [--project <project_id>] [--repo <repo_id>] --principal <principal_id> --fingerprint <ek_fingerprint>
   run402 repos policy <required|grandfathered> [--project <project_id>] [--repo <repo_id>] [--reason <why>]
@@ -358,6 +359,13 @@ Subcommands:
            that declaration's OWN returned counters — no flags needed.
            Owner + step-up. The rekey remedy for "this specific principal's
            key should no longer be trusted."
+  access retire-previous-owner
+           After a project transfer: blocks every writer key whose principal
+           is not a developer+ member of the vault's organization (the
+           previous owner's writers) and commits the writer_key_revoked
+           rotation that removes them. A transfer never does this on its own.
+           Protects only what is written afterwards. Owner + step-up. Safe to
+           re-run; nothing to retire means no rotation.
   access declare-exposure
            Declares reason:"epoch_secret_exposed" for THIS vault
            (vault-scoped, not org-wide) — the rekey remedy for a leaked
@@ -2941,6 +2949,30 @@ async function accessRevokeKey(args) {
  * fingerprint (the out-of-band verification point) and moves the local pin.
  * Adapter only: `sdk.repos.acceptRecipientKeyChange`.
  */
+async function accessRetirePreviousOwner(args) {
+  const a = normalizeArgv(args);
+  assertKnownFlags(a, [...COMMON_VALUE_FLAGS, "--idempotency-key", "-v", "--verbose", "--help", "-h"], [...COMMON_VALUE_FLAGS, "--idempotency-key"]);
+  requirePositionalCount(a, [...COMMON_VALUE_FLAGS, "--idempotency-key"], { min: 0, max: 0, command: "run402 repos access retire-previous-owner", missing: "" });
+  const sdk = getSdk();
+  const target = await vaultTarget(a);
+  try {
+    const result = await sdk.repos.retirePreviousOwnerWriters({
+      ...target,
+      ...(flagValue(a, "--idempotency-key") != null ? { client_idempotency_key: flagValue(a, "--idempotency-key") } : {}),
+    });
+    printJson(sdk, result);
+    if (result.retired.length === 0) {
+      console.error("no writer outside this vault's organization — nothing to retire.");
+    } else {
+      console.error(`retired ${result.retired.length} writer key(s) from outside the organization and rotated to epoch ${result.rotation?.new_epoch} at generation ${result.rotation?.generation}.`);
+    }
+    console.error(result.note);
+    printVerboseStats(a, sdk);
+  } catch (err) {
+    reportSdkError(err);
+  }
+}
+
 async function accessRepin(args) {
   const a = normalizeArgv(args);
   assertKnownFlags(a, [...COMMON_VALUE_FLAGS, "--principal", "--fingerprint", "--help", "-h"], [...COMMON_VALUE_FLAGS, "--principal", "--fingerprint"]);
@@ -3019,6 +3051,7 @@ async function access(args) {
   const a = normalizeArgv(args);
   if (a[0] === "repair") return accessRepair(a.slice(1));
   if (a[0] === "revoke-key") return accessRevokeKey(a.slice(1));
+  if (a[0] === "retire-previous-owner") return accessRetirePreviousOwner(a.slice(1));
   if (a[0] === "declare-exposure") return accessDeclareExposure(a.slice(1));
   if (a[0] === "repin") return accessRepin(a.slice(1));
   if (a[0] === "sync") return accessSync(a.slice(1));

package/lib/transfer.mjs

@@ -18,6 +18,7 @@ Usage:
   run402 transfer preview <transfer_id>
   run402 transfer list [--incoming | --outgoing] [--limit N] [--after <cursor>]
   run402 transfer accept <transfer_id> [--org <org_id>] [--accept-retained-member]
+  run402 transfer handover <transfer_id>
   run402 transfer cancel <transfer_id> [--reason <text>]
 
 Subcommands:
@@ -28,7 +29,10 @@ Subcommands:
   list        List pending transfers (incoming default, or --outgoing) — pending rows unioned
   accept      Accept an incoming transfer, whatever its address (wallet: your wallet must be
               the to_wallet; email: your verified email must match; --org <org_id> picks the
-              receiving org, omit = new org)
+              receiving org, omit = new org). For a project with a vault, accept first
+              names you as the recipient of its source and waits for the sender's handover
+  handover    Sender: hand the project's vault to the recipient they named (admit their key
+              as a writer and wrap the source key for them), so they can accept
   cancel      Cancel a pending transfer of any kind
 
 Notes:
@@ -38,6 +42,10 @@ Notes:
   - --to-org is same-actor only in the first gateway release: you must own both orgs.
   - Secret VALUES are inherited by the recipient on completion; rotation is advised.
   - GitHub repo ownership is NOT transferred — handle that out of band.
+  - A project's KyGit vault moves with it. The recipient cannot accept until the sender
+    runs 'transfer handover'; afterwards the new owner retires the previous owner's
+    writers with 'run402 repos access retire-previous-owner' when ready.
+  - A project whose vault stores its source in your own bucket (BYO) is not transferable.
 `;
 
 const SUB_HELP = {
@@ -101,10 +109,27 @@ owner's CI bindings on the project, enqueues notifications to both parties,
 stamps a 'secrets_rotation_advised' advisory on the project, and returns the
 project keys (saved to your keystore).
 
+For a project with a KyGit vault, the source is handed over before accept: on
+the first run accept publishes this machine's keystore identity, names you as the
+principal that receives the source, and stops with TRANSFER_VAULT_HANDOVER_PENDING
+until the sender runs 'run402 transfer handover <transfer_id>'. Run accept again
+once 'transfer preview' shows vault_handover.state = complete.
+
 Options:
   --org <org_id>           Email-addressed only: the org to receive the project (omit = new org).
   --accept-retained-member Email-addressed only: accept the sender's retained-developer-membership
                            offer (see 'transfer preview' retain_member). Omit = full severance.
+`,
+  handover: `run402 transfer handover — Hand a transferred project's vault to the recipient
+
+Usage:
+  run402 transfer handover <transfer_id>
+
+The sender's step. Reads the principal the recipient named (they run 'transfer
+accept' first), admits that principal's own published signing key as a writer of
+the project's vault, and wraps the vault's current key for it. Your key must be a
+writer of the vault. Safe to re-run: a step already done is reported as such.
+The recipient can accept once vault_handover.state is complete.
 `,
   cancel: `run402 transfer cancel — Cancel a pending transfer
 
@@ -307,12 +332,57 @@ async function accept(args) {
   const acceptRetain = parsedArgs.includes("--accept-retained-member");
   walletAuthHeaders(`/agent/v1/transfers/${transferId}/accept`);
 
+  const sdk = getSdk();
+  const doAccept = () => sdk.admin.transfers.accept(transferId, {
+    orgId: orgId ?? undefined,
+    acceptRetainedMember: acceptRetain || undefined,
+  });
   try {
-    const data = await getSdk().admin.transfers.accept(transferId, {
-      orgId: orgId ?? undefined,
-      acceptRetainedMember: acceptRetain || undefined,
-    });
+    const data = await doAccept();
     console.log(JSON.stringify(data, null, 2));
+  } catch (err) {
+    // A project with a vault waits on its handover. When no recipient has
+    // been named yet, name this principal (publishing its keystore identity
+    // first) so the sender's 'transfer handover' has a key to hand over to.
+    const handoverState = err?.code === "TRANSFER_VAULT_HANDOVER_PENDING" ? err?.details?.vault_handover?.state : null;
+    if (handoverState !== "awaiting_recipient") {
+      reportSdkError(err);
+      return;
+    }
+    try {
+      await sdk.repos.publishKeystoreIdentity();
+      const nominated = await sdk.admin.transfers.nominateVaultRecipient(transferId);
+      if (nominated.vault_handover?.state === "complete") {
+        console.log(JSON.stringify(await doAccept(), null, 2));
+        return;
+      }
+      fail({
+        code: "TRANSFER_VAULT_HANDOVER_PENDING",
+        message: "You are named as the recipient of this project's source. The sender must run 'run402 transfer handover " + transferId + "' (they have been notified); then run this accept again.",
+        details: { transfer_id: transferId, vault_handover: nominated.vault_handover },
+        next_actions: nominated.next_actions,
+        retryable: true,
+      });
+    } catch (inner) {
+      reportSdkError(inner);
+    }
+  }
+}
+
+async function handover(args) {
+  const parsedArgs = normalizeArgv(args);
+  assertKnownFlags(parsedArgs, ["--help", "-h"], []);
+  const positionals = positionalArgs(parsedArgs, []);
+  if (positionals.length !== 1) {
+    fail({ code: "BAD_USAGE", message: "Usage: run402 transfer handover <transfer_id>" });
+  }
+  const transferId = positionals[0];
+  try {
+    const data = await getSdk().repos.completeTransferHandover(transferId);
+    console.log(JSON.stringify(data, null, 2));
+    if (data.vault_handover?.state === "complete") {
+      console.error(`handed over: the recipient can now run 'run402 transfer accept ${transferId}'.`);
+    }
   } catch (err) {
     reportSdkError(err);
   }
@@ -361,6 +431,9 @@ export async function run(sub, args) {
     case "accept":
       await accept(args);
       return;
+    case "handover":
+      await handover(args);
+      return;
     case "cancel":
       await cancel(args);
       return;

package/lib/up.mjs

@@ -65,7 +65,8 @@ Options:
                       commits directly, and a plan whose migrations are all
                       already applied with an identical checksum is not
                       rehearsed either (result.deploy.rehearsal says which:
-                      no_live_release / migrations_unchanged / no_migrations).
+                      no_live_release / migrations_unchanged / no_migrations /
+                      ci_session_unsupported).
   --repo-only         Provision + scaffold the run402 remote + first push,
                       and stop there — no deploy. The vault-only track
                       (D8), composed through up instead of run402 repos

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "run402",
-  "version": "4.105.5",
+  "version": "4.106.0",
   "description": "CLI for Run402 — full-stack backend infrastructure for AI agents: Postgres, auth, storage, serverless functions and atomic deploys. Paid with x402/MPP. Includes $0.03 image generation.",
   "type": "module",
   "bin": {

package/sdk/dist/namespaces/deploy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/namespaces/deploy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAsB3C,OAAO,KAAK,EACV,YAAY,EACZ,sBAAsB,EAQtB,WAAW,EACX,oBAAoB,EAEpB,iBAAiB,EACjB,kBAAkB,EAClB,eAAe,EACf,YAAY,EACZ,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,wBAAwB,EACxB,uBAAuB,EAIvB,sBAAsB,EACtB,oBAAoB,EAUpB,iBAAiB,EAGjB,YAAY,EACZ,cAAc,EACd,aAAa,EACb,kBAAkB,EAClB,gBAAgB,EAChB,2BAA2B,EAC3B,uBAAuB,EACvB,WAAW,EACX,oBAAoB,EACpB,mBAAmB,EACnB,kBAAkB,EAGlB,YAAY,EAEb,MAAM,mBAAmB,CAAC;AAiF3B,qBAAa,MAAM;IACL,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,MAAM;IAE3C;;;;OAIG;IACG,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,GAAE,YAAiB,GAAG,OAAO,CAAC,YAAY,CAAC;IAiD9E;;;OAGG;IACH,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,GAAE,YAAiB,GAAG,OAAO,CAAC,eAAe,CAAC;IAI3E;;;;OAIG;IACG,IAAI,CACR,IAAI,EAAE,WAAW,EACjB,IAAI,GAAE;QACJ,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,IAAI,CAAC,EAAE,cAAc,GAAG,cAAc,CAAC;QACvC,YAAY,CAAC,EAAE;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,eAAe,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAC5D,sEAAsE;QACtE,KAAK,CAAC,EAAE,oBAAoB,CAAC;KACzB,GACL,OAAO,CAAC;QAAE,IAAI,EAAE,YAAY,CAAC;QAAC,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;KAAE,CAAC;IASxE;;;;;OAKG;IACG,MAAM,CACV,IAAI,EAAE,YAAY,EAClB,IAAI,EAAE;QACJ,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QACrC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,CAAC;KACxC,GACA,OAAO,CAAC,IAAI,CAAC;IAWhB;;;;;OAKG;IACG,MAAM,CACV,MAAM,EAAE,MAAM,EACd,IAAI,GAAE;QACJ,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,CAAC;QACvC,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,YAAY,CAAC,EAAE;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,eAAe,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAC5D;;;;WAIG;QACH,KAAK,CAAC,EAAE,sBAAsB,CAAC;KAC3B,GACL,OAAO,CAAC,YAAY,CAAC;IASlB,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,GAAE,mBAAwB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAkC3F;;;;;;;;;OASG;IACG,MAAM,CACV,WAAW,EAAE,MAAM,EACnB,IAAI,GAAE;QAAE,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAO,GACtE,OAAO,CAAC,YAAY,CAAC;IAqBxB;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACG,OAAO,CACX,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,IAAI,GAAE,cAAmB,GACxB,OAAO,CAAC,aAAa,CAAC;IA2CzB;;;;OAIG;IACG,MAAM,CACV,WAAW,EAAE,MAAM,EACnB,IAAI,GAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAO,GAC9B,OAAO,CAAC,iBAAiB,CAAC;IAmB7B;;;;;;OAMG;IACG,IAAI,CACR,IAAI,EAAE,MAAM,GAAG,iBAAiB,GAC/B,OAAO,CAAC,kBAAkB,CAAC;IA6B9B;;;;;;;;OAQG;IACG,MAAM,CACV,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,GACxB,OAAO,CAAC,oBAAoB,CAAC;IAmBhC;;;;OAIG;IACG,aAAa,CACjB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,GACxB,OAAO,CAAC,mBAAmB,CAAC;IAyB/B;;;;OAIG;IACG,gBAAgB,CACpB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,wBAAwB,GAC7B,OAAO,CAAC,uBAAuB,CAAC;IAoCnC;;;;OAIG;IACG,UAAU,CAAC,IAAI,EAAE,2BAA2B,GAAG,OAAO,CAAC,gBAAgB,CAAC;IA6B9E;;;;OAIG;IACG,gBAAgB,CACpB,IAAI,EAAE,uBAAuB,GAC5B,OAAO,CAAC,sBAAsB,CAAC;IAqBlC;;;;OAIG;IACG,IAAI,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,oBAAoB,CAAC;IA+BnE;;;;OAIG;IACG,OAAO,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,qBAAqB,CAAC;CAW1E;AAqkED;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;iEAG6D;IAC7D,KAAK,CAAC,EAAE,SAAS,GAAG,OAAO,GAAG,OAAO,CAAC;CACvC;AAk5ED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAKrD"}
+{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/namespaces/deploy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAuB3C,OAAO,KAAK,EACV,YAAY,EACZ,sBAAsB,EAQtB,WAAW,EACX,oBAAoB,EAEpB,iBAAiB,EACjB,kBAAkB,EAClB,eAAe,EACf,YAAY,EACZ,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,wBAAwB,EACxB,uBAAuB,EAIvB,sBAAsB,EACtB,oBAAoB,EAUpB,iBAAiB,EAGjB,YAAY,EACZ,cAAc,EACd,aAAa,EACb,kBAAkB,EAClB,gBAAgB,EAChB,2BAA2B,EAC3B,uBAAuB,EACvB,WAAW,EACX,oBAAoB,EACpB,mBAAmB,EACnB,kBAAkB,EAGlB,YAAY,EAEb,MAAM,mBAAmB,CAAC;AAqF3B,qBAAa,MAAM;IACL,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,MAAM;IAE3C;;;;OAIG;IACG,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,GAAE,YAAiB,GAAG,OAAO,CAAC,YAAY,CAAC;IAiD9E;;;OAGG;IACH,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,GAAE,YAAiB,GAAG,OAAO,CAAC,eAAe,CAAC;IAI3E;;;;OAIG;IACG,IAAI,CACR,IAAI,EAAE,WAAW,EACjB,IAAI,GAAE;QACJ,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,IAAI,CAAC,EAAE,cAAc,GAAG,cAAc,CAAC;QACvC,YAAY,CAAC,EAAE;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,eAAe,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAC5D,sEAAsE;QACtE,KAAK,CAAC,EAAE,oBAAoB,CAAC;KACzB,GACL,OAAO,CAAC;QAAE,IAAI,EAAE,YAAY,CAAC;QAAC,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;KAAE,CAAC;IASxE;;;;;OAKG;IACG,MAAM,CACV,IAAI,EAAE,YAAY,EAClB,IAAI,EAAE;QACJ,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QACrC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,CAAC;KACxC,GACA,OAAO,CAAC,IAAI,CAAC;IAWhB;;;;;OAKG;IACG,MAAM,CACV,MAAM,EAAE,MAAM,EACd,IAAI,GAAE;QACJ,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,CAAC;QACvC,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,YAAY,CAAC,EAAE;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,eAAe,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAC5D;;;;WAIG;QACH,KAAK,CAAC,EAAE,sBAAsB,CAAC;KAC3B,GACL,OAAO,CAAC,YAAY,CAAC;IASlB,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,GAAE,mBAAwB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAkC3F;;;;;;;;;OASG;IACG,MAAM,CACV,WAAW,EAAE,MAAM,EACnB,IAAI,GAAE;QAAE,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAO,GACtE,OAAO,CAAC,YAAY,CAAC;IAqBxB;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACG,OAAO,CACX,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,IAAI,GAAE,cAAmB,GACxB,OAAO,CAAC,aAAa,CAAC;IA2CzB;;;;OAIG;IACG,MAAM,CACV,WAAW,EAAE,MAAM,EACnB,IAAI,GAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAO,GAC9B,OAAO,CAAC,iBAAiB,CAAC;IAmB7B;;;;;;OAMG;IACG,IAAI,CACR,IAAI,EAAE,MAAM,GAAG,iBAAiB,GAC/B,OAAO,CAAC,kBAAkB,CAAC;IA6B9B;;;;;;;;OAQG;IACG,MAAM,CACV,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,GACxB,OAAO,CAAC,oBAAoB,CAAC;IAmBhC;;;;OAIG;IACG,aAAa,CACjB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,GACxB,OAAO,CAAC,mBAAmB,CAAC;IAyB/B;;;;OAIG;IACG,gBAAgB,CACpB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,wBAAwB,GAC7B,OAAO,CAAC,uBAAuB,CAAC;IAoCnC;;;;OAIG;IACG,UAAU,CAAC,IAAI,EAAE,2BAA2B,GAAG,OAAO,CAAC,gBAAgB,CAAC;IA6B9E;;;;OAIG;IACG,gBAAgB,CACpB,IAAI,EAAE,uBAAuB,GAC5B,OAAO,CAAC,sBAAsB,CAAC;IAqBlC;;;;OAIG;IACG,IAAI,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,oBAAoB,CAAC;IA+BnE;;;;OAIG;IACG,OAAO,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,qBAAqB,CAAC;CAW1E;AAwoED;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;iEAG6D;IAC7D,KAAK,CAAC,EAAE,SAAS,GAAG,OAAO,GAAG,OAAO,CAAC;CACvC;AA+4ED,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAKrD"}

package/sdk/dist/namespaces/deploy.js

@@ -24,7 +24,7 @@ import { isGrantKeyCredentials } from "../grant-key-credentials.js";
 import { isKnownBinaryContent, isUtf8StringSource } from "../validation.js";
 import { assertCiDeployableSpec } from "./ci.js";
 import { ROUTE_PRICING_NETWORKS, ROUTE_HTTP_METHODS, isModernPlanMigrationDiff, normalizeDeployResolveRequest, } from "./deploy.types.js";
-import { ApiError, LocalError, NetworkError, PaymentRequired, Run402DeployError, Unauthorized, isTransferFreezeError, } from "../errors.js";
+import { ApiError, LocalError, NetworkError, PaymentRequired, Run402DeployError, Unauthorized, isRun402Error, isTransferFreezeError, } from "../errors.js";
 import { assertAssetMetadata, assertExifPolicy, } from "./assets-validation.js";
 // ─── Constants ───────────────────────────────────────────────────────────────
 const PLAN_BODY_LIMIT_BYTES = 5 * 1024 * 1024;
@@ -36,6 +36,10 @@ const APPLY_RETRY_DEFAULT_MAX_RETRIES = 2;
 const APPLY_RETRY_BASE_DELAY_MS = 250;
 const APPLY_RETRY_MAX_DELAY_MS = 2_000;
 const APPLY_RETRY_JITTER_MS = 100;
+const CONTENT_COMMIT_MAX_ATTEMPTS = 3;
+const DEPLOY_COMMIT_MAX_ATTEMPTS = 3;
+const DEPLOY_COMMIT_RETRY_BASE_DELAY_MS = 1_000;
+const CONTENT_COMMIT_RETRY_BASE_DELAY_MS = 500;
 const URL_REFRESH_AT_MS = 50 * 60 * 1000;
 const SECRET_KEY_RE = /^[A-Z_][A-Z0-9_]{0,127}$/;
 const APPLY_SAFE_RETRY_CODES = new Set([
@@ -568,11 +572,9 @@ async function rehearseBeforeCommit(client, plan, planId, project, opts, emit) {
     const envelope = plan.rehearsal;
     if (!envelope || !envelope.available) {
         const reason = envelope?.reason ?? "no_migrations";
-        return skip(reason === "no_live_release"
-            ? "no_live_release"
-            : reason === "migrations_unchanged"
-                ? "migrations_unchanged"
-                : "no_migrations");
+        return skip(reason === "no_live_release" || reason === "migrations_unchanged" || reason === "ci_session_unsupported"
+            ? reason
+            : "no_migrations");
     }
     // Named migrations that are all checksum-identical noops (already applied
     // to the live project) would run NOTHING on the branch, so a rehearsal
@@ -731,7 +733,7 @@ async function applyOnce(client, spec, opts, emit) {
             apply_plan_sha256: plan.vault?.apply_plan_sha256 ?? null,
         })
         : undefined;
-    const commit = requireCloudCommitResponse(await commitInternal(client, planId, opts.idempotencyKey, spec.project_id, requiredPlan, vaultCommit), "applying deploy");
+    const commit = requireCloudCommitResponse(await commitInternal(client, planId, opts.idempotencyKey, spec.project_id, requiredPlan, vaultCommit, operationId), "applying deploy");
     const result = await pollUntilReady(client, commit, plan.diff, plan.warnings, emit, spec.project_id, sliceKinds);
     result.rehearsal = rehearsal.block;
     // v1.48 unified-apply: thread the plan response's `asset_entries[]` back
@@ -1591,7 +1593,7 @@ function expandCronNumberPart(part, min, max) {
     }
     return values;
 }
-async function commitInternal(client, planId, idempotencyKey, project, requiredPlan, vault) {
+async function commitInternal(client, planId, idempotencyKey, project, requiredPlan, vault, operationId) {
     try {
         const body = {};
         if (idempotencyKey)
@@ -1600,7 +1602,7 @@ async function commitInternal(client, planId, idempotencyKey, project, requiredP
             body.required_plan = requiredPlanToWire(requiredPlan);
         if (vault)
             body.vault = vault;
-        return await client.request(`/apply/v1/plans/${encodeURIComponent(planId)}/commit`, {
+        const send = () => client.request(`/apply/v1/plans/${encodeURIComponent(planId)}/commit`, {
             method: "POST",
             body,
             // Write-approval scope: committing a deploy is `project.deploy` on this project.
@@ -1615,11 +1617,43 @@ async function commitInternal(client, planId, idempotencyKey, project, requiredP
                 : {}),
             context: "committing deploy",
         });
+        return await sendCommitRecoveringLostResponse(client, send, operationId, project);
     }
     catch (err) {
         throw translateDeployError(err, "commit", planId, null);
     }
 }
+/**
+ * Send a deploy commit, recovering when a 502/503/504 or a dropped connection
+ * loses the response. The commit may still have reached the gateway (a long
+ * commit can outlive the connection that carried it), and a second commit
+ * while the first is running would drive the state machine twice. So read the
+ * operation first: once it has left `planning`/`uploading` the commit landed,
+ * and the caller follows the operation; otherwise the commit never arrived and
+ * is sent again. Without an operation id to read, the failure surfaces as is.
+ */
+async function sendCommitRecoveringLostResponse(client, send, operationId, projectId) {
+    for (let attempt = 1;; attempt++) {
+        try {
+            return await send();
+        }
+        catch (err) {
+            if (!operationId || !projectId || !isTransientGatewayFailure(err) || attempt >= DEPLOY_COMMIT_MAX_ATTEMPTS)
+                throw err;
+            await sleep(DEPLOY_COMMIT_RETRY_BASE_DELAY_MS * 2 ** (attempt - 1));
+            let snapshot;
+            try {
+                snapshot = await client.request(`/apply/v1/operations/${encodeURIComponent(operationId)}`, { headers: await apikeyHeaders(client, projectId), context: "fetching deploy operation" });
+            }
+            catch {
+                throw err;
+            }
+            if (snapshot.status !== "planning" && snapshot.status !== "uploading") {
+                return { operation_id: operationId, status: "running" };
+            }
+        }
+    }
+}
 async function uploadMissing(client, projectId, presence, byteReaders, emit) {
     // Surface CAS dedup hits so agents can distinguish "N files were already
     // present" from "nothing happened". The gateway reports both present and
@@ -1692,7 +1726,7 @@ async function uploadMissing(client, projectId, presence, byteReaders, emit) {
     // Plan-level finalize — marks the plan committed in the deploy_plans
     // table. Per-session promotion to CAS already happened in the loop
     // above; this call is the plan-level idempotency anchor.
-    await client.request(`/content/v1/plans/${encodeURIComponent(planRes.plan_id)}/commit`, { method: "POST", headers, body: {}, context: "committing content upload" });
+    await commitContentPlanWithRetry(client, planRes.plan_id, headers);
 }
 async function uploadCoreContent(client, projectId, byteReaders, emit) {
     const entries = [...byteReaders.entries()].sort(([a], [b]) => a.localeCompare(b));
@@ -1721,6 +1755,35 @@ async function uploadCoreContent(client, projectId, byteReaders, emit) {
         });
     }
 }
+/**
+ * Finalize a content plan, riding out a transient gateway failure. A 502/503/504
+ * or a dropped connection means the load balancer or the network lost the
+ * request, not that the gateway refused it, and the commit is safe to repeat: the
+ * gateway re-promotes the same staged sessions. If a lost attempt had in fact
+ * committed, the repeat answers 409 PLAN_ALREADY_COMMITTED, which is success.
+ */
+async function commitContentPlanWithRetry(client, planId, headers) {
+    for (let attempt = 1;; attempt++) {
+        try {
+            await client.request(`/content/v1/plans/${encodeURIComponent(planId)}/commit`, { method: "POST", headers, body: {}, context: "committing content upload" });
+            return;
+        }
+        catch (err) {
+            if (attempt > 1 && isRun402Error(err) && err.status === 409 && err.code === "PLAN_ALREADY_COMMITTED")
+                return;
+            if (!isTransientGatewayFailure(err) || attempt >= CONTENT_COMMIT_MAX_ATTEMPTS)
+                throw err;
+            await sleep(CONTENT_COMMIT_RETRY_BASE_DELAY_MS * 2 ** (attempt - 1));
+        }
+    }
+}
+function isTransientGatewayFailure(err) {
+    if (!isRun402Error(err))
+        return false;
+    if (err.kind === "network_error")
+        return true;
+    return err.status === 502 || err.status === 503 || err.status === 504;
+}
 async function uploadOneWithRetry(fetchFn, session, bytes) {
     const MAX_ATTEMPTS = 3;
     for (let attempt = 1;; attempt++) {
@@ -2100,8 +2163,8 @@ async function startInternal(client, spec, opts) {
             status: "started",
             ...(sliceKinds.length > 0 ? { slice_kinds: sliceKinds } : {}),
         });
-        const { planId } = requirePersistedPlan(plan, "starting deploy");
-        const commit = requireCloudCommitResponse(await commitInternal(client, planId, opts.idempotencyKey, spec.project_id, opts.requiredPlan), "starting deploy");
+        const { planId, operationId } = requirePersistedPlan(plan, "starting deploy");
+        const commit = requireCloudCommitResponse(await commitInternal(client, planId, opts.idempotencyKey, spec.project_id, opts.requiredPlan, undefined, operationId), "starting deploy");
         return await pollUntilReady(client, commit, plan.diff, plan.warnings, emit, spec.project_id, sliceKinds);
     })();
     // Avoid an unhandled-rejection at construction time. Consumers must call
@@ -4034,7 +4097,7 @@ async function uploadInlineCas(client, projectId, bytes, contentType) {
         await uploadOne(client.fetch, session, bytes);
         // v1.48 unified-apply: per-session /storage/v1/uploads/:id/complete is
         // gone (404). The plan-level commit below promotes the session to CAS.
-        await client.request(`/content/v1/plans/${encodeURIComponent(planRes.plan_id)}/commit`, { method: "POST", headers, body: {}, context: "committing content upload" });
+        await commitContentPlanWithRetry(client, planRes.plan_id, headers);
     }
     return { sha256, size: bytes.byteLength, contentType };
 }