run402 4.28.0 → 4.29.0

package/lib/deploy-v2.mjs

@@ -25,6 +25,7 @@
 import { existsSync, fstatSync, readFileSync } from "node:fs";
 import { resolve, dirname, extname, isAbsolute } from "node:path";
 import {
+  applyWithGitvault,
   buildDeployResolveSummary,
   githubActionsCredentials,
   loadDeployManifest,
@@ -1241,17 +1242,52 @@ async function applyCmd(args) {
     const requiredPlan = opts.mode && opts.mode.kind === "applyReviewed"
       ? { planId: opts.mode.planId, ...(opts.mode.planFingerprint ? { planFingerprint: opts.mode.planFingerprint } : {}) }
       : undefined;
-    const result = await withAutoApprove(() =>
-      getSdk(sdkOpts)._applyEngine.apply(releaseSpec, {
-        onEvent: makeStderrEventWriter(opts.quiet),
-        idempotencyKey,
-        allowWarnings: opts.allowWarnings,
-        allowWarningCodes: opts.allowWarningCodes,
-        ...(requiredPlan ? { requiredPlan } : {}),
+    // A thin shim over the SDK lane (add-gitvault 5.0). `applyWithGitvault`
+    // takes the project's `gitvault_policy` into account: a project that is
+    // not `required` runs the same `apply()` this line always ran, with the
+    // same options object; a `required` one captures, publishes, mints an
+    // activation token, and commits with it.
+    const outcome = await withAutoApprove(() =>
+      applyWithGitvault({
+        sdk: getSdk(sdkOpts),
+        spec: releaseSpec,
+        apply: {
+          onEvent: makeStderrEventWriter(opts.quiet),
+          idempotencyKey,
+          allowWarnings: opts.allowWarnings,
+          allowWarningCodes: opts.allowWarningCodes,
+          ...(requiredPlan ? { requiredPlan } : {}),
+        },
         target: isCoreApiTarget() ? "core" : "cloud",
+        // The `gitvault_commit` line is printed ALWAYS, and to stderr, so
+        // `run402 deploy apply | jq` stays clean (the pipe contract).
+        onCommitLine: (line) => { if (!opts.quiet) process.stderr.write(`${line}\n`); },
       }),
     );
-    console.log(JSON.stringify(result, null, 2));
+    if (!outcome.gitvault) {
+      console.log(JSON.stringify(outcome.deploy, null, 2));
+      return;
+    }
+    const vaulted = outcome.gitvault;
+    // Both `DEPLOYED_*` outcomes activated a release; the override one just
+    // did it without a vaulted capture and carries a draining advisory.
+    const activated = vaulted.outcome === "DEPLOYED_AND_VAULTED" || vaulted.outcome === "DEPLOYED_UNVAULTED_OVERRIDE";
+    console.log(JSON.stringify({
+      ok: activated,
+      outcome: vaulted.outcome,
+      gitvault_commit: vaulted.gitvault_commit,
+      capture_id: vaulted.capture_id,
+      operation_id: vaulted.operation_id,
+      ...("generation" in vaulted ? { generation: vaulted.generation } : {}),
+      ...("push_error" in vaulted ? { push_error: vaulted.push_error } : {}),
+      ...("deploy_error" in vaulted ? { deploy_error: vaulted.deploy_error } : {}),
+      next_actions: vaulted.next_actions,
+      deploy: outcome.deploy,
+    }, null, 2));
+    // A non-activating outcome is a failed deploy even though it resolved
+    // rather than threw: the five outcomes are a result type, not an error
+    // channel, so the exit code has to carry the verdict.
+    if (!activated) process.exit(1);
   } catch (err) {
     reportDeployApplyError(err, useGithubActionsOidc);
   }
@@ -1348,89 +1384,24 @@ const CI_DEPLOY_ERROR_GUIDANCE = {
   },
 };
 
+/**
+ * The gitvault advisory rewrite is RETIRED (change `gitvault-deploy-lane`,
+ * design D4). `GITVAULT_DEPLOY_LANE = "unsupported"` and the client-side
+ * rewrite of `GITVAULT_CLIENT_UPGRADE_REQUIRED` existed only for as long as no
+ * published client could satisfy `gitvault_policy: required`. This one can:
+ * `applyCmd` deploys through `applyWithGitvault`, which declares
+ * `{capture_id, snapshot_oid_hmac}` at plan time and presents an activation
+ * token at commit. The gateway's envelope — `upgrade_client` first, then
+ * `grandfather_policy` — is now TRUE as written, so it is relayed untouched;
+ * re-authoring it here would be the client lying in the opposite direction.
+ * `cli-deploy-gitvault-lane.test.mjs` is the successor gate.
+ */
 function reportDeployApplyError(err, useGithubActionsOidc) {
-  const warningEnhanced = enhanceGitvaultDeployError(enhanceDeployWarningError(err));
+  const warningEnhanced = enhanceDeployWarningError(err);
   if (!useGithubActionsOidc) return reportSdkError(warningEnhanced);
   return reportSdkError(enhanceCiDeployError(warningEnhanced));
 }
 
-/**
- * Whether THIS client's deploy lane speaks the gitvault protocol.
- *
- * `"unsupported"` is a statement of fact about the code in this file: it
- * declares no capture at plan time and sends no gitvault block on commit, so a
- * project with `gitvault_policy: required` refuses its commits. The vault
- * itself works — `run402 gitvault push` and `git push run402` publish captures
- * — it is the DEPLOY lane that has no capture wiring.
- *
- * RETIREMENT CONDITION: flip this to `"supported"` in the same change that
- * makes `applyCmd` declare `{capture_id, snapshot_oid_hmac}` on
- * `POST /apply/v1/plans` and present an activation token on
- * `POST /apply/v1/plans/:id/commit` (protocol §6.5). Doing that faithfully also
- * means building the deploy artifacts from an isolated materialization of the
- * snapshot commit, which is why it is a design change and not a wiring one:
- * build output is normally gitignored, so it is not in the snapshot at all.
- * `cli-deploy-gitvault-advisory.test.mjs` fails if the flag and the advisory
- * ever disagree.
- */
-export const GITVAULT_DEPLOY_LANE = "unsupported";
-
-/**
- * Tell the truth about a deploy the vault gate refused.
- *
- * The gateway's `GITVAULT_CLIENT_UPGRADE_REQUIRED` envelope leads with
- * `upgrade_client` / `npm i -g run402@latest`, which is correct in principle
- * and WRONG right now: no published `run402` has a gitvault-capable deploy
- * lane, so upgrading changes nothing about this refusal (dogfood #1, finding
- * C). Relaying it unedited sends an agent into an upgrade loop. The gateway's
- * SECOND action — grandfather the policy — is real and reachable, and this
- * client now has the verb for it.
- *
- * The gateway's own actions are PRESERVED, never dropped: they are re-ordered
- * behind an honest one, and the upgrade action keeps its place with its
- * promise corrected. When the lane ships, the flag above retires this whole
- * function's rewrite and the envelope passes through untouched.
- */
-export function enhanceGitvaultDeployError(err) {
-  const body = err?.body && typeof err.body === "object" && !Array.isArray(err.body) ? err.body : {};
-  const code = body.code || err?.code || null;
-  if (code !== "GITVAULT_CLIENT_UPGRADE_REQUIRED") return err;
-  if (GITVAULT_DEPLOY_LANE === "supported") return err;
-
-  const gatewayActions = Array.isArray(body.next_actions) ? body.next_actions : [];
-  const enhanced = Object.assign(new Error(err?.message || body.message || code), err);
-  enhanced.body = {
-    ...body,
-    hint:
-      "This project requires a vaulted capture on deploy, and this run402 CLI's deploy lane does not produce one — " +
-      "upgrading the CLI does not currently fix it. Either grandfather the policy (owner + step-up) and deploy, or " +
-      "keep the project vaulted and deploy later. Your source can still be vaulted today: `run402 gitvault push` and " +
-      "`git push run402 <branch>` are not gated on a deploy.",
-    next_actions: [
-      editRequestAction(
-        "run402 gitvault policy grandfathered --reason \"<why>\"",
-        "Un-gate this project so deploys activate without a vaulted capture. Owner + step-up, audited, and it leaves a doctor-persistent warning until you return the project to `required`.",
-      ),
-      editRequestAction(
-        "run402 gitvault push",
-        "Capture and publish your source into the vault. Independent of deploy — a vault-only project pushes for months without one.",
-      ),
-      editRequestAction(
-        "run402 gitvault policy required",
-        "Restore the gate once a gitvault-capable deploy lane is available.",
-      ),
-      // Preserved verbatim in shape, with the promise corrected: the gateway
-      // is describing the eventual client, not one you can install today.
-      ...gatewayActions.map((action) =>
-        action?.type === "upgrade_client"
-          ? { ...action, why: "Tracks the eventual gitvault-capable deploy lane. No published run402 has one yet, so this does not resolve the refusal today." }
-          : action,
-      ),
-    ],
-  };
-  return enhanced;
-}
-
 function enhanceDeployWarningError(err) {
   const existingBody = err?.body && typeof err.body === "object" && !Array.isArray(err.body)
     ? err.body

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "run402",
-  "version": "4.28.0",
+  "version": "4.29.0",
   "description": "CLI for Run402 — provision Postgres databases, deploy static sites, generate images, and manage wallets via x402 and MPP micropayments.",
   "type": "module",
   "bin": {

package/sdk/dist/namespaces/deploy.d.ts

@@ -19,7 +19,7 @@
  * behavior; this file is the implementation.
  */
 import type { Client } from "../kernel.js";
-import type { ApplyOptions, ActiveReleaseInventory, DeployEvent, DeployEventsResponse, DeployListOptions, DeployListResponse, DeployOperation, DeployResult, DeployResolveOptions, DeployResolveResponse, EdgeCoherenceReport, EdgeCoherenceWaitOptions, EdgeCoherenceWaitResult, OperationSnapshot, PlanResponse, PromoteOptions, PromoteResult, ReleaseDiffOptions, ReleaseInventory, ReleaseInventoryByIdOptions, ReleaseInventoryOptions, ReleaseSpec, ReleaseToReleaseDiff, RehearsePlanOptions, RehearsePlanResult, StartOptions } from "./deploy.types.js";
+import type { ApplyOptions, ActiveReleaseInventory, DeployEvent, DeployEventsResponse, DeployListOptions, DeployListResponse, DeployOperation, DeployResult, DeployResolveOptions, DeployResolveResponse, EdgeCoherenceReport, EdgeCoherenceWaitOptions, EdgeCoherenceWaitResult, GitvaultCommitDeclaration, GitvaultPlanDeclaration, OperationSnapshot, PlanResponse, PromoteOptions, PromoteResult, ReleaseDiffOptions, ReleaseInventory, ReleaseInventoryByIdOptions, ReleaseInventoryOptions, ReleaseSpec, ReleaseToReleaseDiff, RehearsePlanOptions, RehearsePlanResult, StartOptions } from "./deploy.types.js";
 export declare class Deploy {
     private readonly client;
     constructor(client: Client);
@@ -47,6 +47,8 @@ export declare class Deploy {
             planId: string;
             planFingerprint?: string;
         };
+        /** gitvault §6.5: bind this plan to a capture (see `runGitvaultDeploy`). */
+        gitvault?: GitvaultPlanDeclaration;
     }): Promise<{
         plan: PlanResponse;
         byteReaders: Map<string, ByteReader>;
@@ -76,6 +78,12 @@ export declare class Deploy {
             planId: string;
             planFingerprint?: string;
         };
+        /**
+         * gitvault §6.5: present the activation token minted for this operation,
+         * or the audited unvaulted override. A `required` project refuses a
+         * commit that carries neither.
+         */
+        gitvault?: GitvaultCommitDeclaration;
     }): Promise<DeployResult>;
     rehearse(planId: string, opts?: RehearsePlanOptions): Promise<RehearsePlanResult>;
     /**

package/sdk/dist/namespaces/deploy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/namespaces/deploy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAqB3C,OAAO,KAAK,EACV,YAAY,EACZ,sBAAsB,EAQtB,WAAW,EACX,oBAAoB,EAEpB,iBAAiB,EACjB,kBAAkB,EAClB,eAAe,EACf,YAAY,EACZ,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,wBAAwB,EACxB,uBAAuB,EAavB,iBAAiB,EAGjB,YAAY,EACZ,cAAc,EACd,aAAa,EACb,kBAAkB,EAClB,gBAAgB,EAChB,2BAA2B,EAC3B,uBAAuB,EACvB,WAAW,EACX,oBAAoB,EACpB,mBAAmB,EACnB,kBAAkB,EAClB,YAAY,EAEb,MAAM,mBAAmB,CAAC;AAiF3B,qBAAa,MAAM;IACL,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,MAAM;IAE3C;;;;OAIG;IACG,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,GAAE,YAAiB,GAAG,OAAO,CAAC,YAAY,CAAC;IA4C9E;;;OAGG;IACH,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,GAAE,YAAiB,GAAG,OAAO,CAAC,eAAe,CAAC;IAI3E;;;;OAIG;IACG,IAAI,CACR,IAAI,EAAE,WAAW,EACjB,IAAI,GAAE;QACJ,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,IAAI,CAAC,EAAE,cAAc,GAAG,cAAc,CAAC;QACvC,YAAY,CAAC,EAAE;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,eAAe,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;KACxD,GACL,OAAO,CAAC;QAAE,IAAI,EAAE,YAAY,CAAC;QAAC,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;KAAE,CAAC;IAQxE;;;;;OAKG;IACG,MAAM,CACV,IAAI,EAAE,YAAY,EAClB,IAAI,EAAE;QACJ,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QACrC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,CAAC;KACxC,GACA,OAAO,CAAC,IAAI,CAAC;IAWhB;;;;;OAKG;IACG,MAAM,CACV,MAAM,EAAE,MAAM,EACd,IAAI,GAAE;QACJ,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,CAAC;QACvC,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,YAAY,CAAC,EAAE;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,eAAe,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;KACxD,GACL,OAAO,CAAC,YAAY,CAAC;IASlB,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,GAAE,mBAAwB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAkC3F;;;;;;;;;OASG;IACG,MAAM,CACV,WAAW,EAAE,MAAM,EACnB,IAAI,GAAE;QAAE,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAO,GACtE,OAAO,CAAC,YAAY,CAAC;IAqBxB;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACG,OAAO,CACX,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,IAAI,GAAE,cAAmB,GACxB,OAAO,CAAC,aAAa,CAAC;IA2CzB;;;;OAIG;IACG,MAAM,CACV,WAAW,EAAE,MAAM,EACnB,IAAI,GAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAO,GAC9B,OAAO,CAAC,iBAAiB,CAAC;IAmB7B;;;;;;OAMG;IACG,IAAI,CACR,IAAI,EAAE,MAAM,GAAG,iBAAiB,GAC/B,OAAO,CAAC,kBAAkB,CAAC;IA6B9B;;;;;;;;OAQG;IACG,MAAM,CACV,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,GACxB,OAAO,CAAC,oBAAoB,CAAC;IAmBhC;;;;OAIG;IACG,aAAa,CACjB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,GACxB,OAAO,CAAC,mBAAmB,CAAC;IAyB/B;;;;OAIG;IACG,gBAAgB,CACpB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,wBAAwB,GAC7B,OAAO,CAAC,uBAAuB,CAAC;IAoCnC;;;;OAIG;IACG,UAAU,CAAC,IAAI,EAAE,2BAA2B,GAAG,OAAO,CAAC,gBAAgB,CAAC;IA2B9E;;;;OAIG;IACG,gBAAgB,CACpB,IAAI,EAAE,uBAAuB,GAC5B,OAAO,CAAC,sBAAsB,CAAC;IAqBlC;;;;OAIG;IACG,IAAI,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,oBAAoB,CAAC;IA+BnE;;;;OAIG;IACG,OAAO,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,qBAAqB,CAAC;CAW1E;AAk5DD;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;iEAG6D;IAC7D,KAAK,CAAC,EAAE,SAAS,GAAG,OAAO,GAAG,OAAO,CAAC;CACvC"}
+{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/namespaces/deploy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAqB3C,OAAO,KAAK,EACV,YAAY,EACZ,sBAAsB,EAQtB,WAAW,EACX,oBAAoB,EAEpB,iBAAiB,EACjB,kBAAkB,EAClB,eAAe,EACf,YAAY,EACZ,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,wBAAwB,EACxB,uBAAuB,EAIvB,yBAAyB,EACzB,uBAAuB,EAUvB,iBAAiB,EAGjB,YAAY,EACZ,cAAc,EACd,aAAa,EACb,kBAAkB,EAClB,gBAAgB,EAChB,2BAA2B,EAC3B,uBAAuB,EACvB,WAAW,EACX,oBAAoB,EACpB,mBAAmB,EACnB,kBAAkB,EAClB,YAAY,EAEb,MAAM,mBAAmB,CAAC;AAiF3B,qBAAa,MAAM;IACL,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,MAAM;IAE3C;;;;OAIG;IACG,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,GAAE,YAAiB,GAAG,OAAO,CAAC,YAAY,CAAC;IAiD9E;;;OAGG;IACH,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,GAAE,YAAiB,GAAG,OAAO,CAAC,eAAe,CAAC;IAI3E;;;;OAIG;IACG,IAAI,CACR,IAAI,EAAE,WAAW,EACjB,IAAI,GAAE;QACJ,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,MAAM,CAAC,EAAE,OAAO,CAAC;QACjB,IAAI,CAAC,EAAE,cAAc,GAAG,cAAc,CAAC;QACvC,YAAY,CAAC,EAAE;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,eAAe,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAC5D,4EAA4E;QAC5E,QAAQ,CAAC,EAAE,uBAAuB,CAAC;KAC/B,GACL,OAAO,CAAC;QAAE,IAAI,EAAE,YAAY,CAAC;QAAC,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;KAAE,CAAC;IASxE;;;;;OAKG;IACG,MAAM,CACV,IAAI,EAAE,YAAY,EAClB,IAAI,EAAE;QACJ,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QACrC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,CAAC;KACxC,GACA,OAAO,CAAC,IAAI,CAAC;IAWhB;;;;;OAKG;IACG,MAAM,CACV,MAAM,EAAE,MAAM,EACd,IAAI,GAAE;QACJ,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,CAAC;QACvC,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,YAAY,CAAC,EAAE;YAAE,MAAM,EAAE,MAAM,CAAC;YAAC,eAAe,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAC5D;;;;WAIG;QACH,QAAQ,CAAC,EAAE,yBAAyB,CAAC;KACjC,GACL,OAAO,CAAC,YAAY,CAAC;IASlB,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,GAAE,mBAAwB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAkC3F;;;;;;;;;OASG;IACG,MAAM,CACV,WAAW,EAAE,MAAM,EACnB,IAAI,GAAE;QAAE,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAO,GACtE,OAAO,CAAC,YAAY,CAAC;IAqBxB;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACG,OAAO,CACX,OAAO,EAAE,MAAM,EACf,SAAS,EAAE,MAAM,EACjB,IAAI,GAAE,cAAmB,GACxB,OAAO,CAAC,aAAa,CAAC;IA2CzB;;;;OAIG;IACG,MAAM,CACV,WAAW,EAAE,MAAM,EACnB,IAAI,GAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAO,GAC9B,OAAO,CAAC,iBAAiB,CAAC;IAmB7B;;;;;;OAMG;IACG,IAAI,CACR,IAAI,EAAE,MAAM,GAAG,iBAAiB,GAC/B,OAAO,CAAC,kBAAkB,CAAC;IA6B9B;;;;;;;;OAQG;IACG,MAAM,CACV,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,GACxB,OAAO,CAAC,oBAAoB,CAAC;IAmBhC;;;;OAIG;IACG,aAAa,CACjB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,GACxB,OAAO,CAAC,mBAAmB,CAAC;IAyB/B;;;;OAIG;IACG,gBAAgB,CACpB,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE,wBAAwB,GAC7B,OAAO,CAAC,uBAAuB,CAAC;IAoCnC;;;;OAIG;IACG,UAAU,CAAC,IAAI,EAAE,2BAA2B,GAAG,OAAO,CAAC,gBAAgB,CAAC;IA2B9E;;;;OAIG;IACG,gBAAgB,CACpB,IAAI,EAAE,uBAAuB,GAC5B,OAAO,CAAC,sBAAsB,CAAC;IAqBlC;;;;OAIG;IACG,IAAI,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,oBAAoB,CAAC;IA+BnE;;;;OAIG;IACG,OAAO,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,qBAAqB,CAAC;CAW1E;AA+6DD;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;iEAG6D;IAC7D,KAAK,CAAC,EAAE,SAAS,GAAG,OAAO,GAAG,OAAO,CAAC;CACvC"}

package/sdk/dist/namespaces/deploy.js

@@ -93,7 +93,12 @@ export class Deploy {
      * {@link Run402DeployError} on any state-machine failure.
      */
     async apply(spec, opts = {}) {
-        const maxRetries = normalizeApplyMaxRetries(opts.maxRetries);
+        // A gitvault-bound apply never auto-retries: each attempt plans a NEW
+        // operation, and an activation token is minted for exactly one. Retrying
+        // would either present a token bound elsewhere (the platform refuses, as
+        // it should) or demand a fresh capture, which is the caller's deliberate
+        // re-run — not something the client does behind their back.
+        const maxRetries = opts.gitvault ? 0 : normalizeApplyMaxRetries(opts.maxRetries);
         const maxAttempts = maxRetries + 1;
         const emit = makeEmitter(opts.onEvent);
         for (let attempt = 1; attempt <= maxAttempts; attempt++) {
@@ -153,6 +158,7 @@ export class Deploy {
             dryRun: opts.dryRun ?? opts.mode === "legacyDryRun",
             reviewedPlan: opts.mode === "reviewedPlan",
             requiredPlan: opts.requiredPlan,
+            ...(opts.gitvault ? { gitvault: opts.gitvault } : {}),
         });
     }
     /**
@@ -173,7 +179,7 @@ export class Deploy {
      */
     async commit(planId, opts = {}) {
         const emit = makeEmitter(opts.onEvent);
-        const commit = requireCloudCommitResponse(await commitInternal(this.client, planId, opts.idempotencyKey, opts.project, opts.requiredPlan), "committing deploy");
+        const commit = requireCloudCommitResponse(await commitInternal(this.client, planId, opts.idempotencyKey, opts.project, opts.requiredPlan, opts.gitvault), "committing deploy");
         return await pollUntilReady(this.client, commit, {}, [], emit, opts.project);
     }
     async rehearse(planId, opts = {}) {
@@ -543,11 +549,17 @@ function deriveSliceKinds(spec) {
 async function applyOnce(client, spec, opts, emit) {
     const allowWarningCodes = normalizeAllowWarningCodes(opts.allowWarningCodes);
     const target = opts.target === "core" ? "core" : "cloud";
+    if (opts.gitvault && target === "core") {
+        // Refuse rather than drop the hooks: silently committing without the
+        // activation block would activate a `required` project unvaulted.
+        throw new Run402DeployError("gitvault-bound deploys are not supported against a self-hosted Core gateway; the vault gate is a Cloud control-plane capability.", { code: "GITVAULT_UNSUPPORTED_TARGET", phase: "validate", retryable: false, context: "applying deploy" });
+    }
     const sliceKinds = deriveSliceKinds(spec);
     emit({ type: "plan.started" });
     const { plan, byteReaders } = await planInternal(client, spec, opts.idempotencyKey, {
         target,
         requiredPlan: opts.requiredPlan,
+        ...(opts.gitvault ? { gitvault: opts.gitvault.declaration } : {}),
     });
     emit({ type: "plan.diff", diff: plan.diff });
     emitPlanWarnings(plan, emit);
@@ -588,8 +600,20 @@ async function applyOnce(client, spec, opts, emit) {
         status: "started",
         ...(sliceKinds.length > 0 ? { slice_kinds: sliceKinds } : {}),
     });
-    const { planId } = requirePersistedPlan(plan, "applying deploy");
-    const commit = requireCloudCommitResponse(await commitInternal(client, planId, opts.idempotencyKey, spec.project, opts.requiredPlan), "applying deploy");
+    const { planId, operationId } = requirePersistedPlan(plan, "applying deploy");
+    // gitvault §6.5 — the handshake. Content is uploaded, so the artifacts this
+    // release ships are fixed; `authorize` verifies snapshot correspondence,
+    // mints the activation token, and hands back the commit block. It throws
+    // rather than returning when the deploy must not proceed, and nothing has
+    // been committed at that point.
+    const gitvaultCommit = opts.gitvault
+        ? await opts.gitvault.authorize({
+            plan_id: planId,
+            operation_id: operationId,
+            apply_plan_sha256: plan.gitvault?.apply_plan_sha256 ?? null,
+        })
+        : undefined;
+    const commit = requireCloudCommitResponse(await commitInternal(client, planId, opts.idempotencyKey, spec.project, opts.requiredPlan, gitvaultCommit), "applying deploy");
     const result = await pollUntilReady(client, commit, plan.diff, plan.warnings, emit, spec.project, sliceKinds);
     // v1.48 unified-apply: thread the plan response's `asset_entries[]` back
     // into DeployResult.assets so callers reading `result.assets.byKey[key]`
@@ -1013,6 +1037,11 @@ async function planInternal(client, spec, idempotencyKey, opts = {}) {
         inlineBody.mode = "reviewed_plan";
     if (opts.requiredPlan)
         inlineBody.required_plan = requiredPlanToWire(opts.requiredPlan);
+    // gitvault §6.5: the capture declaration must ride the SAME plan the gateway
+    // digests, so it is set before the inline/manifest_ref size decision below
+    // and re-attached to the manifest_ref body too.
+    if (opts.gitvault)
+        inlineBody.gitvault = opts.gitvault;
     const inlineBytes = new TextEncoder().encode(JSON.stringify(inlineBody)).byteLength;
     let body;
     if (inlineBytes <= PLAN_BODY_LIMIT_BYTES) {
@@ -1054,6 +1083,8 @@ async function planInternal(client, spec, idempotencyKey, opts = {}) {
         body = { spec: { project_id: spec.project }, manifest_ref: contentRefToWire(ref) };
         if (idempotencyKey)
             body.idempotency_key = idempotencyKey;
+        if (opts.gitvault)
+            body.gitvault = opts.gitvault;
     }
     let plan;
     try {
@@ -1431,13 +1462,15 @@ function expandCronNumberPart(part, min, max) {
     }
     return values;
 }
-async function commitInternal(client, planId, idempotencyKey, project, requiredPlan) {
+async function commitInternal(client, planId, idempotencyKey, project, requiredPlan, gitvault) {
     try {
         const body = {};
         if (idempotencyKey)
             body.idempotency_key = idempotencyKey;
         if (requiredPlan)
             body.required_plan = requiredPlanToWire(requiredPlan);
+        if (gitvault)
+            body.gitvault = gitvault;
         return await client.request(`/apply/v1/plans/${encodeURIComponent(planId)}/commit`, {
             method: "POST",
             body,