specrails-desktop 2.29.2 → 2.29.4

package/server/dist/rail-pr-recovery-git.js

@@ -0,0 +1,235 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.scanUnreachableRecoveryCommits = scanUnreachableRecoveryCommits;
+exports.discoverRunMarkedCommit = discoverRunMarkedCommit;
+exports.commitCarriesRunMarker = commitCarriesRunMarker;
+exports.recoveryRefForDelivery = recoveryRefForDelivery;
+exports.listRecoveryCommitProtections = listRecoveryCommitProtections;
+exports.inspectRecoveryCommitProtection = inspectRecoveryCommitProtection;
+exports.protectRecoveryCommit = protectRecoveryCommit;
+exports.advanceRecoveryCommitProtection = advanceRecoveryCommitProtection;
+exports.releaseRecoveryCommit = releaseRecoveryCommit;
+const crypto_1 = require("crypto");
+const COMMIT_SHA_RE = /^[0-9a-f]{40,64}$/i;
+const MAX_RECOVERY_COMMIT_CANDIDATES = 512;
+/**
+ * Read the complete bounded unreachable-commit surface. Unknown output and an
+ * excessive candidate universe fail closed: truncating either could turn an
+ * ambiguous recovery into a false unique result.
+ */
+async function scanUnreachableRecoveryCommits(git, repoDir) {
+    try {
+        const result = await git.run(['fsck', '--unreachable', '--no-reflogs', '--no-progress'], repoDir);
+        if (result.code !== 0) {
+            return { ok: false, detail: 'Git could not enumerate unreachable recovery objects' };
+        }
+        const commits = new Set();
+        for (const rawLine of result.stdout.split(/\r?\n/)) {
+            const line = rawLine.trim();
+            if (!line)
+                continue;
+            const commit = /^unreachable commit ([0-9a-f]{40,64})$/i.exec(line);
+            if (commit) {
+                commits.add(commit[1].toLowerCase());
+                if (commits.size > MAX_RECOVERY_COMMIT_CANDIDATES) {
+                    return { ok: false, detail: 'Git exposed too many unreachable commits for safe recovery' };
+                }
+                continue;
+            }
+            if (/^(?:unreachable|dangling) (?:blob|tree|tag) [0-9a-f]{40,64}$/i.test(line))
+                continue;
+            return { ok: false, detail: 'Git returned malformed unreachable-object evidence' };
+        }
+        return { ok: true, commits: [...commits] };
+    }
+    catch {
+        return { ok: false, detail: 'Git could not enumerate unreachable recovery objects' };
+    }
+}
+/**
+ * Combine refs, reflogs and unreachable commits, then inspect every subject.
+ * Any enumeration/inspection failure invalidates the entire uniqueness proof.
+ */
+async function discoverRunMarkedCommit(git, repoDir, runId, suppliedScan) {
+    if (!runId || runId.length > 256 || /[\0\r\n]/.test(runId)) {
+        return { kind: 'scan_failed', detail: 'The recorded run identifier is not safe to inspect' };
+    }
+    const unreachable = suppliedScan ?? await scanUnreachableRecoveryCommits(git, repoDir);
+    if (!unreachable.ok)
+        return { kind: 'scan_failed', detail: unreachable.detail };
+    const candidates = new Set(unreachable.commits.map((sha) => sha.toLowerCase()));
+    let refs;
+    try {
+        refs = await git.run(['log', '--all', '--reflog', '--fixed-strings', `--grep=(run ${runId})`, '--format=%H'], repoDir);
+    }
+    catch {
+        return { kind: 'scan_failed', detail: 'Git could not enumerate recovery refs and reflogs' };
+    }
+    if (refs.code !== 0) {
+        return { kind: 'scan_failed', detail: 'Git could not enumerate recovery refs and reflogs' };
+    }
+    for (const rawLine of refs.stdout.split(/\r?\n/)) {
+        const sha = rawLine.trim();
+        if (!sha)
+            continue;
+        if (!COMMIT_SHA_RE.test(sha)) {
+            return { kind: 'scan_failed', detail: 'Git returned malformed recovery commit evidence' };
+        }
+        candidates.add(sha.toLowerCase());
+        if (candidates.size > MAX_RECOVERY_COMMIT_CANDIDATES) {
+            return { kind: 'scan_failed', detail: 'Git exposed too many commits for safe recovery' };
+        }
+    }
+    const marker = `(run ${runId})`;
+    const marked = [];
+    for (const sha of candidates) {
+        let subject;
+        try {
+            subject = await git.run(['show', '-s', '--format=%s', sha], repoDir);
+        }
+        catch {
+            return { kind: 'scan_failed', detail: 'Git could not inspect every recovery commit subject' };
+        }
+        if (subject.code !== 0) {
+            return { kind: 'scan_failed', detail: 'Git could not inspect every recovery commit subject' };
+        }
+        if (subject.stdout.trim().includes(marker))
+            marked.push(sha);
+    }
+    if (marked.length === 0)
+        return { kind: 'none' };
+    if (marked.length > 1)
+        return { kind: 'ambiguous', count: marked.length };
+    return { kind: 'unique', sha: marked[0] };
+}
+async function commitCarriesRunMarker(git, repoDir, sha, runId) {
+    if (!COMMIT_SHA_RE.test(sha))
+        return false;
+    try {
+        const result = await git.run(['show', '-s', '--format=%s', sha], repoDir);
+        return result.code === 0 && result.stdout.trim().includes(`(run ${runId})`);
+    }
+    catch {
+        return false;
+    }
+}
+function recoveryRefForDelivery(deliveryId) {
+    const digest = (0, crypto_1.createHash)('sha256').update(deliveryId).digest('hex');
+    return `refs/specrails/recovery/${digest}`;
+}
+async function listRecoveryCommitProtections(git, repoDir) {
+    try {
+        const result = await git.run(['for-each-ref', '--format=%(refname)%09%(objectname)', 'refs/specrails/recovery/'], repoDir);
+        if (result.code !== 0) {
+            return { ok: false, detail: 'Git could not enumerate delivery recovery refs' };
+        }
+        const protections = new Map();
+        for (const rawLine of result.stdout.split(/\r?\n/)) {
+            const line = rawLine.trim();
+            if (!line)
+                continue;
+            const match = /^(refs\/specrails\/recovery\/[0-9a-f]{64})\t([0-9a-f]{40,64})$/i.exec(line);
+            if (!match || protections.has(match[1])) {
+                return { ok: false, detail: 'Git returned malformed delivery recovery refs' };
+            }
+            protections.set(match[1], match[2].toLowerCase());
+            if (protections.size > MAX_RECOVERY_COMMIT_CANDIDATES) {
+                return { ok: false, detail: 'Git exposed too many delivery recovery refs for safe cleanup' };
+            }
+        }
+        return { ok: true, protections };
+    }
+    catch {
+        return { ok: false, detail: 'Git could not enumerate delivery recovery refs' };
+    }
+}
+async function inspectRecoveryCommitProtection(git, repoDir, deliveryId) {
+    const ref = recoveryRefForDelivery(deliveryId);
+    try {
+        const exists = await git.run(['show-ref', '--verify', '--quiet', ref], repoDir);
+        if (exists.code === 1)
+            return { kind: 'absent', ref };
+        if (exists.code !== 0)
+            return { kind: 'unreadable', ref };
+        const result = await git.run(['rev-parse', '--verify', ref], repoDir);
+        if (result.code !== 0)
+            return { kind: 'unreadable', ref };
+        const sha = result.stdout.trim().toLowerCase();
+        return COMMIT_SHA_RE.test(sha)
+            ? { kind: 'present', ref, sha }
+            : { kind: 'unreadable', ref };
+    }
+    catch {
+        return { kind: 'unreadable', ref };
+    }
+}
+/** Pin a proven orphan without moving any user-visible branch or checkout. */
+async function protectRecoveryCommit(git, repoDir, deliveryId, sha) {
+    if (!COMMIT_SHA_RE.test(sha))
+        return { ok: false, detail: 'The recovery commit SHA is invalid' };
+    const ref = recoveryRefForDelivery(deliveryId);
+    const zero = '0'.repeat(sha.length);
+    try {
+        const created = await git.run(['update-ref', ref, sha, zero], repoDir);
+        if (created.code !== 0) {
+            const existing = await git.run(['rev-parse', '--verify', ref], repoDir);
+            if (existing.code !== 0 || existing.stdout.trim().toLowerCase() !== sha.toLowerCase()) {
+                return { ok: false, detail: 'A different commit already owns this delivery recovery ref' };
+            }
+        }
+        const verified = await git.run(['rev-parse', '--verify', ref], repoDir);
+        if (verified.code !== 0 || verified.stdout.trim().toLowerCase() !== sha.toLowerCase()) {
+            return { ok: false, detail: 'Git could not verify the delivery recovery ref' };
+        }
+        return { ok: true, ref };
+    }
+    catch {
+        return { ok: false, detail: 'Git could not protect the recovered commit from cleanup' };
+    }
+}
+/** Move an already-owned protection ref to a newly committed descendant using
+ * an exact compare-and-set. The old orphan remains pinned unless the caller
+ * proves it still owns the ref at the instant of the update. */
+async function advanceRecoveryCommitProtection(git, repoDir, deliveryId, previousSha, nextSha) {
+    if (!COMMIT_SHA_RE.test(previousSha) || !COMMIT_SHA_RE.test(nextSha)) {
+        return { ok: false, detail: 'The recovery commit SHA is invalid' };
+    }
+    if (previousSha.toLowerCase() === nextSha.toLowerCase()) {
+        return protectRecoveryCommit(git, repoDir, deliveryId, nextSha);
+    }
+    const ref = recoveryRefForDelivery(deliveryId);
+    try {
+        const moved = await git.run(['update-ref', ref, nextSha, previousSha], repoDir);
+        if (moved.code !== 0) {
+            return { ok: false, detail: 'The delivery recovery ref changed before the new commit could be protected' };
+        }
+        const verified = await git.run(['rev-parse', '--verify', ref], repoDir);
+        if (verified.code !== 0 || verified.stdout.trim().toLowerCase() !== nextSha.toLowerCase()) {
+            return { ok: false, detail: 'Git could not verify the advanced delivery recovery ref' };
+        }
+        return { ok: true, ref };
+    }
+    catch {
+        return { ok: false, detail: 'Git could not advance the delivery recovery ref safely' };
+    }
+}
+/** Delete only the exact protected object; a substituted ref is preserved. */
+async function releaseRecoveryCommit(git, repoDir, deliveryId, expectedSha) {
+    // A missing/invalid expected object is not authority to delete a durable
+    // protection ref. Callers may be settling legacy rows that never created
+    // one, while a concurrently repaired row could already own this delivery's
+    // ref. Preserve unknown state rather than deleting by name alone.
+    if (!expectedSha || !COMMIT_SHA_RE.test(expectedSha))
+        return false;
+    const ref = recoveryRefForDelivery(deliveryId);
+    try {
+        const removed = await git.run(['update-ref', '-d', ref, expectedSha], repoDir);
+        if (removed.code === 0)
+            return true;
+        const existing = await git.run(['rev-parse', '--verify', ref], repoDir);
+        return existing.code !== 0;
+    }
+    catch {
+        return false;
+    }
+}

package/server/dist/rail-pr-store.js

@@ -8,10 +8,15 @@ exports.failPrDeliveryAndRestoreSuperseded = failPrDeliveryAndRestoreSuperseded;
 exports.getPrDelivery = getPrDelivery;
 exports.getActivePrDeliveryByRail = getActivePrDeliveryByRail;
 exports.listActivePrDeliveries = listActivePrDeliveries;
+exports.listTerminalPrDeliveries = listTerminalPrDeliveries;
+exports.getLatestTerminalPrDeliveryTouchingTicketSet = getLatestTerminalPrDeliveryTouchingTicketSet;
 exports.listOriginLinkedPrDeliveries = listOriginLinkedPrDeliveries;
 exports.reconcileFailedBuildingPrDeliveries = reconcileFailedBuildingPrDeliveries;
 exports.boundPrDiagnostic = boundPrDiagnostic;
 exports.boundCleanupWarnings = boundCleanupWarnings;
+exports.normalizeSafetyArchives = normalizeSafetyArchives;
+exports.mergeSafetyArchives = mergeSafetyArchives;
+exports.appendPrDeliverySafetyArchive = appendPrDeliverySafetyArchive;
 exports.transitionDecision = transitionDecision;
 exports.transitionClaimedDecision = transitionClaimedDecision;
 exports.claimPrDeliveryOperation = claimPrDeliveryOperation;
@@ -65,6 +70,16 @@ class PrDeliveryGenerationConflict extends Error {
     }
 }
 exports.PrDeliveryGenerationConflict = PrDeliveryGenerationConflict;
+/** SQLite's `datetime('now')` has one-second precision, so a claim, transition,
+ * and release in the same second used to produce conflicting snapshots with an
+ * identical `updatedAt`. Clients must fail closed on such ties. Keep the wire
+ * timestamp strictly increasing per row while retaining a parseable UTC ISO
+ * value for legacy rows and every mutation path. */
+const NEXT_PR_UPDATED_AT_SQL = `CASE
+  WHEN julianday('now') > julianday(updated_at)
+  THEN strftime('%Y-%m-%dT%H:%M:%fZ', 'now')
+  ELSE strftime('%Y-%m-%dT%H:%M:%fZ', updated_at, '+0.001 seconds')
+END`;
 /** Recheck admission and, for a continuation, replace the prior generation in
  * one SQLite transaction. The partial unique index is therefore an invariant,
  * not merely a router convention. Pass null for a genuinely fresh launch. */
@@ -87,7 +102,8 @@ function createPrDeliveryGeneration(db, input, expectedActive) {
         };
         const moved = db.prepare(`
       UPDATE rail_pr_deliveries
-         SET decision = 'superseded', updated_at = datetime('now')
+         SET decision = 'superseded', restored_from_delivery_id = NULL,
+             updated_at = ${NEXT_PR_UPDATED_AT_SQL}
        WHERE id = ? AND decision = ? AND operation_token IS NULL
     `).run(current.id, current.decision);
         if (moved.changes !== 1)
@@ -112,16 +128,17 @@ function failPrDeliveryAndRestoreSuperseded(db, failedId, previous) {
         const failed = db.prepare(`
       UPDATE rail_pr_deliveries
          SET decision = 'discarded', status_code = 'delivery_failed',
-             delivery_outcome = 'blocked', updated_at = datetime('now')
+             delivery_outcome = 'blocked', updated_at = ${NEXT_PR_UPDATED_AT_SQL}
        WHERE id = ? AND decision = 'building'
     `).run(failedId);
         if (failed.changes !== 1)
             return false;
         const restored = db.prepare(`
       UPDATE rail_pr_deliveries
-         SET decision = ?, status_code = ?, updated_at = datetime('now')
+         SET decision = ?, status_code = ?, restored_from_delivery_id = ?,
+             updated_at = ${NEXT_PR_UPDATED_AT_SQL}
        WHERE id = ? AND decision = 'superseded'
-    `).run(previous.decision, previous.statusCode, previous.id);
+    `).run(previous.decision, previous.statusCode, failedId, previous.id);
         if (restored.changes !== 1)
             throw new Error(`failed to restore superseded delivery ${previous.id}`);
         return true;
@@ -150,6 +167,39 @@ function listActivePrDeliveries(db) {
        ORDER BY rail_index, created_at DESC, rowid DESC`)
         .all();
 }
+/** Terminal delivery history, newest first. Continuation discovery uses this
+ * only as a conservative ownership hint: callers must still require an exact
+ * ticket target and revalidate the recorded PR/ref identity before reuse. */
+function listTerminalPrDeliveries(db) {
+    return db
+        .prepare(`SELECT * FROM rail_pr_deliveries
+       WHERE decision IN ('completed','merged','discarded','superseded')
+       ORDER BY created_at DESC, rowid DESC`)
+        .all();
+}
+function canonicalTicketSet(values) {
+    if (values.length === 0)
+        return null;
+    const tickets = new Set();
+    for (const value of values) {
+        if (typeof value === 'number' && Number.isSafeInteger(value) && value > 0)
+            tickets.add(value);
+    }
+    return tickets.size > 0 ? [...tickets].sort((a, b) => a - b).join(',') : null;
+}
+/**
+ * Newest terminal generation touching any requested ticket. The returned row
+ * is intentionally not otherwise validated: a newer subset, superset, or
+ * malformed row still owns the overlapping ticket lineage and must shadow
+ * older exact-set history rather than letting a caller resurrect a stale PR.
+ */
+function getLatestTerminalPrDeliveryTouchingTicketSet(db, ticketIds) {
+    const target = canonicalTicketSet(ticketIds);
+    if (!target || target.split(',').length !== ticketIds.length)
+        return undefined;
+    const wanted = new Set(target.split(',').map(Number));
+    return listTerminalPrDeliveries(db).find((row) => (parseJsonArray(row.ticket_ids).some((value) => (typeof value === 'number' && Number.isSafeInteger(value) && wanted.has(value)))));
+}
 /** Startup projection source for persisted Agent cards. Terminal rows matter:
  * a process may die after their SQLite transition but before the conversation
  * envelope update, leaving an obsolete actionable card pinned forever. */
@@ -294,6 +344,7 @@ const PATCH_COLUMNS = {
     operationToken: 'operation_token',
     operationStartedAtMs: 'operation_started_at_ms',
     cleanupWarnings: 'cleanup_warnings',
+    safetyArchives: 'safety_archives',
 };
 function patchValue(key, patch) {
     const raw = patch[key];
@@ -301,6 +352,8 @@ function patchValue(key, patch) {
         return JSON.stringify(raw);
     if (key === 'cleanupWarnings')
         return JSON.stringify(boundCleanupWarnings(raw));
+    if (key === 'safetyArchives')
+        return JSON.stringify(normalizeSafetyArchives(raw));
     if (key === 'statusDetail')
         return raw == null ? null : boundPrDiagnostic(String(raw));
     if (key === 'isContinuation')
@@ -317,6 +370,45 @@ function boundPrDiagnostic(value, maxLength = 512) {
 function boundCleanupWarnings(values) {
     return [...new Set(values.map((value) => boundPrDiagnostic(value)).filter(Boolean))].slice(0, 8);
 }
+/** Safety archive paths must remain exact filesystem locations. They are
+ * internally generated pointers to bytes that still occupy disk, so dropping
+ * an older pointer is never a valid payload-size optimization. Deduplicate
+ * exact non-empty OS-representable paths without trimming them. */
+function normalizeSafetyArchives(values) {
+    const newestUnique = [];
+    for (const value of values) {
+        if (typeof value !== 'string' || value.length === 0 || value.length > 8192 || value.includes('\0'))
+            continue;
+        const previous = newestUnique.indexOf(value);
+        if (previous >= 0)
+            newestUnique.splice(previous, 1);
+        newestUnique.push(value);
+    }
+    return newestUnique;
+}
+function mergeSafetyArchives(existing, additions) {
+    return normalizeSafetyArchives([...existing, ...additions]);
+}
+/** Add one quarantine path independently of lifecycle state. Safety archives
+ * are monotonic recovery metadata: a concurrent decision transition must not
+ * erase a path created just before a crash. */
+function appendPrDeliverySafetyArchive(db, id, archive) {
+    return db.transaction(() => {
+        const row = db.prepare(`SELECT safety_archives FROM rail_pr_deliveries WHERE id = ?`)
+            .get(id);
+        if (!row)
+            return null;
+        const existing = normalizeSafetyArchives(parseJsonArray(row.safety_archives ?? '[]')
+            .filter((value) => typeof value === 'string'));
+        const merged = mergeSafetyArchives(existing, [archive]);
+        db.prepare(`
+      UPDATE rail_pr_deliveries
+         SET safety_archives = ?, updated_at = ${NEXT_PR_UPDATED_AT_SQL}
+       WHERE id = ?
+    `).run(JSON.stringify(merged), id);
+        return merged;
+    })();
+}
 /**
  * COMPARE-AND-SET decision transition: one atomic
  * `UPDATE … WHERE id = ? AND decision = ?` (no read-modify-write), so two
@@ -331,7 +423,7 @@ function transitionDecision(db, id, expected, next, patch = {}) {
     const values = keys.map((k) => patchValue(k, patch));
     return (db
         .prepare(`UPDATE rail_pr_deliveries
-         SET decision = ?, updated_at = datetime('now')${patchClause}
+         SET decision = ?, updated_at = ${NEXT_PR_UPDATED_AT_SQL}${patchClause}
          WHERE id = ? AND decision = ?`)
         .run(next, ...values, id, expected).changes > 0);
 }
@@ -347,7 +439,7 @@ function transitionClaimedDecision(db, id, expected, next, operationToken, patch
     const values = keys.map((key) => patchValue(key, patch));
     return db.prepare(`
     UPDATE rail_pr_deliveries
-       SET decision = ?, updated_at = datetime('now')${patchClause}
+       SET decision = ?, updated_at = ${NEXT_PR_UPDATED_AT_SQL}${patchClause}
      WHERE id = ? AND decision = ? AND operation_token = ?
   `).run(next, ...values, id, expected, operationToken).changes > 0;
 }
@@ -362,7 +454,7 @@ function claimPrDeliveryOperation(db, id, expected, operation, token, nowMs = Da
     return db.prepare(`
     UPDATE rail_pr_deliveries
        SET operation = ?, operation_token = ?, operation_started_at_ms = ?,
-           updated_at = datetime('now')
+           updated_at = ${NEXT_PR_UPDATED_AT_SQL}
      WHERE id = ? AND decision = ?
        AND (operation_token IS NULL OR operation_started_at_ms IS NULL OR operation_started_at_ms < ?)
   `).run(operation, token, nowMs, id, expected, staleBefore).changes > 0;
@@ -373,7 +465,7 @@ function releasePrDeliveryOperation(db, id, token) {
     return db.prepare(`
     UPDATE rail_pr_deliveries
        SET operation = NULL, operation_token = NULL, operation_started_at_ms = NULL,
-           updated_at = datetime('now')
+           updated_at = ${NEXT_PR_UPDATED_AT_SQL}
      WHERE id = ? AND operation_token = ?
   `).run(id, token).changes > 0;
 }
@@ -387,16 +479,24 @@ function clearOrphanedPrDeliveryOperations(db) {
        SET operation = NULL, operation_token = NULL, operation_started_at_ms = NULL,
            status_code = CASE
              WHEN decision NOT IN ('completed','merged','discarded','superseded')
+              AND NOT (
+                operation = 'recover-and-retry'
+                AND status_code IN ('settlement_interrupted','recovery_unavailable')
+              )
              THEN 'operation_interrupted'
              ELSE status_code
            END,
            status_detail = CASE
              WHEN decision NOT IN ('completed','merged','discarded','superseded')
+              AND NOT (
+                operation = 'recover-and-retry'
+                AND status_code IN ('settlement_interrupted','recovery_unavailable')
+              )
               AND (status_detail IS NULL OR status_detail = '')
              THEN 'A previous delivery action was interrupted by restart. Its durable evidence was preserved; review the current state and retry.'
              ELSE status_detail
            END,
-           updated_at = datetime('now')
+           updated_at = ${NEXT_PR_UPDATED_AT_SQL}
      WHERE operation IS NOT NULL OR operation_token IS NOT NULL OR operation_started_at_ms IS NOT NULL
   `).run().changes;
 }
@@ -430,8 +530,11 @@ function toPrDeliverySnapshot(row) {
         deliverySha: row.delivery_sha ?? null,
         isContinuation: row.is_continuation === 1,
         supersedesDeliveryId: row.supersedes_delivery_id ?? null,
+        restoredFromDeliveryId: row.restored_from_delivery_id ?? null,
         operation: row.operation ?? null,
         cleanupWarnings: parseJsonArray(row.cleanup_warnings ?? '[]'),
+        safetyArchives: normalizeSafetyArchives(parseJsonArray(row.safety_archives ?? '[]')
+            .filter((value) => typeof value === 'string')),
         branches: units,
         units,
         loopName: row.loop_name,
@@ -470,11 +573,15 @@ function toRailPrStateMessage(projectId, snap) {
         deliverySha: snap.deliverySha,
         isContinuation: snap.isContinuation,
         supersedesDeliveryId: snap.supersedesDeliveryId,
+        restoredFromDeliveryId: snap.restoredFromDeliveryId,
         operation: snap.operation,
         cleanupWarnings: snap.cleanupWarnings,
+        safetyArchives: snap.safetyArchives,
         units: snap.units,
         runIds: snap.runIds,
         originConversationId: snap.originConversationId,
+        createdAt: snap.createdAt,
+        updatedAt: snap.updatedAt,
     };
 }
 /**
@@ -499,13 +606,17 @@ function toPrDecisionCardEnvelope(projectId, snap) {
         deliverySha: snap.deliverySha,
         isContinuation: snap.isContinuation,
         supersedesDeliveryId: snap.supersedesDeliveryId,
+        restoredFromDeliveryId: snap.restoredFromDeliveryId,
         operation: snap.operation,
         cleanupWarnings: snap.cleanupWarnings,
+        safetyArchives: snap.safetyArchives,
         units: snap.units,
         prUrl: snap.prUrl,
         prNumber: snap.prNumber,
         prState: snap.prState,
         branch: snap.branch,
         runIds: snap.runIds,
+        createdAt: snap.createdAt,
+        updatedAt: snap.updatedAt,
     };
 }