velocious 1.0.575 → 1.0.577

package/build/src/deployment-api/sanitize.d.ts

@@ -1,27 +0,0 @@
-/**
- * Converts an integration-owned value (adapter report, live status, audit
- * payload fragment) into a bounded JSON-safe structure: plain objects, arrays,
- * strings, finite numbers, booleans, and null survive; everything else
- * (functions, class instances, undefined) is dropped. String values and object
- * keys are redacted and capped in length; deterministic suffixes preserve every
- * value when redacted keys collide.
- * @param {?} value - Raw value from the integration.
- * @param {string[]} secrets - Secret values to redact.
- * @param {number} [depth] - Current recursion depth.
- * @returns {?} - JSON-safe redacted value, or undefined when the value cannot be represented.
- */
-export function sanitizeAdapterValue(value: unknown, secrets: string[], depth?: number): unknown;
-/**
- * Builds the sanitized failure payload persisted for a failed run. The message
- * is redacted; an integration-provided plain-object `error.recovery` (e.g.
- * Rampway reporting restoration of the previous release) is included after
- * sanitization.
- * @param {?} error - Thrown error from the adapter.
- * @param {string[]} secrets - Secret values to redact.
- * @returns {{message: string, recovery: (? | undefined)}} - Sanitized failure payload.
- */
-export function sanitizeErrorPayload(error: unknown, secrets: string[]): {
-    message: string;
-    recovery: (unknown | undefined);
-};
-//# sourceMappingURL=sanitize.d.ts.map

package/build/src/deployment-api/sanitize.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"sanitize.d.ts","sourceRoot":"","sources":["../../../src/deployment-api/sanitize.js"],"names":[],"mappings":"AA2BA;;;;;;;;;;;GAWG;AACH,4CALW,OAAC,WACD,MAAM,EAAE,UACR,MAAM,GACJ,OAAC,CA2Db;AAED;;;;;;;;GAQG;AACH,4CAJW,OAAC,WACD,MAAM,EAAE,GACN;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,CAAC,OAAC,GAAG,SAAS,CAAC,CAAA;CAAC,CAQxD"}

package/build/src/deployment-api/sanitize.js

@@ -1,100 +0,0 @@
-// @ts-check
-const MAX_STRING_LENGTH = 4000;
-const MAX_DEPTH = 20;
-const REDACTED = "[redacted]";
-/**
- * Replaces every occurrence of each configured secret in a string so tokens
- * never leak into persisted run state, audit payloads, or API responses.
- * @param {string} value - Raw string.
- * @param {string[]} secrets - Secret values to redact.
- * @returns {string} - Redacted string.
- */
-function redactString(value, secrets) {
-    let result = value;
-    for (const secret of secrets) {
-        if (secret.length > 0)
-            result = result.split(secret).join(REDACTED);
-    }
-    if (result.length > MAX_STRING_LENGTH) {
-        result = `${result.slice(0, MAX_STRING_LENGTH)}…`;
-    }
-    return result;
-}
-/**
- * Converts an integration-owned value (adapter report, live status, audit
- * payload fragment) into a bounded JSON-safe structure: plain objects, arrays,
- * strings, finite numbers, booleans, and null survive; everything else
- * (functions, class instances, undefined) is dropped. String values and object
- * keys are redacted and capped in length; deterministic suffixes preserve every
- * value when redacted keys collide.
- * @param {?} value - Raw value from the integration.
- * @param {string[]} secrets - Secret values to redact.
- * @param {number} [depth] - Current recursion depth.
- * @returns {?} - JSON-safe redacted value, or undefined when the value cannot be represented.
- */
-export function sanitizeAdapterValue(value, secrets, depth = 0) {
-    if (value === null)
-        return null;
-    if (depth > MAX_DEPTH)
-        return undefined;
-    const valueType = typeof value;
-    if (valueType === "string")
-        return redactString(value, secrets);
-    if (valueType === "number")
-        return Number.isFinite(value) ? value : null;
-    if (valueType === "boolean")
-        return value;
-    if (Array.isArray(value)) {
-        /** @type {Array<?>} */
-        const result = [];
-        for (const entry of value) {
-            const sanitized = sanitizeAdapterValue(entry, secrets, depth + 1);
-            if (sanitized !== undefined)
-                result.push(sanitized);
-        }
-        return result;
-    }
-    if (valueType === "object") {
-        const prototype = Object.getPrototypeOf(value);
-        if (prototype !== Object.prototype && prototype !== null)
-            return undefined;
-        /** @type {Record<string, ?>} */
-        const result = {};
-        for (const [key, entry] of Object.entries(value)) {
-            const sanitized = sanitizeAdapterValue(entry, secrets, depth + 1);
-            if (sanitized === undefined)
-                continue;
-            const redactedKey = redactString(key, secrets);
-            let availableKey = redactedKey;
-            let collisionNumber = 2;
-            while (Object.hasOwn(result, availableKey)) {
-                availableKey = `${redactedKey}#${collisionNumber}`;
-                collisionNumber++;
-            }
-            Object.defineProperty(result, availableKey, {
-                configurable: true,
-                enumerable: true,
-                value: sanitized,
-                writable: true
-            });
-        }
-        return result;
-    }
-    return undefined;
-}
-/**
- * Builds the sanitized failure payload persisted for a failed run. The message
- * is redacted; an integration-provided plain-object `error.recovery` (e.g.
- * Rampway reporting restoration of the previous release) is included after
- * sanitization.
- * @param {?} error - Thrown error from the adapter.
- * @param {string[]} secrets - Secret values to redact.
- * @returns {{message: string, recovery: (? | undefined)}} - Sanitized failure payload.
- */
-export function sanitizeErrorPayload(error, secrets) {
-    const rawMessage = error instanceof Error ? error.message : String(error);
-    const rawRecovery = error instanceof Error ? /** @type {Record<string, ?>} */ (error).recovery : undefined;
-    const recovery = sanitizeAdapterValue(rawRecovery, secrets);
-    return { message: redactString(rawMessage, secrets), recovery };
-}
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2FuaXRpemUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi9zcmMvZGVwbG95bWVudC1hcGkvc2FuaXRpemUuanMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsWUFBWTtBQUVaLE1BQU0saUJBQWlCLEdBQUcsSUFBSSxDQUFBO0FBQzlCLE1BQU0sU0FBUyxHQUFHLEVBQUUsQ0FBQTtBQUNwQixNQUFNLFFBQVEsR0FBRyxZQUFZLENBQUE7QUFFN0I7Ozs7OztHQU1HO0FBQ0gsU0FBUyxZQUFZLENBQUMsS0FBSyxFQUFFLE9BQU87SUFDbEMsSUFBSSxNQUFNLEdBQUcsS0FBSyxDQUFBO0lBRWxCLEtBQUssTUFBTSxNQUFNLElBQUksT0FBTyxFQUFFLENBQUM7UUFDN0IsSUFBSSxNQUFNLENBQUMsTUFBTSxHQUFHLENBQUM7WUFBRSxNQUFNLEdBQUcsTUFBTSxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUMsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLENBQUE7SUFDckUsQ0FBQztJQUVELElBQUksTUFBTSxDQUFDLE1BQU0sR0FBRyxpQkFBaUIsRUFBRSxDQUFDO1FBQ3RDLE1BQU0sR0FBRyxHQUFHLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQyxFQUFFLGlCQUFpQixDQUFDLEdBQUcsQ0FBQTtJQUNuRCxDQUFDO0lBRUQsT0FBTyxNQUFNLENBQUE7QUFDZixDQUFDO0FBRUQ7Ozs7Ozs7Ozs7O0dBV0c7QUFDSCxNQUFNLFVBQVUsb0JBQW9CLENBQUMsS0FBSyxFQUFFLE9BQU8sRUFBRSxLQUFLLEdBQUcsQ0FBQztJQUM1RCxJQUFJLEtBQUssS0FBSyxJQUFJO1FBQUUsT0FBTyxJQUFJLENBQUE7SUFDL0IsSUFBSSxLQUFLLEdBQUcsU0FBUztRQUFFLE9BQU8sU0FBUyxDQUFBO0lBRXZDLE1BQU0sU0FBUyxHQUFHLE9BQU8sS0FBSyxDQUFBO0lBRTlCLElBQUksU0FBUyxLQUFLLFFBQVE7UUFBRSxPQUFPLFlBQVksQ0FBQyxLQUFLLEVBQUUsT0FBTyxDQUFDLENBQUE7SUFDL0QsSUFBSSxTQUFTLEtBQUssUUFBUTtRQUFFLE9BQU8sTUFBTSxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUE7SUFDeEUsSUFBSSxTQUFTLEtBQUssU0FBUztRQUFFLE9BQU8sS0FBSyxDQUFBO0lBRXpDLElBQUksS0FBSyxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDO1FBQ3pCLHVCQUF1QjtRQUN2QixNQUFNLE1BQU0sR0FBRyxFQUFFLENBQUE7UUFFakIsS0FBSyxNQUFNLEtBQUssSUFBSSxLQUFLLEVBQUUsQ0FBQztZQUMxQixNQUFNLFNBQVMsR0FBRyxvQkFBb0IsQ0FBQyxLQUFLLEVBQUUsT0FBTyxFQUFFLEtBQUssR0FBRyxDQUFDLENBQUMsQ0FBQTtZQUVqRSxJQUFJLFNBQVMsS0FBSyxTQUFTO2dCQUFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLENBQUE7UUFDckQsQ0FBQztRQUVELE9BQU8sTUFBTSxDQUFBO0lBQ2YsQ0FBQztJQUVELElBQUksU0FBUyxLQUFLLFFBQVEsRUFBRSxDQUFDO1FBQzNCLE1BQU0sU0FBUyxHQUFHLE1BQU0sQ0FBQyxjQUFjLENBQUMsS0FBSyxDQUFDLENBQUE7UUFFOUMsSUFBSSxTQUFTLEtBQUssTUFBTSxDQUFDLFNBQVMsSUFBSSxTQUFTLEtBQUssSUFBSTtZQUFFLE9BQU8sU0FBUyxDQUFBO1FBRTFFLGdDQUFnQztRQUNoQyxNQUFNLE1BQU0sR0FBRyxFQUFFLENBQUE7UUFFakIsS0FBSyxNQUFNLENBQUMsR0FBRyxFQUFFLEtBQUssQ0FBQyxJQUFJLE1BQU0sQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQztZQUNqRCxNQUFNLFNBQVMsR0FBRyxvQkFBb0IsQ0FBQyxLQUFLLEVBQUUsT0FBTyxFQUFFLEtBQUssR0FBRyxDQUFDLENBQUMsQ0FBQTtZQUVqRSxJQUFJLFNBQVMsS0FBSyxTQUFTO2dCQUFFLFNBQVE7WUFFckMsTUFBTSxXQUFXLEdBQUcsWUFBWSxDQUFDLEdBQUcsRUFBRSxPQUFPLENBQUMsQ0FBQTtZQUM5QyxJQUFJLFlBQVksR0FBRyxXQUFXLENBQUE7WUFDOUIsSUFBSSxlQUFlLEdBQUcsQ0FBQyxDQUFBO1lBRXZCLE9BQU8sTUFBTSxDQUFDLE1BQU0sQ0FBQyxNQUFNLEVBQUUsWUFBWSxDQUFDLEVBQUUsQ0FBQztnQkFDM0MsWUFBWSxHQUFHLEdBQUcsV0FBVyxJQUFJLGVBQWUsRUFBRSxDQUFBO2dCQUNsRCxlQUFlLEVBQUUsQ0FBQTtZQUNuQixDQUFDO1lBRUQsTUFBTSxDQUFDLGNBQWMsQ0FBQyxNQUFNLEVBQUUsWUFBWSxFQUFFO2dCQUMxQyxZQUFZLEVBQUUsSUFBSTtnQkFDbEIsVUFBVSxFQUFFLElBQUk7Z0JBQ2hCLEtBQUssRUFBRSxTQUFTO2dCQUNoQixRQUFRLEVBQUUsSUFBSTthQUNmLENBQUMsQ0FBQTtRQUNKLENBQUM7UUFFRCxPQUFPLE1BQU0sQ0FBQTtJQUNmLENBQUM7SUFFRCxPQUFPLFNBQVMsQ0FBQTtBQUNsQixDQUFDO0FBRUQ7Ozs7Ozs7O0dBUUc7QUFDSCxNQUFNLFVBQVUsb0JBQW9CLENBQUMsS0FBSyxFQUFFLE9BQU87SUFDakQsTUFBTSxVQUFVLEdBQUcsS0FBSyxZQUFZLEtBQUssQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFBO0lBQ3pFLE1BQU0sV0FBVyxHQUFHLEtBQUssWUFBWSxLQUFLLENBQUMsQ0FBQyxDQUFDLGdDQUFnQyxDQUFDLENBQUMsS0FBSyxDQUFDLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUE7SUFDMUcsTUFBTSxRQUFRLEdBQUcsb0JBQW9CLENBQUMsV0FBVyxFQUFFLE9BQU8sQ0FBQyxDQUFBO0lBRTNELE9BQU8sRUFBQyxPQUFPLEVBQUUsWUFBWSxDQUFDLFVBQVUsRUFBRSxPQUFPLENBQUMsRUFBRSxRQUFRLEVBQUMsQ0FBQTtBQUMvRCxDQUFDIiwic291cmNlc0NvbnRlbnQiOlsiLy8gQHRzLWNoZWNrXG5cbmNvbnN0IE1BWF9TVFJJTkdfTEVOR1RIID0gNDAwMFxuY29uc3QgTUFYX0RFUFRIID0gMjBcbmNvbnN0IFJFREFDVEVEID0gXCJbcmVkYWN0ZWRdXCJcblxuLyoqXG4gKiBSZXBsYWNlcyBldmVyeSBvY2N1cnJlbmNlIG9mIGVhY2ggY29uZmlndXJlZCBzZWNyZXQgaW4gYSBzdHJpbmcgc28gdG9rZW5zXG4gKiBuZXZlciBsZWFrIGludG8gcGVyc2lzdGVkIHJ1biBzdGF0ZSwgYXVkaXQgcGF5bG9hZHMsIG9yIEFQSSByZXNwb25zZXMuXG4gKiBAcGFyYW0ge3N0cmluZ30gdmFsdWUgLSBSYXcgc3RyaW5nLlxuICogQHBhcmFtIHtzdHJpbmdbXX0gc2VjcmV0cyAtIFNlY3JldCB2YWx1ZXMgdG8gcmVkYWN0LlxuICogQHJldHVybnMge3N0cmluZ30gLSBSZWRhY3RlZCBzdHJpbmcuXG4gKi9cbmZ1bmN0aW9uIHJlZGFjdFN0cmluZyh2YWx1ZSwgc2VjcmV0cykge1xuICBsZXQgcmVzdWx0ID0gdmFsdWVcblxuICBmb3IgKGNvbnN0IHNlY3JldCBvZiBzZWNyZXRzKSB7XG4gICAgaWYgKHNlY3JldC5sZW5ndGggPiAwKSByZXN1bHQgPSByZXN1bHQuc3BsaXQoc2VjcmV0KS5qb2luKFJFREFDVEVEKVxuICB9XG5cbiAgaWYgKHJlc3VsdC5sZW5ndGggPiBNQVhfU1RSSU5HX0xFTkdUSCkge1xuICAgIHJlc3VsdCA9IGAke3Jlc3VsdC5zbGljZSgwLCBNQVhfU1RSSU5HX0xFTkdUSCl94oCmYFxuICB9XG5cbiAgcmV0dXJuIHJlc3VsdFxufVxuXG4vKipcbiAqIENvbnZlcnRzIGFuIGludGVncmF0aW9uLW93bmVkIHZhbHVlIChhZGFwdGVyIHJlcG9ydCwgbGl2ZSBzdGF0dXMsIGF1ZGl0XG4gKiBwYXlsb2FkIGZyYWdtZW50KSBpbnRvIGEgYm91bmRlZCBKU09OLXNhZmUgc3RydWN0dXJlOiBwbGFpbiBvYmplY3RzLCBhcnJheXMsXG4gKiBzdHJpbmdzLCBmaW5pdGUgbnVtYmVycywgYm9vbGVhbnMsIGFuZCBudWxsIHN1cnZpdmU7IGV2ZXJ5dGhpbmcgZWxzZVxuICogKGZ1bmN0aW9ucywgY2xhc3MgaW5zdGFuY2VzLCB1bmRlZmluZWQpIGlzIGRyb3BwZWQuIFN0cmluZyB2YWx1ZXMgYW5kIG9iamVjdFxuICoga2V5cyBhcmUgcmVkYWN0ZWQgYW5kIGNhcHBlZCBpbiBsZW5ndGg7IGRldGVybWluaXN0aWMgc3VmZml4ZXMgcHJlc2VydmUgZXZlcnlcbiAqIHZhbHVlIHdoZW4gcmVkYWN0ZWQga2V5cyBjb2xsaWRlLlxuICogQHBhcmFtIHs/fSB2YWx1ZSAtIFJhdyB2YWx1ZSBmcm9tIHRoZSBpbnRlZ3JhdGlvbi5cbiAqIEBwYXJhbSB7c3RyaW5nW119IHNlY3JldHMgLSBTZWNyZXQgdmFsdWVzIHRvIHJlZGFjdC5cbiAqIEBwYXJhbSB7bnVtYmVyfSBbZGVwdGhdIC0gQ3VycmVudCByZWN1cnNpb24gZGVwdGguXG4gKiBAcmV0dXJucyB7P30gLSBKU09OLXNhZmUgcmVkYWN0ZWQgdmFsdWUsIG9yIHVuZGVmaW5lZCB3aGVuIHRoZSB2YWx1ZSBjYW5ub3QgYmUgcmVwcmVzZW50ZWQuXG4gKi9cbmV4cG9ydCBmdW5jdGlvbiBzYW5pdGl6ZUFkYXB0ZXJWYWx1ZSh2YWx1ZSwgc2VjcmV0cywgZGVwdGggPSAwKSB7XG4gIGlmICh2YWx1ZSA9PT0gbnVsbCkgcmV0dXJuIG51bGxcbiAgaWYgKGRlcHRoID4gTUFYX0RFUFRIKSByZXR1cm4gdW5kZWZpbmVkXG5cbiAgY29uc3QgdmFsdWVUeXBlID0gdHlwZW9mIHZhbHVlXG5cbiAgaWYgKHZhbHVlVHlwZSA9PT0gXCJzdHJpbmdcIikgcmV0dXJuIHJlZGFjdFN0cmluZyh2YWx1ZSwgc2VjcmV0cylcbiAgaWYgKHZhbHVlVHlwZSA9PT0gXCJudW1iZXJcIikgcmV0dXJuIE51bWJlci5pc0Zpbml0ZSh2YWx1ZSkgPyB2YWx1ZSA6IG51bGxcbiAgaWYgKHZhbHVlVHlwZSA9PT0gXCJib29sZWFuXCIpIHJldHVybiB2YWx1ZVxuXG4gIGlmIChBcnJheS5pc0FycmF5KHZhbHVlKSkge1xuICAgIC8qKiBAdHlwZSB7QXJyYXk8Pz59ICovXG4gICAgY29uc3QgcmVzdWx0ID0gW11cblxuICAgIGZvciAoY29uc3QgZW50cnkgb2YgdmFsdWUpIHtcbiAgICAgIGNvbnN0IHNhbml0aXplZCA9IHNhbml0aXplQWRhcHRlclZhbHVlKGVudHJ5LCBzZWNyZXRzLCBkZXB0aCArIDEpXG5cbiAgICAgIGlmIChzYW5pdGl6ZWQgIT09IHVuZGVmaW5lZCkgcmVzdWx0LnB1c2goc2FuaXRpemVkKVxuICAgIH1cblxuICAgIHJldHVybiByZXN1bHRcbiAgfVxuXG4gIGlmICh2YWx1ZVR5cGUgPT09IFwib2JqZWN0XCIpIHtcbiAgICBjb25zdCBwcm90b3R5cGUgPSBPYmplY3QuZ2V0UHJvdG90eXBlT2YodmFsdWUpXG5cbiAgICBpZiAocHJvdG90eXBlICE9PSBPYmplY3QucHJvdG90eXBlICYmIHByb3RvdHlwZSAhPT0gbnVsbCkgcmV0dXJuIHVuZGVmaW5lZFxuXG4gICAgLyoqIEB0eXBlIHtSZWNvcmQ8c3RyaW5nLCA/Pn0gKi9cbiAgICBjb25zdCByZXN1bHQgPSB7fVxuXG4gICAgZm9yIChjb25zdCBba2V5LCBlbnRyeV0gb2YgT2JqZWN0LmVudHJpZXModmFsdWUpKSB7XG4gICAgICBjb25zdCBzYW5pdGl6ZWQgPSBzYW5pdGl6ZUFkYXB0ZXJWYWx1ZShlbnRyeSwgc2VjcmV0cywgZGVwdGggKyAxKVxuXG4gICAgICBpZiAoc2FuaXRpemVkID09PSB1bmRlZmluZWQpIGNvbnRpbnVlXG5cbiAgICAgIGNvbnN0IHJlZGFjdGVkS2V5ID0gcmVkYWN0U3RyaW5nKGtleSwgc2VjcmV0cylcbiAgICAgIGxldCBhdmFpbGFibGVLZXkgPSByZWRhY3RlZEtleVxuICAgICAgbGV0IGNvbGxpc2lvbk51bWJlciA9IDJcblxuICAgICAgd2hpbGUgKE9iamVjdC5oYXNPd24ocmVzdWx0LCBhdmFpbGFibGVLZXkpKSB7XG4gICAgICAgIGF2YWlsYWJsZUtleSA9IGAke3JlZGFjdGVkS2V5fSMke2NvbGxpc2lvbk51bWJlcn1gXG4gICAgICAgIGNvbGxpc2lvbk51bWJlcisrXG4gICAgICB9XG5cbiAgICAgIE9iamVjdC5kZWZpbmVQcm9wZXJ0eShyZXN1bHQsIGF2YWlsYWJsZUtleSwge1xuICAgICAgICBjb25maWd1cmFibGU6IHRydWUsXG4gICAgICAgIGVudW1lcmFibGU6IHRydWUsXG4gICAgICAgIHZhbHVlOiBzYW5pdGl6ZWQsXG4gICAgICAgIHdyaXRhYmxlOiB0cnVlXG4gICAgICB9KVxuICAgIH1cblxuICAgIHJldHVybiByZXN1bHRcbiAgfVxuXG4gIHJldHVybiB1bmRlZmluZWRcbn1cblxuLyoqXG4gKiBCdWlsZHMgdGhlIHNhbml0aXplZCBmYWlsdXJlIHBheWxvYWQgcGVyc2lzdGVkIGZvciBhIGZhaWxlZCBydW4uIFRoZSBtZXNzYWdlXG4gKiBpcyByZWRhY3RlZDsgYW4gaW50ZWdyYXRpb24tcHJvdmlkZWQgcGxhaW4tb2JqZWN0IGBlcnJvci5yZWNvdmVyeWAgKGUuZy5cbiAqIFJhbXB3YXkgcmVwb3J0aW5nIHJlc3RvcmF0aW9uIG9mIHRoZSBwcmV2aW91cyByZWxlYXNlKSBpcyBpbmNsdWRlZCBhZnRlclxuICogc2FuaXRpemF0aW9uLlxuICogQHBhcmFtIHs/fSBlcnJvciAtIFRocm93biBlcnJvciBmcm9tIHRoZSBhZGFwdGVyLlxuICogQHBhcmFtIHtzdHJpbmdbXX0gc2VjcmV0cyAtIFNlY3JldCB2YWx1ZXMgdG8gcmVkYWN0LlxuICogQHJldHVybnMge3ttZXNzYWdlOiBzdHJpbmcsIHJlY292ZXJ5OiAoPyB8IHVuZGVmaW5lZCl9fSAtIFNhbml0aXplZCBmYWlsdXJlIHBheWxvYWQuXG4gKi9cbmV4cG9ydCBmdW5jdGlvbiBzYW5pdGl6ZUVycm9yUGF5bG9hZChlcnJvciwgc2VjcmV0cykge1xuICBjb25zdCByYXdNZXNzYWdlID0gZXJyb3IgaW5zdGFuY2VvZiBFcnJvciA/IGVycm9yLm1lc3NhZ2UgOiBTdHJpbmcoZXJyb3IpXG4gIGNvbnN0IHJhd1JlY292ZXJ5ID0gZXJyb3IgaW5zdGFuY2VvZiBFcnJvciA/IC8qKiBAdHlwZSB7UmVjb3JkPHN0cmluZywgPz59ICovIChlcnJvcikucmVjb3ZlcnkgOiB1bmRlZmluZWRcbiAgY29uc3QgcmVjb3ZlcnkgPSBzYW5pdGl6ZUFkYXB0ZXJWYWx1ZShyYXdSZWNvdmVyeSwgc2VjcmV0cylcblxuICByZXR1cm4ge21lc3NhZ2U6IHJlZGFjdFN0cmluZyhyYXdNZXNzYWdlLCBzZWNyZXRzKSwgcmVjb3Zlcnl9XG59XG4iXX0=

package/src/deployment-api/controller.js

@@ -1,437 +0,0 @@
-// @ts-check
-
-import Controller from "../controller.js"
-import DeploymentRunStore, {registerActiveDeploymentRun, unregisterActiveDeploymentRun} from "./run-store.js"
-import {bearerToken, constantTimeEqual} from "../utils/bearer-token.js"
-import {getDeploymentMount} from "./registry.js"
-import {sanitizeAdapterValue, sanitizeErrorPayload} from "./sanitize.js"
-
-const REVISION_PATTERN = /^[0-9a-f]{40}$/
-const MAX_IDEMPOTENCY_KEY_LENGTH = 255
-
-/**
- * Resolves allowlisted stage options with own-property checks only, so
- * request-controlled names like "__proto__" or "constructor" can never
- * resolve inherited values. The normalized maps are also null-prototype, so
- * this is defense in depth.
- * @param {import("./registry.js").DeploymentMountOptions} options - Mount options.
- * @param {string} project - Requested project identifier.
- * @param {string} stage - Requested stage identifier.
- * @returns {import("./registry.js").DeploymentStageOptions | undefined} - Stage options when allowlisted.
- */
-function lookupStageOptions(options, project, stage) {
-  if (!Object.hasOwn(options.projects, project)) return undefined
-
-  const stages = options.projects[project].stages
-
-  if (!Object.hasOwn(stages, stage)) return undefined
-
-  return stages[stage]
-}
-
-/**
- * Authenticated HTTP API for callable deployments. Mounted by
- * {@link import("./index.js").default} as a route-resolver hook so it can ship
- * inside the velocious package. Every action is gated by a bearer-token check
- * against the configured access tokens; the API exposes only allowlisted
- * project/stage pairs and full immutable revisions, and delegates all
- * execution to the configured adapter. It never accepts commands, paths,
- * arbitrary refs, environment variables, or raw log output.
- */
-export default class VelociousDeploymentApiController extends Controller {
-  /**
-   * Runs mount options.
-   * @returns {import("./registry.js").DeploymentMountOptions} - Options for the mount that matched this request.
-   */
-  _mountOptions() {
-    const at = /** @type {string} */ (this.params().velociousDeploymentMountAt)
-    const options = getDeploymentMount(this.getConfiguration(), at)
-
-    if (!options) throw new Error(`No deployment API mount registered at ${at}`)
-
-    return options
-  }
-
-  /**
-   * Runs store.
-   * @returns {DeploymentRunStore} - Run store scoped to the mount's database.
-   */
-  _store() {
-    if (!this._deploymentRunStore) {
-      this._deploymentRunStore = new DeploymentRunStore({
-        configuration: this.getConfiguration(),
-        databaseIdentifier: this._mountOptions().databaseIdentifier,
-        mountIdentifier: this._mountOptions().mountIdentifier,
-        staleRunTimeoutMs: this._mountOptions().staleRunTimeoutMs
-      })
-    }
-
-    return this._deploymentRunStore
-  }
-
-  /**
-   * Reports one internally consumed framework failure on both documented
-   * error channels so framework-specific and unified reporters see the same
-   * payload.
-   * @param {object} args - Options.
-   * @param {string} args.context - Deployment API failure context.
-   * @param {?} args.error - Consumed error.
-   * @returns {void} - No return value.
-   */
-  _emitFrameworkError({context, error}) {
-    const errorEvents = this.getConfiguration().getErrorEvents()
-    const payload = {context, error, request: this.getRequest()}
-
-    errorEvents.emit("framework-error", payload)
-    errorEvents.emit("all-error", {...payload, errorType: "framework-error"})
-  }
-
-  /**
-   * Authorizes the request with a constant-time bearer-token comparison and
-   * runs the action body only when authorized. Renders a 401 otherwise. The
-   * base controller has no before-action halting, so authorization is enforced
-   * here per action. Tokens are only accepted through the Authorization header
-   * — never through URLs — and are never rendered back.
-   * @param {() => Promise<void>} actionFn - Action body.
-   * @returns {Promise<void>} - Resolves when complete.
-   */
-  async _respond(actionFn) {
-    const token = bearerToken(this.request())
-    let authorized = false
-
-    if (token) {
-      for (const accessToken of this._mountOptions().accessTokens) {
-        if (constantTimeEqual(token, accessToken)) {
-          authorized = true
-          break
-        }
-      }
-    }
-
-    if (!authorized) {
-      await this.render({json: {error: "unauthorized"}, status: 401})
-      return
-    }
-
-    await actionFn()
-  }
-
-  /**
-   * Creates a deployment run for an allowlisted project/stage and a full
-   * immutable revision reachable from the approved release branch. Idempotent:
-   * a retried idempotency key reads the original run, a reused key with a
-   * different payload conflicts, and an active run for the same project/stage
-   * returns a bounded conflict.
-   * @returns {Promise<void>} - Resolves when complete.
-   */
-  async create() {
-    await this._respond(async () => {
-      const params = this.params()
-      const revision = typeof params.revision === "string" ? params.revision : null
-      const idempotencyKey = typeof params.idempotencyKey === "string" ? params.idempotencyKey : null
-      const invalidFields = []
-
-      if (!revision || !REVISION_PATTERN.test(revision)) invalidFields.push("revision")
-      if (!idempotencyKey || idempotencyKey.length === 0 || idempotencyKey.length > MAX_IDEMPOTENCY_KEY_LENGTH) {
-        invalidFields.push("idempotencyKey")
-      }
-
-      if (invalidFields.length > 0) {
-        await this.render({json: {error: "invalid_params", fields: invalidFields}, status: 422})
-        return
-      }
-
-      const options = this._mountOptions()
-      const project = typeof params.project === "string" ? params.project : ""
-      const stage = typeof params.stage === "string" ? params.stage : ""
-      const stageOptions = lookupStageOptions(options, project, stage)
-
-      if (!stageOptions) {
-        await this.render({json: {error: "not_found"}, status: 404})
-        return
-      }
-
-      const store = this._store()
-      const validRevision = /** @type {string} */ (revision)
-      const validIdempotencyKey = /** @type {string} */ (idempotencyKey)
-
-      // Retries read the original run before anything else — a replay must
-      // never re-validate or re-deploy.
-      const existingRun = await store.findRunByKey(validIdempotencyKey)
-
-      if (existingRun) {
-        await this._renderExistingRun({existingRun, project, revision: validRevision, stage})
-        return
-      }
-
-      const reachable = await options.adapter.validateRevision({
-        configuration: this.getConfiguration(),
-        project,
-        releaseBranch: stageOptions.releaseBranch,
-        revision: validRevision,
-        stage
-      })
-
-      if (!reachable) {
-        await this.render({json: {error: "revision_not_reachable"}, status: 422})
-        return
-      }
-
-      const outcome = await store.createRunIfPossible({
-        idempotencyKey: validIdempotencyKey,
-        project,
-        revision: validRevision,
-        stage
-      })
-
-      if (outcome.outcome === "replay" || outcome.outcome === "conflict") {
-        const existingFromStore = outcome.run
-
-        if (!existingFromStore) throw new Error(`Deployment run store reported '${outcome.outcome}' without a run`)
-
-        await this._renderExistingRun({existingRun: existingFromStore, project, revision: validRevision, stage})
-        return
-      }
-
-      if (outcome.outcome === "in_progress") {
-        const activeRun = outcome.run
-
-        await this.render({json: {error: "deployment_in_progress", runId: activeRun ? activeRun.id : undefined}, status: 409})
-        return
-      }
-
-      if (outcome.outcome === "reconciliation_required") {
-        const blockedRun = outcome.run
-
-        if (!blockedRun) throw new Error("Deployment run store reported 'reconciliation_required' without a run")
-
-        await this.render({json: {error: "deployment_reconciliation_required", runId: blockedRun.id}, status: 409})
-        return
-      }
-
-      const run = outcome.run
-
-      if (!run) throw new Error("Deployment run store reported 'created' without a run")
-
-      await this._audit({event: "run_requested", payload: {project, revision: validRevision, stage}, runId: run.id})
-
-      // Execution is deliberately not awaited: the deploy runs under the
-      // integration's own lock/build/health/rollback semantics and the caller
-      // reads progress back through the show action.
-      this._executeRun({options, run}).catch((error) => {
-        this._emitFrameworkError({context: "deployment-api-execute-run", error})
-      })
-
-      await this.render({json: {run: this._serializeRun(run)}, status: 202})
-    })
-  }
-
-  /**
-   * Renders a previously created run for an idempotency-key hit: a replay when
-   * the payload matches, a bounded conflict when it doesn't.
-   * @param {object} args - Options.
-   * @param {import("./run-store.js").DeploymentRunRow} args.existingRun - The stored run.
-   * @param {string} args.project - Requested project.
-   * @param {string} args.revision - Requested revision.
-   * @param {string} args.stage - Requested stage.
-   * @returns {Promise<void>} - Resolves when complete.
-   */
-  async _renderExistingRun({existingRun, project, revision, stage}) {
-    const samePayload = existingRun.project === project && existingRun.stage === stage && existingRun.revision === revision
-
-    if (!samePayload) {
-      await this.render({json: {error: "idempotency_conflict", runId: existingRun.id}, status: 409})
-      return
-    }
-
-    await this.render({json: {replayed: true, run: this._serializeRun(existingRun)}, status: 200})
-  }
-
-  /**
-   * Returns the bounded state of a single run, enriched with the adapter's
-   * live status when the integration provides one.
-   * @returns {Promise<void>} - Resolves when complete.
-   */
-  async show() {
-    await this._respond(async () => {
-      const run = await this._store().findRunById(/** @type {string} */ (this.params().id))
-
-      if (!run) {
-        await this.render({json: {error: "not_found"}, status: 404})
-        return
-      }
-
-      const options = this._mountOptions()
-      /** @type {Record<string, ?>} */
-      const body = {run: this._serializeRun(run)}
-
-      if (options.adapter.readStatus) {
-        const liveStatus = await options.adapter.readStatus({
-          configuration: this.getConfiguration(),
-          project: run.project,
-          stage: run.stage
-        })
-
-        body.current = sanitizeAdapterValue(liveStatus, options.accessTokens) ?? null
-      }
-
-      await this.render({json: body, status: 200})
-    })
-  }
-
-  /**
-   * Executes a created run asynchronously: registers it as active in this
-   * process, marks it running, heartbeats its ownership lease while the
-   * adapter deploys, and records the sanitized outcome. A deployment failure
-   * is an expected operational result — it is persisted with its sanitized
-   * recovery information instead of being raised, so it stays visible through
-   * readback and audit rather than crashing the worker.
-   * @param {object} args - Options.
-   * @param {import("./registry.js").DeploymentMountOptions} args.options - Mount options.
-   * @param {import("./run-store.js").DeploymentRunRow} args.run - The created run.
-   * @returns {Promise<void>} - Resolves when the outcome is recorded.
-   */
-  async _executeRun({options, run}) {
-    const store = this._store()
-    const secrets = options.accessTokens
-    const stageOptions = lookupStageOptions(options, run.project, run.stage)
-
-    if (!stageOptions) throw new Error(`Deployment run ${run.id} references non-allowlisted ${run.project}/${run.stage}`)
-    if (!run.ownerToken) throw new Error(`Deployment run ${run.id} has no execution owner token`)
-
-    const ownerToken = run.ownerToken
-
-    registerActiveDeploymentRun(run.id)
-
-    /** @type {ReturnType<typeof setInterval> | null} */
-    let heartbeatTimer = null
-
-    try {
-      await store.markRunning({id: run.id, startedAtMs: Date.now()})
-
-      // Renew the ownership lease while the deploy runs so reconciliation
-      // never reclaims this genuinely active run; unref'd so the timer alone
-      // keeps no process alive.
-      const heartbeatIntervalMs = Math.max(1000, Math.floor(options.staleRunTimeoutMs / 4))
-
-      heartbeatTimer = setInterval(() => {
-        store.heartbeat({heartbeatAtMs: Date.now(), id: run.id}).catch((error) => {
-          this._emitFrameworkError({context: "deployment-api-heartbeat", error})
-        })
-      }, heartbeatIntervalMs)
-      heartbeatTimer.unref()
-
-      await this._audit({event: "run_started", payload: {project: run.project, revision: run.revision, stage: run.stage}, runId: run.id})
-
-      let report
-
-      try {
-        report = await options.adapter.deploy({
-          configuration: this.getConfiguration(),
-          project: run.project,
-          releaseBranch: stageOptions.releaseBranch,
-          revision: run.revision,
-          runId: run.id,
-          stage: run.stage
-        })
-      } catch (error) {
-        const errorPayload = sanitizeErrorPayload(error, secrets)
-
-        try {
-          await store.markFailed({error: errorPayload, finishedAtMs: Date.now(), id: run.id, ownerToken})
-          await this._audit({
-            event: "run_failed",
-            payload: {message: errorPayload.message, project: run.project, revision: run.revision, stage: run.stage},
-            runId: run.id
-          })
-        } catch (storeError) {
-          // Recording the failure itself failed — that is an unexpected bug
-          // and must surface to process-level error reporters.
-          this._emitFrameworkError({context: "deployment-api-record-failure", error: storeError})
-        }
-
-        return
-      }
-
-      try {
-        const result = sanitizeAdapterValue(report ?? {}, secrets) ?? {}
-
-        await store.markSucceeded({finishedAtMs: Date.now(), id: run.id, ownerToken, result})
-        await this._audit({event: "run_succeeded", payload: {project: run.project, revision: run.revision, stage: run.stage}, runId: run.id})
-      } catch (error) {
-        // The adapter already returned success. Surface the recording error,
-        // then fence the run in a durable non-retryable state rather than
-        // falsely recording an external success as a deployment failure.
-        this._emitFrameworkError({context: "deployment-api-record-success", error})
-
-        const reconciliationError = {
-          message: "Deployment activation succeeded, but its result could not be persisted; operator reconciliation is required"
-        }
-
-        try {
-          await store.markReconciliationRequired({
-            error: reconciliationError,
-            finishedAtMs: Date.now(),
-            id: run.id,
-            ownerToken
-          })
-          await this._audit({
-            event: "run_reconciliation_required",
-            payload: {message: reconciliationError.message, project: run.project, revision: run.revision, stage: run.stage},
-            runId: run.id
-          })
-        } catch (reconciliationErrorPersistenceError) {
-          this._emitFrameworkError({
-            context: "deployment-api-record-reconciliation-required",
-            error: reconciliationErrorPersistenceError
-          })
-        }
-      }
-    } finally {
-      if (heartbeatTimer) clearInterval(heartbeatTimer)
-      unregisterActiveDeploymentRun(run.id)
-    }
-  }
-
-  /**
-   * Records a sanitized audit event. Audit persistence must never strand or
-   * suppress a deployment, so a failure here is reported on the
-   * framework-error and unified all-error channels (where process-level bug
-   * reporters capture it), and execution continues.
-   * @param {object} args - Options.
-   * @param {string} args.event - Event name.
-   * @param {Record<string, ?>} args.payload - Payload; sanitized and redacted before persistence.
-   * @param {string | null} args.runId - Owning run id.
-   * @returns {Promise<void>} - Resolves when recorded or reported.
-   */
-  async _audit({event, payload, runId}) {
-    const sanitized = sanitizeAdapterValue(payload, this._mountOptions().accessTokens) ?? {}
-
-    try {
-      await this._store().addAuditEvent({event, payload: sanitized, runId})
-    } catch (error) {
-      this._emitFrameworkError({context: "deployment-api-audit", error})
-    }
-  }
-
-  /**
-   * Serializes a run for the API.
-   * @param {import("./run-store.js").DeploymentRunRow} run - Run row.
-   * @returns {Record<string, ?>} - Serialized run.
-   */
-  _serializeRun(run) {
-    return {
-      error: run.error,
-      finishedAtMs: run.finishedAtMs,
-      id: run.id,
-      idempotencyKey: run.idempotencyKey,
-      project: run.project,
-      requestedAtMs: run.requestedAtMs,
-      result: run.result,
-      revision: run.revision,
-      stage: run.stage,
-      startedAtMs: run.startedAtMs,
-      status: run.status
-    }
-  }
-}