Vercel provider for LSSM OS
This package implements the authoritative LSSM OS ProviderExecutionPort
over injected Vercel I/O. It makes no network calls and resolves no credentials. An adapter instance exclusively owns either provider_api resources or
provider_native_config project configuration.
The ./runtime-node export directly implements ProviderLifecyclePortV1. It accepts only closed, secret-free, digest-bound Vercel V2 commands, reserves the exact execution fence before mutation, persists an exact V2 receipt, and replays only independently verified durable receipts. It never loads or calls the legacy ProviderExecutionPort; that older adapter remains a compatibility surface outside Agent Host production routing.
Runtime Node dependencies are injected Vercel command I/O plus durable reservation and receipt state. Timeout aborts move attempted mutations into indeterminate custody, where redelivery cannot repeat the provider effect. Offline qualification proves 100-way contention, exact replay, command/result substitution rejection, and hostile timeout containment. Credentialed Vercel canary and 24-hour observation evidence remain required for live support.
The offline v0 surface discovers/imports projects, environments, deployments, domains, functions, environment-variable references, usage, billing, status, rollback, and promotion records. Discovery requires terminal cursor evidence for every family (including empty families) and enforces page and record bounds.
Execution uses one absolute deadline and trusted clock. A durable atomic state port owns lease expiry/takeover, operation replay, reconciliation state, and resource high-water fences. Receipts bind the exact plan, effect, authorization decision and attestation, provider result/observation, usage, evidence, and fence. A lease must outlive the absolute deadline plus a safety margin. Noncooperative timeouts remain indeterminate until trusted reconciliation proves a late effect or terminal post-deadline absence. The offline conformance target performs reconciliation through the injected read-only oracle observation boundary; it never replays a mutation to infer provider state. Concurrent operation keys for one resource scope are excluded. A higher fence must durably settle and quarantine every superseded provider attempt before its effect may run; stale failures are receipted only after verified provider absence and atomic persistence. Before any port call, execution recomputes the canonical runtime-plan digest and requires the input step to be the unique exact plan member bound to the same change, resource, and action.
Only opaque Vercel credential and secret references may cross the boundary. Credential, secret, and webhook-signature references use one canonical lowercase path spelling; aliases, encoded paths, dot segments, empty segments, and trailing separators are rejected. Successful deployment and domain mutations require ready and verified provider observations. Rollback and promotion use dedicated driver methods and require exact trusted pre/post observations. Compensation requires matching durable operation and receipt indexes, verified receipt/evidence semantics, and an exact expected prior observation bound to the current scope and authorization. Every driver return crosses a closed-world runtime validator before independent verification or durable state. Unknown fields and secret-like credential or variable material fail closed; credentialRefs must contain only canonical
credential://vercel/... references, and env discovery exposes references and target metadata only. Durable step records are an exact succeeded/failed XOR: success contains only its mutation observation, while failure contains only its verified absence resolution. Contradictory or fully reattested mixed records fail verification. Verification recursively decodes receipt, observation, economic evidence, and failure resolution into fresh closed values before semantic or evidence checks; unknown nested authority and noncanonical timestamps fail closed.
projectVerifiedVercelTopologyReceipt is the narrow bridge into Integration Hub topology evidence. It projects a secret-free receipt only after both the generic execution/receipt binding and Vercel's durable provider verifier pass. The authorized plan and desired properties must bind the exact tenant, workspace, environment, integration, connection, topology digest, and provider account reference. Cross-connection, noncanonical digest, failed, or unrecoverable receipts are rejected. Cleanup accepts only handles bound to the failed current step. Webhooks accept only canonical signature://vercel/... references, then require injected signature verification followed by atomic durable replay reservation.
Billing and usage are strictly actual, estimated, or unavailable; estimates require methodology evidence, unavailable claims require a reason, and contradictory discriminants fail closed. Discovery applies the same strict positive quantities/amounts, ISO currency, and real calendar validation. The ./testing export provides sanitized fakes and fixtures. The
./conformance export is an offline target only and makes no live Vercel qualification claim.
Run bun run lint:check, bun run typecheck, bun test, and
bun run pack:verify before handoff. Pack verification stages installable semver dependency ranges, extracts the real npm tarball, installs it with npm, and imports every public entry under Node and Bun in a clean consumer.
Vercel discovery names remain source-compatible aliases of the shared lib.lssm-os-runtime/ports resource/page/scope contracts. VercelProviderDriver extends the shared discovery port; execution, fencing, evidence and provider validation remain unchanged.
