Fix Vercel upload contract (POST /v2/files, SHA1) and lengthen Netlify wait

The real-account smoke test exposed that Vercel's file upload endpoint moved
from POST /v13/files to POST /v2/files and the digest must be SHA1 (max 40
chars), not SHA256 — the old shape was rejected with 400 "File digest
missing". Updated the provider, the mock (asserts /v2/files, SHA1 digest,
Content-Length) and docs. Netlify's deploy poll default is 120s and the
timeout error now reports the deploy's last observed state, so a stuck
uploading/processing deploy is diagnosable.

🤖 Generated with Codebuff
Co-Authored-By: Codebuff <noreply@codebuff.com>

Author: MR-1124

ARCHITECTURE.md

@@ -326,7 +326,7 @@ deploy server             # dev: local control plane (what the prototype bundles
 local|netlify|vercel|cloudflare|s3`, so the same build detection and command
 surface ship the same folder to the bundled control plane, the Netlify API
 (digest uploads for production, zip for branch deploys), the Vercel API
-(sha256 file uploads + manifest), Cloudflare Pages (direct upload), or S3
+(SHA1 file uploads + manifest), Cloudflare Pages (direct upload), or S3
 (SigV4-signed PutObject). Each provider also handles its own polling until the
 host reports ready, with retries/backoff shared via `lib/http.js`. This is how
 the CLI can both dogfood its own control plane and target real hosts today;
@@ -370,7 +370,7 @@ Implementation notes:
 | Auth (OAuth + keychain)       | `deploy login` stores tokens in `~/.deploy-cli/config.json` (env `DEPLOY_CONFIG_DIR` overrides) |
 | Blob storage                  | `storage/` directory, one folder per deploy         |
 | Streaming tar upload          | real POSIX ustar tar, POSTed as a single body       |
-| Real hosts                    | provider layer: Netlify digest/zip, Vercel sha-upload, Cloudflare Pages, S3 SigV4 |
+| Real hosts                    | provider layer: Netlify digest/zip, Vercel SHA1 upload, Cloudflare Pages, S3 SigV4 |
 | Per-deploy URLs               | `http://localhost:8787/<project>/<id>/`             |
 | Aliases                       | `latest`, `preview-<branch>` pointers in `registry.json` |
 | Rollback                      | `deploy rollback <id>` re-points `latest` (local); restore/promote on hosts |

README.md

@@ -11,7 +11,7 @@ rollback, and preview deploys. It targets five hosts through one interface:
 |-------------|------------------------------------------------------------|-----------------------------------|
 | `local`     | tar → bundled control plane (`:8787`)                      | alias re-point (instant)          |
 | `netlify`   | digest uploads (production) / zip (previews)               | restore previous deploy           |
-| `vercel`    | sha256 file uploads + files manifest                       | instant rollback                  |
+| `vercel`    | SHA1 file uploads (`/v2/files`) + files manifest           | instant rollback                  |
 | `cloudflare`| Pages direct upload (requires `--account`)                 | dashboard (no API)                |
 | `s3`        | SigV4-signed PutObject (requires `--bucket`)               | re-upload (no built-in)           |
 
@@ -68,8 +68,9 @@ Upload strategy notes:
   missing files are uploaded — avoids the 25k-file zip cap and 30 s request
   timeout). Branch/preview deploys use the zip method (the documented way).
   Override with `--method zip|digest`.
-- **Vercel** uploads every file once via `POST /v13/files` keyed by sha256, then
-  creates a deployment referencing the shas (no giant JSON manifest).
+- **Vercel** uploads every file once via `POST /v2/files` keyed by SHA1 (the
+  current documented contract), then creates a deployment referencing the shas
+  (no giant JSON manifest).
 - Both hosts are polled until the deploy is `ready`/`success` by default
   (`--no-wait` to skip; `--timeout <seconds>` to bound polling).
 - All requests retry network failures and 5xx/429 with exponential backoff;

docs/providers-vercel.md

@@ -29,7 +29,7 @@ deploy up --provider vercel
 
 ## How uploads work
 
-Every file is uploaded once via `POST /v13/files` keyed by **sha256**
+Every file is uploaded once via `POST /v2/files` keyed by **SHA1**
 (`x-vercel-digest` header; a 409 means "already uploaded" and is treated as
 success). The deployment then references the shas — no giant base64 request
 body, and unchanged files between deploys are naturally deduped.

docs/smoke-test.md

@@ -45,7 +45,7 @@ A provider without credentials is skipped (exit stays 0). A provider that
 | Provider | Upload path | Content check | Rollback check |
 |---|---|---|---|
 | Netlify | digest upload (sha1 per file) | fetches the returned URL until it serves `smoke-ok` | `POST .../restore` accepted |
-| Vercel | sha256 file uploads + manifest | same, against the production alias | undocumented rollback endpoint (the one Vercel's CLI uses) |
+| Vercel | SHA1 file uploads (`/v2/files`) + manifest | same, against the production alias | undocumented rollback endpoint (the one Vercel's CLI uses) |
 | Cloudflare | Pages direct upload | same, against the `pages.dev` URL | n/a — no rollback API, reported as such |
 | S3 | SigV4-signed PutObject | fetches the object via the path-style URL | n/a — plain S3 has no rollback |
 

lib/providers/netlify.js

@@ -59,13 +59,17 @@ async function request(pathname, { method = "GET", token, body, headers = {}, qu
 
 /** Poll GET /api/v1/deploys/{id} until state is ready (or error/timeout). */
 async function waitForDeploy(token, deployId, timeoutSeconds) {
-  const deadline = Date.now() + (timeoutSeconds || 60) * 1000;
+  // 120s default: brand-new auto-created sites can sit in uploading/processing
+  // while Netlify provisions them, well past the old 60s window.
+  const deadline = Date.now() + (timeoutSeconds || 120) * 1000;
+  let lastState = "?";
   for (;;) {
     const d = await request(`/deploys/${deployId}`, { token, what: "deploy" });
+    lastState = d.state;
     if (d.state === "ready") return d;
     if (d.state === "error") throw taggedError(`Netlify deploy ${deployId} failed (state=error)`, { provider: "netlify" });
     if (Date.now() > deadline) {
-      throw taggedError(`Netlify deploy ${deployId} not ready after ${timeoutSeconds || 60}s`, {
+      throw taggedError(`Netlify deploy ${deployId} not ready after ${timeoutSeconds || 120}s (last state: ${lastState})`, {
         provider: "netlify",
         hint: "Check the deploy in your Netlify dashboard, or pass --wait=false to skip polling.",
       });

lib/providers/vercel.js

@@ -1,5 +1,6 @@
-// Vercel provider. Uses the REST API:
-//   POST /v13/files                  upload each file (x-vercel-digest: sha256)
+// Vercel provider. Uses the REST API (contract verified 2026-08 against
+// vercel.com/docs/rest-api/deployments/upload-deployment-files):
+//   POST /v2/files                   upload each file (x-vercel-digest: sha1)
 //   POST /v13/deployments            create deployment referencing uploaded shas
 //   GET  /v9/projects?name=          resolve a project id by name
 //   POST /v9/projects/{id}/rollback/{deploymentId}   instant rollback (as the Vercel CLI uses)
@@ -70,22 +71,24 @@ export async function login({ flags }) {
 }
 
 /**
- * Upload every file once via POST /v13/files, keyed by sha256, and return the
- * manifest entries Vercel expects ({ file, sha, size }). Skipping unchanged
- * files is handled by treating 409 (already exists) as success.
+ * Upload every file once via POST /v2/files, keyed by SHA1 (the documented
+ * digest for the upload API and for deployment file references), and return
+ * the manifest entries Vercel expects ({ file, sha, size }). A 409 (already
+ * exists) is treated as success, as is the 200 "file already uploaded" reply.
  */
 async function uploadFiles(token, files) {
   const manifest = [];
   let done = 0;
   for (const f of files) {
     const content = await fs.promises.readFile(f.path);
-    const sha = crypto.createHash("sha256").update(content).digest("hex");
-    const url = new URL(BASE() + "/v13/files");
+    const sha = crypto.createHash("sha1").update(content).digest("hex");
+    const url = new URL(BASE() + "/v2/files");
     const res = await apiFetch(url, {
       method: "POST",
       headers: {
         Authorization: `Bearer ${token}`,
         "Content-Type": "application/octet-stream",
+        "Content-Length": String(content.length),
         "x-vercel-digest": sha,
       },
       body: content,

site/index.html

@@ -77,7 +77,7 @@ <h2>Ship anywhere</h2>
       <div class="provider-row">
         <div class="provider"><span class="dot local"></span><strong>local</strong><small>bundled control plane</small></div>
         <div class="provider"><span class="dot netlify"></span><strong>netlify</strong><small>digest uploads · restore</small></div>
-        <div class="provider"><span class="dot vercel"></span><strong>vercel</strong><small>sha256 uploads · rollback</small></div>
+        <div class="provider"><span class="dot vercel"></span><strong>vercel</strong><small>SHA1 uploads · rollback</small></div>
         <div class="provider"><span class="dot cloudflare"></span><strong>cloudflare</strong><small>Pages direct upload</small></div>
         <div class="provider"><span class="dot s3"></span><strong>s3</strong><small>SigV4 signed puts</small></div>
       </div>

test/providers.js

@@ -228,17 +228,18 @@ const vercelServer = await startServer(async (req, res) => {
   if (req.headers.authorization !== "Bearer vc_test") return json(res, 401, { error: { code: "unauthorized" } });
   const body = await readBody(req);
 
-  if (url.pathname === "/v13/files" && req.method === "POST") {
-    const digest = req.headers["x-vercel-digest"];
-    assert.equal(digest, sha256(body));
+  // current documented contract: POST /v2/files with a SHA1 x-vercel-digest
+  if (url.pathname === "/v2/files" && req.method === "POST") {
+    assert.equal(req.headers["x-vercel-digest"], sha1(body));
+    assert.equal(req.headers["content-length"], String(body.length), "Content-Length sent");
     // simulate an already-uploaded file for one of them (409 is fine)
     return json(res, body.toString("utf8").includes("rebeccapurple") ? 409 : 200, {});
   }
   if (url.pathname === "/v13/deployments" && req.method === "POST") {
     const payload = JSON.parse(body.toString("utf8"));
     assert.equal(payload.name, "sample-site");
     const idx = payload.files.find((f) => f.file === "index.html");
-    assert.equal(idx.sha, sha256(INDEX));
+    assert.equal(idx.sha, sha1(INDEX));
     assert.equal(idx.size, INDEX.length);
     assert.ok(!("data" in idx), "manifest references sha, not inline data");
     assert.ok(payload.files.some((f) => f.file === "assets/app.css"));