@celilo/e2e 0.7.14 → 0.7.16

package/registry-server/src/server.test.ts

@@ -2,7 +2,7 @@ import { afterEach, beforeEach, describe, expect, test } from 'bun:test';
 import { mkdtempSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import { TokenAuth } from './auth';
+import { ADMIN_SCOPE, TokenAuth } from './auth';
 import { createRateLimiter } from './rate-limit';
 import { startServer } from './server';
 
@@ -17,7 +17,7 @@ beforeEach(() => {
     port: 0, // let Bun pick an ephemeral port
     pathPrefix: '',
     publicUrl: 'https://example.test',
-    auth: new TokenAuth(['valid-token']),
+    auth: new TokenAuth([{ token: 'valid-token', scope: ADMIN_SCOPE }]),
   });
   baseUrl = `http://localhost:${server.port}`;
 });
@@ -107,9 +107,10 @@ describe('PUT /api/v1/modules/new', () => {
     const res = await publish('homebridge', '1.0.0+1', 'valid-token');
     expect(res.status).toBe(200);
 
-    const meta = (await fetch(`${baseUrl}/api/v1/modules/homebridge`).then((r) =>
-      r.json(),
-    )) as { name: string; versions: { num: string }[] };
+    const meta = (await fetch(`${baseUrl}/api/v1/modules/homebridge`).then((r) => r.json())) as {
+      name: string;
+      versions: { num: string }[];
+    };
     expect(meta.name).toBe('homebridge');
     expect(meta.versions).toHaveLength(1);
     expect(meta.versions[0].num).toBe('1.0.0+1');
@@ -258,9 +259,10 @@ describe('GET /api/v1/modules/{name} (metadata) — total_downloads', () => {
     await fetch(`${baseUrl}/api/v1/modules/homebridge/1.0.0+1/download`);
     await fetch(`${baseUrl}/api/v1/modules/homebridge/1.0.0+1/download`);
 
-    const meta = (await fetch(`${baseUrl}/api/v1/modules/homebridge`).then((r) =>
-      r.json(),
-    )) as { name: string; total_downloads: number };
+    const meta = (await fetch(`${baseUrl}/api/v1/modules/homebridge`).then((r) => r.json())) as {
+      name: string;
+      total_downloads: number;
+    };
     expect(meta.total_downloads).toBe(2);
   });
 });
@@ -344,7 +346,7 @@ describe('write endpoints are rate limited', () => {
       port: 0,
       pathPrefix: '',
       publicUrl: 'https://example.test',
-      auth: new TokenAuth(['tok']),
+      auth: new TokenAuth([{ token: 'tok', scope: ADMIN_SCOPE }]),
       rateLimiter: createRateLimiter({ max: 2, windowMs: 60_000 }),
     });
     try {
@@ -386,7 +388,7 @@ describe('path prefix routing', () => {
       port: 0,
       pathPrefix: '/registry',
       publicUrl: 'https://example.test/registry',
-      auth: new TokenAuth(['valid-token']),
+      auth: new TokenAuth([{ token: 'valid-token', scope: ADMIN_SCOPE }]),
     });
     try {
       const base = `http://localhost:${prefixed.port}`;
@@ -400,6 +402,86 @@ describe('path prefix routing', () => {
   });
 });
 
+// ── scoped publish tokens (ISS-0140) ──────────────────────────────────────────
+
+describe('POST /api/v1/modules/tokens/mint + scoped publish', () => {
+  async function mint(repo: string, scope: string, token: string): Promise<Response> {
+    return fetch(`${baseUrl}/api/v1/modules/tokens/mint`, {
+      method: 'POST',
+      headers: token ? { Authorization: token, 'Content-Type': 'application/json' } : {},
+      body: JSON.stringify({ repo, scope }),
+    });
+  }
+
+  test('admin token mints a scoped token; non-admin / no token is 401', async () => {
+    const noTok = await mint('celilo/lunacycle', 'lunacycle', '');
+    expect(noTok.status).toBe(401);
+
+    const ok = await mint('celilo/lunacycle', 'lunacycle', 'valid-token');
+    expect(ok.status).toBe(200);
+    const body = (await ok.json()) as { ok: boolean; token: string; scope: string };
+    expect(body.ok).toBe(true);
+    expect(body.scope).toBe('lunacycle');
+    expect(body.token.length).toBeGreaterThan(10);
+  });
+
+  test('a minted scoped token publishes ONLY its package', async () => {
+    const minted = (await (await mint('celilo/lunacycle', 'lunacycle', 'valid-token')).json()) as {
+      token: string;
+    };
+
+    // Can publish its own package…
+    const ok = await publish('lunacycle', '1.0.0+1', minted.token);
+    expect(ok.status).toBe(200);
+
+    // …but NOT another module.
+    const denied = await publish('caddy', '1.0.0+1', minted.token);
+    expect(denied.status).toBe(401);
+  });
+
+  test('a scoped token cannot mint (not admin)', async () => {
+    const minted = (await (await mint('celilo/lunacycle', 'lunacycle', 'valid-token')).json()) as {
+      token: string;
+    };
+    const reMint = await mint('celilo/caddy', 'caddy', minted.token);
+    expect(reMint.status).toBe(401);
+  });
+
+  test('re-minting rotates: the old token stops working, the new one publishes', async () => {
+    const first = (await (await mint('celilo/lunacycle', 'lunacycle', 'valid-token')).json()) as {
+      token: string;
+    };
+    const second = (await (await mint('celilo/lunacycle', 'lunacycle', 'valid-token')).json()) as {
+      token: string;
+    };
+    expect(second.token).not.toBe(first.token);
+
+    const oldDenied = await publish('lunacycle', '2.0.0+1', first.token);
+    expect(oldDenied.status).toBe(401);
+    const newOk = await publish('lunacycle', '2.0.0+1', second.token);
+    expect(newOk.status).toBe(200);
+  });
+
+  test('revoke disables the token', async () => {
+    const minted = (await (await mint('celilo/lunacycle', 'lunacycle', 'valid-token')).json()) as {
+      token: string;
+    };
+    const revoke = await fetch(`${baseUrl}/api/v1/modules/tokens/revoke`, {
+      method: 'POST',
+      headers: { Authorization: 'valid-token', 'Content-Type': 'application/json' },
+      body: JSON.stringify({ repo: 'celilo/lunacycle' }),
+    });
+    expect(revoke.status).toBe(200);
+    const denied = await publish('lunacycle', '1.0.0+1', minted.token);
+    expect(denied.status).toBe(401);
+  });
+
+  test('mint rejects an invalid scope (not a valid package name)', async () => {
+    const res = await mint('celilo/lunacycle', 'Bad_Scope', 'valid-token');
+    expect(res.status).toBe(400);
+  });
+});
+
 // ─── helpers ──────────────────────────────────────────────────────────────────
 
 async function publish(

package/registry-server/src/server.ts

@@ -19,19 +19,19 @@
  * can publish-then-import against a live registry.
  */
 
-import { readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { TokenAuth } from './auth';
-import { landingResponse } from './landing';
 import {
+  type BootstrapEntry,
   bootstrapIndexEntry,
   packageBootstrapModule,
   scanBootstrapDir,
   scanUploadsDir,
-  type BootstrapEntry,
 } from './bootstrap';
-import { clientIp, createRateLimiter, type RateLimiter } from './rate-limit';
-import { RegistryStorage, type IndexEntry } from './storage';
+import { landingResponse } from './landing';
+import { type RateLimiter, clientIp, createRateLimiter } from './rate-limit';
+import { ScopedTokenStore, fileScopedTokenPersistence } from './scoped-token-store';
+import { type IndexEntry, RegistryStorage } from './storage';
 import { isValidName, isValidVersion, validateNameAndVersion } from './validation';
 
 /** Max total publish body size. Real modules are a few MB; 100MB is generous. */
@@ -70,14 +70,26 @@ interface ServerOptions {
    * to slow a bad actor to a crawl.
    */
   rateLimiter?: RateLimiter;
+  /**
+   * Store of minted, per-repo package-scoped tokens (build-bus Phase 3,
+   * ISS-0140). Defaults to a JSON file in `dataDir`. Its persisted hashes are
+   * loaded into `auth` at startup so minted tokens survive a restart.
+   */
+  scopedTokenStore?: ScopedTokenStore;
 }
 
 export function startServer(options: ServerOptions): ReturnType<typeof Bun.serve> {
   const { dataDir, port, pathPrefix, publicUrl, auth } = options;
   const storage = new RegistryStorage(dataDir);
+  const scopedTokenStore =
+    options.scopedTokenStore ??
+    new ScopedTokenStore(fileScopedTokenPersistence(join(dataDir, 'scoped-tokens.json')));
+  // Load persisted minted tokens into the in-memory authorizer.
+  for (const entry of scopedTokenStore.list()) {
+    auth.addHashed(entry.hash, entry.scope);
+  }
   const bootstrapCacheDir = options.bootstrapCacheDir ?? join(dataDir, '.bootstrap-cache');
-  const rateLimiter =
-    options.rateLimiter ?? createRateLimiter({ max: 30, windowMs: 60_000 });
+  const rateLimiter = options.rateLimiter ?? createRateLimiter({ max: 30, windowMs: 60_000 });
 
   /**
    * Rescan every request so .netapps dropped into bootstrapUploadsDir at
@@ -122,15 +134,24 @@ export function startServer(options: ServerOptions): ReturnType<typeof Bun.serve
     return err('Unauthorized — provide a valid publish token in the Authorization header', 401);
   }
 
-  function requireAuth(req: Request): boolean {
-    return auth.verify(req.headers.get('Authorization') ?? '');
+  /** True when the request's token may publish/yank `pkg` (admin or exact scope). */
+  function authorizePackage(req: Request, pkg: string): boolean {
+    return auth.authorize(req.headers.get('Authorization') ?? '', pkg);
+  }
+
+  /** True when the request carries an admin (`*`-scoped) token — required to mint. */
+  function authorizeAdmin(req: Request): boolean {
+    return auth.isAdmin(req.headers.get('Authorization') ?? '');
   }
 
   /**
    * Rate-limit check for write endpoints. Returns a 429 response when
    * exceeded (with Retry-After), null when allowed.
    */
-  function rateLimitOrNull(req: Request, srv: { requestIP(r: Request): { address: string } | null }): Response | null {
+  function rateLimitOrNull(
+    req: Request,
+    srv: { requestIP(r: Request): { address: string } | null },
+  ): Response | null {
     const ip = clientIp(req, srv);
     const result = rateLimiter.take(ip);
     if (result.ok) return null;
@@ -214,12 +235,15 @@ export function startServer(options: ServerOptions): ReturnType<typeof Bun.serve
     // celilo CLI reads manifest.yml#description and includes it). When
     // not provided we leave it undefined; the search endpoint falls
     // back to bootstrap data or empty.
-    const description =
-      typeof meta.description === 'string' ? meta.description : undefined;
+    const description = typeof meta.description === 'string' ? meta.description : undefined;
 
     const validation = validateNameAndVersion(name, vers);
     if (!validation.ok) return err(validation.message);
 
+    // Scope check AFTER the name is known: a package-scoped token may publish
+    // only its own package; an admin token publishes anything (ISS-0140).
+    if (!authorizePackage(req, name)) return unauthorized();
+
     const fileOffset = 4 + metaLen;
     const fileLen = buf.readUInt32LE(fileOffset);
     if (buf.length < fileOffset + 4 + fileLen) return err('Request body truncated (file)');
@@ -253,6 +277,51 @@ export function startServer(options: ServerOptions): ReturnType<typeof Bun.serve
     return Response.json({ ok: true });
   }
 
+  /**
+   * Mint a per-repo, package-scoped publish token (ISS-0140). Admin-only. The
+   * `registry_publish` capability calls this on behalf of `source_forge.
+   * registerRepo`. Reconciled: re-minting for the same repo rotates the token.
+   * The raw token is returned ONCE — the caller sets it as the repo's Actions
+   * secret; the server keeps only its hash.
+   */
+  async function handleMintToken(req: Request): Promise<Response> {
+    if (!authorizeAdmin(req)) return unauthorized();
+    let body: { repo?: unknown; scope?: unknown };
+    try {
+      body = (await req.json()) as { repo?: unknown; scope?: unknown };
+    } catch {
+      return err('Invalid JSON body');
+    }
+    const repo = typeof body.repo === 'string' ? body.repo.trim() : '';
+    const scope = typeof body.scope === 'string' ? body.scope.trim() : '';
+    if (!repo) return err('repo is required');
+    if (!scope || !isValidName(scope)) return err('scope must be a valid package name');
+
+    const { token, entry, revokedHashes } = scopedTokenStore.mint(repo, scope);
+    for (const h of revokedHashes) auth.removeHashed(h);
+    auth.addHashed(entry.hash, entry.scope);
+    console.log(`[registry] minted scoped token for ${repo} → ${scope}`);
+    return Response.json({ ok: true, token, scope, repo });
+  }
+
+  /** Revoke all scoped tokens for a repo (ISS-0140). Admin-only. */
+  async function handleRevokeToken(req: Request): Promise<Response> {
+    if (!authorizeAdmin(req)) return unauthorized();
+    let body: { repo?: unknown };
+    try {
+      body = (await req.json()) as { repo?: unknown };
+    } catch {
+      return err('Invalid JSON body');
+    }
+    const repo = typeof body.repo === 'string' ? body.repo.trim() : '';
+    if (!repo) return err('repo is required');
+
+    const removed = scopedTokenStore.revoke(repo);
+    for (const h of removed) auth.removeHashed(h);
+    console.log(`[registry] revoked ${removed.length} scoped token(s) for ${repo}`);
+    return Response.json({ ok: true, repo, revoked: removed.length });
+  }
+
   const server = Bun.serve({
     port,
     async fetch(req, srv) {
@@ -273,10 +342,7 @@ export function startServer(options: ServerOptions): ReturnType<typeof Bun.serve
       //   - suffix='/'       → request was prefix + '/', or just '/'
       //   - suffix='/index.html'
       // See apps/celilo/designs/REGISTRY_BROWSE_UI.md (decision D2).
-      if (
-        method === 'GET' &&
-        (suffix === '' || suffix === '/' || suffix === '/index.html')
-      ) {
+      if (method === 'GET' && (suffix === '' || suffix === '/' || suffix === '/index.html')) {
         return landingResponse(publicUrl);
       }
 
@@ -329,10 +395,7 @@ export function startServer(options: ServerOptions): ReturnType<typeof Bun.serve
           //   3. Empty string (older publishes that pre-date the
           //      description capture and haven't been republished).
           const bootstrapEntry = bootstrap.get(name);
-          const description =
-            latest?.description ??
-            bootstrapEntry?.description ??
-            '';
+          const description = latest?.description ?? bootstrapEntry?.description ?? '';
           return {
             name,
             max_version: latest?.vers ?? '0.0.0',
@@ -359,14 +422,26 @@ export function startServer(options: ServerOptions): ReturnType<typeof Bun.serve
       }
 
       // Publish — rate-limit before even checking auth so a bad-token flood
-      // can't crowd out legitimate traffic on the shared buckets.
+      // can't crowd out legitimate traffic on the shared buckets. The scope
+      // check happens inside handlePublish, once the package name is known.
       if (method === 'PUT' && suffix === `${apiBase}/new`) {
         const rl = rateLimitOrNull(req, srv);
         if (rl) return rl;
-        if (!requireAuth(req)) return unauthorized();
         return handlePublish(req);
       }
 
+      // Mint / revoke per-repo scoped publish tokens (admin-only — ISS-0140).
+      if (method === 'POST' && suffix === `${apiBase}/tokens/mint`) {
+        const rl = rateLimitOrNull(req, srv);
+        if (rl) return rl;
+        return handleMintToken(req);
+      }
+      if (method === 'POST' && suffix === `${apiBase}/tokens/revoke`) {
+        const rl = rateLimitOrNull(req, srv);
+        if (rl) return rl;
+        return handleRevokeToken(req);
+      }
+
       if (suffix.startsWith(`${apiBase}/`)) {
         const modulePath = suffix.slice(apiBase.length + 1);
         // URL-decode path segments — module versions use a literal '+' to
@@ -387,10 +462,7 @@ export function startServer(options: ServerOptions): ReturnType<typeof Bun.serve
           // endpoint — see notes there.
           const latest = entries.filter((v) => !v.yanked).at(-1) ?? entries.at(-1);
           const bootstrapEntry = resolveBootstrap().get(name);
-          const description =
-            latest?.description ??
-            bootstrapEntry?.description ??
-            '';
+          const description = latest?.description ?? bootstrapEntry?.description ?? '';
           return Response.json({
             name,
             description,
@@ -434,9 +506,9 @@ export function startServer(options: ServerOptions): ReturnType<typeof Bun.serve
         if (method === 'DELETE' && parts.length === 3 && parts[2] === 'yank') {
           const rl = rateLimitOrNull(req, srv);
           if (rl) return rl;
-          if (!requireAuth(req)) return unauthorized();
           const [name, version] = parts;
           if (!isValidName(name) || !isValidVersion(version)) return notFound();
+          if (!authorizePackage(req, name)) return unauthorized();
           return setYanked(name, version, true);
         }
 
@@ -444,9 +516,9 @@ export function startServer(options: ServerOptions): ReturnType<typeof Bun.serve
         if (method === 'PUT' && parts.length === 3 && parts[2] === 'unyank') {
           const rl = rateLimitOrNull(req, srv);
           if (rl) return rl;
-          if (!requireAuth(req)) return unauthorized();
           const [name, version] = parts;
           if (!isValidName(name) || !isValidVersion(version)) return notFound();
+          if (!authorizePackage(req, name)) return unauthorized();
           return setYanked(name, version, false);
         }
       }
@@ -464,8 +536,7 @@ export function startFromEnv(): void {
   const port = Number(process.env.PORT ?? 3000);
   const pathPrefix = (process.env.PATH_PREFIX ?? '').replace(/\/$/, '');
   const publicUrl =
-    process.env.PUBLIC_URL ??
-    `https://${process.env.DOMAIN ?? 'celilo.computer'}${pathPrefix}`;
+    process.env.PUBLIC_URL ?? `https://${process.env.DOMAIN ?? 'celilo.computer'}${pathPrefix}`;
   const bootstrapModulesDir = process.env.BOOTSTRAP_MODULES_DIR || undefined;
   const bootstrapUploadsDir = process.env.BOOTSTRAP_UPLOADS_DIR || undefined;
   const bootstrapCacheDir = process.env.BOOTSTRAP_CACHE_DIR || undefined;
@@ -485,7 +556,9 @@ export function startFromEnv(): void {
   const bootstrapBits = [
     bootstrapModulesDir ? `modulesDir=${bootstrapModulesDir}` : '',
     bootstrapUploadsDir ? `uploadsDir=${bootstrapUploadsDir}` : '',
-  ].filter(Boolean).join(', ');
+  ]
+    .filter(Boolean)
+    .join(', ');
   console.log(
     `[registry] listening on :${server.port} (prefix=${pathPrefix || '(none)'}, publicUrl=${publicUrl}${
       bootstrapBits ? `, bootstrap=[${bootstrapBits}]` : ''

package/scripts/pack-celilo-packages.ts

@@ -13,9 +13,14 @@
  *   @celilo/capabilities → (none)
  *   @celilo/cli-display → (none)
  *
- * So 5 workspace packages need to land in the simulator. We rely on
- * `bun pm pack` to rewrite `workspace:^` deps to concrete versions, so
- * the published tarballs resolve cleanly without real npm.
+ * So 5 workspace packages need to land in the simulator. We rewrite each
+ * package's `workspace:^` deps to concrete `^<workspace-version>` ranges
+ * OURSELVES before `bun pm pack` — we do NOT rely on bun's lock-based
+ * expansion, which goes stale after a cross-caret version bump and pins
+ * dependents to an unresolvable old range (ISS-0103: a `0.3→0.4`
+ * capabilities bump left the lock at 0.3, so packed cli pinned
+ * `^0.3.0-alpha.0`, excluding the 0.4.x the sim served). package.json is
+ * restored after packing so `workspace:^` stays in source.
  *
  * Output directory is typically `packages/e2e/.npm-registry-cache/` —
  * staged into the npm-registry-sim Docker image at build time.
@@ -25,11 +30,73 @@
  */
 
 import { execSync } from 'node:child_process';
-import { existsSync, mkdirSync, readdirSync, readFileSync, rmSync } from 'node:fs';
+import { existsSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 
 const REPO_ROOT = join(import.meta.dir, '..', '..', '..');
 
+interface PackageJson {
+  name?: string;
+  version?: string;
+  dependencies?: Record<string, string>;
+  devDependencies?: Record<string, string>;
+  peerDependencies?: Record<string, string>;
+  optionalDependencies?: Record<string, string>;
+}
+
+export interface WorkspaceRewrite {
+  depName: string;
+  oldSpec: string;
+  newSpec: string;
+}
+
+const DEP_BUCKETS = [
+  'dependencies',
+  'devDependencies',
+  'peerDependencies',
+  'optionalDependencies',
+] as const;
+
+/**
+ * Rewrite `workspace:` deps in `pkg` to concrete ranges using the
+ * name→version map, mutating `pkg`. Mirrors the publish flow's
+ * `rewriteWorkspaceDeps`:
+ *   workspace:^      → ^<version>
+ *   workspace:~      → ~<version>
+ *   workspace:*  / workspace:  → *           (any version)
+ *   workspace:X.Y.Z  → X.Y.Z                 (explicit, passes through)
+ *
+ * We do this ourselves rather than trust `bun pm pack`'s lock-based
+ * expansion, which goes stale after a cross-caret version bump (ISS-0103).
+ * Only deps present in `versions` (our own @celilo/* set) are touched.
+ * Returns the rewrites applied.
+ */
+export function rewriteWorkspacePins(
+  pkg: PackageJson,
+  versions: Map<string, string>,
+): WorkspaceRewrite[] {
+  const rewrites: WorkspaceRewrite[] = [];
+  for (const bucket of DEP_BUCKETS) {
+    const deps = pkg[bucket];
+    if (!deps) continue;
+    for (const [name, spec] of Object.entries(deps)) {
+      if (!spec.startsWith('workspace:')) continue;
+      const version = versions.get(name);
+      if (!version) continue;
+      const range = spec.slice('workspace:'.length);
+      let newSpec: string;
+      if (range === '*' || range === '') newSpec = '*';
+      else if (range === '^') newSpec = `^${version}`;
+      else if (range === '~') newSpec = `~${version}`;
+      else newSpec = range;
+      if (newSpec === spec) continue;
+      deps[name] = newSpec;
+      rewrites.push({ depName: name, oldSpec: spec, newSpec });
+    }
+  }
+  return rewrites;
+}
+
 /**
  * Workspace packages that install.sh's transitive @celilo/* closure depends
  * on. Hardcoded by name → relative path so a typo in package.json or a future
@@ -63,27 +130,46 @@ function parseArgs(): CliArgs {
   return { destination };
 }
 
-function pack(pkgPath: string, destination: string): string {
+function pack(pkgPath: string, destination: string, versions: Map<string, string>): string {
   const fullPath = join(REPO_ROOT, pkgPath);
-  if (!existsSync(join(fullPath, 'package.json'))) {
+  const pkgJsonPath = join(fullPath, 'package.json');
+  if (!existsSync(pkgJsonPath)) {
     throw new Error(`No package.json in ${fullPath}`);
   }
-  // Capture filenames before/after so we can identify the tarball this
-  // pack call produced even when the destination already contains tarballs
-  // from earlier packages in the loop.
-  const before = new Set(readdirSync(destination).filter((f) => f.endsWith('.tgz')));
-  execSync(`bun pm pack --destination=${destination}`, {
-    cwd: fullPath,
-    stdio: 'inherit',
-  });
-  const after = readdirSync(destination).filter((f) => f.endsWith('.tgz'));
-  const produced = after.filter((f) => !before.has(f));
-  if (produced.length !== 1) {
-    throw new Error(
-      `Expected exactly one new tarball from packing ${pkgPath}, got ${produced.length}: ${produced.join(', ')}`,
-    );
+
+  // Rewrite workspace:^ deps to concrete ranges ourselves (see header /
+  // ISS-0103), then restore the original so workspace:^ stays in source.
+  const originalPkgJson = readFileSync(pkgJsonPath, 'utf-8');
+  const parsed = JSON.parse(originalPkgJson) as PackageJson;
+  const rewrites = rewriteWorkspacePins(parsed, versions);
+  if (rewrites.length > 0) {
+    const trailingNl = originalPkgJson.endsWith('\n') ? '\n' : '';
+    writeFileSync(pkgJsonPath, JSON.stringify(parsed, null, 2) + trailingNl);
+    for (const r of rewrites) {
+      console.log(`  rewrote ${r.depName}: ${r.oldSpec} → ${r.newSpec}`);
+    }
+  }
+
+  try {
+    // Capture filenames before/after so we can identify the tarball this
+    // pack call produced even when the destination already contains tarballs
+    // from earlier packages in the loop.
+    const before = new Set(readdirSync(destination).filter((f) => f.endsWith('.tgz')));
+    execSync(`bun pm pack --destination=${destination}`, {
+      cwd: fullPath,
+      stdio: 'inherit',
+    });
+    const after = readdirSync(destination).filter((f) => f.endsWith('.tgz'));
+    const produced = after.filter((f) => !before.has(f));
+    if (produced.length !== 1) {
+      throw new Error(
+        `Expected exactly one new tarball from packing ${pkgPath}, got ${produced.length}: ${produced.join(', ')}`,
+      );
+    }
+    return produced[0];
+  } finally {
+    writeFileSync(pkgJsonPath, originalPkgJson);
   }
-  return produced[0];
 }
 
 function workspaceVersion(pkgPath: string): string {
@@ -104,11 +190,17 @@ function main(): void {
   console.log(`Packing @celilo/* packages → ${destination}`);
   console.log('');
 
+  // The name→version map used to rewrite each package's workspace:^ deps to
+  // concrete ranges that resolve against the co-packed versions (ISS-0103).
+  const versions = new Map<string, string>(
+    PACKAGES_TO_PACK.map(({ name, path }) => [name, workspaceVersion(path)]),
+  );
+
   const results: Array<{ name: string; version: string; tarball: string }> = [];
   for (const { name, path } of PACKAGES_TO_PACK) {
     const version = workspaceVersion(path);
     console.log(`▸ ${name}@${version}  (${path})`);
-    const tarball = pack(path, destination);
+    const tarball = pack(path, destination, versions);
     results.push({ name, version, tarball });
     console.log(`  → ${tarball}`);
     console.log('');

package/src/container-manager.ts

@@ -16,7 +16,7 @@ import type {
   ProxyOptions,
   SocksProxyHandle,
 } from './types';
-import { CeliloCommandError, ZONE_GATEWAYS, ZONE_SUBNETS } from './types';
+import { CeliloCommandError, internalNatIp, ZONE_GATEWAYS, ZONE_SUBNETS } from './types';
 
 /** Package root — where docker/, config/, simulators/ live */
 const PACKAGE_ROOT = join(__dirname, '..');
@@ -137,7 +137,7 @@ const SHARED_CONTAINERS = new Set([
  * set (useful for --keep debugging).
  */
 async function scrubDnsZones(): Promise<void> {
-  const zones = ['iamtheinternet.org', 'lunacycle.net'];
+  const zones = ['iamtheinternet.org', 'example.net'];
   const composeDir = PACKAGE_ROOT;
 
   for (const zone of zones) {
@@ -675,7 +675,7 @@ export async function startNetwork(config: NetworkConfig): Promise<NetworkHandle
     async deployFirewall(opts = {}): Promise<void> {
       const zones = opts.zones ?? ['dmz', 'app', 'secure'];
       const firewallIp = ZONE_GATEWAYS.internal; // fw-main on internal
-      const natIp = opts.natIp ?? '192.168.0.253';
+      const natIp = opts.natIp ?? internalNatIp();
       const providedNetworks = zones.map((zone) => ({
         zone,
         subnet: ZONE_SUBNETS[zone],
@@ -950,7 +950,7 @@ export function reconnectNetwork(projectName: string): NetworkHandle {
     async deployFirewall(opts = {}): Promise<void> {
       const zones = opts.zones ?? ['dmz', 'app', 'secure'];
       const firewallIp = ZONE_GATEWAYS.internal; // fw-main on internal
-      const natIp = opts.natIp ?? '192.168.0.253';
+      const natIp = opts.natIp ?? internalNatIp();
       const providedNetworks = zones.map((zone) => ({
         zone,
         subnet: ZONE_SUBNETS[zone],