@vibesdotdev/forge 0.0.0-stage → 1.0.0-rc.4

package/LICENSE

@@ -0,0 +1,18 @@
+MIT License
+
+Copyright (c) 2026 VIBES DEV LLC
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and
+associated documentation files (the "Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the
+following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial
+portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT
+LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO
+EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+USE OR OTHER DEALINGS IN THE SOFTWARE.

package/README.md

@@ -1,3 +1,209 @@
-# Temporary Holding Version
+# @vibesdotdev/forge
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Tier-1 package for the Vibes git forge — schemas, client contracts, and the
+runtime plugin (see [SPEC.md](./SPEC.md)) plus its folded surfaces:
+`./cli` (the `vibes forge` / `vibes git` command group), `./svelte`
+(presentational forge UI components), and `./tools` (MCP/native-loop agent
+tools).
+
+## CLI surface (`./cli`)
+
+CLI surface for the vibes git forge and package registry publishing workflow.
+Registers `vibes forge` / `vibes git` repository commands, deploy-token and
+SSH-key helpers, issue/PR workflows, branch merge policies, collaborator access
+management, internal forge smoke gates, and `vibes registry token`
+publishing-token commands.
+
+All commands talk to **platform-web** (e.g. `https://platform.vibes.dev`), NOT
+`git.vibes.dev`: platform-web owns the owner-scoped repository + deploy-token
+admin API. The CLI sends the handed runtime's caller bearer and lets the routes
+enforce RBAC server-side.
+
+PR consumers resolve `(await getVibesClient('forge', runtime)).pullRequests()` through
+the registered Forge capability. Its canonical schemas validate public inputs,
+successful response envelopes and diff hunks. Invalid inputs refuse
+`INVALID_INPUT / pull-request-input-invalid`; malformed responses refuse
+`UNAVAILABLE / pull-request-response-invalid`. Non-PR and merged lifecycle
+refusals send no mutation. The request-scoped factory shares these checks.
+
+The CLI plugin composes a shared consumer auth/transport slice.
+`ForgeCliAuthClient` owns the explicit-session compatibility cache through
+`runtime/client:forge.cli-auth`; registry forks borrow its owner and disposal
+prevents late cache writes. It also captures the runtime's `forge.cli` Config
+settings once:
+
+| Setting | Default | Environment alias |
+| --- | ---: | --- |
+| `fetchTimeoutMs` | 90,000 | `VIBES_FORGE_FETCH_TIMEOUT_MS` |
+| `credentialSettleMs` | 1,200 | `VIBES_FORGE_CREDENTIAL_SETTLE_MS` |
+| `aiReviewPollIntervalMs` | 3,000 | `VIBES_FORGE_AI_REVIEW_POLL_INTERVAL_MS` |
+| `aiReviewPollTimeoutMs` | 30,000 | `VIBES_FORGE_AI_REVIEW_POLL_TIMEOUT_MS` |
+
+A missing `forge.cli` manifest uses these declared defaults and applies the
+aliases. The descriptor-owned resolver validates aliases before the Config read;
+malformed values refuse with `INVALID_INPUT / forge-cli-config-invalid` and name
+their fields. Other Config read failures refuse with
+`UNAVAILABLE / forge-cli-config-unavailable` and retain the owner failure as the
+cause. `credentialSettleMs: 0` disables the settle pause; the
+request deadline and poll values must stay positive. The TUI plugin composes the
+registered status loader and `ForgeMountClient`; lifecycle-owned refreshes
+cannot publish after mount or runtime disposal.
+
+Operational smoke commands register in source-mode hosts; a public host can
+expose them with `VIBES_FORGE_ENABLE_SMOKES=1`. Both `forge smoke merge` and
+`forge smoke ai-review` print a dry-run plan by default, and `--execute` enables
+mutation. `--keep` preserves the test repository; scratch cleanup still runs.
+`VIBES_FORGE_ENABLE_SMOKES=1` also opts into the credential reread, which waits
+for `credentialSettleMs` (zero disables only that pause). AI review polling
+uses the configured cadence and window with the runtime clock and cancellation
+signal, and validates the comments response against Forge's tracking schema. A malformed response refuses
+`UNAVAILABLE / forge-smoke-comments-invalid`. Each smoke attempts scratch
+cleanup after success or failure and attempts repository deletion unless
+`--keep` was set. Cleanup failures go to the
+handed runtime logger; if that logger cannot report one, a value-free receipt is
+returned in JSON or attached to the primary typed failure.
+
+`bun run check` typechecks all source and test TypeScript/TSX with
+`tsconfig.json`, then checks Svelte. `bun run build` emits production TypeScript
+with `tsconfig.core.json` and packages Svelte separately; `bun run test` provides
+in-process behavior proof. These commands alone do not certify a deployment.
+
+### Commands
+
+| Command                                                                                                            | Route                                                   | RBAC              |
+| ------------------------------------------------------------------------------------------------------------------ | ------------------------------------------------ | ------------------- |
+| `vibes forge repo create <name> [--private] [--public] [--org <id>] [--description <d>] [--default-branch <name>]` | `POST /api/repositories`                                | owner             |
+| `vibes forge repo list [--provider] [--status] [--org]`                                                            | `GET /api/repositories`                                 | owner             |
+| `vibes forge repo delete <repo> [--yes]`                                                                           | `DELETE /api/repositories/{id}`                         | admin             |
+| `vibes forge token mint <repo> [--name] [--ttl <s>] [--read-only]`                                                 | `POST /api/repositories/{id}/tokens`                    | admin             |
+| `vibes forge token list <repo>`                                                                                    | `GET /api/repositories/{id}/tokens`                     | admin             |
+| `vibes forge token revoke <repo> <tokenId>`                                                                        | `DELETE /api/repositories/{id}/tokens/{tokenId}`        | admin             |
+| `vibes forge clone-url <repo>`                                                                                     | `GET /api/repositories/{id}/clone-url?credential=omit`  | read              |
+| `vibes forge remote bootstrap <repo> [--cwd] [--remote]`                                                           | `GET /api/repositories/{id}`                            | read + local Git  |
+| `vibes forge ssh-key add <name> [--key <path>] [--public-key <line>]`                                              | `POST /api/account/ssh-keys`                            | owner             |
+| `vibes forge ssh-key list`                                                                                         | `GET /api/account/ssh-keys`                             | owner             |
+| `vibes forge ssh-key remove <id\|fingerprint\|name>`                                                               | `DELETE /api/account/ssh-keys/{id}`                     | owner             |
+| `vibes forge credential-helper <get\|store\|erase>`                                                                | `GET /api/repositories/{id}/clone-credential`    | session + repo RBAC |
+
+`<repo>` accepts a repository UUID, `<owner>/<name>`, or a bare `<name>`
+(resolved via `GET /api/repositories/resolve` or a list+match).
+
+Stacked PRs live under `vibes forge pr stack {list,get,create,update,dissolve,restack,merge}`.
+PR arguments are bottom-to-top comma-separated numbers; restack and merge require
+exact `number=40-character-sha` bindings plus the expected stack revision.
+
+`token mint` prints the plaintext token to STDOUT exactly **once** (notices go to
+STDERR), like `vibes secrets reveal`. `clone-url` prints credential-free durable
+repository metadata to STDOUT. It selects standard Git SSH when the repository
+service publishes a certified SSH location; otherwise it falls back to HTTPS.
+`--transport https` always selects the compatibility path explicitly.
+
+### Standard Git SSH (capability-gated)
+
+Register a public key once, then use ordinary Git forever:
+
+```sh
+vibes forge ssh-key add laptop
+git clone "$(vibes forge clone-url <owner>/<repo>)"
+git -C <repo> push
+```
+
+When the live service publishes it, the resulting URL is
+`git@git.vibes.dev:<owner>/<repo>.git`. The SSH
+handshake proves key possession and the gateway derives read or write scope
+from `git-upload-pack` or `git-receive-pack`; no Git credential-helper
+configuration, stored token, or Forge-specific push command is involved. Git
+may ask to trust the host key on the first connection, as it does for any new
+SSH forge. Clients never guess this endpoint: until the service advertises it,
+the same command returns the durable HTTPS location.
+
+### Passwordless HTTPS compatibility
+
+`forge credential-helper` exchanges the active Vibes login session for an
+ephemeral, repo-scoped token without storing a Git password. Successful
+`vibes auth login` installs the integration automatically. It persists the
+runtime-declared Vibes executable and canonical `VIBES_HOME`, so Git invokes the
+same client identity even outside the login shell. It also installs Git's native
+push-only URL rewrite, so fetch stays read-scoped while ordinary `git push`
+requests a bounded write credential.
+
+```sh
+# 1. one Vibes login configures authenticated clients downstream
+vibes auth login
+
+# 2. request the compatibility URL explicitly
+git clone "$(vibes forge clone-url <owner>/<repo> --transport https)"
+
+# 3. standard Git now carries operation intent automatically
+git -C <repo> push origin HEAD
+
+# explicit diagnosis/repair, not onboarding
+vibes forge setup-git --check
+```
+
+On `get`, the helper validates Git's exact host/path, resolves the repository
+through platform-web, and requests `/clone-credential` with read or write intent.
+The server applies repository RBAC and returns a short-lived `vibes-deploy`
+credential. The reserved `vibes-write@` push URL is the explicit intent signal
+Git's credential protocol otherwise lacks. Git's `pushInsteadOf` projection
+supplies that username only for push operations; clone/fetch URLs remain
+credential-free. Write credentials live for at most 30 minutes.
+`store`/`erase` are no-ops.
+
+SSH keys remain available for the standard SSH transport and for the explicit
+challenge-signed `vibes forge push` primitive; they are not a prerequisite for
+normal HTTPS clone, fetch, or push after login.
+
+For an existing checkout, bootstrap the canonical Forge remote in one
+idempotent operation. It writes repository-local `credential.useHttpPath`, the
+path-bound helper, a credential-free fetch URL, and a `vibes-write@` push URL.
+The username is only an intent marker; the helper mints the scoped credential
+in-process when Git actually pushes.
+
+```sh
+vibes forge remote bootstrap <owner>/<repo> --cwd ./my-clone --remote forge
+```
+
+`vibes forge doctor --cwd ./my-clone` reports read-auth readiness separately
+from push readiness and identifies unavailable credential storage instead of
+calling it a missing login.
+
+### Deferred (not registered)
+
+- the `split` dogfood driver — Phase 3.
+
+## Svelte surface (`./svelte`)
+
+Reusable Svelte 5 presentation components for forge issue, pull-request,
+review, project, milestone, and run-ledger views. Components are data-in and
+compose VibesKit / git-svelte primitives; they do not fetch or own
+persistence. Import components from the narrow subpath
+`@vibesdotdev/forge/svelte/components/<Name>.svelte`. These component exports
+use the optional `@vibesdotdev/kit`, `@lucide/svelte`, and `svelte` peers when
+loaded; the Svelte plugin defers its widget components through runtime loaders.
+
+`@vibesdotdev/cli` is a required peer because `./cli` preserves synchronous
+programmatic command and output exports that call CLI provider values at module
+load. TUI and logging peers stay optional for hosts that do not use those runtime
+surfaces; documentation, test, and build tooling peers are also optional.
+React and OpenTUI peers support the TUI renderer.
+[SPEC.md](./SPEC.md) records their load boundaries.
+
+## Tools surface (`./tools`)
+
+Runtime tool package exposing Vibes Forge operations to MCP clients and native
+agent loops through the `tools/tool` kind (repository list, file read, issue
+and PR CRUD/search, PR merge, PR stack lifecycle operations). Registered by
+`@vibesdotdev/forge/tools/plugin`; every implementation stays behind a lazy
+loader.
+
+See [SPEC.md](./SPEC.md) for the full ownership contract, hard rules, and
+verification commands across all four surfaces.
+
+Service targets come from the host's declared `infra/service` catalog and
+schema-validated `infra.services` configuration. Registry setup and smoke use
+`registry`; mint/revoke uses `platform`; CLI bootstrap uses `cli`.
+Smoke target overrides leave the host's credential environment and auth origin
+unchanged. CI hosts use `compileForgeActionsPipelineForRuntime` and
+`forgeStepShellCommandForRuntime` from `./ci`; synchronous helpers retain
+canonical production defaults and accept resolved origins.

package/VIBES.md

@@ -0,0 +1,125 @@
+---
+slice: repos/platform/framework/forge
+name: forge
+generated: 2026-10-27T01:44:13.728Z
+branches: [origin/main, v1/correctness]
+policy:
+  lifecycle: "active"
+  changeResistance: "none"
+  frozen: false
+  frozenAt: null
+  frozenBy: null
+  freezeReason: null
+  enforcement: "error"
+  scope: "all"
+  exceptions: []
+  expiresAt: null
+  expired: false
+  requiresApproval: []
+  violationCount: 0
+  violations: []
+---
+
+# forge
+
+## Ownership
+
+**owners:** none
+**source:** "none"
+**confidence:** 0
+
+## Dependencies
+
+| sliceId | paths |
+| --- | --- |
+| client | @vibesdotdev/client |
+| config | @vibesdotdev/config |
+| docs | @vibesdotdev/docs |
+| docs-contracts | @vibesdotdev/docs-contracts |
+| filesystem | @vibesdotdev/filesystem |
+| git-operations | @vibesdotdev/git-operations |
+| host-bun | @vibesdotdev/host-bun |
+| host-node | @vibesdotdev/host-node |
+| infra-core | @vibesdotdev/infra-core |
+| kernel | @vibesdotdev/kernel |
+| kit | @vibesdotdev/kit |
+| logging | @vibesdotdev/logging |
+| paths | @vibesdotdev/paths |
+| shared | @vibesdotdev/shared |
+| testing | @vibesdotdev/testing |
+| tools | @vibesdotdev/tools |
+| tracking-schemas | @vibesdotdev/tracking-schemas |
+| tui | @vibesdotdev/tui |
+| vibesdotdev.auth | @vibesdotdev/auth |
+| vibesdotdev.cli | @vibesdotdev/cli |
+| vibesdotdev.storage | @vibesdotdev/storage |
+| workers | @vibesdotdev/workers |
+**importedBy:** none
+**external:** @lucide/svelte, @opentui/react, @sveltejs/package, @types/bun, @types/react, @vibesdotdev/forge, bun:test, commander, node:child_process, node:fs, node:os, node:path, node:url, react, svelte, svelte-check, typescript, yaml, zod
+**source:** "both"
+
+## Health
+
+**ruleViolations:** none
+| package | check | status | findings |
+| --- | --- | --- | --- |
+| @vibesdotdev/developer-bootstrap | import-exports | failed | 22806 |
+| @vibesdotdev/developer-bootstrap | dependency-specs | failed | 182 |
+| @vibesdotdev/forge | test | failed | 7 |
+**typeErrors:** 0
+**warnings:** 0
+**indexCoverage:** 0
+
+## Index State
+
+**dirtyFiles:** 0
+**signalCoverage:** {"workspace.signal.file-stats":0.9690346083788707}
+
+## Lock State
+
+### origin/main
+
+(working-tree status is live data — query the workspace slice)
+**hasConflicts:** false
+**conflictFiles:** none
+**aheadBehind:** {"ahead":0,"behind":0}
+
+### v1/correctness
+
+(working-tree status is live data — query the workspace slice)
+**hasConflicts:** false
+**conflictFiles:** none
+**aheadBehind:** {"ahead":0,"behind":0}
+
+
+## Change Summary
+
+### origin/main
+
+**baseBranch:** "origin/main"
+**filesChanged:** 0
+**insertions:** 0
+**deletions:** 0
+**changedFiles:** none
+**unavailable:** {"reason":"slice-git-unavailable","message":"The slice's Git facts could not be read."}
+
+### v1/correctness
+
+**baseBranch:** "v1/correctness"
+**filesChanged:** 10
+**insertions:** 61
+**deletions:** 34
+(change summary is live data — query the workspace slice)
+
+
+## Children
+
+**children:** none
+**totalChildren:** 0
+**frozenChildren:** 0
+**healthyChildren:** 0
+**degradedChildren:** 0
+**totalViolations:** 0
+
+---
+*Generated by vibes workspace slices*

package/dist/auth.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Build Forge's canonical auth-web entry URL.
+ *
+ * `canonicalForgeOrigin` is REQUIRED and must be the declared `git`
+ * `infra/service` origin (`serviceOrigin(runtime, 'git')`, rc04 §2.4), never
+ * the inbound request. A preview/alias request may retain its path, but the
+ * callback always returns to the environment-owned Forge origin — this keeps
+ * auth's redirect allowlist and the app shell on the same source of truth.
+ * There is intentionally no fallback to the requested origin: that would let
+ * an attacker-controlled Host/alias echo back as the redirect target (open
+ * redirect).
+ */
+export declare function buildForgeSignInUrl(authOrigin: string, returnTo: string, canonicalForgeOrigin: string): string;
+//# sourceMappingURL=auth.d.ts.map

package/dist/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CAClC,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,oBAAoB,EAAE,MAAM,GAC1B,MAAM,CA+BR"}

package/dist/auth.js

@@ -0,0 +1,44 @@
+import { buildAuthSignInUrl } from '@vibesdotdev/auth/client/auth-client';
+/**
+ * Build Forge's canonical auth-web entry URL.
+ *
+ * `canonicalForgeOrigin` is REQUIRED and must be the declared `git`
+ * `infra/service` origin (`serviceOrigin(runtime, 'git')`, rc04 §2.4), never
+ * the inbound request. A preview/alias request may retain its path, but the
+ * callback always returns to the environment-owned Forge origin — this keeps
+ * auth's redirect allowlist and the app shell on the same source of truth.
+ * There is intentionally no fallback to the requested origin: that would let
+ * an attacker-controlled Host/alias echo back as the redirect target (open
+ * redirect).
+ */
+export function buildForgeSignInUrl(authOrigin, returnTo, canonicalForgeOrigin) {
+    if (!canonicalForgeOrigin) {
+        throw new TypeError('buildForgeSignInUrl requires an explicit canonicalForgeOrigin (the declared git infra/service origin)');
+    }
+    const requested = new URL(returnTo);
+    const canonical = new URL(canonicalForgeOrigin);
+    if (canonical.protocol !== 'http:' && canonical.protocol !== 'https:') {
+        throw new TypeError('Forge auth return origin must use HTTP or HTTPS');
+    }
+    const clientOrigin = canonical.origin;
+    const canonicalReturnUrl = new URL(clientOrigin);
+    // Assign URL components after fixing the authority. Passing a `//host` path
+    // into `new URL(path, base)` would reinterpret it as another trusted app's
+    // authority (protocol-relative URL) and confuse the callback boundary.
+    canonicalReturnUrl.pathname = `/${requested.pathname.replace(/^\/+/, '')}`;
+    canonicalReturnUrl.search = requested.search;
+    canonicalReturnUrl.hash = requested.hash;
+    const canonicalReturn = canonicalReturnUrl.toString();
+    return buildAuthSignInUrl({
+        // 'forge', not 'git': the client id must match a registered auth client
+        // (auth/src/client/gateway.ts) or auth cannot allowlist the
+        // return origin. `git.<domain>` is the clone/push alias of the same
+        // worker and is intentionally not a client — sign-in always returns to
+        // the canonical forge origin.
+        authOrigin,
+        clientId: 'forge',
+        clientOrigin,
+        redirectTo: canonicalReturn
+    });
+}
+//# sourceMappingURL=auth.js.map

package/dist/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AAE1E;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,mBAAmB,CAClC,UAAkB,EAClB,QAAgB,EAChB,oBAA4B;IAE5B,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAC3B,MAAM,IAAI,SAAS,CAClB,uGAAuG,CACvG,CAAC;IACH,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IACpC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,oBAAoB,CAAC,CAAC;IAChD,IAAI,SAAS,CAAC,QAAQ,KAAK,OAAO,IAAI,SAAS,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACvE,MAAM,IAAI,SAAS,CAAC,iDAAiD,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,YAAY,GAAG,SAAS,CAAC,MAAM,CAAC;IACtC,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;IACjD,4EAA4E;IAC5E,2EAA2E;IAC3E,uEAAuE;IACvE,kBAAkB,CAAC,QAAQ,GAAG,IAAI,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC;IAC3E,kBAAkB,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC;IAC7C,kBAAkB,CAAC,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC;IACzC,MAAM,eAAe,GAAG,kBAAkB,CAAC,QAAQ,EAAE,CAAC;IACtD,OAAO,kBAAkB,CAAC;QACzB,wEAAwE;QACxE,4DAA4D;QAC5D,oEAAoE;QACpE,uEAAuE;QACvE,8BAA8B;QAC9B,UAAU;QACV,QAAQ,EAAE,OAAO;QACjB,YAAY;QACZ,UAAU,EAAE,eAAe;KAC3B,CAAC,CAAC;AACJ,CAAC"}

package/dist/ci/actions-pipeline.d.ts

@@ -0,0 +1,85 @@
+import { type RuntimeRef } from '@vibesdotdev/kernel';
+import { type ForgeCiProfiles } from './profiles/catalog.ts';
+import { type ForgeCiPublishTargets } from './runtime-catalogs.ts';
+import type { CiPipelineDescriptor } from './schemas.ts';
+import { type ActionsInput, type ForgeRunnerProfileId, type JobInput, type Step } from '../schemas/actions.ts';
+export declare const FORGE_ACTIONS_PIPELINE_ID = "forge-actions";
+export declare const FORGE_ACTIONS_PATH = ".forge/actions.yml";
+export interface CompileForgeActionsPipelineInput {
+    /**
+     * Authored actions. The public compiler validates the whole document through
+     * `ActionsSchema` before lowering, so a hand-built or YAML-parsed input is
+     * held to the same contract as `parseActionsYml` output.
+     */
+    actions: ActionsInput;
+    /** CLI service origin resolved by the operational host. */
+    cliOrigin?: string;
+    repository: string;
+    defaultBranch: string;
+    /** The `ci/profile` catalog to fill a profile's jobs from (`resolveForgeCiProfiles`); the built-in one when absent. */
+    profiles?: () => ForgeCiProfiles;
+    /** The `ci/publish-target` catalog a `publish:` step resolves through (`resolveForgeCiPublishTargets`); the built-in one when absent. */
+    publishTargets?: () => ForgeCiPublishTargets;
+}
+/** Immutable provider-neutral execution policy resolved from one authored job. */
+export interface ForgeActionsJobExecutionPolicy {
+    runnerId: string;
+    runnerProfile: ForgeRunnerProfileId;
+    runnerLabels: string[];
+    jobTimeoutSeconds: number;
+}
+/**
+ * Resolve public Forge Actions policy once so hashing, persistence, scheduling,
+ * and executor dispatch do not independently reinterpret defaults.
+ */
+export declare function resolveForgeActionsJobExecutionPolicy(job: JobInput): ForgeActionsJobExecutionPolicy;
+/**
+ * Public CLI installer — the same one `buildFleetCloudInit` curl-installs onto
+ * every fleet-provisioned host. A fleet machine therefore already satisfies
+ * this; re-running it there is a no-op because the guard below short-circuits.
+ */
+/** Where that installer places the binary when VIBES_INSTALL_DIR is unset. */
+export declare const FORGE_CI_CLI_BIN_DIR = "$HOME/.local/bin";
+/**
+ * The checkout's own declared CLI: the build-executor entry of the
+ * `@vibesdotdev/bin` the checkout installed, run against the checkout root.
+ */
+export declare const FORGE_CI_CHECKOUT_CLI = "node_modules/@vibesdotdev/bin/checkout.mjs";
+/**
+ * The exact shell one VALIDATED step runs.
+ *
+ * `step` must be the value returned by `ActionsSchema` or `StepSchema`; the
+ * public entrypoints validate before lowering, so this helper does not
+ * reinterpret an unvalidated shape.
+ *
+ * Exported because the dispatch payload needs the SAME translation the pipeline
+ * descriptor gets. It did not have it: dispatch kept its own copy that emitted a
+ * bare `vibes infra deploy run …` argv, so every deploy step exited 127 with
+ * `vibes: command not found` while the descriptor — used only for status checks
+ * — carried the prelude that would have prevented it. One translation, one
+ * place, or the two drift exactly this way.
+ */
+export declare function forgeStepShellCommand(step: Step, cliOrigin?: string, publishTargets?: () => ForgeCiPublishTargets): string;
+/**
+ * The exact shell one authored step runs, validated through `StepSchema` first.
+ *
+ * A step that reaches this from a caller the compiler did not validate (a
+ * dispatch payload, a hand-built call) is validated here, so a malformed publish
+ * path or an unsupported release contract refuses before any command exists.
+ */
+export declare function forgeStepCommand(step: unknown, cliOrigin?: string, publishTargets?: () => ForgeCiPublishTargets): string;
+/**
+ * Compile repository-authored Forge Actions into a provider-neutral CI descriptor.
+ *
+ * `ActionsSchema` validates the authored document, including each nested job
+ * and step, before lowering. Profile jobs are parsed through `JobSchema` when
+ * materialized. A malformed `paths: ['--dry-run']` or
+ * `releaseContractVersion: 1` therefore refuses before it can compile into a
+ * command.
+ */
+export declare function compileForgeActionsPipeline(input: CompileForgeActionsPipelineInput): CiPipelineDescriptor;
+/** Operational entrypoint: retain the pure compiler while resolving the host's CLI target, profile catalog, and publish targets. */
+export declare function compileForgeActionsPipelineForRuntime(runtime: RuntimeRef, input: CompileForgeActionsPipelineInput): Promise<CiPipelineDescriptor>;
+/** Operational dispatch uses the same installer, step validation, and publish-target selection as pipeline compilation. */
+export declare function forgeStepShellCommandForRuntime(runtime: RuntimeRef, step: unknown): Promise<string>;
+//# sourceMappingURL=actions-pipeline.d.ts.map

package/dist/ci/actions-pipeline.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"actions-pipeline.d.ts","sourceRoot":"","sources":["../../src/ci/actions-pipeline.ts"],"names":[],"mappings":"AACA,OAAO,EAAmB,KAAK,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEvE,OAAO,EAA2B,KAAK,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAGtF,OAAO,EAA4B,KAAK,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAE7F,OAAO,KAAK,EAAiB,oBAAoB,EAA2B,MAAM,cAAc,CAAC;AACjG,OAAO,EAUN,KAAK,YAAY,EACjB,KAAK,oBAAoB,EAEzB,KAAK,QAAQ,EAEb,KAAK,IAAI,EACT,MAAM,uBAAuB,CAAC;AAE/B,eAAO,MAAM,yBAAyB,kBAAkB,CAAC;AACzD,eAAO,MAAM,kBAAkB,uBAAuB,CAAC;AAEvD,MAAM,WAAW,gCAAgC;IAChD;;;;OAIG;IACH,OAAO,EAAE,YAAY,CAAC;IACtB,2DAA2D;IAC3D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,uHAAuH;IACvH,QAAQ,CAAC,EAAE,MAAM,eAAe,CAAC;IACjC,yIAAyI;IACzI,cAAc,CAAC,EAAE,MAAM,qBAAqB,CAAC;CAC7C;AAED,kFAAkF;AAClF,MAAM,WAAW,8BAA8B;IAC9C,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,oBAAoB,CAAC;IACpC,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,iBAAiB,EAAE,MAAM,CAAC;CAC1B;AAED;;;GAGG;AACH,wBAAgB,qCAAqC,CACpD,GAAG,EAAE,QAAQ,GACX,8BAA8B,CAoBhC;AAoBD;;;;GAIG;AAEH,8EAA8E;AAC9E,eAAO,MAAM,oBAAoB,qBAAqB,CAAC;AAWvD;;;GAGG;AACH,eAAO,MAAM,qBAAqB,+CAA+C,CAAC;AAoElF;;;;;;;;;;;;;GAaG;AACH,wBAAgB,qBAAqB,CACpC,IAAI,EAAE,IAAI,EACV,SAAS,CAAC,EAAE,MAAM,EAClB,cAAc,CAAC,EAAE,MAAM,qBAAqB,GAC1C,MAAM,CAsBR;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC/B,IAAI,EAAE,OAAO,EACb,SAAS,CAAC,EAAE,MAAM,EAClB,cAAc,CAAC,EAAE,MAAM,qBAAqB,GAC1C,MAAM,CAER;AAMD;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CAC1C,KAAK,EAAE,gCAAgC,GACrC,oBAAoB,CA2DtB;AAED,oIAAoI;AACpI,wBAAsB,qCAAqC,CAC1D,OAAO,EAAE,UAAU,EACnB,KAAK,EAAE,gCAAgC,GACrC,OAAO,CAAC,oBAAoB,CAAC,CAc/B;AAED,2HAA2H;AAC3H,wBAAsB,+BAA+B,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAIzG"}