@vibesdotdev/forge 0.0.0-stage → 1.0.0-rc.4

package/dist/cli/commands/forge.clone-url.command.impl.d.ts

@@ -0,0 +1,57 @@
+import type { CommandContext } from '@vibesdotdev/cli';
+import type { UIContext } from '@vibesdotdev/cli/providers';
+import { type VibesRuntime } from '@vibesdotdev/kernel';
+import type { SendForgeRequest } from '../lib/ci-attempts.ts';
+import { type CloneUrlResult, type CredentialFreeCloneUrlResult } from '@vibesdotdev/git-operations/repository/clone-transport';
+export declare const CREDENTIAL_HELPER_CONFIG_COMMAND = "vibes forge setup-git --https --local";
+export type CredentialFreeCloneUrl = CredentialFreeCloneUrlResult;
+export type CloneTransport = 'ssh' | 'https';
+export interface SelectedCloneTransport {
+    cloneUrl: string;
+    cloneUrls: {
+        https?: string;
+        ssh?: string;
+    };
+    transport: CloneTransport;
+}
+export declare function selectCloneTransport(cloneUrls: CredentialFreeCloneUrl['cloneUrls'], requested?: string): SelectedCloneTransport;
+/**
+ * The reserved `vibes-write@` push-intent URL for a credential-free
+ * git.vibes.dev clone URL. A retired behavior per SPEC that still ships
+ * (coordinator ruling 2026-10-03): kept, listed for Drew.
+ */
+export declare function writeIntentPushUrl(cloneUrl: string): string;
+/** The forge transport a clone-url resolution uses (a test replaces it at the network boundary). */
+export interface CloneUrlResolveDeps {
+    resolveRepo: (repoRef: string) => Promise<string>;
+    send: SendForgeRequest;
+}
+/** The forge transport bound to the runtime the command was handed. */
+export declare function cloneUrlResolveDeps(runtime: VibesRuntime): CloneUrlResolveDeps;
+/** The options a clone-url resolution reads. */
+export type CloneUrlOptions = Readonly<{
+    transport?: string;
+}>;
+export declare function resolveCredentialFreeCloneTransport(repoRef: string, opts: CloneUrlOptions, deps: CloneUrlResolveDeps): Promise<{
+    selected: SelectedCloneTransport;
+    repositoryUrl: CredentialFreeCloneUrl;
+}>;
+export declare function warnSelectedHttpsTransport(ui: UIContext, selected: SelectedCloneTransport): void;
+/** Validate durable repository metadata before emitting anything to stdout. */
+export declare function requireCredentialFreeCloneUrl(value: CloneUrlResult): CredentialFreeCloneUrl;
+/** The arguments `forge clone-url` reads. */
+export interface CloneUrlArgs {
+    repo?: string;
+}
+/** The options `forge clone-url` reads, as the CLI hands them. */
+export type CloneUrlCommandOptions = CloneUrlOptions & Readonly<{
+    json?: boolean;
+    format?: string;
+    output?: string;
+}>;
+export declare function execute(args: CloneUrlArgs, opts: CloneUrlCommandOptions, context: CommandContext, deps?: CloneUrlResolveDeps): Promise<void>;
+declare const _default: {
+    execute: typeof execute;
+};
+export default _default;
+//# sourceMappingURL=forge.clone-url.command.impl.d.ts.map

package/dist/cli/commands/forge.clone-url.command.impl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"forge.clone-url.command.impl.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/forge.clone-url.command.impl.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAYvD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAoC,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAG1F,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAG9D,OAAO,EAGN,KAAK,cAAc,EACnB,KAAK,4BAA4B,EACjC,MAAM,wDAAwD,CAAC;AAIhE,eAAO,MAAM,gCAAgC,0CAA0C,CAAC;AAExF,MAAM,MAAM,sBAAsB,GAAG,4BAA4B,CAAC;AAElE,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,OAAO,CAAC;AAE7C,MAAM,WAAW,sBAAsB;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE;QACV,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,GAAG,CAAC,EAAE,MAAM,CAAC;KACb,CAAC;IACF,SAAS,EAAE,cAAc,CAAC;CAC1B;AAID,wBAAgB,oBAAoB,CACnC,SAAS,EAAE,sBAAsB,CAAC,WAAW,CAAC,EAC9C,SAAS,CAAC,EAAE,MAAM,GAChB,sBAAsB,CA2BxB;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAiB3D;AAED,oGAAoG;AACpG,MAAM,WAAW,mBAAmB;IACnC,WAAW,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAClD,IAAI,EAAE,gBAAgB,CAAC;CACvB;AAED,uEAAuE;AACvE,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,YAAY,GAAG,mBAAmB,CAK9E;AAED,gDAAgD;AAChD,MAAM,MAAM,eAAe,GAAG,QAAQ,CAAC;IAAE,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAI/D,wBAAsB,mCAAmC,CACxD,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,eAAe,EACrB,IAAI,EAAE,mBAAmB,GACvB,OAAO,CAAC;IAAE,QAAQ,EAAE,sBAAsB,CAAC;IAAC,aAAa,EAAE,sBAAsB,CAAA;CAAE,CAAC,CAsBtF;AAED,wBAAgB,0BAA0B,CAAC,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,sBAAsB,GAAG,IAAI,CAwBhG;AAKD,+EAA+E;AAC/E,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,cAAc,GAAG,sBAAsB,CAkB3F;AAED,6CAA6C;AAC7C,MAAM,WAAW,YAAY;IAC5B,IAAI,CAAC,EAAE,MAAM,CAAC;CACd;AAED,kEAAkE;AAClE,MAAM,MAAM,sBAAsB,GAAG,eAAe,GAAG,QAAQ,CAAC;IAAE,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAItH,wBAAsB,OAAO,CAC5B,IAAI,EAAE,YAAY,EAClB,IAAI,EAAE,sBAAsB,EAC5B,OAAO,EAAE,cAAc,EACvB,IAAI,CAAC,EAAE,mBAAmB,GACxB,OAAO,CAAC,IAAI,CAAC,CAyCf;;;;AAED,wBAA2B"}

package/dist/cli/commands/forge.clone-url.command.impl.js

@@ -0,0 +1,175 @@
+/**
+ * `vibes forge clone-url <repo>` — print a repository's canonical clone URL.
+ *
+ * Clone URLs are durable repository metadata and never carry credentials. The
+ * bare URL remains the only human-mode STDOUT, written once through the handed
+ * runtime's stdio, so command substitution is safe. Vibes-hosted repositories
+ * use standard Git SSH by default; HTTPS remains an explicit compatibility
+ * transport.
+ */
+import * as z from 'zod/v4';
+import { CapabilityError, getRuntimeStdio } from '@vibesdotdev/kernel';
+import { sendForgeRequest } from "../lib/transport.js";
+import { forgeResponseFailure } from "../../request.js";
+import { resolveRepositoryId } from "../lib/repo-ref.js";
+import { cloneUrlResponseSchema, credentialFreeCloneUrlResultSchema } from '@vibesdotdev/git-operations/repository/clone-transport';
+import { commandUI, printJson, printWarning, wantsJson } from "../lib/output.js";
+import { missingCredentialHelperRemedy } from "../lib/git-credential-setup.js";
+export const CREDENTIAL_HELPER_CONFIG_COMMAND = 'vibes forge setup-git --https --local';
+const CloneTransportSchema = z.enum(['ssh', 'https']);
+export function selectCloneTransport(cloneUrls, requested) {
+    const choice = requested === undefined ? undefined : CloneTransportSchema.safeParse(requested);
+    if (choice && !choice.success) {
+        throw new CapabilityError('Clone transport must be `ssh` or `https`.', 'INVALID_INPUT', {
+            reason: 'clone-transport-invalid',
+            retryable: false
+        });
+    }
+    if (choice?.data === 'ssh' && !cloneUrls.ssh) {
+        throw new CapabilityError('This repository service did not publish an SSH clone transport.', 'UNAVAILABLE', {
+            reason: 'clone-transport-unpublished',
+            retryable: false
+        });
+    }
+    const transport = choice?.data ?? (cloneUrls.ssh ? 'ssh' : 'https');
+    const cloneUrl = transport === 'ssh' ? cloneUrls.ssh : cloneUrls.https;
+    if (!cloneUrl) {
+        throw new CapabilityError('This repository service did not publish the requested clone transport.', 'UNAVAILABLE', {
+            reason: 'clone-transport-unpublished',
+            retryable: false
+        });
+    }
+    return {
+        cloneUrl,
+        cloneUrls,
+        transport
+    };
+}
+/**
+ * The reserved `vibes-write@` push-intent URL for a credential-free
+ * git.vibes.dev clone URL. A retired behavior per SPEC that still ships
+ * (coordinator ruling 2026-10-03): kept, listed for Drew.
+ */
+export function writeIntentPushUrl(cloneUrl) {
+    const url = URL.canParse(cloneUrl) ? new URL(cloneUrl) : null;
+    if (!url ||
+        url.protocol !== 'https:' ||
+        url.hostname !== 'git.vibes.dev' ||
+        url.username ||
+        url.password) {
+        throw new CapabilityError('A write-intent push URL requires a credential-free git.vibes.dev clone URL.', 'INVALID_INPUT', { reason: 'write-intent-url-invalid', retryable: false });
+    }
+    url.username = 'vibes-write';
+    return url.toString();
+}
+/** The forge transport bound to the runtime the command was handed. */
+export function cloneUrlResolveDeps(runtime) {
+    return {
+        resolveRepo: (repoRef) => resolveRepositoryId(runtime, repoRef),
+        send: (spec) => sendForgeRequest(runtime, spec)
+    };
+}
+const CloneUrlOptionsSchema = z.object({ transport: z.string().optional().catch(undefined) });
+export async function resolveCredentialFreeCloneTransport(repoRef, opts, deps) {
+    const { resolveRepo, send } = deps;
+    const options = CloneUrlOptionsSchema.safeParse(opts);
+    const id = await resolveRepo(repoRef);
+    const res = await send({
+        method: 'GET',
+        path: `/api/repositories/${encodeURIComponent(id)}/clone-url`,
+        query: { credential: 'omit' }
+    });
+    if (!res.ok)
+        throw forgeResponseFailure(res);
+    const wire = cloneUrlResponseSchema.safeParse(res.data);
+    if (!wire.success) {
+        throw new CapabilityError('Forge returned an invalid clone response; refusing to print it.', 'UNAVAILABLE', {
+            reason: 'clone-metadata-invalid',
+            retryable: false
+        });
+    }
+    const repositoryUrl = requireCredentialFreeCloneUrl(wire.data.result);
+    return {
+        selected: selectCloneTransport(repositoryUrl.cloneUrls, options.success ? options.data.transport : undefined),
+        repositoryUrl
+    };
+}
+export function warnSelectedHttpsTransport(ui, selected) {
+    const { cloneUrl, cloneUrls, transport } = selected;
+    if (transport === 'https' &&
+        cloneUrls.https &&
+        new URL(cloneUrls.https).hostname === 'git.vibes.dev') {
+        printWarning(ui, '[forge] HTTPS is an explicit user-selected Smart Git transport.\n' +
+            `  Enable repository-scoped clone/fetch/push: ${CREDENTIAL_HELPER_CONFIG_COMMAND}\n` +
+            '  Verify: vibes forge setup-git --https --local --check\n' +
+            `[forge] If git prompts for a Password / Device not configured:\n` +
+            missingCredentialHelperRemedy()
+                .split('\n')
+                .map((line) => (line.startsWith('[forge]') ? line : `  ${line}`))
+                .join('\n'));
+    }
+    else if (transport === 'https') {
+        printWarning(ui, `[forge] ${new URL(cloneUrl).hostname} authentication is handled by that provider's credential helper.`);
+    }
+}
+/** A clone result the forge marked credential-bearing, read without trusting its shape. */
+const AuthenticatedCloneUrlSchema = z.object({ authenticated: z.literal(true) });
+/** Validate durable repository metadata before emitting anything to stdout. */
+export function requireCredentialFreeCloneUrl(value) {
+    if (AuthenticatedCloneUrlSchema.safeParse(value).success) {
+        throw new CapabilityError('Forge returned a credential-bearing clone URL; refusing to print it.', 'UNAVAILABLE', {
+            reason: 'clone-url-credential-bearing',
+            retryable: false
+        });
+    }
+    const parsed = credentialFreeCloneUrlResultSchema.safeParse(value);
+    if (!parsed.success) {
+        // Only the schema's own authored text names the defect; never a value.
+        const issue = parsed.error.issues.find((candidate) => candidate.code === 'custom');
+        const detail = issue?.message ?? 'invalid clone metadata';
+        throw new CapabilityError(`Forge returned unsafe clone metadata; refusing to print it (${detail}).`, 'UNAVAILABLE', {
+            reason: 'clone-metadata-unsafe',
+            retryable: false
+        });
+    }
+    return parsed.data;
+}
+const CloneUrlArgsSchema = z.object({ repo: z.string().trim().catch('') });
+export async function execute(args, opts, context, deps) {
+    const ui = commandUI(context);
+    const parsedArgs = CloneUrlArgsSchema.safeParse(args);
+    const repoRef = parsedArgs.success ? parsedArgs.data.repo : '';
+    if (!repoRef) {
+        throw new CapabilityError('Usage: vibes forge clone-url <repo>', 'INVALID_INPUT', {
+            reason: 'command-usage',
+            retryable: false
+        });
+    }
+    const { selected, repositoryUrl } = await resolveCredentialFreeCloneTransport(repoRef, opts, deps ?? cloneUrlResolveDeps(context.runtime));
+    const { cloneUrl, cloneUrls, transport } = selected;
+    if (wantsJson(opts)) {
+        printJson(ui, {
+            cloneUrl,
+            cloneUrls,
+            transport,
+            authenticated: repositoryUrl.authenticated,
+            authentication: transport === 'ssh'
+                ? {
+                    method: 'ssh-key',
+                    register: 'vibes forge ssh-key add <name>'
+                }
+                : cloneUrls.https && new URL(cloneUrls.https).hostname === 'git.vibes.dev'
+                    ? {
+                        method: 'vibes-auth-ephemeral-git-credential',
+                        configure: CREDENTIAL_HELPER_CONFIG_COMMAND,
+                        nativePush: true
+                    }
+                    : { method: 'provider-credential-helper-required' }
+        });
+        return;
+    }
+    warnSelectedHttpsTransport(ui, selected);
+    (await getRuntimeStdio(context.runtime)).write('stdout', `${cloneUrl}\n`);
+}
+export default { execute };
+//# sourceMappingURL=forge.clone-url.command.impl.js.map

package/dist/cli/commands/forge.clone-url.command.impl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"forge.clone-url.command.impl.js","sourceRoot":"","sources":["../../../src/cli/commands/forge.clone-url.command.impl.ts"],"names":[],"mappings":"AACA;;;;;;;;GAQG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,OAAO,EAAE,eAAe,EAAE,eAAe,EAAqB,MAAM,qBAAqB,CAAC;AAC1F,OAAO,EAAE,gBAAgB,EAAyB,MAAM,qBAAqB,CAAC;AAC9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAExD,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD,OAAO,EACN,sBAAsB,EACtB,kCAAkC,EAGlC,MAAM,wDAAwD,CAAC;AAChE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACjF,OAAO,EAAE,6BAA6B,EAAE,MAAM,gCAAgC,CAAC;AAE/E,MAAM,CAAC,MAAM,gCAAgC,GAAG,uCAAuC,CAAC;AAexF,MAAM,oBAAoB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;AAEtD,MAAM,UAAU,oBAAoB,CACnC,SAA8C,EAC9C,SAAkB;IAElB,MAAM,MAAM,GAAG,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,oBAAoB,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IAC/F,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QAC/B,MAAM,IAAI,eAAe,CAAC,2CAA2C,EAAE,eAAe,EAAE;YACvF,MAAM,EAAE,yBAAyB;YACjC,SAAS,EAAE,KAAK;SAChB,CAAC,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,EAAE,IAAI,KAAK,KAAK,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC;QAC9C,MAAM,IAAI,eAAe,CAAC,iEAAiE,EAAE,aAAa,EAAE;YAC3G,MAAM,EAAE,6BAA6B;YACrC,SAAS,EAAE,KAAK;SAChB,CAAC,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACpE,MAAM,QAAQ,GAAG,SAAS,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC;IACvE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACf,MAAM,IAAI,eAAe,CAAC,wEAAwE,EAAE,aAAa,EAAE;YAClH,MAAM,EAAE,6BAA6B;YACrC,SAAS,EAAE,KAAK;SAChB,CAAC,CAAC;IACJ,CAAC;IACD,OAAO;QACN,QAAQ;QACR,SAAS;QACT,SAAS;KACT,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAAgB;IAClD,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9D,IACC,CAAC,GAAG;QACJ,GAAG,CAAC,QAAQ,KAAK,QAAQ;QACzB,GAAG,CAAC,QAAQ,KAAK,eAAe;QAChC,GAAG,CAAC,QAAQ;QACZ,GAAG,CAAC,QAAQ,EACX,CAAC;QACF,MAAM,IAAI,eAAe,CACxB,6EAA6E,EAC7E,eAAe,EACf,EAAE,MAAM,EAAE,0BAA0B,EAAE,SAAS,EAAE,KAAK,EAAE,CACxD,CAAC;IACH,CAAC;IACD,GAAG,CAAC,QAAQ,GAAG,aAAa,CAAC;IAC7B,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACvB,CAAC;AAQD,uEAAuE;AACvE,MAAM,UAAU,mBAAmB,CAAC,OAAqB;IACxD,OAAO;QACN,WAAW,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC;QAC/D,IAAI,EAAE,CAAI,IAAsB,EAAE,EAAE,CAAC,gBAAgB,CAAI,OAAO,EAAE,IAAI,CAAC;KACvE,CAAC;AACH,CAAC;AAKD,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;AAE9F,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACxD,OAAe,EACf,IAAqB,EACrB,IAAyB;IAEzB,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;IACnC,MAAM,OAAO,GAAG,qBAAqB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACtD,MAAM,EAAE,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAmB;QACxC,MAAM,EAAE,KAAK;QACb,IAAI,EAAE,qBAAqB,kBAAkB,CAAC,EAAE,CAAC,YAAY;QAC7D,KAAK,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE;KAC7B,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,oBAAoB,CAAC,GAAG,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,sBAAsB,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACxD,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QACnB,MAAM,IAAI,eAAe,CAAC,iEAAiE,EAAE,aAAa,EAAE;YAC3G,MAAM,EAAE,wBAAwB;YAChC,SAAS,EAAE,KAAK;SAChB,CAAC,CAAC;IACJ,CAAC;IACD,MAAM,aAAa,GAAG,6BAA6B,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACtE,OAAO;QACN,QAAQ,EAAE,oBAAoB,CAAC,aAAa,CAAC,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7G,aAAa;KACb,CAAC;AACH,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,EAAa,EAAE,QAAgC;IACzF,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,QAAQ,CAAC;IACpD,IACC,SAAS,KAAK,OAAO;QACrB,SAAS,CAAC,KAAK;QACf,IAAI,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,QAAQ,KAAK,eAAe,EACpD,CAAC;QACF,YAAY,CACX,EAAE,EACF,mEAAmE;YAClE,gDAAgD,gCAAgC,IAAI;YACpF,2DAA2D;YAC3D,kEAAkE;YAClE,6BAA6B,EAAE;iBAC7B,KAAK,CAAC,IAAI,CAAC;iBACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;iBAChE,IAAI,CAAC,IAAI,CAAC,CACb,CAAC;IACH,CAAC;SAAM,IAAI,SAAS,KAAK,OAAO,EAAE,CAAC;QAClC,YAAY,CACX,EAAE,EACF,WAAW,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,QAAQ,kEAAkE,CACvG,CAAC;IACH,CAAC;AACF,CAAC;AAED,2FAA2F;AAC3F,MAAM,2BAA2B,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAEjF,+EAA+E;AAC/E,MAAM,UAAU,6BAA6B,CAAC,KAAqB;IAClE,IAAI,2BAA2B,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;QAC1D,MAAM,IAAI,eAAe,CAAC,sEAAsE,EAAE,aAAa,EAAE;YAChH,MAAM,EAAE,8BAA8B;YACtC,SAAS,EAAE,KAAK;SAChB,CAAC,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,kCAAkC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACnE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,uEAAuE;QACvE,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;QACnF,MAAM,MAAM,GAAG,KAAK,EAAE,OAAO,IAAI,wBAAwB,CAAC;QAC1D,MAAM,IAAI,eAAe,CAAC,+DAA+D,MAAM,IAAI,EAAE,aAAa,EAAE;YACnH,MAAM,EAAE,uBAAuB;YAC/B,SAAS,EAAE,KAAK;SAChB,CAAC,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACpB,CAAC;AAUD,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;AAE3E,MAAM,CAAC,KAAK,UAAU,OAAO,CAC5B,IAAkB,EAClB,IAA4B,EAC5B,OAAuB,EACvB,IAA0B;IAE1B,MAAM,EAAE,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAC9B,MAAM,UAAU,GAAG,kBAAkB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/D,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,MAAM,IAAI,eAAe,CAAC,qCAAqC,EAAE,eAAe,EAAE;YACjF,MAAM,EAAE,eAAe;YACvB,SAAS,EAAE,KAAK;SAChB,CAAC,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,GAAG,MAAM,mCAAmC,CAC5E,OAAO,EACP,IAAI,EACJ,IAAI,IAAI,mBAAmB,CAAC,OAAO,CAAC,OAAO,CAAC,CAC5C,CAAC;IACF,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,QAAQ,CAAC;IACpD,IAAI,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,SAAS,CAAC,EAAE,EAAE;YACb,QAAQ;YACR,SAAS;YACT,SAAS;YACT,aAAa,EAAE,aAAa,CAAC,aAAa;YAC1C,cAAc,EACb,SAAS,KAAK,KAAK;gBAClB,CAAC,CAAC;oBACA,MAAM,EAAE,SAAS;oBACjB,QAAQ,EAAE,gCAAgC;iBAC1C;gBACF,CAAC,CAAC,SAAS,CAAC,KAAK,IAAI,IAAI,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,QAAQ,KAAK,eAAe;oBACzE,CAAC,CAAC;wBACA,MAAM,EAAE,qCAAqC;wBAC7C,SAAS,EAAE,gCAAgC;wBAC3C,UAAU,EAAE,IAAI;qBAChB;oBACF,CAAC,CAAC,EAAE,MAAM,EAAE,qCAAqC,EAAE;SACtD,CAAC,CAAC;QACH,OAAO;IACR,CAAC;IACD,0BAA0B,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IACzC,CAAC,MAAM,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,QAAQ,IAAI,CAAC,CAAC;AAC3E,CAAC;AAED,eAAe,EAAE,OAAO,EAAE,CAAC"}

package/dist/cli/commands/forge.clone.command.descriptor.d.ts

@@ -0,0 +1,36 @@
+export declare const cloneCommandDescriptor: {
+    readonly kind: "cli/command";
+    readonly id: "forge.clone";
+    readonly name: "clone";
+    readonly description: "Clone a repository using the service-published credential-free clone URL";
+    readonly group: "forge";
+    readonly arguments: [{
+        readonly name: "repo";
+        readonly description: "Repository id, <owner>/<name>, or bare name";
+        readonly required: true;
+    }, {
+        readonly name: "directory";
+        readonly description: "Target directory (defaults to the repository name git would choose)";
+        readonly required: false;
+    }];
+    readonly options: [{
+        readonly flags: "--transport <transport>";
+        readonly description: "Select ssh or https (default: best transport published by the service)";
+        readonly choices: ["ssh", "https"];
+    }];
+    readonly surfaces: ["cli"];
+    readonly hardware: readonly ["consumer"];
+    readonly enabled: true;
+    readonly order: 39;
+    readonly examples: [{
+        readonly command: "vibes forge clone my-app";
+        readonly description: "Clone my-app with the service-published default transport";
+        readonly expectExit: 0;
+    }, {
+        readonly command: "vibes forge clone my-app ./my-app --transport https";
+        readonly description: "Clone into a directory over the HTTPS compatibility transport";
+        readonly expectExit: 0;
+    }];
+};
+export default cloneCommandDescriptor;
+//# sourceMappingURL=forge.clone.command.descriptor.d.ts.map

package/dist/cli/commands/forge.clone.command.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"forge.clone.command.descriptor.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/forge.clone.command.descriptor.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAqCjC,CAAC;AAEH,eAAe,sBAAsB,CAAC"}

package/dist/cli/commands/forge.clone.command.descriptor.js

@@ -0,0 +1,41 @@
+import { createRuntimeAsset } from '@vibesdotdev/kernel';
+export const cloneCommandDescriptor = createRuntimeAsset({
+    kind: 'cli/command',
+    id: 'forge.clone',
+    name: 'clone',
+    description: 'Clone a repository using the service-published credential-free clone URL',
+    group: 'forge',
+    arguments: [
+        { name: 'repo', description: 'Repository id, <owner>/<name>, or bare name', required: true },
+        {
+            name: 'directory',
+            description: 'Target directory (defaults to the repository name git would choose)',
+            required: false
+        }
+    ],
+    options: [
+        {
+            flags: '--transport <transport>',
+            description: 'Select ssh or https (default: best transport published by the service)',
+            choices: ['ssh', 'https']
+        }
+    ],
+    surfaces: ['cli'],
+    hardware: ['consumer'],
+    enabled: true,
+    order: 39,
+    examples: [
+        {
+            command: 'vibes forge clone my-app',
+            description: 'Clone my-app with the service-published default transport',
+            expectExit: 0
+        },
+        {
+            command: 'vibes forge clone my-app ./my-app --transport https',
+            description: 'Clone into a directory over the HTTPS compatibility transport',
+            expectExit: 0
+        }
+    ]
+});
+export default cloneCommandDescriptor;
+//# sourceMappingURL=forge.clone.command.descriptor.js.map

package/dist/cli/commands/forge.clone.command.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"forge.clone.command.descriptor.js","sourceRoot":"","sources":["../../../src/cli/commands/forge.clone.command.descriptor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEzD,MAAM,CAAC,MAAM,sBAAsB,GAAG,kBAAkB,CAAC;IACxD,IAAI,EAAE,aAAa;IACnB,EAAE,EAAE,aAAa;IACjB,IAAI,EAAE,OAAO;IACb,WAAW,EAAE,0EAA0E;IACvF,KAAK,EAAE,OAAO;IACd,SAAS,EAAE;QACV,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,6CAA6C,EAAE,QAAQ,EAAE,IAAI,EAAE;QAC5F;YACC,IAAI,EAAE,WAAW;YACjB,WAAW,EAAE,qEAAqE;YAClF,QAAQ,EAAE,KAAK;SACf;KACD;IACD,OAAO,EAAE;QACR;YACC,KAAK,EAAE,yBAAyB;YAChC,WAAW,EAAE,wEAAwE;YACrF,OAAO,EAAE,CAAC,KAAK,EAAE,OAAO,CAAC;SACzB;KACD;IACD,QAAQ,EAAE,CAAC,KAAK,CAAC;IACjB,QAAQ,EAAE,CAAC,UAAU,CAAC;IACtB,OAAO,EAAE,IAAI;IACb,KAAK,EAAE,EAAE;IACT,QAAQ,EAAE;QACT;YACC,OAAO,EAAE,0BAA0B;YACnC,WAAW,EAAE,2DAA2D;YACxE,UAAU,EAAE,CAAC;SACb;QACD;YACC,OAAO,EAAE,qDAAqD;YAC9D,WAAW,EAAE,+DAA+D;YAC5E,UAAU,EAAE,CAAC;SACb;KACD;CACD,CAAC,CAAC;AAEH,eAAe,sBAAsB,CAAC"}

package/dist/cli/commands/forge.clone.command.impl.d.ts

@@ -0,0 +1,34 @@
+import type { CommandContext } from '@vibesdotdev/cli';
+import { type VibesRuntime } from '@vibesdotdev/kernel';
+import { type GitExec } from '../lib/git-credential-setup.node.ts';
+import { type CloneUrlOptions, type SelectedCloneTransport } from './forge.clone-url.command.impl.ts';
+export interface ForgeCloneDeps {
+    resolveCloneUrl?: (repoRef: string, opts: CloneUrlOptions) => Promise<SelectedCloneTransport>;
+    gitExec?: GitExec;
+}
+/**
+ * `git clone` with its progress on the terminal: the host's `runtime/execution`
+ * spawns git with the host's stdout and stderr inherited and no stdin. The child
+ * gets only the kernel's composed git environment (`gitChildEnvironment` over
+ * the handed runtime), never the whole host environment.
+ */
+export declare function inheritGitExec(runtime: VibesRuntime): GitExec;
+export declare function buildGitCloneArgv(cloneUrl: string, directory?: string): string[];
+/** The arguments `forge clone` reads. */
+export interface ForgeCloneArgs {
+    repo?: string;
+    directory?: string;
+}
+/** The options `forge clone` reads, as the CLI hands them. */
+export type ForgeCloneOptions = CloneUrlOptions & Readonly<{
+    cwd?: string;
+    json?: boolean;
+    format?: string;
+    output?: string;
+}>;
+export declare function execute(args: ForgeCloneArgs, opts: ForgeCloneOptions, context: CommandContext, deps?: ForgeCloneDeps): Promise<void>;
+declare const _default: {
+    execute: typeof execute;
+};
+export default _default;
+//# sourceMappingURL=forge.clone.command.impl.d.ts.map

package/dist/cli/commands/forge.clone.command.impl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"forge.clone.command.impl.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/forge.clone.command.impl.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAWvD,OAAO,EAAsC,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAI5F,OAAO,EAAkB,KAAK,OAAO,EAAE,MAAM,qCAAqC,CAAC;AAEnF,OAAO,EAIN,KAAK,eAAe,EACpB,KAAK,sBAAsB,EAC3B,MAAM,mCAAmC,CAAC;AAE3C,MAAM,WAAW,cAAc;IAC9B,eAAe,CAAC,EAAE,CACjB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,eAAe,KACjB,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACrC,OAAO,CAAC,EAAE,OAAO,CAAC;CAClB;AAsBD;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAkB7D;AAeD,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAEhF;AAED,yCAAyC;AACzC,MAAM,WAAW,cAAc;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,8DAA8D;AAC9D,MAAM,MAAM,iBAAiB,GAAG,eAAe,GAAG,QAAQ,CAAC;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAS/H,wBAAsB,OAAO,CAC5B,IAAI,EAAE,cAAc,EACpB,IAAI,EAAE,iBAAiB,EACvB,OAAO,EAAE,cAAc,EACvB,IAAI,GAAE,cAAmB,GACvB,OAAO,CAAC,IAAI,CAAC,CA4Cf;;;;AAED,wBAA2B"}

package/dist/cli/commands/forge.clone.command.impl.js

@@ -0,0 +1,115 @@
+/**
+ * `vibes forge clone <repo> [directory]` — clone via the credential-free URL.
+ *
+ * Resolves the same durable metadata as `vibes forge clone-url`, then runs
+ * `git clone <url> [directory]` through the handed runtime's execution
+ * (`runtime/execution`). Git remains the transport; this command never prints
+ * credentials.
+ */
+import * as z from 'zod/v4';
+import { CapabilityError, requireRuntimeCwd } from '@vibesdotdev/kernel';
+import { getRuntimeExecution } from '@vibesdotdev/kernel/execution';
+import { redactedCause } from "../../failures.js";
+import { commandUI, printJson, wantsJson } from "../lib/output.js";
+import { runtimeGitExec } from "../lib/git-credential-setup.node.js";
+import { gitChildEnvironment } from "./forge.push.command.impl.js";
+import { cloneUrlResolveDeps, resolveCredentialFreeCloneTransport, warnSelectedHttpsTransport } from "./forge.clone-url.command.impl.js";
+function gitCloneArgv(cloneUrl, directory) {
+    return directory ? ['clone', cloneUrl, directory] : ['clone', cloneUrl];
+}
+function assertNoCloneCredentials(cloneUrl) {
+    if (!URL.canParse(cloneUrl)) {
+        throw new CapabilityError('Forge returned unsafe clone metadata; refusing to use it.', 'UNAVAILABLE', {
+            reason: 'clone-metadata-unsafe',
+            retryable: false
+        });
+    }
+    const url = new URL(cloneUrl);
+    if (url.password || url.search || url.hash) {
+        throw new CapabilityError('Forge returned a credential-bearing clone URL; refusing to use it.', 'UNAVAILABLE', {
+            reason: 'clone-url-credential-bearing',
+            retryable: false
+        });
+    }
+}
+/**
+ * `git clone` with its progress on the terminal: the host's `runtime/execution`
+ * spawns git with the host's stdout and stderr inherited and no stdin. The child
+ * gets only the kernel's composed git environment (`gitChildEnvironment` over
+ * the handed runtime), never the whole host environment.
+ */
+export function inheritGitExec(runtime) {
+    const env = gitChildEnvironment(runtime);
+    return async (args, options) => {
+        const execution = await getRuntimeExecution(runtime);
+        const child = await execution.spawn({
+            command: 'git',
+            args,
+            cwd: options?.cwd,
+            env,
+            envMode: 'replace',
+            stdin: 'ignore',
+            stdout: 'inherit',
+            stderr: 'inherit',
+            killTree: true
+        });
+        const exited = await child.exited;
+        return { code: exited.code ?? 1, stdout: '', stderr: '' };
+    };
+}
+async function defaultResolveCloneUrl(runtime, repoRef, opts) {
+    const { selected } = await resolveCredentialFreeCloneTransport(repoRef, opts, cloneUrlResolveDeps(runtime));
+    return selected;
+}
+export function buildGitCloneArgv(cloneUrl, directory) {
+    return gitCloneArgv(cloneUrl, directory);
+}
+const ForgeCloneArgsSchema = z.object({
+    repo: z.string().trim().catch(''),
+    directory: z.string().trim().catch('')
+});
+const ForgeCloneOptionsSchema = z.object({ cwd: z.string().min(1).optional().catch(undefined) });
+export async function execute(args, opts, context, deps = {}) {
+    const ui = commandUI(context);
+    const parsedArgs = ForgeCloneArgsSchema.safeParse(args);
+    const repoRef = parsedArgs.success ? parsedArgs.data.repo : '';
+    const directory = parsedArgs.success && parsedArgs.data.directory ? parsedArgs.data.directory : undefined;
+    if (!repoRef) {
+        throw new CapabilityError('Usage: vibes forge clone <repo> [directory]', 'INVALID_INPUT', {
+            reason: 'command-usage',
+            retryable: false
+        });
+    }
+    const resolveCloneUrl = deps.resolveCloneUrl ??
+        ((ref, options) => defaultResolveCloneUrl(context.runtime, ref, options));
+    const gitExec = deps.gitExec ?? (wantsJson(opts) ? runtimeGitExec(context.runtime) : inheritGitExec(context.runtime));
+    // `--cwd`, else the host's working directory; never the process's.
+    const options = ForgeCloneOptionsSchema.safeParse(opts);
+    const cwd = (options.success ? options.data.cwd : undefined) ?? requireRuntimeCwd(context.runtime);
+    const selected = await resolveCloneUrl(repoRef, opts);
+    assertNoCloneCredentials(selected.cloneUrl);
+    if (!wantsJson(opts))
+        warnSelectedHttpsTransport(ui, selected);
+    const gitArgs = gitCloneArgv(selected.cloneUrl, directory);
+    const result = await gitExec(gitArgs, { cwd });
+    if (result.code !== 0) {
+        // Git's own text rides only as the redacted cause, never the message.
+        const output = result.stderr.trim() || result.stdout.trim();
+        throw new CapabilityError('git clone failed.', 'UNAVAILABLE', {
+            reason: 'git-clone-failed',
+            retryable: false,
+            details: { exitCode: result.code },
+            cause: output ? redactedCause(output) : undefined
+        });
+    }
+    if (wantsJson(opts)) {
+        printJson(ui, {
+            ok: true,
+            cloneUrl: selected.cloneUrl,
+            directory: directory ?? null,
+            transport: selected.transport
+        });
+    }
+}
+export default { execute };
+//# sourceMappingURL=forge.clone.command.impl.js.map

package/dist/cli/commands/forge.clone.command.impl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"forge.clone.command.impl.js","sourceRoot":"","sources":["../../../src/cli/commands/forge.clone.command.impl.ts"],"names":[],"mappings":"AACA;;;;;;;GAOG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAqB,MAAM,qBAAqB,CAAC;AAC5F,OAAO,EAAE,mBAAmB,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAgB,MAAM,qCAAqC,CAAC;AACnF,OAAO,EAAE,mBAAmB,EAAE,MAAM,8BAA8B,CAAC;AACnE,OAAO,EACN,mBAAmB,EACnB,mCAAmC,EACnC,0BAA0B,EAG1B,MAAM,mCAAmC,CAAC;AAU3C,SAAS,YAAY,CAAC,QAAgB,EAAE,SAAkB;IACzD,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,wBAAwB,CAAC,QAAgB;IACjD,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,eAAe,CAAC,2DAA2D,EAAE,aAAa,EAAE;YACrG,MAAM,EAAE,uBAAuB;YAC/B,SAAS,EAAE,KAAK;SAChB,CAAC,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC9B,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QAC5C,MAAM,IAAI,eAAe,CAAC,oEAAoE,EAAE,aAAa,EAAE;YAC9G,MAAM,EAAE,8BAA8B;YACtC,SAAS,EAAE,KAAK;SAChB,CAAC,CAAC;IACJ,CAAC;AACF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,OAAqB;IACnD,MAAM,GAAG,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IACzC,OAAO,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE;QAC9B,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,CAAC;QACrD,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC;YACnC,OAAO,EAAE,KAAK;YACd,IAAI;YACJ,GAAG,EAAE,OAAO,EAAE,GAAG;YACjB,GAAG;YACH,OAAO,EAAE,SAAS;YAClB,KAAK,EAAE,QAAQ;YACf,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,SAAS;YACjB,QAAQ,EAAE,IAAI;SACd,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC;QAClC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAC3D,CAAC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,sBAAsB,CACpC,OAAqB,EACrB,OAAe,EACf,IAAqB;IAErB,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,mCAAmC,CAC7D,OAAO,EACP,IAAI,EACJ,mBAAmB,CAAC,OAAO,CAAC,CAC5B,CAAC;IACF,OAAO,QAAQ,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,QAAgB,EAAE,SAAkB;IACrE,OAAO,YAAY,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;AAC1C,CAAC;AAWD,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;IACjC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;CACtC,CAAC,CAAC;AAEH,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;AAEjG,MAAM,CAAC,KAAK,UAAU,OAAO,CAC5B,IAAoB,EACpB,IAAuB,EACvB,OAAuB,EACvB,OAAuB,EAAE;IAEzB,MAAM,EAAE,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAC9B,MAAM,UAAU,GAAG,oBAAoB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACxD,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/D,MAAM,SAAS,GAAG,UAAU,CAAC,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1G,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,MAAM,IAAI,eAAe,CAAC,6CAA6C,EAAE,eAAe,EAAE;YACzF,MAAM,EAAE,eAAe;YACvB,SAAS,EAAE,KAAK;SAChB,CAAC,CAAC;IACJ,CAAC;IAED,MAAM,eAAe,GACpB,IAAI,CAAC,eAAe;QACpB,CAAC,CAAC,GAAW,EAAE,OAAwB,EAAE,EAAE,CAAC,sBAAsB,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC;IACpG,MAAM,OAAO,GACZ,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IACvG,mEAAmE;IACnE,MAAM,OAAO,GAAG,uBAAuB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAEnG,MAAM,QAAQ,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACtD,wBAAwB,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC5C,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;QAAE,0BAA0B,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IAC3D,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IAC/C,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACvB,sEAAsE;QACtE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAC5D,MAAM,IAAI,eAAe,CAAC,mBAAmB,EAAE,aAAa,EAAE;YAC7D,MAAM,EAAE,kBAAkB;YAC1B,SAAS,EAAE,KAAK;YAChB,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE;YAClC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;SACjD,CAAC,CAAC;IACJ,CAAC;IACD,IAAI,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,SAAS,CAAC,EAAE,EAAE;YACb,EAAE,EAAE,IAAI;YACR,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,SAAS,EAAE,SAAS,IAAI,IAAI;YAC5B,SAAS,EAAE,QAAQ,CAAC,SAAS;SAC7B,CAAC,CAAC;IACJ,CAAC;AACF,CAAC;AAED,eAAe,EAAE,OAAO,EAAE,CAAC"}

package/dist/cli/commands/forge.collaborator.add.command.descriptor.d.ts

@@ -0,0 +1,34 @@
+export declare const collaboratorAddCommandDescriptor: {
+    readonly kind: "cli/command";
+    readonly id: "forge.collaborator.add";
+    readonly name: "add";
+    readonly description: "Grant or update a user collaborator role on a repository";
+    readonly group: "forge.collaborator";
+    readonly arguments: [{
+        readonly name: "repo";
+        readonly description: "Repository id, <owner>/<name>, or bare name";
+        readonly required: true;
+    }, {
+        readonly name: "userId";
+        readonly description: "User id to grant access to";
+        readonly required: true;
+    }];
+    readonly options: [{
+        readonly flags: "--role <role>";
+        readonly description: "Grant role (read|write|admin)";
+    }, {
+        readonly flags: "--granted-by-org <id>";
+        readonly description: "Optional org id provenance for automated org-derived grants";
+    }];
+    readonly surfaces: ["cli"];
+    readonly hardware: readonly ["consumer"];
+    readonly enabled: true;
+    readonly order: 20;
+    readonly examples: [{
+        readonly command: "vibes forge collaborator add my-app user_123 --role write";
+        readonly description: "Grant write access to user_123";
+        readonly expectExit: 0;
+    }];
+};
+export default collaboratorAddCommandDescriptor;
+//# sourceMappingURL=forge.collaborator.add.command.descriptor.d.ts.map

package/dist/cli/commands/forge.collaborator.add.command.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"forge.collaborator.add.command.descriptor.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/forge.collaborator.add.command.descriptor.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4B3C,CAAC;AAEH,eAAe,gCAAgC,CAAC"}

package/dist/cli/commands/forge.collaborator.add.command.descriptor.js

@@ -0,0 +1,32 @@
+import { createRuntimeAsset } from '@vibesdotdev/kernel';
+export const collaboratorAddCommandDescriptor = createRuntimeAsset({
+    kind: 'cli/command',
+    id: 'forge.collaborator.add',
+    name: 'add',
+    description: 'Grant or update a user collaborator role on a repository',
+    group: 'forge.collaborator',
+    arguments: [
+        { name: 'repo', description: 'Repository id, <owner>/<name>, or bare name', required: true },
+        { name: 'userId', description: 'User id to grant access to', required: true }
+    ],
+    options: [
+        { flags: '--role <role>', description: 'Grant role (read|write|admin)' },
+        {
+            flags: '--granted-by-org <id>',
+            description: 'Optional org id provenance for automated org-derived grants'
+        }
+    ],
+    surfaces: ['cli'],
+    hardware: ['consumer'],
+    enabled: true,
+    order: 20,
+    examples: [
+        {
+            command: 'vibes forge collaborator add my-app user_123 --role write',
+            description: 'Grant write access to user_123',
+            expectExit: 0
+        }
+    ]
+});
+export default collaboratorAddCommandDescriptor;
+//# sourceMappingURL=forge.collaborator.add.command.descriptor.js.map

package/dist/cli/commands/forge.collaborator.add.command.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"forge.collaborator.add.command.descriptor.js","sourceRoot":"","sources":["../../../src/cli/commands/forge.collaborator.add.command.descriptor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEzD,MAAM,CAAC,MAAM,gCAAgC,GAAG,kBAAkB,CAAC;IAClE,IAAI,EAAE,aAAa;IACnB,EAAE,EAAE,wBAAwB;IAC5B,IAAI,EAAE,KAAK;IACX,WAAW,EAAE,0DAA0D;IACvE,KAAK,EAAE,oBAAoB;IAC3B,SAAS,EAAE;QACV,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,6CAA6C,EAAE,QAAQ,EAAE,IAAI,EAAE;QAC5F,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,4BAA4B,EAAE,QAAQ,EAAE,IAAI,EAAE;KAC7E;IACD,OAAO,EAAE;QACR,EAAE,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,+BAA+B,EAAE;QACxE;YACC,KAAK,EAAE,uBAAuB;YAC9B,WAAW,EAAE,6DAA6D;SAC1E;KACD;IACD,QAAQ,EAAE,CAAC,KAAK,CAAC;IACjB,QAAQ,EAAE,CAAC,UAAU,CAAC;IACtB,OAAO,EAAE,IAAI;IACb,KAAK,EAAE,EAAE;IACT,QAAQ,EAAE;QACT;YACC,OAAO,EAAE,2DAA2D;YACpE,WAAW,EAAE,gCAAgC;YAC7C,UAAU,EAAE,CAAC;SACb;KACD;CACD,CAAC,CAAC;AAEH,eAAe,gCAAgC,CAAC"}

package/dist/cli/commands/forge.collaborator.add.command.impl.d.ts

@@ -0,0 +1,8 @@
+import type { CommandContext } from '@vibesdotdev/cli';
+import type { JsonObject } from '@vibesdotdev/kernel/schemas/json';
+export declare function execute(args: JsonObject, opts: JsonObject, context: CommandContext): Promise<void>;
+declare const _default: {
+    execute: typeof execute;
+};
+export default _default;
+//# sourceMappingURL=forge.collaborator.add.command.impl.d.ts.map

package/dist/cli/commands/forge.collaborator.add.command.impl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"forge.collaborator.add.command.impl.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/forge.collaborator.add.command.impl.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAEvD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kCAAkC,CAAC;AAmBnE,wBAAsB,OAAO,CAC5B,IAAI,EAAE,UAAU,EAChB,IAAI,EAAE,UAAU,EAChB,OAAO,EAAE,cAAc,GACrB,OAAO,CAAC,IAAI,CAAC,CAsCf;;;;AAED,wBAA2B"}

package/dist/cli/commands/forge.collaborator.add.command.impl.js

@@ -0,0 +1,45 @@
+import { CaughtFailureSchema } from '@vibesdotdev/kernel';
+import { sendForgeRequest } from "../lib/transport.js";
+import { resolveRepositoryId } from "../lib/repo-ref.js";
+import { commandUI, printJson, printSuccess, wantsJson } from "../lib/output.js";
+import { buildCollaboratorAddBody, failWithForgeCliAccessError } from "../lib/collaborators.js";
+function isString(value) {
+    return typeof value === 'string';
+}
+export async function execute(args, opts, context) {
+    const { runtime } = context;
+    const ui = commandUI(context);
+    const repoRef = isString(args.repo) ? args.repo.trim() : '';
+    const userId = isString(args.userId) ? args.userId.trim() : '';
+    const outcome = await (async () => {
+        try {
+            if (!repoRef)
+                throw new Error('Usage: vibes forge collaborator add <repo> <user-id> --role <role>');
+            const body = buildCollaboratorAddBody(userId, opts);
+            const id = await resolveRepositoryId(runtime, repoRef);
+            const res = await sendForgeRequest(runtime, {
+                method: 'POST',
+                path: `/api/repositories/${encodeURIComponent(id)}/collaborators`,
+                body
+            });
+            if (!res.ok) {
+                return { ok: false, error: new Error(res.message) };
+            }
+            return { ok: true, collaborator: res.data.result };
+        }
+        catch (error) {
+            return { ok: false, error: CaughtFailureSchema.parse(error) };
+        }
+    })();
+    if (!outcome.ok) {
+        failWithForgeCliAccessError(ui, outcome.error, opts);
+    }
+    if (wantsJson(opts)) {
+        printJson(ui, outcome.collaborator);
+        return;
+    }
+    const collaborator = outcome.collaborator;
+    printSuccess(ui, `Granted ${collaborator.role} access to ${collaborator.userId} on repository ${collaborator.repositoryId}`);
+}
+export default { execute };
+//# sourceMappingURL=forge.collaborator.add.command.impl.js.map