@vibesdotdev/forge 0.0.0-stage → 1.0.0-rc.4

package/dist/cli/commands/forge.token.list.command.descriptor.d.ts

@@ -0,0 +1,24 @@
+export declare const tokenListCommandDescriptor: {
+    readonly kind: "cli/command";
+    readonly id: "forge.token.list";
+    readonly name: "list";
+    readonly description: "List deploy tokens for a repository (never shows plaintext)";
+    readonly group: "forge.token";
+    readonly arguments: [{
+        readonly name: "repo";
+        readonly description: "Repository id, <owner>/<name>, or bare name";
+        readonly required: true;
+    }];
+    readonly options: [];
+    readonly surfaces: ["cli"];
+    readonly hardware: readonly ["consumer"];
+    readonly enabled: true;
+    readonly order: 20;
+    readonly examples: [{
+        readonly command: "vibes forge token list my-app";
+        readonly description: "List the deploy tokens minted for my-app";
+        readonly expectExit: 0;
+    }];
+};
+export default tokenListCommandDescriptor;
+//# sourceMappingURL=forge.token.list.command.descriptor.d.ts.map

package/dist/cli/commands/forge.token.list.command.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"forge.token.list.command.descriptor.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/forge.token.list.command.descriptor.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;CAqBrC,CAAC;AAEH,eAAe,0BAA0B,CAAC"}

package/dist/cli/commands/forge.token.list.command.descriptor.js

@@ -0,0 +1,25 @@
+import { createRuntimeAsset } from '@vibesdotdev/kernel';
+export const tokenListCommandDescriptor = createRuntimeAsset({
+    kind: 'cli/command',
+    id: 'forge.token.list',
+    name: 'list',
+    description: 'List deploy tokens for a repository (never shows plaintext)',
+    group: 'forge.token',
+    arguments: [
+        { name: 'repo', description: 'Repository id, <owner>/<name>, or bare name', required: true }
+    ],
+    options: [],
+    surfaces: ['cli'],
+    hardware: ['consumer'],
+    enabled: true,
+    order: 20,
+    examples: [
+        {
+            command: 'vibes forge token list my-app',
+            description: 'List the deploy tokens minted for my-app',
+            expectExit: 0
+        }
+    ]
+});
+export default tokenListCommandDescriptor;
+//# sourceMappingURL=forge.token.list.command.descriptor.js.map

package/dist/cli/commands/forge.token.list.command.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"forge.token.list.command.descriptor.js","sourceRoot":"","sources":["../../../src/cli/commands/forge.token.list.command.descriptor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEzD,MAAM,CAAC,MAAM,0BAA0B,GAAG,kBAAkB,CAAC;IAC5D,IAAI,EAAE,aAAa;IACnB,EAAE,EAAE,kBAAkB;IACtB,IAAI,EAAE,MAAM;IACZ,WAAW,EAAE,6DAA6D;IAC1E,KAAK,EAAE,aAAa;IACpB,SAAS,EAAE;QACV,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,6CAA6C,EAAE,QAAQ,EAAE,IAAI,EAAE;KAC5F;IACD,OAAO,EAAE,EAAE;IACX,QAAQ,EAAE,CAAC,KAAK,CAAC;IACjB,QAAQ,EAAE,CAAC,UAAU,CAAC;IACtB,OAAO,EAAE,IAAI;IACb,KAAK,EAAE,EAAE;IACT,QAAQ,EAAE;QACT;YACC,OAAO,EAAE,+BAA+B;YACxC,WAAW,EAAE,0CAA0C;YACvD,UAAU,EAAE,CAAC;SACb;KACD;CACD,CAAC,CAAC;AAEH,eAAe,0BAA0B,CAAC"}

package/dist/cli/commands/forge.token.list.command.impl.d.ts

@@ -0,0 +1,8 @@
+import type { CommandContext } from '@vibesdotdev/cli';
+import type { JsonObject } from '@vibesdotdev/kernel/schemas/json';
+export declare function execute(args: JsonObject, opts: JsonObject, context: CommandContext): Promise<void>;
+declare const _default: {
+    execute: typeof execute;
+};
+export default _default;
+//# sourceMappingURL=forge.token.list.command.impl.d.ts.map

package/dist/cli/commands/forge.token.list.command.impl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"forge.token.list.command.impl.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/forge.token.list.command.impl.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kCAAkC,CAAC;AAuBnE,wBAAsB,OAAO,CAC5B,IAAI,EAAE,UAAU,EAChB,IAAI,EAAE,UAAU,EAChB,OAAO,EAAE,cAAc,GACrB,OAAO,CAAC,IAAI,CAAC,CAuDf;;;;AAED,wBAA2B"}

package/dist/cli/commands/forge.token.list.command.impl.js

@@ -0,0 +1,61 @@
+/**
+ * `vibes forge token list <repo>` — list a repository's deploy tokens.
+ *
+ * Requires `admin` server-side. The list NEVER includes the plaintext token —
+ * only summaries (id, name, scopes, timestamps).
+ */
+import { sendForgeRequest, ForgeNotSignedInError, ForgeOriginUnavailableError } from "../lib/transport.js";
+import { resolveRepositoryId, RepoNotFoundError, RepoAmbiguousError } from "../lib/repo-ref.js";
+import { commandUI, failWith, printJson, renderTable, wantsJson } from "../lib/output.js";
+function isString(value) {
+    return typeof value === 'string';
+}
+export async function execute(args, opts, context) {
+    const { runtime } = context;
+    const ui = commandUI(context);
+    const repoRef = isString(args.repo) ? args.repo.trim() : '';
+    if (!repoRef) {
+        failWith(ui, 'Usage: vibes forge token list <repo>', opts);
+        return;
+    }
+    const outcome = await (async () => {
+        try {
+            const id = await resolveRepositoryId(runtime, repoRef);
+            const res = await sendForgeRequest(runtime, {
+                method: 'GET',
+                path: `/api/repositories/${encodeURIComponent(id)}/tokens`
+            });
+            if (!res.ok) {
+                return { ok: false, error: new Error(res.message) };
+            }
+            return { ok: true, tokens: res.data.results ?? [] };
+        }
+        catch (error) {
+            return { ok: false, error };
+        }
+    })();
+    if (!outcome.ok) {
+        if (outcome.error instanceof ForgeNotSignedInError ||
+            outcome.error instanceof ForgeOriginUnavailableError ||
+            outcome.error instanceof RepoNotFoundError ||
+            outcome.error instanceof RepoAmbiguousError) {
+            failWith(ui, outcome.error.message, opts);
+            return;
+        }
+        failWith(ui, outcome.error instanceof Error ? outcome.error.message : String(outcome.error), opts);
+        return;
+    }
+    const { tokens } = outcome;
+    if (wantsJson(opts)) {
+        printJson(ui, tokens);
+        return;
+    }
+    renderTable(ui, tokens, [
+        { header: 'NAME', width: 24, value: (t) => t.name },
+        { header: 'SCOPES', width: 24, value: (t) => (t.scopes ?? []).join(',') },
+        { header: 'LAST USED', width: 24, value: (t) => t.lastUsedAt ?? 'never' },
+        { header: 'ID', width: 36, value: (t) => t.id }
+    ], `No deploy tokens found for ${repoRef}.`);
+}
+export default { execute };
+//# sourceMappingURL=forge.token.list.command.impl.js.map

package/dist/cli/commands/forge.token.list.command.impl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"forge.token.list.command.impl.js","sourceRoot":"","sources":["../../../src/cli/commands/forge.token.list.command.impl.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AAEH,OAAO,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAC3G,OAAO,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAEhG,OAAO,EACN,SAAS,EACT,QAAQ,EACR,SAAS,EACT,WAAW,EACX,SAAS,EACT,MAAM,kBAAkB,CAAC;AAE1B,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC;AAClC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAC5B,IAAgB,EAChB,IAAgB,EAChB,OAAuB;IAEvB,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAC5B,MAAM,EAAE,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAC9B,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5D,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,QAAQ,CAAC,EAAE,EAAE,sCAAsC,EAAE,IAAI,CAAC,CAAC;QAC3D,OAAO;IACR,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE;QACjC,IAAI,CAAC;YACJ,MAAM,EAAE,GAAG,MAAM,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACvD,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAA0B,OAAO,EAAE;gBACpE,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,qBAAqB,kBAAkB,CAAC,EAAE,CAAC,SAAS;aAC1D,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACb,OAAO,EAAE,EAAE,EAAE,KAAc,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9D,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,IAAa,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;QAC9D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,OAAO,EAAE,EAAE,EAAE,KAAc,EAAE,KAAK,EAAE,CAAC;QACtC,CAAC;IACF,CAAC,CAAC,EAAE,CAAC;IAEL,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QACjB,IACC,OAAO,CAAC,KAAK,YAAY,qBAAqB;YAC9C,OAAO,CAAC,KAAK,YAAY,2BAA2B;YACpD,OAAO,CAAC,KAAK,YAAY,iBAAiB;YAC1C,OAAO,CAAC,KAAK,YAAY,kBAAkB,EAC1C,CAAC;YACF,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAC1C,OAAO;QACR,CAAC;QACD,QAAQ,CAAC,EAAE,EAAE,OAAO,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,CAAC;QACnG,OAAO;IACR,CAAC;IAED,MAAM,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IAC3B,IAAI,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,SAAS,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;QACtB,OAAO;IACR,CAAC;IACD,WAAW,CACV,EAAE,EACF,MAAM,EACN;QACC,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE;QACnD,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QACzE,EAAE,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,IAAI,OAAO,EAAE;QACzE,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;KAC/C,EACD,8BAA8B,OAAO,GAAG,CACxC,CAAC;AACH,CAAC;AAED,eAAe,EAAE,OAAO,EAAE,CAAC"}

package/dist/cli/commands/forge.token.mint.command.descriptor.d.ts

@@ -0,0 +1,33 @@
+export declare const tokenMintCommandDescriptor: {
+    readonly kind: "cli/command";
+    readonly id: "forge.token.mint";
+    readonly name: "mint";
+    readonly description: "Mint a deploy token for a repository (plaintext printed ONCE to STDOUT)";
+    readonly group: "forge.token";
+    readonly arguments: [{
+        readonly name: "repo";
+        readonly description: "Repository id, <owner>/<name>, or bare name";
+        readonly required: true;
+    }];
+    readonly options: [{
+        readonly flags: "--name <name>";
+        readonly description: "Token name (1-120 chars; default: cli-token)";
+    }, {
+        readonly flags: "--ttl <seconds>";
+        readonly description: "Token lifetime in seconds (>0, ≤ 31536000)";
+    }, {
+        readonly flags: "--read-only";
+        readonly description: "Grant only repo:read (default: read + write)";
+    }];
+    readonly surfaces: ["cli"];
+    readonly hardware: readonly ["consumer"];
+    readonly enabled: true;
+    readonly order: 10;
+    readonly examples: [{
+        readonly command: "vibes forge token mint my-app --ttl 3600";
+        readonly description: "Mint a 1-hour read+write deploy token for my-app";
+        readonly expectExit: 0;
+    }];
+};
+export default tokenMintCommandDescriptor;
+//# sourceMappingURL=forge.token.mint.command.descriptor.d.ts.map

package/dist/cli/commands/forge.token.mint.command.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"forge.token.mint.command.descriptor.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/forge.token.mint.command.descriptor.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAyBrC,CAAC;AAEH,eAAe,0BAA0B,CAAC"}

package/dist/cli/commands/forge.token.mint.command.descriptor.js

@@ -0,0 +1,29 @@
+import { createRuntimeAsset } from '@vibesdotdev/kernel';
+export const tokenMintCommandDescriptor = createRuntimeAsset({
+    kind: 'cli/command',
+    id: 'forge.token.mint',
+    name: 'mint',
+    description: 'Mint a deploy token for a repository (plaintext printed ONCE to STDOUT)',
+    group: 'forge.token',
+    arguments: [
+        { name: 'repo', description: 'Repository id, <owner>/<name>, or bare name', required: true }
+    ],
+    options: [
+        { flags: '--name <name>', description: 'Token name (1-120 chars; default: cli-token)' },
+        { flags: '--ttl <seconds>', description: 'Token lifetime in seconds (>0, ≤ 31536000)' },
+        { flags: '--read-only', description: 'Grant only repo:read (default: read + write)' }
+    ],
+    surfaces: ['cli'],
+    hardware: ['consumer'],
+    enabled: true,
+    order: 10,
+    examples: [
+        {
+            command: 'vibes forge token mint my-app --ttl 3600',
+            description: 'Mint a 1-hour read+write deploy token for my-app',
+            expectExit: 0
+        }
+    ]
+});
+export default tokenMintCommandDescriptor;
+//# sourceMappingURL=forge.token.mint.command.descriptor.js.map

package/dist/cli/commands/forge.token.mint.command.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"forge.token.mint.command.descriptor.js","sourceRoot":"","sources":["../../../src/cli/commands/forge.token.mint.command.descriptor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEzD,MAAM,CAAC,MAAM,0BAA0B,GAAG,kBAAkB,CAAC;IAC5D,IAAI,EAAE,aAAa;IACnB,EAAE,EAAE,kBAAkB;IACtB,IAAI,EAAE,MAAM;IACZ,WAAW,EAAE,yEAAyE;IACtF,KAAK,EAAE,aAAa;IACpB,SAAS,EAAE;QACV,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,6CAA6C,EAAE,QAAQ,EAAE,IAAI,EAAE;KAC5F;IACD,OAAO,EAAE;QACR,EAAE,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,8CAA8C,EAAE;QACvF,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,4CAA4C,EAAE;QACvF,EAAE,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,8CAA8C,EAAE;KACrF;IACD,QAAQ,EAAE,CAAC,KAAK,CAAC;IACjB,QAAQ,EAAE,CAAC,UAAU,CAAC;IACtB,OAAO,EAAE,IAAI;IACb,KAAK,EAAE,EAAE;IACT,QAAQ,EAAE;QACT;YACC,OAAO,EAAE,0CAA0C;YACnD,WAAW,EAAE,kDAAkD;YAC/D,UAAU,EAAE,CAAC;SACb;KACD;CACD,CAAC,CAAC;AAEH,eAAe,0BAA0B,CAAC"}

package/dist/cli/commands/forge.token.mint.command.impl.d.ts

@@ -0,0 +1,33 @@
+import type { CommandContext } from '@vibesdotdev/cli';
+import { type TokenMintOptionInput } from '../../schemas/token-mint.ts';
+import { type ForgeRequestSpec, type ForgeResponse } from '../lib/transport.ts';
+interface MintBody {
+    name: string;
+    scopes?: Array<'repo:read' | 'repo:write'>;
+    ttlSeconds?: number;
+}
+/** The options `forge token mint` reads, as the CLI hands them. */
+export type TokenMintOptions = Readonly<{
+    name?: string;
+    readOnly?: boolean;
+    ttl?: string | number;
+    json?: boolean;
+    format?: string;
+    output?: string;
+}>;
+/** The arguments `forge token mint` reads. */
+export interface TokenMintArgs {
+    repo?: string;
+}
+export declare function buildMintBody(opts: TokenMintOptionInput): MintBody;
+/** The forge transport a mint uses (a test replaces it at the network boundary). */
+export interface TokenMintDeps {
+    resolveRepo: (repoRef: string) => Promise<string>;
+    send: (spec: ForgeRequestSpec) => Promise<ForgeResponse<unknown>>;
+}
+export declare function execute(args: TokenMintArgs, opts: TokenMintOptions, context: CommandContext, deps?: Partial<TokenMintDeps>): Promise<void>;
+declare const _default: {
+    execute: typeof execute;
+};
+export default _default;
+//# sourceMappingURL=forge.token.mint.command.impl.d.ts.map

package/dist/cli/commands/forge.token.mint.command.impl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"forge.token.mint.command.impl.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/forge.token.mint.command.impl.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAavD,OAAO,EAAqB,KAAK,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAE3F,OAAO,EAAoB,KAAK,gBAAgB,EAAE,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAKlG,UAAU,QAAQ;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,KAAK,CAAC,WAAW,GAAG,YAAY,CAAC,CAAC;IAC3C,UAAU,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,mEAAmE;AACnE,MAAM,MAAM,gBAAgB,GAAG,QAAQ,CAAC;IACvC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACtB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC,CAAC;AAEH,8CAA8C;AAC9C,MAAM,WAAW,aAAa;IAC7B,IAAI,CAAC,EAAE,MAAM,CAAC;CACd;AAiBD,wBAAgB,aAAa,CAAC,IAAI,EAAE,oBAAoB,GAAG,QAAQ,CAsBlE;AAED,oFAAoF;AACpF,MAAM,WAAW,aAAa;IAC7B,WAAW,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAClD,IAAI,EAAE,CAAC,IAAI,EAAE,gBAAgB,KAAK,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;CAClE;AAED,wBAAsB,OAAO,CAC5B,IAAI,EAAE,aAAa,EACnB,IAAI,EAAE,gBAAgB,EACtB,OAAO,EAAE,cAAc,EACvB,IAAI,GAAE,OAAO,CAAC,aAAa,CAAM,GAC/B,OAAO,CAAC,IAAI,CAAC,CA6Cf;;;;AAED,wBAA2B"}

package/dist/cli/commands/forge.token.mint.command.impl.js

@@ -0,0 +1,100 @@
+/**
+ * `vibes forge token mint <repo>` — mint a deploy token.
+ *
+ * The server requires `admin` on the repo and returns the plaintext `token`
+ * exactly ONCE on the 201. We treat it like `secrets reveal`: the plaintext
+ * goes to STDOUT exactly once, through the handed runtime's stdio, so scripts
+ * can capture it via `$(vibes forge token mint repo)`; all notices go to the
+ * UI's STDERR. The token is NEVER logged, rendered elsewhere, or carried by a
+ * failure.
+ */
+import * as z from 'zod/v4';
+import { MintOptionsSchema } from "../../schemas/token-mint.js";
+import { CapabilityError, getRuntimeStdio } from '@vibesdotdev/kernel';
+import { sendForgeRequest } from "../lib/transport.js";
+import { forgeResponseFailure } from "../../request.js";
+import { resolveRepositoryId } from "../lib/repo-ref.js";
+import { commandUI, printWarning, wantsJson } from "../lib/output.js";
+const TokenMintArgsSchema = z.object({ repo: z.string().trim().catch('') });
+/** A deploy-token lifetime: a positive whole number of seconds. */
+const TtlSecondsSchema = z.number().int().positive();
+/** What the mint route answers: the summary and the plaintext token, once. */
+const DeployTokenMintSchema = z.object({
+    result: z.object({
+        id: z.string(),
+        name: z.string(),
+        scopes: z.array(z.string())
+    }).loose(),
+    token: z.string().min(1).regex(/^[^\r\n]+$/)
+});
+export function buildMintBody(opts) {
+    const parsed = MintOptionsSchema.safeParse(opts);
+    const options = parsed.success ? parsed.data : {};
+    const body = { name: options.name ?? 'cli-token' };
+    // Commander stores a bare `--read-only` boolean flag under the camelCase
+    // attribute `readOnly`, not the literal hyphenated string (verified against
+    // the real Option/action pipeline in cli/src/surface/register-commands.ts;
+    // this flag silently no-op'd before this fix — every mint was read+write).
+    if (options.readOnly === true) {
+        body.scopes = ['repo:read'];
+    }
+    if (options.ttl !== undefined && options.ttl !== null) {
+        const ttl = TtlSecondsSchema.safeParse(Number(options.ttl));
+        if (!ttl.success) {
+            throw new CapabilityError('--ttl must be a positive integer number of seconds', 'INVALID_INPUT', {
+                reason: 'deploy-token-ttl-invalid',
+                retryable: false
+            });
+        }
+        body.ttlSeconds = ttl.data;
+    }
+    return body;
+}
+export async function execute(args, opts, context, deps = {}) {
+    const { runtime } = context;
+    const ui = commandUI(context);
+    const parsedArgs = TokenMintArgsSchema.safeParse(args);
+    const repoRef = parsedArgs.success ? parsedArgs.data.repo : '';
+    if (!repoRef) {
+        throw new CapabilityError('Usage: vibes forge token mint <repo>', 'INVALID_INPUT', {
+            reason: 'command-usage',
+            retryable: false
+        });
+    }
+    const body = buildMintBody(opts);
+    // Resolved before the mint: a host that cannot print the plaintext never
+    // asks the forge for a token it would then lose.
+    const stdio = await getRuntimeStdio(runtime);
+    const resolveRepo = deps.resolveRepo ?? ((ref) => resolveRepositoryId(runtime, ref));
+    const send = deps.send ?? ((spec) => sendForgeRequest(runtime, spec));
+    const id = await resolveRepo(repoRef);
+    const res = await send({
+        method: 'POST',
+        path: `/api/repositories/${encodeURIComponent(id)}/tokens`,
+        body
+    });
+    if (!res.ok)
+        throw forgeResponseFailure(res);
+    // The body is never a cause: a malformed answer may still hold the token.
+    const minted = DeployTokenMintSchema.safeParse(res.data);
+    if (!minted.success) {
+        throw new CapabilityError('Forge answered the deploy-token mint without a valid token.', 'UNAVAILABLE', {
+            reason: 'deploy-token-response-invalid',
+            retryable: false
+        });
+    }
+    const { result, token } = minted.data;
+    if (wantsJson(opts)) {
+        // JSON includes the plaintext once, by explicit request: one document,
+        // one stdout write.
+        stdio.write('stdout', `${JSON.stringify({ result, token }, null, 2)}\n`);
+        printWarning(ui, '[forge] Deploy token minted — plaintext is shown ONCE and cannot be retrieved again.');
+        return;
+    }
+    // Human path: plaintext to STDOUT exactly once; notices to STDERR.
+    printWarning(ui, `[forge] Minted deploy token "${result.name}" (${result.id}) on ${repoRef}.`);
+    printWarning(ui, `[forge] Scopes: ${result.scopes.join(', ')}. This plaintext is shown ONCE.`);
+    stdio.write('stdout', `${token}\n`);
+}
+export default { execute };
+//# sourceMappingURL=forge.token.mint.command.impl.js.map

package/dist/cli/commands/forge.token.mint.command.impl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"forge.token.mint.command.impl.js","sourceRoot":"","sources":["../../../src/cli/commands/forge.token.mint.command.impl.ts"],"names":[],"mappings":"AACA;;;;;;;;;GASG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,iBAAiB,EAA6B,MAAM,6BAA6B,CAAC;AAC3F,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACvE,OAAO,EAAE,gBAAgB,EAA6C,MAAM,qBAAqB,CAAC;AAClG,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAuBtE,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;AAE5E,mEAAmE;AACnE,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;AAErD,8EAA8E;AAC9E,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC;QAChB,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;QACd,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE;QAChB,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;KAC3B,CAAC,CAAC,KAAK,EAAE;IACV,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC;CAC5C,CAAC,CAAC;AAEH,MAAM,UAAU,aAAa,CAAC,IAA0B;IACvD,MAAM,MAAM,GAAG,iBAAiB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACjD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAClD,MAAM,IAAI,GAAa,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC;IAC7D,yEAAyE;IACzE,4EAA4E;IAC5E,2EAA2E;IAC3E,2EAA2E;IAC3E,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC/B,IAAI,CAAC,MAAM,GAAG,CAAC,WAAW,CAAC,CAAC;IAC7B,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;QACvD,MAAM,GAAG,GAAG,gBAAgB,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5D,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,eAAe,CAAC,oDAAoD,EAAE,eAAe,EAAE;gBAChG,MAAM,EAAE,0BAA0B;gBAClC,SAAS,EAAE,KAAK;aAChB,CAAC,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,UAAU,GAAG,GAAG,CAAC,IAAI,CAAC;IAC5B,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAQD,MAAM,CAAC,KAAK,UAAU,OAAO,CAC5B,IAAmB,EACnB,IAAsB,EACtB,OAAuB,EACvB,OAA+B,EAAE;IAEjC,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAC5B,MAAM,EAAE,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAC9B,MAAM,UAAU,GAAG,mBAAmB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/D,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,MAAM,IAAI,eAAe,CAAC,sCAAsC,EAAE,eAAe,EAAE;YAClF,MAAM,EAAE,eAAe;YACvB,SAAS,EAAE,KAAK;SAChB,CAAC,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACjC,yEAAyE;IACzE,iDAAiD;IACjD,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,CAAC;IAC7C,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,CAAC,CAAC,GAAW,EAAE,EAAE,CAAC,mBAAmB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;IAC7F,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,CAAC,CAAI,IAAsB,EAAE,EAAE,CAAC,gBAAgB,CAAI,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;IAE9F,MAAM,EAAE,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC;QACtB,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,qBAAqB,kBAAkB,CAAC,EAAE,CAAC,SAAS;QAC1D,IAAI;KACJ,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,oBAAoB,CAAC,GAAG,CAAC,CAAC;IAC7C,0EAA0E;IAC1E,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACzD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,IAAI,eAAe,CAAC,6DAA6D,EAAE,aAAa,EAAE;YACvG,MAAM,EAAE,+BAA+B;YACvC,SAAS,EAAE,KAAK;SAChB,CAAC,CAAC;IACJ,CAAC;IACD,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;IACtC,IAAI,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,uEAAuE;QACvE,oBAAoB;QACpB,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QACzE,YAAY,CAAC,EAAE,EAAE,sFAAsF,CAAC,CAAC;QACzG,OAAO;IACR,CAAC;IACD,mEAAmE;IACnE,YAAY,CAAC,EAAE,EAAE,gCAAgC,MAAM,CAAC,IAAI,MAAM,MAAM,CAAC,EAAE,QAAQ,OAAO,GAAG,CAAC,CAAC;IAC/F,YAAY,CAAC,EAAE,EAAE,mBAAmB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC;IAC/F,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,KAAK,IAAI,CAAC,CAAC;AACrC,CAAC;AAED,eAAe,EAAE,OAAO,EAAE,CAAC"}

package/dist/cli/commands/forge.token.revoke.command.descriptor.d.ts

@@ -0,0 +1,28 @@
+export declare const tokenRevokeCommandDescriptor: {
+    readonly kind: "cli/command";
+    readonly id: "forge.token.revoke";
+    readonly name: "revoke";
+    readonly description: "Revoke a deploy token (host-revoke-first, fail-closed)";
+    readonly group: "forge.token";
+    readonly arguments: [{
+        readonly name: "repo";
+        readonly description: "Repository id, <owner>/<name>, or bare name";
+        readonly required: true;
+    }, {
+        readonly name: "tokenId";
+        readonly description: "Deploy token id (uuid)";
+        readonly required: true;
+    }];
+    readonly options: [];
+    readonly surfaces: ["cli"];
+    readonly hardware: readonly ["consumer"];
+    readonly enabled: true;
+    readonly order: 30;
+    readonly examples: [{
+        readonly command: "vibes forge token revoke my-app 3f1c...";
+        readonly description: "Revoke the given deploy token on my-app";
+        readonly expectExit: 0;
+    }];
+};
+export default tokenRevokeCommandDescriptor;
+//# sourceMappingURL=forge.token.revoke.command.descriptor.d.ts.map

package/dist/cli/commands/forge.token.revoke.command.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"forge.token.revoke.command.descriptor.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/forge.token.revoke.command.descriptor.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;CAsBvC,CAAC;AAEH,eAAe,4BAA4B,CAAC"}

package/dist/cli/commands/forge.token.revoke.command.descriptor.js

@@ -0,0 +1,26 @@
+import { createRuntimeAsset } from '@vibesdotdev/kernel';
+export const tokenRevokeCommandDescriptor = createRuntimeAsset({
+    kind: 'cli/command',
+    id: 'forge.token.revoke',
+    name: 'revoke',
+    description: 'Revoke a deploy token (host-revoke-first, fail-closed)',
+    group: 'forge.token',
+    arguments: [
+        { name: 'repo', description: 'Repository id, <owner>/<name>, or bare name', required: true },
+        { name: 'tokenId', description: 'Deploy token id (uuid)', required: true }
+    ],
+    options: [],
+    surfaces: ['cli'],
+    hardware: ['consumer'],
+    enabled: true,
+    order: 30,
+    examples: [
+        {
+            command: 'vibes forge token revoke my-app 3f1c...',
+            description: 'Revoke the given deploy token on my-app',
+            expectExit: 0
+        }
+    ]
+});
+export default tokenRevokeCommandDescriptor;
+//# sourceMappingURL=forge.token.revoke.command.descriptor.js.map

package/dist/cli/commands/forge.token.revoke.command.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"forge.token.revoke.command.descriptor.js","sourceRoot":"","sources":["../../../src/cli/commands/forge.token.revoke.command.descriptor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEzD,MAAM,CAAC,MAAM,4BAA4B,GAAG,kBAAkB,CAAC;IAC9D,IAAI,EAAE,aAAa;IACnB,EAAE,EAAE,oBAAoB;IACxB,IAAI,EAAE,QAAQ;IACd,WAAW,EAAE,wDAAwD;IACrE,KAAK,EAAE,aAAa;IACpB,SAAS,EAAE;QACV,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,6CAA6C,EAAE,QAAQ,EAAE,IAAI,EAAE;QAC5F,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,wBAAwB,EAAE,QAAQ,EAAE,IAAI,EAAE;KAC1E;IACD,OAAO,EAAE,EAAE;IACX,QAAQ,EAAE,CAAC,KAAK,CAAC;IACjB,QAAQ,EAAE,CAAC,UAAU,CAAC;IACtB,OAAO,EAAE,IAAI;IACb,KAAK,EAAE,EAAE;IACT,QAAQ,EAAE;QACT;YACC,OAAO,EAAE,yCAAyC;YAClD,WAAW,EAAE,yCAAyC;YACtD,UAAU,EAAE,CAAC;SACb;KACD;CACD,CAAC,CAAC;AAEH,eAAe,4BAA4B,CAAC"}

package/dist/cli/commands/forge.token.revoke.command.impl.d.ts

@@ -0,0 +1,18 @@
+import type { CommandContext } from '@vibesdotdev/cli';
+/** The arguments `forge token revoke` reads. */
+export interface TokenRevokeArgs {
+    repo?: string;
+    tokenId?: string;
+}
+/** The options `forge token revoke` reads, as the CLI hands them. */
+export type TokenRevokeOptions = Readonly<{
+    json?: boolean;
+    format?: string;
+    output?: string;
+}>;
+export declare function execute(args: TokenRevokeArgs, opts: TokenRevokeOptions, context: CommandContext): Promise<void>;
+declare const _default: {
+    execute: typeof execute;
+};
+export default _default;
+//# sourceMappingURL=forge.token.revoke.command.impl.d.ts.map

package/dist/cli/commands/forge.token.revoke.command.impl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"forge.token.revoke.command.impl.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/forge.token.revoke.command.impl.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAgBvD,gDAAgD;AAChD,MAAM,WAAW,eAAe;IAC/B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,qEAAqE;AACrE,MAAM,MAAM,kBAAkB,GAAG,QAAQ,CAAC;IAAE,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAOhG,wBAAsB,OAAO,CAC5B,IAAI,EAAE,eAAe,EACrB,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,cAAc,GACrB,OAAO,CAAC,IAAI,CAAC,CAuBf;;;;AAED,wBAA2B"}

package/dist/cli/commands/forge.token.revoke.command.impl.js

@@ -0,0 +1,43 @@
+/**
+ * `vibes forge token revoke <repo> <tokenId>` — revoke a deploy token.
+ *
+ * Requires `admin` server-side. The server revokes on the git host first and
+ * fails closed (502) if that fails — surfaced here as the typed forge failure,
+ * never treated as success.
+ */
+import * as z from 'zod/v4';
+import { CapabilityError } from '@vibesdotdev/kernel';
+import { sendForgeRequest } from "../lib/transport.js";
+import { forgeResponseFailure } from "../../request.js";
+import { resolveRepositoryId } from "../lib/repo-ref.js";
+import { commandUI, printJson, printSuccess, wantsJson } from "../lib/output.js";
+const TokenRevokeArgsSchema = z.object({
+    repo: z.string().trim().catch(''),
+    tokenId: z.string().trim().catch('')
+});
+export async function execute(args, opts, context) {
+    const { runtime } = context;
+    const ui = commandUI(context);
+    const parsed = TokenRevokeArgsSchema.safeParse(args);
+    const { repo: repoRef, tokenId } = parsed.success ? parsed.data : { repo: '', tokenId: '' };
+    if (!repoRef || !tokenId) {
+        throw new CapabilityError('Usage: vibes forge token revoke <repo> <tokenId>', 'INVALID_INPUT', {
+            reason: 'command-usage',
+            retryable: false
+        });
+    }
+    const id = await resolveRepositoryId(runtime, repoRef);
+    const res = await sendForgeRequest(runtime, {
+        method: 'DELETE',
+        path: `/api/repositories/${encodeURIComponent(id)}/tokens/${encodeURIComponent(tokenId)}`
+    });
+    if (!res.ok)
+        throw forgeResponseFailure(res);
+    if (wantsJson(opts)) {
+        printJson(ui, { revoked: true, repositoryId: id, tokenId });
+        return;
+    }
+    printSuccess(ui, `Revoked deploy token ${tokenId} on ${repoRef}`);
+}
+export default { execute };
+//# sourceMappingURL=forge.token.revoke.command.impl.js.map

package/dist/cli/commands/forge.token.revoke.command.impl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"forge.token.revoke.command.impl.js","sourceRoot":"","sources":["../../../src/cli/commands/forge.token.revoke.command.impl.ts"],"names":[],"mappings":"AACA;;;;;;GAMG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAWjF,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IACtC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;IACjC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;CACpC,CAAC,CAAC;AAEH,MAAM,CAAC,KAAK,UAAU,OAAO,CAC5B,IAAqB,EACrB,IAAwB,EACxB,OAAuB;IAEvB,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAC5B,MAAM,EAAE,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAC9B,MAAM,MAAM,GAAG,qBAAqB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACrD,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAC5F,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;QAC1B,MAAM,IAAI,eAAe,CAAC,kDAAkD,EAAE,eAAe,EAAE;YAC9F,MAAM,EAAE,eAAe;YACvB,SAAS,EAAE,KAAK;SAChB,CAAC,CAAC;IACJ,CAAC;IAED,MAAM,EAAE,GAAG,MAAM,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACvD,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAU,OAAO,EAAE;QACpD,MAAM,EAAE,QAAQ;QAChB,IAAI,EAAE,qBAAqB,kBAAkB,CAAC,EAAE,CAAC,WAAW,kBAAkB,CAAC,OAAO,CAAC,EAAE;KACzF,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,oBAAoB,CAAC,GAAG,CAAC,CAAC;IAC7C,IAAI,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,SAAS,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QAC5D,OAAO;IACR,CAAC;IACD,YAAY,CAAC,EAAE,EAAE,wBAAwB,OAAO,OAAO,OAAO,EAAE,CAAC,CAAC;AACnE,CAAC;AAED,eAAe,EAAE,OAAO,EAAE,CAAC"}

package/dist/cli/commands/registry.access.command.descriptor.d.ts

@@ -0,0 +1,39 @@
+export declare const registryAccessCommandDescriptor: {
+    readonly kind: "cli/command";
+    readonly id: "registry.access";
+    readonly name: "access";
+    readonly description: "Show or change whether registry packages are public or restricted, and which version ranges are restricted";
+    readonly group: "registry";
+    readonly arguments: [{
+        readonly name: "packages";
+        readonly description: "Package names, e.g. @vibesdotdev/kernel, optionally followed by public or restricted. Several packages change in one request, judged together.";
+        readonly required: true;
+        readonly variadic: true;
+    }];
+    readonly options: [{
+        readonly flags: "--restrict <range>";
+        readonly description: "Restrict the versions matching this semver range (prereleases included), e.g. '<1.0.0-rc.0'; replaces the package's version ranges";
+    }, {
+        readonly flags: "--clear-ranges";
+        readonly description: "Remove the package's version ranges; every version takes the package access";
+    }];
+    readonly surfaces: ["cli"];
+    readonly hardware: readonly ["consumer"];
+    readonly enabled: true;
+    readonly order: 12;
+    readonly examples: [{
+        readonly command: "vibes registry access @vibesdotdev/kernel";
+        readonly description: "Show whether the package is public or restricted";
+        readonly expectExit: 0;
+    }, {
+        readonly command: "vibes registry access @vibesdotdev/kernel public";
+        readonly description: "Make the package installable without signing in";
+        readonly expectExit: 0;
+    }, {
+        readonly command: "vibes registry access @vibesdotdev/kernel @vibesdotdev/kit --restrict '<1.0.0-rc.0'";
+        readonly description: "Keep pre-RC versions private while RC and later stay public, judged as one change";
+        readonly expectExit: 0;
+    }];
+};
+export default registryAccessCommandDescriptor;
+//# sourceMappingURL=registry.access.command.descriptor.d.ts.map

package/dist/cli/commands/registry.access.command.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.access.command.descriptor.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/registry.access.command.descriptor.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6C1C,CAAC;AAEH,eAAe,+BAA+B,CAAC"}

package/dist/cli/commands/registry.access.command.descriptor.js

@@ -0,0 +1,46 @@
+import { createRuntimeAsset } from '@vibesdotdev/kernel';
+export const registryAccessCommandDescriptor = createRuntimeAsset({
+    kind: 'cli/command',
+    id: 'registry.access',
+    name: 'access',
+    description: 'Show or change whether registry packages are public or restricted, and which version ranges are restricted',
+    group: 'registry',
+    arguments: [
+        {
+            name: 'packages',
+            description: 'Package names, e.g. @vibesdotdev/kernel, optionally followed by public or restricted. Several packages change in one request, judged together.',
+            required: true,
+            variadic: true
+        }
+    ],
+    options: [
+        {
+            flags: '--restrict <range>',
+            description: "Restrict the versions matching this semver range (prereleases included), e.g. '<1.0.0-rc.0'; replaces the package's version ranges"
+        },
+        { flags: '--clear-ranges', description: "Remove the package's version ranges; every version takes the package access" }
+    ],
+    surfaces: ['cli'],
+    hardware: ['consumer'],
+    enabled: true,
+    order: 12,
+    examples: [
+        {
+            command: 'vibes registry access @vibesdotdev/kernel',
+            description: 'Show whether the package is public or restricted',
+            expectExit: 0
+        },
+        {
+            command: 'vibes registry access @vibesdotdev/kernel public',
+            description: 'Make the package installable without signing in',
+            expectExit: 0
+        },
+        {
+            command: "vibes registry access @vibesdotdev/kernel @vibesdotdev/kit --restrict '<1.0.0-rc.0'",
+            description: 'Keep pre-RC versions private while RC and later stay public, judged as one change',
+            expectExit: 0
+        }
+    ]
+});
+export default registryAccessCommandDescriptor;
+//# sourceMappingURL=registry.access.command.descriptor.js.map

package/dist/cli/commands/registry.access.command.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.access.command.descriptor.js","sourceRoot":"","sources":["../../../src/cli/commands/registry.access.command.descriptor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEzD,MAAM,CAAC,MAAM,+BAA+B,GAAG,kBAAkB,CAAC;IACjE,IAAI,EAAE,aAAa;IACnB,EAAE,EAAE,iBAAiB;IACrB,IAAI,EAAE,QAAQ;IACd,WAAW,EACV,4GAA4G;IAC7G,KAAK,EAAE,UAAU;IACjB,SAAS,EAAE;QACV;YACC,IAAI,EAAE,UAAU;YAChB,WAAW,EACV,gJAAgJ;YACjJ,QAAQ,EAAE,IAAI;YACd,QAAQ,EAAE,IAAI;SACd;KACD;IACD,OAAO,EAAE;QACR;YACC,KAAK,EAAE,oBAAoB;YAC3B,WAAW,EACV,oIAAoI;SACrI;QACD,EAAE,KAAK,EAAE,gBAAgB,EAAE,WAAW,EAAE,6EAA6E,EAAE;KACvH;IACD,QAAQ,EAAE,CAAC,KAAK,CAAC;IACjB,QAAQ,EAAE,CAAC,UAAU,CAAC;IACtB,OAAO,EAAE,IAAI;IACb,KAAK,EAAE,EAAE;IACT,QAAQ,EAAE;QACT;YACC,OAAO,EAAE,2CAA2C;YACpD,WAAW,EAAE,kDAAkD;YAC/D,UAAU,EAAE,CAAC;SACb;QACD;YACC,OAAO,EAAE,kDAAkD;YAC3D,WAAW,EAAE,iDAAiD;YAC9D,UAAU,EAAE,CAAC;SACb;QACD;YACC,OAAO,EAAE,qFAAqF;YAC9F,WAAW,EAAE,mFAAmF;YAChG,UAAU,EAAE,CAAC;SACb;KACD;CACD,CAAC,CAAC;AAEH,eAAe,+BAA+B,CAAC"}