@vibesdotdev/forge 0.0.0-stage → 1.0.0-rc.4

package/dist/cli/commands/registry.access.command.impl.d.ts

@@ -0,0 +1,123 @@
+import type { CommandContext } from '@vibesdotdev/cli';
+/**
+ * `vibes registry access <package> [public|restricted]`: show or change a
+ * package's registry visibility.
+ *
+ * The registry changes visibility only through npm's access protocol, and only
+ * for a manager of the package's owner (see integrations-cloudflare
+ * `registry-npm/protocol/access.ts`). Release leases cannot do it, and a
+ * session JWT only reads. So this command mints a short-lived owner token
+ * through the signed-in session, uses it for this one request, and revokes it
+ * in `finally`. The token is never printed or stored.
+ *
+ * The registry is the declared `registry` `infra/service` in the host's
+ * configured service environment (never a hard-coded host), and the request
+ * goes through the shared Forge request construction, response parsing and
+ * lifecycle-bounded fetch.
+ */
+import * as z from 'zod/v4';
+import type { UIContext } from '@vibesdotdev/cli/providers';
+import { type VibesRuntime } from '@vibesdotdev/kernel';
+import { type FetchLike } from '../lib/transport.ts';
+export type PackageAccess = 'public' | 'restricted';
+export interface RegistryAccessDeps {
+    mintToken: () => Promise<{
+        id: string;
+        token: string;
+    }>;
+    revokeToken: (id: string) => Promise<void>;
+    fetch: FetchLike;
+    registryOrigin: string;
+}
+/** The declared service the registry is. */
+export declare const REGISTRY_SERVICE_ID = "registry";
+export declare function packagePath(name: string): string;
+export declare function parseAccess(raw: string | null | undefined): PackageAccess | undefined;
+/**
+ * One version range with its own access, as the registry stores it. The
+ * registry validates ranges with `@vibesdotdev/registry/version-access`; this
+ * reads its answer.
+ */
+declare const VersionRangeSchema: z.ZodObject<{
+    range: z.ZodString;
+    access: z.ZodEnum<{
+        public: "public";
+        restricted: "restricted";
+    }>;
+    includePrerelease: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+export type VersionRange = z.infer<typeof VersionRangeSchema>;
+/** What the registry answers about a package's access: the default and its version ranges. */
+declare const RegistryAccessBodySchema: z.ZodObject<{
+    access: z.ZodEnum<{
+        public: "public";
+        restricted: "restricted";
+    }>;
+    ranges: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        range: z.ZodString;
+        access: z.ZodEnum<{
+            public: "public";
+            restricted: "restricted";
+        }>;
+        includePrerelease: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+export type PackageAccessState = z.infer<typeof RegistryAccessBodySchema>;
+/** A requested change: the package default, the whole version policy, or both. */
+export interface PackageAccessChange {
+    access?: PackageAccess;
+    /** Replaces the policy; `[]` clears it. */
+    ranges?: VersionRange[];
+}
+/**
+ * Read or change access for one or more packages with a token that exists only
+ * for this call. Several packages change in ONE request (`POST /-/access`), so
+ * the registry judges them together: packages that require each other can only
+ * change together. Reads go one package at a time.
+ */
+export declare function registryAccessStates(names: readonly string[], change: PackageAccessChange | undefined, deps: RegistryAccessDeps): Promise<Array<PackageAccessState & {
+    name: string;
+}>>;
+/** Read or set one package's default access. */
+export declare function registryAccess(name: string, access: PackageAccess | undefined, deps: RegistryAccessDeps): Promise<PackageAccess>;
+/**
+ * The registry access transport on the handed runtime: the declared
+ * `registry` origin in its service environment, the shared host fetch bounded
+ * by its lifecycle, and the forge session for the temporary token. Revoke
+ * failures render on its UI.
+ */
+export declare function registryAccessDeps(runtime: VibesRuntime, ui: UIContext): Promise<RegistryAccessDeps>;
+/** The arguments `registry access` reads. */
+export interface RegistryAccessArgs {
+    packages?: string | string[];
+}
+/** The options `registry access` reads, as the CLI hands them. */
+export type RegistryAccessOptions = Readonly<{
+    json?: boolean;
+    format?: string;
+    output?: string;
+    restrict?: string;
+    clearRanges?: boolean;
+}>;
+/**
+ * Split the positionals: package names, then an optional trailing
+ * `public`/`restricted`. A lone token is always a package name.
+ */
+export interface AccessOperands {
+    names: string[];
+    access?: string;
+}
+export declare function parseAccessOperands(raw: string | string[] | undefined): AccessOperands;
+/** The change the options and operands request, or undefined for a read. */
+export declare function accessChange(access: PackageAccess | undefined, opts: RegistryAccessOptions): PackageAccessChange | undefined;
+/**
+ * The human lines for one package: the bare access first (scripts and
+ * runbooks read line one), then one line per version range.
+ */
+export declare function describeState(state: PackageAccessState, label?: string): string[];
+export declare function execute(args: RegistryAccessArgs, opts: RegistryAccessOptions, context: CommandContext, overrides?: RegistryAccessDeps): Promise<void>;
+declare const _default: {
+    execute: typeof execute;
+};
+export default _default;
+//# sourceMappingURL=registry.access.command.impl.d.ts.map

package/dist/cli/commands/registry.access.command.impl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.access.command.impl.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/registry.access.command.impl.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACvD;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAmB,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEzE,OAAO,EAMN,KAAK,SAAS,EAEd,MAAM,qBAAqB,CAAC;AAK7B,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,YAAY,CAAC;AAEpD,MAAM,WAAW,kBAAkB;IAClC,SAAS,EAAE,MAAM,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACxD,WAAW,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C,KAAK,EAAE,SAAS,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;CACvB;AAED,4CAA4C;AAC5C,eAAO,MAAM,mBAAmB,aAAa,CAAC;AAQ9C,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAQhD;AAED,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,aAAa,GAAG,SAAS,CAUrF;AAED;;;;GAIG;AACH,QAAA,MAAM,kBAAkB;;;;;;;iBAItB,CAAC;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,8FAA8F;AAC9F,QAAA,MAAM,wBAAwB;;;;;;;;;;;;;iBAG5B,CAAC;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAM1E,kFAAkF;AAClF,MAAM,WAAW,mBAAmB;IACnC,MAAM,CAAC,EAAE,aAAa,CAAC;IACvB,2CAA2C;IAC3C,MAAM,CAAC,EAAE,YAAY,EAAE,CAAC;CACxB;AAiCD;;;;;GAKG;AACH,wBAAsB,oBAAoB,CACzC,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,MAAM,EAAE,mBAAmB,GAAG,SAAS,EACvC,IAAI,EAAE,kBAAkB,GACtB,OAAO,CAAC,KAAK,CAAC,kBAAkB,GAAG;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC,CA0BvD;AAED,gDAAgD;AAChD,wBAAsB,cAAc,CACnC,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,aAAa,GAAG,SAAS,EACjC,IAAI,EAAE,kBAAkB,GACtB,OAAO,CAAC,aAAa,CAAC,CAGxB;AAQD;;;;;GAKG;AACH,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,EAAE,SAAS,GAAG,OAAO,CAAC,kBAAkB,CAAC,CA+B1G;AAED,6CAA6C;AAC7C,MAAM,WAAW,kBAAkB;IAClC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;CAC7B;AAED,kEAAkE;AAClE,MAAM,MAAM,qBAAqB,GAAG,QAAQ,CAAC;IAC5C,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,OAAO,CAAC;CACtB,CAAC,CAAC;AASH;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC9B,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,GAAG,cAAc,CAOtF;AAED,4EAA4E;AAC5E,wBAAgB,YAAY,CAAC,MAAM,EAAE,aAAa,GAAG,SAAS,EAAE,IAAI,EAAE,qBAAqB,GAAG,mBAAmB,GAAG,SAAS,CAa5H;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,kBAAkB,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAGjF;AAED,wBAAsB,OAAO,CAC5B,IAAI,EAAE,kBAAkB,EACxB,IAAI,EAAE,qBAAqB,EAC3B,OAAO,EAAE,cAAc,EACvB,SAAS,CAAC,EAAE,kBAAkB,GAC5B,OAAO,CAAC,IAAI,CAAC,CAqBf;;;;AAED,wBAA2B"}

package/dist/cli/commands/registry.access.command.impl.js

@@ -0,0 +1,236 @@
+/**
+ * `vibes registry access <package> [public|restricted]`: show or change a
+ * package's registry visibility.
+ *
+ * The registry changes visibility only through npm's access protocol, and only
+ * for a manager of the package's owner (see integrations-cloudflare
+ * `registry-npm/protocol/access.ts`). Release leases cannot do it, and a
+ * session JWT only reads. So this command mints a short-lived owner token
+ * through the signed-in session, uses it for this one request, and revokes it
+ * in `finally`. The token is never printed or stored.
+ *
+ * The registry is the declared `registry` `infra/service` in the host's
+ * configured service environment (never a hard-coded host), and the request
+ * goes through the shared Forge request construction, response parsing and
+ * lifecycle-bounded fetch.
+ */
+import * as z from 'zod/v4';
+import { CapabilityError } from '@vibesdotdev/kernel';
+import { serviceOrigin } from '@vibesdotdev/infra-core/service';
+import { buildRequest, forgeResponseFailure, parseResponse, sendForgeRequest, withFetchTimeout } from "../lib/transport.js";
+import { forgeHostFetch } from "../../request.js";
+import { commandUI, printJson, printLine, printSuccess, printWarning, wantsJson } from "../lib/output.js";
+/** The declared service the registry is. */
+export const REGISTRY_SERVICE_ID = 'registry';
+/** How long one registry access request may take. */
+const REGISTRY_ACCESS_TIMEOUT_MS = 90_000;
+const PackageNameSchema = z.string().regex(/^(@[a-z0-9][a-z0-9._-]*\/)?[a-z0-9][a-z0-9._-]*$/);
+const PackageAccessSchema = z.enum(['public', 'restricted']);
+export function packagePath(name) {
+    if (!PackageNameSchema.safeParse(name).success) {
+        throw new CapabilityError('Not a package name.', 'INVALID_INPUT', {
+            reason: 'registry-package-name-invalid',
+            retryable: false
+        });
+    }
+    return name.replace('/', '%2f');
+}
+export function parseAccess(raw) {
+    if (raw === undefined || raw === null || raw === '')
+        return undefined;
+    const access = PackageAccessSchema.safeParse(raw);
+    if (!access.success) {
+        throw new CapabilityError('access must be "public" or "restricted"', 'INVALID_INPUT', {
+            reason: 'registry-access-invalid',
+            retryable: false
+        });
+    }
+    return access.data;
+}
+/**
+ * One version range with its own access, as the registry stores it. The
+ * registry validates ranges with `@vibesdotdev/registry/version-access`; this
+ * reads its answer.
+ */
+const VersionRangeSchema = z.object({
+    range: z.string(),
+    access: PackageAccessSchema,
+    includePrerelease: z.boolean().optional()
+});
+/** What the registry answers about a package's access: the default and its version ranges. */
+const RegistryAccessBodySchema = z.object({
+    access: PackageAccessSchema,
+    ranges: z.array(VersionRangeSchema).default([])
+});
+const RegistryAccessBatchBodySchema = z.object({
+    packages: z.array(RegistryAccessBodySchema.extend({ name: z.string() }))
+});
+async function sendAccessRequest(spec, deps, token, schema) {
+    const { url, init } = buildRequest(spec, deps.registryOrigin, token);
+    const response = await deps.fetch(url, init);
+    const parsed = parseResponse(response.status, response.ok, await response.text(), [token]);
+    if (!parsed.ok) {
+        // The registry's own text rides only as the redacted cause.
+        const cause = forgeResponseFailure(parsed);
+        throw new CapabilityError('The registry refused the package access request.', cause.code, {
+            reason: 'registry-access-refused',
+            retryable: cause.retryable,
+            details: { status: parsed.status },
+            cause
+        });
+    }
+    const body = schema.safeParse(parsed.data);
+    if (!body.success)
+        throw invalidAccessResponse();
+    return body.data;
+}
+function invalidAccessResponse() {
+    return new CapabilityError('The registry returned no access value.', 'UNAVAILABLE', {
+        reason: 'registry-access-response-invalid',
+        retryable: false
+    });
+}
+/**
+ * Read or change access for one or more packages with a token that exists only
+ * for this call. Several packages change in ONE request (`POST /-/access`), so
+ * the registry judges them together: packages that require each other can only
+ * change together. Reads go one package at a time.
+ */
+export async function registryAccessStates(names, change, deps) {
+    const paths = names.map((name) => `/-/package/${packagePath(name)}/access`);
+    const minted = await deps.mintToken();
+    try {
+        const headers = { accept: 'application/json' };
+        if (change && names.length > 1) {
+            const body = await sendAccessRequest({ method: 'POST', path: '/-/access', headers, body: { packages: names.map((name) => ({ name, ...change })) } }, deps, minted.token, RegistryAccessBatchBodySchema);
+            return body.packages;
+        }
+        const states = [];
+        for (const [index, name] of names.entries()) {
+            const path = paths[index];
+            const spec = change
+                ? { method: 'POST', path, headers, body: { ...change } }
+                : { method: 'GET', path, headers };
+            states.push({ name, ...(await sendAccessRequest(spec, deps, minted.token, RegistryAccessBodySchema)) });
+        }
+        return states;
+    }
+    finally {
+        await deps.revokeToken(minted.id);
+    }
+}
+/** Read or set one package's default access. */
+export async function registryAccess(name, access, deps) {
+    const [state] = await registryAccessStates([name], access ? { access } : undefined, deps);
+    return state.access;
+}
+/** What the registry token mint answers: its id and the plaintext, once. */
+const MintedRegistryTokenSchema = z.object({
+    result: z.object({ id: z.string().min(1) }),
+    token: z.string().min(1)
+});
+/**
+ * The registry access transport on the handed runtime: the declared
+ * `registry` origin in its service environment, the shared host fetch bounded
+ * by its lifecycle, and the forge session for the temporary token. Revoke
+ * failures render on its UI.
+ */
+export async function registryAccessDeps(runtime, ui) {
+    return {
+        registryOrigin: (await serviceOrigin(runtime, REGISTRY_SERVICE_ID)).replace(/\/$/, ''),
+        fetch: withFetchTimeout(forgeHostFetch, REGISTRY_ACCESS_TIMEOUT_MS, runtime.lifecycle),
+        async mintToken() {
+            const res = await sendForgeRequest(runtime, {
+                method: 'POST',
+                path: '/api/registry/tokens',
+                body: { name: `cli-registry-access-${Date.now()}` }
+            });
+            if (!res.ok)
+                throw forgeResponseFailure(res);
+            const minted = MintedRegistryTokenSchema.safeParse(res.data);
+            if (!minted.success) {
+                throw new CapabilityError('Forge answered the registry token mint without a valid token.', 'UNAVAILABLE', {
+                    reason: 'registry-token-response-invalid',
+                    retryable: false
+                });
+            }
+            return { id: minted.data.result.id, token: minted.data.token };
+        },
+        async revokeToken(id) {
+            const res = await sendForgeRequest(runtime, {
+                method: 'DELETE',
+                path: '/api/registry/tokens',
+                body: { id }
+            });
+            if (!res.ok) {
+                printWarning(ui, `[registry] could not revoke the temporary token ${id}: ${res.message}. Run: vibes registry token revoke ${id}`);
+            }
+        }
+    };
+}
+const RegistryAccessArgsSchema = z.object({
+    packages: z.union([z.string(), z.array(z.string())]).optional().catch(undefined)
+});
+const USAGE = 'Usage: vibes registry access <package...> [public|restricted] [--restrict <range>] [--clear-ranges]';
+export function parseAccessOperands(raw) {
+    const tokens = (Array.isArray(raw) ? raw : raw === undefined ? [] : [raw]).map((token) => token.trim()).filter(Boolean);
+    const last = tokens.at(-1);
+    if (tokens.length > 1 && (last === 'public' || last === 'restricted')) {
+        return { names: tokens.slice(0, -1), access: last };
+    }
+    return { names: tokens };
+}
+/** The change the options and operands request, or undefined for a read. */
+export function accessChange(access, opts) {
+    const restrict = opts.restrict?.trim();
+    if (restrict && opts.clearRanges) {
+        throw new CapabilityError('--restrict and --clear-ranges cannot be combined.', 'INVALID_INPUT', {
+            reason: 'command-usage',
+            retryable: false
+        });
+    }
+    const change = {};
+    if (access)
+        change.access = access;
+    if (restrict)
+        change.ranges = [{ range: restrict, access: 'restricted' }];
+    if (opts.clearRanges)
+        change.ranges = [];
+    return Object.keys(change).length > 0 ? change : undefined;
+}
+/**
+ * The human lines for one package: the bare access first (scripts and
+ * runbooks read line one), then one line per version range.
+ */
+export function describeState(state, label) {
+    const head = label ? `${label}: ${state.access}` : state.access;
+    return [head, ...state.ranges.map((range) => `  versions ${range.range}: ${range.access}`)];
+}
+export async function execute(args, opts, context, overrides) {
+    const ui = commandUI(context);
+    const parsedArgs = RegistryAccessArgsSchema.safeParse(args);
+    const { names, access } = parseAccessOperands(parsedArgs.success ? parsedArgs.data.packages : undefined);
+    if (names.length === 0) {
+        throw new CapabilityError(USAGE, 'INVALID_INPUT', { reason: 'command-usage', retryable: false });
+    }
+    for (const name of names)
+        packagePath(name);
+    const change = accessChange(parseAccess(access), opts);
+    const deps = overrides ?? (await registryAccessDeps(context.runtime, ui));
+    const states = await registryAccessStates(names, change, deps);
+    if (wantsJson(opts)) {
+        printJson(ui, states.length === 1 ? { package: states[0].name, access: states[0].access, ranges: states[0].ranges } : { packages: states });
+        return;
+    }
+    for (const state of states) {
+        const [head, ...ranges] = describeState(state, names.length > 1 ? state.name : undefined);
+        if (change)
+            printSuccess(ui, `[registry] ${names.length > 1 ? head : `${state.name} is now ${head}`}`);
+        else
+            printLine(ui, head);
+        for (const line of ranges)
+            printLine(ui, line);
+    }
+}
+export default { execute };
+//# sourceMappingURL=registry.access.command.impl.js.map

package/dist/cli/commands/registry.access.command.impl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.access.command.impl.js","sourceRoot":"","sources":["../../../src/cli/commands/registry.access.command.impl.ts"],"names":[],"mappings":"AACA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,OAAO,EAAE,eAAe,EAAqB,MAAM,qBAAqB,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAChE,OAAO,EACN,YAAY,EACZ,oBAAoB,EACpB,aAAa,EACb,gBAAgB,EAChB,gBAAgB,EAGhB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAElD,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAW1G,4CAA4C;AAC5C,MAAM,CAAC,MAAM,mBAAmB,GAAG,UAAU,CAAC;AAE9C,qDAAqD;AACrD,MAAM,0BAA0B,GAAG,MAAM,CAAC;AAE1C,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,kDAAkD,CAAC,CAAC;AAC/F,MAAM,mBAAmB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC;AAE7D,MAAM,UAAU,WAAW,CAAC,IAAY;IACvC,IAAI,CAAC,iBAAiB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;QAChD,MAAM,IAAI,eAAe,CAAC,qBAAqB,EAAE,eAAe,EAAE;YACjE,MAAM,EAAE,+BAA+B;YACvC,SAAS,EAAE,KAAK;SAChB,CAAC,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,GAA8B;IACzD,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IACtE,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAClD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,IAAI,eAAe,CAAC,yCAAyC,EAAE,eAAe,EAAE;YACrF,MAAM,EAAE,yBAAyB;YACjC,SAAS,EAAE,KAAK;SAChB,CAAC,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACpB,CAAC;AAED;;;;GAIG;AACH,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,CAAC;IACnC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE;IACjB,MAAM,EAAE,mBAAmB;IAC3B,iBAAiB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACzC,CAAC,CAAC;AAGH,8FAA8F;AAC9F,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,MAAM,EAAE,mBAAmB;IAC3B,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CAC/C,CAAC,CAAC;AAGH,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;CACxE,CAAC,CAAC;AASH,KAAK,UAAU,iBAAiB,CAC/B,IAAsB,EACtB,IAAwB,EACxB,KAAa,EACb,MAAc;IAEd,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;IACrE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC7C,MAAM,MAAM,GAAG,aAAa,CAAkB,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;IAC5G,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QAChB,4DAA4D;QAC5D,MAAM,KAAK,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;QAC3C,MAAM,IAAI,eAAe,CAAC,kDAAkD,EAAE,KAAK,CAAC,IAAI,EAAE;YACzF,MAAM,EAAE,yBAAyB;YACjC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE;YAClC,KAAK;SACL,CAAC,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,CAAC,IAAI,CAAC,OAAO;QAAE,MAAM,qBAAqB,EAAE,CAAC;IACjD,OAAO,IAAI,CAAC,IAAI,CAAC;AAClB,CAAC;AAED,SAAS,qBAAqB;IAC7B,OAAO,IAAI,eAAe,CAAC,wCAAwC,EAAE,aAAa,EAAE;QACnF,MAAM,EAAE,kCAAkC;QAC1C,SAAS,EAAE,KAAK;KAChB,CAAC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACzC,KAAwB,EACxB,MAAuC,EACvC,IAAwB;IAExB,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC5E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;IACtC,IAAI,CAAC;QACJ,MAAM,OAAO,GAAG,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;QAC/C,IAAI,MAAM,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,GAAG,MAAM,iBAAiB,CACnC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,EAC9G,IAAI,EACJ,MAAM,CAAC,KAAK,EACZ,6BAA6B,CAC7B,CAAC;YACF,OAAO,IAAI,CAAC,QAAQ,CAAC;QACtB,CAAC;QACD,MAAM,MAAM,GAAiD,EAAE,CAAC;QAChE,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;YAC7C,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAE,CAAC;YAC3B,MAAM,IAAI,GAAqB,MAAM;gBACpC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE;gBACxD,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;YACpC,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,iBAAiB,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,EAAE,wBAAwB,CAAC,CAAC,EAAE,CAAC,CAAC;QACzG,CAAC;QACD,OAAO,MAAM,CAAC;IACf,CAAC;YAAS,CAAC;QACV,MAAM,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACnC,CAAC;AACF,CAAC;AAED,gDAAgD;AAChD,MAAM,CAAC,KAAK,UAAU,cAAc,CACnC,IAAY,EACZ,MAAiC,EACjC,IAAwB;IAExB,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,oBAAoB,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IAC1F,OAAO,KAAM,CAAC,MAAM,CAAC;AACtB,CAAC;AAED,4EAA4E;AAC5E,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1C,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3C,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACxB,CAA+D,CAAC;AAEjE;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAAqB,EAAE,EAAa;IAC5E,OAAO;QACN,cAAc,EAAE,CAAC,MAAM,aAAa,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;QACtF,KAAK,EAAE,gBAAgB,CAAC,cAAc,EAAE,0BAA0B,EAAE,OAAO,CAAC,SAAS,CAAC;QACtF,KAAK,CAAC,SAAS;YACd,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAA4B,OAAO,EAAE;gBACtE,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,sBAAsB;gBAC5B,IAAI,EAAE,EAAE,IAAI,EAAE,uBAAuB,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE;aACnD,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,MAAM,oBAAoB,CAAC,GAAG,CAAC,CAAC;YAC7C,MAAM,MAAM,GAAG,yBAAyB,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC7D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACrB,MAAM,IAAI,eAAe,CAAC,+DAA+D,EAAE,aAAa,EAAE;oBACzG,MAAM,EAAE,iCAAiC;oBACzC,SAAS,EAAE,KAAK;iBAChB,CAAC,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAChE,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,EAAE;YACnB,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAU,OAAO,EAAE;gBACpD,MAAM,EAAE,QAAQ;gBAChB,IAAI,EAAE,sBAAsB;gBAC5B,IAAI,EAAE,EAAE,EAAE,EAAE;aACZ,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACb,YAAY,CAAC,EAAE,EAAE,mDAAmD,EAAE,KAAK,GAAG,CAAC,OAAO,sCAAsC,EAAE,EAAE,CAAC,CAAC;YACnI,CAAC;QACF,CAAC;KACD,CAAC;AACH,CAAC;AAgBD,MAAM,wBAAwB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;CAChF,CAAC,CAAC;AAEH,MAAM,KAAK,GACV,qGAAqG,CAAC;AAWvG,MAAM,UAAU,mBAAmB,CAAC,GAAkC;IACrE,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACxH,MAAM,IAAI,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3B,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,YAAY,CAAC,EAAE,CAAC;QACvE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACrD,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAC1B,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,YAAY,CAAC,MAAiC,EAAE,IAA2B;IAC1F,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC;IACvC,IAAI,QAAQ,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QAClC,MAAM,IAAI,eAAe,CAAC,mDAAmD,EAAE,eAAe,EAAE;YAC/F,MAAM,EAAE,eAAe;YACvB,SAAS,EAAE,KAAK;SAChB,CAAC,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAwB,EAAE,CAAC;IACvC,IAAI,MAAM;QAAE,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;IACnC,IAAI,QAAQ;QAAE,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;IAC1E,IAAI,IAAI,CAAC,WAAW;QAAE,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC;IACzC,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,KAAyB,EAAE,KAAc;IACtE,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC;IAChE,OAAO,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;AAC7F,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAC5B,IAAwB,EACxB,IAA2B,EAC3B,OAAuB,EACvB,SAA8B;IAE9B,MAAM,EAAE,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAC9B,MAAM,UAAU,GAAG,wBAAwB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC5D,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,mBAAmB,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACzG,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,eAAe,CAAC,KAAK,EAAE,eAAe,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;IAClG,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,WAAW,CAAC,IAAI,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,YAAY,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC;IACvD,MAAM,IAAI,GAAG,SAAS,IAAI,CAAC,MAAM,kBAAkB,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;IAC1E,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;IAC/D,IAAI,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,SAAS,CAAC,EAAE,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAE,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QAC/I,OAAO;IACR,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC5B,MAAM,CAAC,IAAI,EAAE,GAAG,MAAM,CAAC,GAAG,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC1F,IAAI,MAAM;YAAE,YAAY,CAAC,EAAE,EAAE,cAAc,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,WAAW,IAAI,EAAE,EAAE,CAAC,CAAC;;YAClG,SAAS,CAAC,EAAE,EAAE,IAAK,CAAC,CAAC;QAC1B,KAAK,MAAM,IAAI,IAAI,MAAM;YAAE,SAAS,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IAChD,CAAC;AACF,CAAC;AAED,eAAe,EAAE,OAAO,EAAE,CAAC"}

package/dist/cli/commands/registry.authority.verify.command.descriptor.d.ts

@@ -0,0 +1,26 @@
+export declare const registryAuthorityVerifyCommandDescriptor: {
+    readonly kind: "cli/command";
+    readonly id: "registry.authority.verify";
+    readonly name: "verify";
+    readonly description: "Publish, install, reject replay/expiry, then delete all canary authority";
+    readonly group: "registry.authority";
+    readonly arguments: [{
+        readonly name: "path";
+        readonly description: "Managed Forge package directory";
+        readonly required: false;
+    }];
+    readonly options: [{
+        readonly flags: "--execute";
+        readonly description: "Run the mutating authority verification and cleanup";
+    }];
+    readonly surfaces: ["cli"];
+    readonly hardware: readonly ["consumer"];
+    readonly enabled: true;
+    readonly examples: [{
+        readonly command: "vibes registry authority verify --execute";
+        readonly description: "Run the exact-lease authority lifecycle";
+        readonly expectExit: 0;
+    }];
+};
+export default registryAuthorityVerifyCommandDescriptor;
+//# sourceMappingURL=registry.authority.verify.command.descriptor.d.ts.map

package/dist/cli/commands/registry.authority.verify.command.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.authority.verify.command.descriptor.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/registry.authority.verify.command.descriptor.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,wCAAwC;;;;;;;;;;;;;;;;;;;;;;;CAYnD,CAAC;AAEH,eAAe,wCAAwC,CAAC"}

package/dist/cli/commands/registry.authority.verify.command.descriptor.js

@@ -0,0 +1,16 @@
+import { createRuntimeAsset } from '@vibesdotdev/kernel';
+export const registryAuthorityVerifyCommandDescriptor = createRuntimeAsset({
+    kind: 'cli/command',
+    id: 'registry.authority.verify',
+    name: 'verify',
+    description: 'Publish, install, reject replay/expiry, then delete all canary authority',
+    group: 'registry.authority',
+    arguments: [{ name: 'path', description: 'Managed Forge package directory', required: false }],
+    options: [{ flags: '--execute', description: 'Run the mutating authority verification and cleanup' }],
+    surfaces: ['cli'],
+    hardware: ['consumer'],
+    enabled: true,
+    examples: [{ command: 'vibes registry authority verify --execute', description: 'Run the exact-lease authority lifecycle', expectExit: 0 }]
+});
+export default registryAuthorityVerifyCommandDescriptor;
+//# sourceMappingURL=registry.authority.verify.command.descriptor.js.map

package/dist/cli/commands/registry.authority.verify.command.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.authority.verify.command.descriptor.js","sourceRoot":"","sources":["../../../src/cli/commands/registry.authority.verify.command.descriptor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEzD,MAAM,CAAC,MAAM,wCAAwC,GAAG,kBAAkB,CAAC;IAC1E,IAAI,EAAE,aAAa;IACnB,EAAE,EAAE,2BAA2B;IAC/B,IAAI,EAAE,QAAQ;IACd,WAAW,EAAE,0EAA0E;IACvF,KAAK,EAAE,oBAAoB;IAC3B,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,iCAAiC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC9F,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,qDAAqD,EAAE,CAAC;IACrG,QAAQ,EAAE,CAAC,KAAK,CAAC;IACjB,QAAQ,EAAE,CAAC,UAAU,CAAC;IACtB,OAAO,EAAE,IAAI;IACb,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,2CAA2C,EAAE,WAAW,EAAE,yCAAyC,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;CAC3I,CAAC,CAAC;AAEH,eAAe,wCAAwC,CAAC"}

package/dist/cli/commands/registry.env.command.descriptor.d.ts

@@ -0,0 +1,19 @@
+export declare const registryEnvCommandDescriptor: {
+    readonly kind: "cli/command";
+    readonly id: "registry.env";
+    readonly name: "env";
+    readonly description: "Print export VIBES_REGISTRY_TOKEN=... from the signed-in session";
+    readonly group: "registry";
+    readonly arguments: [];
+    readonly options: [];
+    readonly surfaces: ["cli"];
+    readonly hardware: readonly ["consumer"];
+    readonly enabled: true;
+    readonly order: 6;
+    readonly examples: [{
+        readonly command: "eval \"$(vibes registry env)\"";
+        readonly description: "Export a fresh session-derived registry token into the current shell";
+    }];
+};
+export default registryEnvCommandDescriptor;
+//# sourceMappingURL=registry.env.command.descriptor.d.ts.map

package/dist/cli/commands/registry.env.command.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.env.command.descriptor.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/registry.env.command.descriptor.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;CAkBvC,CAAC;AAEH,eAAe,4BAA4B,CAAC"}

package/dist/cli/commands/registry.env.command.descriptor.js

@@ -0,0 +1,22 @@
+import { createRuntimeAsset } from '@vibesdotdev/kernel';
+export const registryEnvCommandDescriptor = createRuntimeAsset({
+    kind: 'cli/command',
+    id: 'registry.env',
+    name: 'env',
+    description: 'Print export VIBES_REGISTRY_TOKEN=... from the signed-in session',
+    group: 'registry',
+    arguments: [],
+    options: [],
+    surfaces: ['cli'],
+    hardware: ['consumer'],
+    enabled: true,
+    order: 6,
+    examples: [
+        {
+            command: 'eval "$(vibes registry env)"',
+            description: 'Export a fresh session-derived registry token into the current shell'
+        }
+    ]
+});
+export default registryEnvCommandDescriptor;
+//# sourceMappingURL=registry.env.command.descriptor.js.map

package/dist/cli/commands/registry.env.command.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.env.command.descriptor.js","sourceRoot":"","sources":["../../../src/cli/commands/registry.env.command.descriptor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEzD,MAAM,CAAC,MAAM,4BAA4B,GAAG,kBAAkB,CAAC;IAC9D,IAAI,EAAE,aAAa;IACnB,EAAE,EAAE,cAAc;IAClB,IAAI,EAAE,KAAK;IACX,WAAW,EAAE,kEAAkE;IAC/E,KAAK,EAAE,UAAU;IACjB,SAAS,EAAE,EAAE;IACb,OAAO,EAAE,EAAE;IACX,QAAQ,EAAE,CAAC,KAAK,CAAC;IACjB,QAAQ,EAAE,CAAC,UAAU,CAAC;IACtB,OAAO,EAAE,IAAI;IACb,KAAK,EAAE,CAAC;IACR,QAAQ,EAAE;QACT;YACC,OAAO,EAAE,8BAA8B;YACvC,WAAW,EAAE,sEAAsE;SACnF;KACD;CACD,CAAC,CAAC;AAEH,eAAe,4BAA4B,CAAC"}

package/dist/cli/commands/registry.env.command.impl.d.ts

@@ -0,0 +1,41 @@
+import type { CommandContext } from '@vibesdotdev/cli';
+/**
+ * `vibes registry env` — emit `export VIBES_REGISTRY_TOKEN=...` for eval.
+ *
+ * The value is the caller's bearer from auth's `resolveCallerBearer`, chosen by
+ * the host's declared capability: the stored login on an interactive CLI (the
+ * `auth/device-session` store), a published host credential under
+ * `vibes secrets exec`. Registry reads authenticate as the caller (rc05 §2.2);
+ * `VIBES_REGISTRY_JWT` folded into `VIBES_REGISTRY_TOKEN`.
+ *
+ * The export line (or the `--json` document) is written once, on stdout,
+ * through the handed runtime's stdio; the bearer never reaches stderr, a log or
+ * a failure.
+ */
+import { type VibesRuntime } from '@vibesdotdev/kernel';
+/**
+ * The registry credential for a shell: `resolveSessionJwt` when the caller
+ * passes one (the login flow's own minted JWT), else the caller's bearer. An
+ * anonymous caller is `ForgeNotSignedInError`; a signed-out interactive host
+ * is auth's `AUTH_REQUIRED` `not-signed-in`.
+ */
+export declare function resolveRegistryEnvToken(runtime: VibesRuntime, options?: {
+    resolveSessionJwt?: () => Promise<string>;
+}): Promise<{
+    token: string;
+    source: 'session';
+}>;
+/** `registry env` takes no arguments. */
+export type RegistryEnvArgs = Readonly<Record<string, never>>;
+/** The options `registry env` reads, as the CLI hands them. */
+export type RegistryEnvOptions = Readonly<{
+    json?: boolean;
+    format?: string;
+    output?: string;
+}>;
+export declare function execute(_args: RegistryEnvArgs, opts: RegistryEnvOptions, context: CommandContext): Promise<void>;
+declare const _default: {
+    execute: typeof execute;
+};
+export default _default;
+//# sourceMappingURL=registry.env.command.impl.d.ts.map

package/dist/cli/commands/registry.env.command.impl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.env.command.impl.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/registry.env.command.impl.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACvD;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAoC,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAM1F;;;;;GAKG;AACH,wBAAsB,uBAAuB,CAC5C,OAAO,EAAE,YAAY,EACrB,OAAO,GAAE;IAAE,iBAAiB,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAA;CAAO,GACzD,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,SAAS,CAAA;CAAE,CAAC,CAI/C;AAED,yCAAyC;AACzC,MAAM,MAAM,eAAe,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;AAE9D,+DAA+D;AAC/D,MAAM,MAAM,kBAAkB,GAAG,QAAQ,CAAC;IAAE,IAAI,CAAC,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAEhG,wBAAsB,OAAO,CAC5B,KAAK,EAAE,eAAe,EACtB,IAAI,EAAE,kBAAkB,EACxB,OAAO,EAAE,cAAc,GACrB,OAAO,CAAC,IAAI,CAAC,CAqBf;;;;AAED,wBAA2B"}

package/dist/cli/commands/registry.env.command.impl.js

@@ -0,0 +1,51 @@
+/**
+ * `vibes registry env` — emit `export VIBES_REGISTRY_TOKEN=...` for eval.
+ *
+ * The value is the caller's bearer from auth's `resolveCallerBearer`, chosen by
+ * the host's declared capability: the stored login on an interactive CLI (the
+ * `auth/device-session` store), a published host credential under
+ * `vibes secrets exec`. Registry reads authenticate as the caller (rc05 §2.2);
+ * `VIBES_REGISTRY_JWT` folded into `VIBES_REGISTRY_TOKEN`.
+ *
+ * The export line (or the `--json` document) is written once, on stdout,
+ * through the handed runtime's stdio; the bearer never reaches stderr, a log or
+ * a failure.
+ */
+import { CapabilityError, getRuntimeStdio } from '@vibesdotdev/kernel';
+import { resolveCallerBearer } from '@vibesdotdev/auth/caller-bearer';
+import { ForgeNotSignedInError } from "../lib/transport.js";
+import { wantsJson } from "../lib/output.js";
+import { formatRegistryEnvExport, isNotSignedIn, REGISTRY_TOKEN_ENV } from "../lib/registry-client-config.js";
+/**
+ * The registry credential for a shell: `resolveSessionJwt` when the caller
+ * passes one (the login flow's own minted JWT), else the caller's bearer. An
+ * anonymous caller is `ForgeNotSignedInError`; a signed-out interactive host
+ * is auth's `AUTH_REQUIRED` `not-signed-in`.
+ */
+export async function resolveRegistryEnvToken(runtime, options = {}) {
+    const token = options.resolveSessionJwt ? await options.resolveSessionJwt() : await resolveCallerBearer(runtime);
+    if (!token)
+        throw new ForgeNotSignedInError();
+    return { token, source: 'session' };
+}
+export async function execute(_args, opts, context) {
+    const stdio = await getRuntimeStdio(context.runtime);
+    let resolved;
+    try {
+        resolved = await resolveRegistryEnvToken(context.runtime);
+    }
+    catch (error) {
+        if (isNotSignedIn(error)) {
+            throw new CapabilityError(`Not signed in, so there is no ${REGISTRY_TOKEN_ENV} to export. Run vibes auth login.`, 'AUTH_REQUIRED', { reason: 'not-signed-in', recoveryHint: 'Run: vibes auth login', cause: error });
+        }
+        throw error;
+    }
+    if (wantsJson(opts)) {
+        const document = { env: REGISTRY_TOKEN_ENV, token: resolved.token, source: resolved.source };
+        stdio.write('stdout', `${JSON.stringify(document, null, 2)}\n`);
+        return;
+    }
+    stdio.write('stdout', formatRegistryEnvExport(resolved.token));
+}
+export default { execute };
+//# sourceMappingURL=registry.env.command.impl.js.map

package/dist/cli/commands/registry.env.command.impl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.env.command.impl.js","sourceRoot":"","sources":["../../../src/cli/commands/registry.env.command.impl.ts"],"names":[],"mappings":"AACA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,eAAe,EAAE,eAAe,EAAqB,MAAM,qBAAqB,CAAC;AAC1F,OAAO,EAAE,mBAAmB,EAAE,MAAM,iCAAiC,CAAC;AACtE,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,uBAAuB,EAAE,aAAa,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAE9G;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC5C,OAAqB,EACrB,UAAyD,EAAE;IAE3D,MAAM,KAAK,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC,MAAM,mBAAmB,CAAC,OAAO,CAAC,CAAC;IACjH,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,qBAAqB,EAAE,CAAC;IAC9C,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AACrC,CAAC;AAQD,MAAM,CAAC,KAAK,UAAU,OAAO,CAC5B,KAAsB,EACtB,IAAwB,EACxB,OAAuB;IAEvB,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACrD,IAAI,QAA6D,CAAC;IAClE,IAAI,CAAC;QACJ,QAAQ,GAAG,MAAM,uBAAuB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,eAAe,CACxB,iCAAiC,kBAAkB,mCAAmC,EACtF,eAAe,EACf,EAAE,MAAM,EAAE,eAAe,EAAE,YAAY,EAAE,uBAAuB,EAAE,KAAK,EAAE,KAAK,EAAE,CAChF,CAAC;QACH,CAAC;QACD,MAAM,KAAK,CAAC;IACb,CAAC;IACD,IAAI,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,MAAM,QAAQ,GAAG,EAAE,GAAG,EAAE,kBAAkB,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC7F,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QAChE,OAAO;IACR,CAAC;IACD,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,uBAAuB,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,eAAe,EAAE,OAAO,EAAE,CAAC"}

package/dist/cli/commands/registry.env.fast-path.d.ts

@@ -0,0 +1,27 @@
+/**
+ * What `vibes registry env` needs to answer without a whole CLI boot.
+ *
+ * Interactive shells run `vibes registry env` from the managed remint
+ * (`user-environment.projection.ts`), so its cost is paid per shell. A full
+ * boot composes every workspace plugin (seconds, ~800 MB); the bearer needs
+ * only the owners below. The host entry boots a subset workspace composition
+ * (every config layer projected as usual, these plugins composed) and calls
+ * {@link registryEnvExportLine}; on any failure it falls through to the full
+ * CLI, whose command is the one contract for refusals and exit codes.
+ */
+import type { VibesRuntime } from '@vibesdotdev/kernel';
+/**
+ * The plugins the caller bearer resolves through: logging (the credential
+ * store logs), storage + config + environment + `infra.services` (the stored login and the
+ * environment it is partitioned under), the Vibes service origins (the auth
+ * origin the stored login is exchanged at for the app JWT; without it auth
+ * degrades to the raw stored credential), secrets (the `secrets/store` kind),
+ * and auth with its consumer device-session store and declared dependencies.
+ */
+export declare const REGISTRY_ENV_FAST_PATH_PLUGINS: readonly string[];
+/**
+ * The export line `vibes registry env` writes, or `null` when the caller has
+ * no bearer. Any failure propagates: the caller falls through to the command.
+ */
+export declare function registryEnvExportLine(runtime: VibesRuntime): Promise<string | null>;
+//# sourceMappingURL=registry.env.fast-path.d.ts.map

package/dist/cli/commands/registry.env.fast-path.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.env.fast-path.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/registry.env.fast-path.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAIxD;;;;;;;GAOG;AACH,eAAO,MAAM,8BAA8B,EAAE,SAAS,MAAM,EAc1D,CAAC;AAEH;;;GAGG;AACH,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAGzF"}