@vibesdotdev/forge 0.0.0-stage → 1.0.0-rc.4

package/dist/cli/lib/registry-client-config.js

@@ -0,0 +1,106 @@
+import { serviceOrigin } from '@vibesdotdev/infra-core/service';
+/**
+ * User-level scoped-registry client config. Files store env-var indirection
+ * only — never a long-lived token.
+ *
+ * Repo bunfig/.npmrc and Forge CI inject `VIBES_REGISTRY_TOKEN`. The caller's
+ * app bearer is a valid value of that same name (resolve-token accepts it).
+ * `VIBES_REGISTRY_JWT` folded into `VIBES_REGISTRY_TOKEN` (rc05 §2.2).
+ */
+import { join, resolveFileSystemAdapter } from '@vibesdotdev/filesystem';
+import { getPathRoots } from '@vibesdotdev/paths';
+import { CapabilityError } from '@vibesdotdev/kernel';
+export const REGISTRY_TOKEN_ENV = 'VIBES_REGISTRY_TOKEN';
+export const REGISTRY_SCOPE = '@vibesdotdev';
+export function registryAuthKey(origin) {
+    const url = new URL(origin);
+    return `//${url.host}${url.pathname.replace(/\/?$/, '/')}:_authToken=`;
+}
+export function mergeUserNpmrc(existing, origin) {
+    const priorOrigin = existing.split('\n').map((line) => line.trim())
+        .find((line) => line.startsWith(`${REGISTRY_SCOPE}:registry=`))?.slice(`${REGISTRY_SCOPE}:registry=`.length);
+    const priorAuthKey = priorOrigin && URL.canParse(priorOrigin) ? registryAuthKey(priorOrigin) : undefined;
+    const kept = existing
+        .replace(/\r\n/g, '\n')
+        .split('\n')
+        .filter((line) => {
+        const trimmed = line.trim();
+        if (trimmed.startsWith(`${REGISTRY_SCOPE}:registry=`))
+            return false;
+        if (priorAuthKey && trimmed.startsWith(priorAuthKey))
+            return false;
+        if (trimmed.startsWith(registryAuthKey(origin)))
+            return false;
+        return true;
+    });
+    while (kept.length > 0 && kept[kept.length - 1] === '')
+        kept.pop();
+    return [...kept, `${REGISTRY_SCOPE}:registry=${origin}`, `${registryAuthKey(origin)}\${${REGISTRY_TOKEN_ENV}}`, ''].join('\n');
+}
+export function mergeUserBunfig(existing, origin) {
+    const scopeLine = `"${REGISTRY_SCOPE}" = { url = ${JSON.stringify(origin)}, token = "$${REGISTRY_TOKEN_ENV}" }`;
+    let inScopes = false;
+    const lines = existing.replace(/\r\n/g, '\n').split('\n').filter((line) => {
+        const section = line.trim();
+        if (section.startsWith('['))
+            inScopes = section === '[install.scopes]';
+        return !(inScopes && /^\s*"?@vibesdotdev"?\s*=/.test(line));
+    });
+    const text = lines.join('\n');
+    if (!text.trim())
+        return `[install.scopes]\n${scopeLine}\n`;
+    if (/^\[install\.scopes\][ \t]*$/m.test(text)) {
+        return text.replace(/^\[install\.scopes\][ \t]*(?:\n|$)/m, `[install.scopes]\n${scopeLine}\n`);
+    }
+    return `${text.replace(/\n+$/, '')}\n\n[install.scopes]\n${scopeLine}\n`;
+}
+export function formatRegistryEnvExport(token) {
+    if (!token || /[\n\r\0]/.test(token)) {
+        throw new Error('Registry credential is not a single-line token');
+    }
+    const quoted = token.replace(/'/g, `'\\''`);
+    return `export ${REGISTRY_TOKEN_ENV}='${quoted}'\n`;
+}
+/**
+ * The named registry token (`VIBES_REGISTRY_TOKEN`) from the host's declared
+ * secrets store, or `null` when it is not set. It is an install credential,
+ * never the caller's bearer. Any other resolution failure is thrown.
+ */
+export async function resolveNamedRegistryToken(runtime) {
+    const resolution = await runtime.resolveCredential({ source: 'secret', key: REGISTRY_TOKEN_ENV });
+    if (resolution.ok)
+        return resolution.value.trim() || null;
+    if (resolution.error.reason === 'credential-not-set')
+        return null;
+    throw resolution.error;
+}
+/** True when `error` is the typed signed-out failure of `resolveCallerBearer`. */
+export function isNotSignedIn(error) {
+    return error instanceof CapabilityError && error.reason === 'not-signed-in';
+}
+/**
+ * The registry projection's homes: the path roots' `userHome` and `vibesHome`
+ * (rc02-rc03 §3). Nothing reads `HOME`, `USERPROFILE` or `homedir()`.
+ */
+export function registryHomes(runtime) {
+    const roots = getPathRoots(runtime);
+    return { home: roots.userHome, vibesHome: roots.vibesHome, userHome: roots.userHome };
+}
+function toText(data) {
+    return data instanceof Uint8Array ? new TextDecoder().decode(data) : data;
+}
+export async function writeUserRegistryClientConfig(home, runtime) {
+    const fs = await resolveFileSystemAdapter(runtime, { binding: false });
+    await fs.mkdir(home, { recursive: true });
+    const npmrcPath = join(home, '.npmrc');
+    const bunfigPath = join(home, '.bunfig.toml');
+    const existingNpmrc = (await fs.exists(npmrcPath)) ? await fs.readFile(npmrcPath, 'utf8') : '';
+    const existingBunfig = (await fs.exists(bunfigPath)) ? await fs.readFile(bunfigPath, 'utf8') : '';
+    const origin = await serviceOrigin(runtime, 'registry');
+    const npmrc = mergeUserNpmrc(toText(existingNpmrc), origin);
+    const bunfig = mergeUserBunfig(toText(existingBunfig), origin);
+    await fs.writeFile(npmrcPath, npmrc, { mode: 0o600 });
+    await fs.writeFile(bunfigPath, bunfig, { mode: 0o600 });
+    return { npmrc: npmrcPath, bunfig: bunfigPath };
+}
+//# sourceMappingURL=registry-client-config.js.map

package/dist/cli/lib/registry-client-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry-client-config.js","sourceRoot":"","sources":["../../../src/cli/lib/registry-client-config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAChE;;;;;;;GAOG;AAEH,OAAO,EAAE,IAAI,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACzE,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAqB,MAAM,qBAAqB,CAAC;AAEzE,MAAM,CAAC,MAAM,kBAAkB,GAAG,sBAAsB,CAAC;AACzD,MAAM,CAAC,MAAM,cAAc,GAAG,cAAc,CAAC;AAE7C,MAAM,UAAU,eAAe,CAAC,MAAc;IAC7C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B,OAAO,KAAK,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,cAAc,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,QAAgB,EAAE,MAAc;IAC9D,MAAM,WAAW,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SACjE,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,cAAc,YAAY,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,cAAc,YAAY,CAAC,MAAM,CAAC,CAAC;IAC9G,MAAM,YAAY,GAAG,WAAW,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACzG,MAAM,IAAI,GAAG,QAAQ;SACnB,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC;SACtB,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;QAChB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,cAAc,YAAY,CAAC;YAAE,OAAO,KAAK,CAAC;QACpE,IAAI,YAAY,IAAI,OAAO,CAAC,UAAU,CAAC,YAAY,CAAC;YAAE,OAAO,KAAK,CAAC;QACnE,IAAI,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAC9D,OAAO,IAAI,CAAC;IACb,CAAC,CAAC,CAAC;IACJ,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE;QAAE,IAAI,CAAC,GAAG,EAAE,CAAC;IACnE,OAAO,CAAC,GAAG,IAAI,EAAE,GAAG,cAAc,aAAa,MAAM,EAAE,EAAE,GAAG,eAAe,CAAC,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAChI,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,QAAgB,EAAE,MAAc;IAC/D,MAAM,SAAS,GAAG,IAAI,cAAc,eAAe,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,eAAe,kBAAkB,KAAK,CAAC;IAChH,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;QACzE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,QAAQ,GAAG,OAAO,KAAK,kBAAkB,CAAC;QACvE,OAAO,CAAC,CAAC,QAAQ,IAAI,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,qBAAqB,SAAS,IAAI,CAAC;IAC5D,IAAI,8BAA8B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/C,OAAO,IAAI,CAAC,OAAO,CAAC,qCAAqC,EAAE,qBAAqB,SAAS,IAAI,CAAC,CAAC;IAChG,CAAC;IACD,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,yBAAyB,SAAS,IAAI,CAAC;AAC1E,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,KAAa;IACpD,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC5C,OAAO,UAAU,kBAAkB,KAAK,MAAM,KAAK,CAAC;AACrD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,OAAqB;IACpE,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAClG,IAAI,UAAU,CAAC,EAAE;QAAE,OAAO,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;IAC1D,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,KAAK,oBAAoB;QAAE,OAAO,IAAI,CAAC;IAClE,MAAM,UAAU,CAAC,KAAK,CAAC;AACxB,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,aAAa,CAAC,KAAc;IAC3C,OAAO,KAAK,YAAY,eAAe,IAAI,KAAK,CAAC,MAAM,KAAK,eAAe,CAAC;AAC7E,CAAC;AAYD;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,OAAqB;IAClD,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;IACpC,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC;AACvF,CAAC;AACD,SAAS,MAAM,CAAC,IAAyB;IACxC,OAAO,IAAI,YAAY,UAAU,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC3E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAClD,IAAY,EACZ,OAAqB;IAErB,MAAM,EAAE,GAAG,MAAM,wBAAwB,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IACvE,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACvC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IAC9C,MAAM,aAAa,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/F,MAAM,cAAc,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAClG,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IACxD,MAAM,KAAK,GAAG,cAAc,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC,CAAC;IAC/D,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACtD,MAAM,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACxD,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;AACjD,CAAC"}

package/dist/cli/lib/registry-projection.d.ts

@@ -0,0 +1,41 @@
+import type { VibesRuntime } from '@vibesdotdev/kernel';
+import { type RegistryHomes } from './registry-client-config.ts';
+import { type UserEnvironmentHost, type UserEnvironmentProjection } from './user-environment.projection.ts';
+export interface RegistryConfigInspection {
+    npmrc: string;
+    bunfig: string;
+    npmrcReady: boolean;
+    bunfigReady: boolean;
+}
+export declare const REGISTRY_PROBE_PACKAGE = "@vibesdotdev/kernel";
+export interface RegistryProjectionReport {
+    config: RegistryConfigInspection;
+    tokenSource: 'session' | 'named' | 'missing';
+    tokenBound: boolean;
+    tokenUsable: boolean;
+    registryReachable: boolean;
+    userEnvironment: UserEnvironmentProjection;
+}
+export declare function jwtExpiryMs(token: string): number | null;
+export declare function registryTokenUsable(token: string, now?: number): boolean;
+export declare function probeRegistryAuth(token: string, origin: string, fetchImpl?: typeof fetch): Promise<{
+    ok: boolean;
+    status: number;
+    error?: unknown;
+}>;
+export interface UserRegistryConfigTextInspection {
+    npmrcReady: boolean;
+    bunfigReady: boolean;
+}
+export declare function inspectUserRegistryConfigText(npmrc: string, bunfig: string, origin: string): UserRegistryConfigTextInspection;
+export declare function inspectUserRegistryConfig(home: string, runtime: VibesRuntime): Promise<RegistryConfigInspection>;
+/** True when the host's secrets store holds a named `VIBES_REGISTRY_TOKEN`. */
+export declare function registryTokenBound(runtime: VibesRuntime): Promise<boolean>;
+export declare function inspectRegistryProjection(runtime: VibesRuntime, homes: RegistryHomes, fetchImpl?: typeof fetch): Promise<RegistryProjectionReport>;
+export declare function projectRegistryAfterLogin(options: RegistryHomes & {
+    runtime: VibesRuntime;
+    resolveSessionJwt?: () => Promise<string>;
+    host?: UserEnvironmentHost;
+    platform?: NodeJS.Platform;
+}): Promise<RegistryProjectionReport>;
+//# sourceMappingURL=registry-projection.d.ts.map

package/dist/cli/lib/registry-projection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry-projection.d.ts","sourceRoot":"","sources":["../../../src/cli/lib/registry-projection.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAExD,OAAO,EAQN,KAAK,aAAa,EAClB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAGN,KAAK,mBAAmB,EACxB,KAAK,yBAAyB,EAC9B,MAAM,kCAAkC,CAAC;AAG1C,MAAM,WAAW,wBAAwB;IACxC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,OAAO,CAAC;IACpB,WAAW,EAAE,OAAO,CAAC;CACrB;AAED,eAAO,MAAM,sBAAsB,wBAAwB,CAAC;AAG5D,MAAM,WAAW,wBAAwB;IACxC,MAAM,EAAE,wBAAwB,CAAC;IACjC,WAAW,EAAE,SAAS,GAAG,OAAO,GAAG,SAAS,CAAC;IAC7C,UAAU,EAAE,OAAO,CAAC;IACpB,WAAW,EAAE,OAAO,CAAC;IACrB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,eAAe,EAAE,yBAAyB,CAAC;CAC3C;AAgBD,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAOxD;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,SAAa,GAAG,OAAO,CAM5E;AAED,wBAAsB,iBAAiB,CACtC,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,EACd,SAAS,GAAE,OAAO,KAAa,GAC7B,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CAU3D;AAED,MAAM,WAAW,gCAAgC;IAChD,UAAU,EAAE,OAAO,CAAC;IACpB,WAAW,EAAE,OAAO,CAAC;CACrB;AAED,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,gCAAgC,CAO7H;AAMD,wBAAsB,yBAAyB,CAC9C,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,YAAY,GACnB,OAAO,CAAC,wBAAwB,CAAC,CAYnC;AAED,+EAA+E;AAC/E,wBAAsB,kBAAkB,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,CAEhF;AAED,wBAAsB,yBAAyB,CAC9C,OAAO,EAAE,YAAY,EACrB,KAAK,EAAE,aAAa,EACpB,SAAS,CAAC,EAAE,OAAO,KAAK,GACtB,OAAO,CAAC,wBAAwB,CAAC,CAoBnC;AAiBD,wBAAsB,yBAAyB,CAAC,OAAO,EAAE,aAAa,GAAG;IACxE,OAAO,EAAE,YAAY,CAAC;IACtB,iBAAiB,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,CAAC,EAAE,mBAAmB,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;CAC3B,GAAI,OAAO,CAAC,wBAAwB,CAAC,CAyDrC"}

package/dist/cli/lib/registry-projection.js

@@ -0,0 +1,176 @@
+import { serviceOrigin } from '@vibesdotdev/infra-core/service';
+/**
+ * Project scoped-registry client config and remint hooks onto this machine.
+ * Files keep env-var indirection; new shells remint through `vibes registry env`.
+ *
+ * Nothing is bound into this process's environment. After login `tokenBound`
+ * means the caller's bearer (auth's `resolveCallerBearer`) was projected into
+ * the durable user environment; `inspectRegistryProjection` reports the named
+ * `VIBES_REGISTRY_TOKEN` the host's secrets store holds, read through
+ * `runtime.resolveCredential` (rc01 §3 "Bridge-key readers").
+ */
+import { join, resolveFileSystemAdapter } from '@vibesdotdev/filesystem';
+import { ForgeNotSignedInError } from "./transport.js";
+import { isNotSignedIn, REGISTRY_TOKEN_ENV, REGISTRY_SCOPE, registryAuthKey, mergeUserBunfig, resolveNamedRegistryToken, writeUserRegistryClientConfig } from "./registry-client-config.js";
+import { inspectUserRegistryEnvironment, projectUserRegistryEnvironment } from "./user-environment.projection.js";
+import { resolveRegistryEnvToken } from "../commands/registry.env.command.impl.js";
+export const REGISTRY_PROBE_PACKAGE = '@vibesdotdev/kernel';
+const TOKEN_LEAD_MS = 60_000;
+import * as z from 'zod/v4';
+const JwtPayloadSchema = z.object({
+    exp: z.number()
+});
+function safeJsonParse(text) {
+    try {
+        return { ok: true, value: JSON.parse(text) };
+    }
+    catch (error) {
+        return { ok: false, error };
+    }
+}
+export function jwtExpiryMs(token) {
+    const parts = token.split('.');
+    if (parts.length < 2)
+        return null;
+    const parsedJson = safeJsonParse(Buffer.from(parts[1], 'base64url').toString());
+    if (!parsedJson.ok)
+        return null;
+    const parsed = JwtPayloadSchema.safeParse(parsedJson.value);
+    return parsed.success ? parsed.data.exp * 1000 : null;
+}
+export function registryTokenUsable(token, now = Date.now()) {
+    const value = token.trim();
+    if (!value)
+        return false;
+    const expiry = jwtExpiryMs(value);
+    if (expiry === null)
+        return true;
+    return expiry - now > TOKEN_LEAD_MS;
+}
+export async function probeRegistryAuth(token, origin, fetchImpl = fetch) {
+    const url = `${origin}/${REGISTRY_PROBE_PACKAGE.replace('/', '%2f')}`;
+    try {
+        const response = await fetchImpl(url, {
+            headers: { Authorization: `Bearer ${token}` }
+        });
+        return { ok: response.status === 200, status: response.status };
+    }
+    catch (error) {
+        return { ok: false, status: 0, error };
+    }
+}
+export function inspectUserRegistryConfigText(npmrc, bunfig, origin) {
+    return {
+        npmrcReady: npmrc.includes(`${REGISTRY_SCOPE}:registry=${origin}`) &&
+            npmrc.includes(`${registryAuthKey(origin)}\${${REGISTRY_TOKEN_ENV}}`),
+        bunfigReady: bunfig.includes(mergeUserBunfig("", origin).split("\n")[1])
+    };
+}
+function toText(data) {
+    return data instanceof Uint8Array ? new TextDecoder().decode(data) : data;
+}
+export async function inspectUserRegistryConfig(home, runtime) {
+    const fs = await resolveFileSystemAdapter(runtime, { binding: false });
+    const npmrcPath = join(home, '.npmrc');
+    const bunfigPath = join(home, '.bunfig.toml');
+    // LEGIT: inspection reports presence; an absent or unreadable file inspects as empty
+    const npmrc = (await fs.exists(npmrcPath)) ? toText(await fs.readFile(npmrcPath, 'utf8')) : '';
+    const bunfig = (await fs.exists(bunfigPath)) ? toText(await fs.readFile(bunfigPath, 'utf8')) : '';
+    return {
+        npmrc: npmrcPath,
+        bunfig: bunfigPath,
+        ...inspectUserRegistryConfigText(npmrc, bunfig, await serviceOrigin(runtime, 'registry'))
+    };
+}
+/** True when the host's secrets store holds a named `VIBES_REGISTRY_TOKEN`. */
+export async function registryTokenBound(runtime) {
+    return (await resolveNamedRegistryToken(runtime)) !== null;
+}
+export async function inspectRegistryProjection(runtime, homes, fetchImpl) {
+    const named = await resolveNamedRegistryToken(runtime);
+    const tokenUsable = named ? registryTokenUsable(named) : false;
+    let registryReachable = false;
+    if (tokenUsable && named) {
+        const probe = await probeRegistryAuth(named, await serviceOrigin(runtime, 'registry'), fetchImpl);
+        registryReachable = probe.ok;
+    }
+    return {
+        config: await inspectUserRegistryConfig(homes.home, runtime),
+        tokenSource: named ? 'named' : 'missing',
+        tokenBound: named !== null,
+        tokenUsable,
+        registryReachable,
+        userEnvironment: await inspectUserRegistryEnvironment({
+            vibesHome: homes.vibesHome,
+            userHome: homes.userHome,
+            runtime
+        })
+    };
+}
+async function tryResolveRegistryEnvToken(runtime, options) {
+    try {
+        const resolved = await resolveRegistryEnvToken(runtime, options);
+        return { ok: true, resolved };
+    }
+    catch (error) {
+        return { ok: false, error };
+    }
+}
+export async function projectRegistryAfterLogin(options) {
+    const written = await writeUserRegistryClientConfig(options.home, options.runtime);
+    let tokenSource = 'missing';
+    let token = null;
+    const resolution = await tryResolveRegistryEnvToken(options.runtime, {
+        resolveSessionJwt: options.resolveSessionJwt
+    });
+    if (resolution.ok) {
+        token = resolution.resolved.token;
+        tokenSource = resolution.resolved.source;
+    }
+    else {
+        const { error } = resolution;
+        if (!(error instanceof ForgeNotSignedInError) && !isNotSignedIn(error)) {
+            throw error;
+        }
+    }
+    if (token) {
+        const userEnvironment = await projectUserRegistryEnvironment(token, {
+            vibesHome: options.vibesHome,
+            userHome: options.userHome,
+            runtime: options.runtime,
+            host: options.host,
+            platform: options.platform
+        });
+        const fs = await resolveFileSystemAdapter(options.runtime, { binding: false });
+        const npmrc = (await fs.exists(written.npmrc)) ? toText(await fs.readFile(written.npmrc, 'utf8')) : '';
+        const bunfig = (await fs.exists(written.bunfig)) ? toText(await fs.readFile(written.bunfig, 'utf8')) : '';
+        return {
+            config: {
+                ...written,
+                ...inspectUserRegistryConfigText(npmrc, bunfig, await serviceOrigin(options.runtime, 'registry'))
+            },
+            tokenSource,
+            tokenBound: true,
+            tokenUsable: registryTokenUsable(token),
+            registryReachable: false,
+            userEnvironment
+        };
+    }
+    return {
+        config: {
+            ...written,
+            npmrcReady: true,
+            bunfigReady: true
+        },
+        tokenSource,
+        tokenBound: false,
+        tokenUsable: false,
+        registryReachable: false,
+        userEnvironment: await inspectUserRegistryEnvironment({
+            vibesHome: options.vibesHome,
+            userHome: options.userHome,
+            runtime: options.runtime
+        })
+    };
+}
+//# sourceMappingURL=registry-projection.js.map

package/dist/cli/lib/registry-projection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry-projection.js","sourceRoot":"","sources":["../../../src/cli/lib/registry-projection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAChE;;;;;;;;;GASG;AAEH,OAAO,EAAE,IAAI,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AAEzE,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,EACN,aAAa,EACb,kBAAkB,EAClB,cAAc,EACd,eAAe,EACf,eAAe,EACf,yBAAyB,EACzB,6BAA6B,EAE7B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACN,8BAA8B,EAC9B,8BAA8B,EAG9B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAAE,uBAAuB,EAAE,MAAM,0CAA0C,CAAC;AASnF,MAAM,CAAC,MAAM,sBAAsB,GAAG,qBAAqB,CAAC;AAC5D,MAAM,aAAa,GAAG,MAAM,CAAC;AAW7B,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IACjC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;CACf,CAAC,CAAC;AAEH,SAAS,aAAa,CAAC,IAAY;IAClC,IAAI,CAAC;QACJ,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;IAC9C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC7B,CAAC;AACF,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,KAAa;IACxC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;IACjF,IAAI,CAAC,UAAU,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IAC5D,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAa,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAClE,MAAM,KAAK,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACjC,OAAO,MAAM,GAAG,GAAG,GAAG,aAAa,CAAC;AACrC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACtC,KAAa,EACb,MAAc,EACd,YAA0B,KAAK;IAE/B,MAAM,GAAG,GAAG,GAAG,MAAM,IAAI,sBAAsB,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC;IACtE,IAAI,CAAC;QACJ,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;YACrC,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;SAC7C,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;IACjE,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC;IACxC,CAAC;AACF,CAAC;AAOD,MAAM,UAAU,6BAA6B,CAAC,KAAa,EAAE,MAAc,EAAE,MAAc;IAC1F,OAAO;QACN,UAAU,EACT,KAAK,CAAC,QAAQ,CAAC,GAAG,cAAc,aAAa,MAAM,EAAE,CAAC;YACtD,KAAK,CAAC,QAAQ,CAAC,GAAG,eAAe,CAAC,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;QACtE,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,CAAC;KACzE,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,IAAyB;IACxC,OAAO,IAAI,YAAY,UAAU,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC3E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC9C,IAAY,EACZ,OAAqB;IAErB,MAAM,EAAE,GAAG,MAAM,wBAAwB,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IACvE,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACvC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IAC9C,qFAAqF;IACrF,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/F,MAAM,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAClG,OAAO;QACN,KAAK,EAAE,SAAS;QAChB,MAAM,EAAE,UAAU;QAClB,GAAG,6BAA6B,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;KACzF,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAAqB;IAC7D,OAAO,CAAC,MAAM,yBAAyB,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,CAAC;AAC5D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC9C,OAAqB,EACrB,KAAoB,EACpB,SAAwB;IAExB,MAAM,KAAK,GAAG,MAAM,yBAAyB,CAAC,OAAO,CAAC,CAAC;IACvD,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IAC/D,IAAI,iBAAiB,GAAG,KAAK,CAAC;IAC9B,IAAI,WAAW,IAAI,KAAK,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,KAAK,EAAE,MAAM,aAAa,CAAC,OAAO,EAAE,UAAU,CAAC,EAAE,SAAS,CAAC,CAAC;QAClG,iBAAiB,GAAG,KAAK,CAAC,EAAE,CAAC;IAC9B,CAAC;IACD,OAAO;QACN,MAAM,EAAE,MAAM,yBAAyB,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC;QAC5D,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;QACxC,UAAU,EAAE,KAAK,KAAK,IAAI;QAC1B,WAAW;QACX,iBAAiB;QACjB,eAAe,EAAE,MAAM,8BAA8B,CAAC;YACrD,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,OAAO;SACP,CAAC;KACF,CAAC;AACH,CAAC;AAED,KAAK,UAAU,0BAA0B,CACxC,OAAqB,EACrB,OAAsD;IAKtD,IAAI,CAAC;QACJ,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACjE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC/B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC7B,CAAC;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,OAK/C;IACA,MAAM,OAAO,GAAG,MAAM,6BAA6B,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACnF,IAAI,WAAW,GAA4C,SAAS,CAAC;IACrE,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,MAAM,UAAU,GAAG,MAAM,0BAA0B,CAAC,OAAO,CAAC,OAAO,EAAE;QACpE,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;KAC5C,CAAC,CAAC;IACH,IAAI,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,KAAK,GAAG,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC;QAClC,WAAW,GAAG,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC;IAC1C,CAAC;SAAM,CAAC;QACP,MAAM,EAAE,KAAK,EAAE,GAAG,UAAU,CAAC;QAC7B,IAAI,CAAC,CAAC,KAAK,YAAY,qBAAqB,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;YACxE,MAAM,KAAK,CAAC;QACb,CAAC;IACF,CAAC;IAED,IAAI,KAAK,EAAE,CAAC;QACX,MAAM,eAAe,GAAG,MAAM,8BAA8B,CAAC,KAAK,EAAE;YACnE,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,QAAQ,EAAE,OAAO,CAAC,QAAQ;SAC1B,CAAC,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,wBAAwB,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/E,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACvG,MAAM,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1G,OAAO;YACN,MAAM,EAAE;gBACP,GAAG,OAAO;gBACV,GAAG,6BAA6B,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC,OAAO,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;aACjG;YACD,WAAW;YACX,UAAU,EAAE,IAAI;YAChB,WAAW,EAAE,mBAAmB,CAAC,KAAK,CAAC;YACvC,iBAAiB,EAAE,KAAK;YACxB,eAAe;SACf,CAAC;IACH,CAAC;IAED,OAAO;QACN,MAAM,EAAE;YACP,GAAG,OAAO;YACV,UAAU,EAAE,IAAI;YAChB,WAAW,EAAE,IAAI;SACjB;QACD,WAAW;QACX,UAAU,EAAE,KAAK;QACjB,WAAW,EAAE,KAAK;QAClB,iBAAiB,EAAE,KAAK;QACxB,eAAe,EAAE,MAAM,8BAA8B,CAAC;YACrD,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,OAAO,EAAE,OAAO,CAAC,OAAO;SACxB,CAAC;KACF,CAAC;AACH,CAAC"}

package/dist/cli/lib/repo-ref.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Resolve a user-friendly `<repo>` argument to the platform repository UUID
+ * that the item/token/clone-url routes require.
+ *
+ * Accepted forms:
+ *   - a bare UUID            → used as-is (no network round-trip)
+ *   - `<owner>/<name>`       → GET /api/repositories/resolve?owner=&name=
+ *   - `<name>`               → GET /api/repositories then match by name
+ *                              (optionally scoped to an org owner so bare names
+ *                              can resolve org-owned repos, not just the user's)
+ *
+ * Pure-ish: the network call goes through the injectable `sendForgeRequest`
+ * transport, so the resolution logic is testable at the transport boundary.
+ */
+import type { VibesRuntime } from '@vibesdotdev/kernel';
+import type { FetchLike, ForgeRequestOptions } from './transport.ts';
+export { isUuid, RepoNotFoundError, RepoAmbiguousError, matchRepoByName } from '../../repository-ref.ts';
+/**
+ * Resolve `<repo>` → repository UUID. Throws RepoNotFoundError /
+ * RepoAmbiguousError, or surfaces a transport error message.
+ */
+export declare function resolveRepositoryId(runtime: VibesRuntime, ref: string, fetchImpl?: FetchLike, ownerId?: string, options?: ForgeRequestOptions): Promise<string>;
+//# sourceMappingURL=repo-ref.d.ts.map

package/dist/cli/lib/repo-ref.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repo-ref.d.ts","sourceRoot":"","sources":["../../../src/cli/lib/repo-ref.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAE,SAAS,EAAE,mBAAmB,EAAoB,MAAM,gBAAgB,CAAC;AAKvF,OAAO,EACN,MAAM,EACN,iBAAiB,EACjB,kBAAkB,EAClB,eAAe,EACf,MAAM,yBAAyB,CAAC;AAEjC;;;GAGG;AACH,wBAAsB,mBAAmB,CACxC,OAAO,EAAE,YAAY,EACrB,GAAG,EAAE,MAAM,EACX,SAAS,CAAC,EAAE,SAAS,EACrB,OAAO,CAAC,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,mBAAmB,GAC3B,OAAO,CAAC,MAAM,CAAC,CAsCjB"}

package/dist/cli/lib/repo-ref.js

@@ -0,0 +1,52 @@
+/**
+ * Resolve a user-friendly `<repo>` argument to the platform repository UUID
+ * that the item/token/clone-url routes require.
+ *
+ * Accepted forms:
+ *   - a bare UUID            → used as-is (no network round-trip)
+ *   - `<owner>/<name>`       → GET /api/repositories/resolve?owner=&name=
+ *   - `<name>`               → GET /api/repositories then match by name
+ *                              (optionally scoped to an org owner so bare names
+ *                              can resolve org-owned repos, not just the user's)
+ *
+ * Pure-ish: the network call goes through the injectable `sendForgeRequest`
+ * transport, so the resolution logic is testable at the transport boundary.
+ */
+import { sendForgeRequest } from "./transport.js";
+import { isUuid, RepoNotFoundError, resolveRepositoryName } from "../../repository-ref.js";
+export { isUuid, RepoNotFoundError, RepoAmbiguousError, matchRepoByName } from "../../repository-ref.js";
+/**
+ * Resolve `<repo>` → repository UUID. Throws RepoNotFoundError /
+ * RepoAmbiguousError, or surfaces a transport error message.
+ */
+export async function resolveRepositoryId(runtime, ref, fetchImpl, ownerId, options) {
+    if (isUuid(ref))
+        return ref;
+    if (ref.includes('/')) {
+        const slash = ref.indexOf('/');
+        const owner = ref.slice(0, slash);
+        const name = ref.slice(slash + 1);
+        const res = await sendForgeRequest(runtime, { method: 'GET', path: '/api/repositories/resolve', query: { owner, name } }, fetchImpl, options);
+        if (!res.ok) {
+            if (res.status === 404)
+                throw new RepoNotFoundError(ref);
+            throw new Error(res.message);
+        }
+        return res.data.result.id;
+    }
+    // Bare name: list + match. The list is owner-scoped server-side; pass an
+    // `ownerId` (from `--owner`) to scope it to an organization so a bare name
+    // can resolve an org-owned repo instead of only the acting user's.
+    return resolveRepositoryName(ref, async (limit, offset) => {
+        const query = { limit, offset };
+        if (ownerId) {
+            query.ownerType = 'organization';
+            query.ownerId = ownerId;
+        }
+        const res = await sendForgeRequest(runtime, { method: 'GET', path: '/api/repositories', query }, fetchImpl, options);
+        if (!res.ok)
+            throw new Error(res.message);
+        return res.data.results ?? [];
+    });
+}
+//# sourceMappingURL=repo-ref.js.map

package/dist/cli/lib/repo-ref.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"repo-ref.js","sourceRoot":"","sources":["../../../src/cli/lib/repo-ref.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAGlD,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAC3F,OAAO,EACN,MAAM,EACN,iBAAiB,EACjB,kBAAkB,EAClB,eAAe,EACf,MAAM,yBAAyB,CAAC;AAEjC;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACxC,OAAqB,EACrB,GAAW,EACX,SAAqB,EACrB,OAAgB,EAChB,OAA6B;IAE7B,IAAI,MAAM,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC;IAE5B,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAClC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAClC,MAAM,GAAG,GAAG,MAAM,gBAAgB,CACjC,OAAO,EACP,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,2BAA2B,EAAE,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAC5E,SAAS,EACT,OAAO,CACP,CAAC;QACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACb,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;gBAAE,MAAM,IAAI,iBAAiB,CAAC,GAAG,CAAC,CAAC;YACzD,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC9B,CAAC;QACD,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;IAC3B,CAAC;IAED,yEAAyE;IACzE,2EAA2E;IAC3E,mEAAmE;IACnE,OAAO,qBAAqB,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;QACzD,MAAM,KAAK,GAA2C,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QACxE,IAAI,OAAO,EAAE,CAAC;YACb,KAAK,CAAC,SAAS,GAAG,cAAc,CAAC;YACjC,KAAK,CAAC,OAAO,GAAG,OAAO,CAAC;QACzB,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,gBAAgB,CACjC,OAAO,EACP,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,KAAK,EAAE,EACnD,SAAS,EACT,OAAO,CACP,CAAC;QACF,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC1C,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;IAC/B,CAAC,CAAC,CAAC;AACJ,CAAC"}

package/dist/cli/lib/ssh-identity.d.ts

@@ -0,0 +1,109 @@
+/**
+ * The machine's Forge SSH identity: one ed25519 key, registered to the signed-in
+ * account, and pinned for git.vibes.dev in `~/.ssh/config`.
+ *
+ * Forge Git is SSH-only (`ssh://git@git.vibes.dev/…`), so a machine with no key,
+ * an unregistered key, or an unknown host key cannot clone, and each of those
+ * used to be a manual step (`ssh-keygen`, `vibes forge ssh-key add`, answering
+ * the host-key prompt). `ensureForgeSshIdentity` does all three, idempotently:
+ *
+ * - SELECT before creating. `~/.ssh/id_ed25519.pub` first (OpenSSH's own default
+ *   identity), then any other `ssh-ed25519` public key in `~/.ssh`, sorted. A key
+ *   is generated only when the machine has none, at the default path, so plain
+ *   `ssh` and `git` use it too. The private key is never read or sent. A key
+ *   file that is absent is expected; one that exists but cannot be read stops
+ *   setup with its cause, because skipping it could hide the key the user meant
+ *   and lead to generating over it.
+ * - REGISTER by fingerprint. A key the account already holds is left alone.
+ * - PIN the host in a marked block that is the only part of `~/.ssh/config` this
+ *   module writes. `StrictHostKeyChecking accept-new` records git.vibes.dev's
+ *   key on first contact and still refuses a CHANGED key.
+ *
+ * `~/.ssh` is the runtime's path-roots user home. Reads, listing, `mkdir` and
+ * writes go through the runtime's host-disk `filesystem/adapter`
+ * (`resolveSshHome`). Two steps do not: `ssh-keygen` writes the key pair
+ * itself, and the owner-only permission bits are set with node's `chmod`,
+ * because `filesystem/adapter` has no permission operation yet. That gap is
+ * `@vibesdotdev/filesystem`'s to close.
+ */
+import { type RuntimeRef, type VibesRuntime } from '@vibesdotdev/kernel';
+import { z } from 'zod';
+import type { ForgeResponse } from '../../request.ts';
+import { type ExecLike } from './ssh-keygen.ts';
+export declare const FORGE_SSH_HOST = "git.vibes.dev";
+/**
+ * The part of `filesystem/adapter` this module calls. Forge has no dependency
+ * on `@vibesdotdev/filesystem`, so it names these operations here and checks
+ * the resolved implementation against them.
+ */
+export declare const SshFilesSchema: z.ZodObject<{
+    exists: z.ZodCustom<(path: string) => Promise<boolean>, (path: string) => Promise<boolean>>;
+    readFile: z.ZodCustom<(path: string, encoding: "utf8") => Promise<string | Uint8Array>, (path: string, encoding: "utf8") => Promise<string | Uint8Array>>;
+    list: z.ZodCustom<(path: string) => Promise<Array<{
+        name: string;
+        kind: string;
+    }>>, (path: string) => Promise<Array<{
+        name: string;
+        kind: string;
+    }>>>;
+    mkdir: z.ZodCustom<(path: string, options: {
+        recursive: boolean;
+    }) => Promise<void>, (path: string, options: {
+        recursive: boolean;
+    }) => Promise<void>>;
+    writeFile: z.ZodCustom<(path: string, data: string) => Promise<void>, (path: string, data: string) => Promise<void>>;
+}, z.core.$strip>;
+export type SshFiles = z.infer<typeof SshFilesSchema>;
+/** `~/.ssh` on this machine and the means to reach it. */
+export interface SshHome {
+    dir: string;
+    join: (...segments: string[]) => string;
+    files: SshFiles;
+    /**
+     * Set owner-only permission bits: ssh expects `~/.ssh` at 0700 and its
+     * config at 0600. `filesystem/adapter` cannot set a mode, so this is node's
+     * `chmod` until it can.
+     */
+    restrict: (path: string, mode: number) => Promise<void>;
+}
+export interface SshIdentityDeps {
+    /** Resolves `~/.ssh`; called once per run. */
+    home: () => Promise<SshHome>;
+    hostname: string;
+    exec: ExecLike;
+    send: <T>(spec: {
+        method: 'GET' | 'POST';
+        path: string;
+        body?: unknown;
+    }) => Promise<ForgeResponse<T>>;
+}
+export interface SshIdentityReport {
+    ok: boolean;
+    /** Public key path in use, or null when the machine has none (check mode). */
+    publicKey: string | null;
+    fingerprint: string | null;
+    generated: boolean;
+    registered: 'already' | 'now' | 'missing';
+    sshConfig: 'ready' | 'written' | 'missing';
+    problem?: string;
+}
+/** The public key to use: the default identity first, then any ed25519 key in `~/.ssh`. */
+export declare function selectEd25519PublicKey(home: SshHome): Promise<string | null>;
+/** The managed `Host git.vibes.dev` block for `identityFile`. */
+export declare function renderSshConfigBlock(identityFile: string): string;
+/**
+ * `existing` with the managed block set to `block`, or null when it already is.
+ *
+ * The block is placed FIRST: ssh takes the first value it finds for each
+ * option, so a block appended after a `Host *` stanza would be shadowed by it.
+ */
+export declare function mergeSshConfig(existing: string, block: string): string | null;
+/** Select or create, register, and pin. `check` reports without writing anything. */
+export declare function ensureForgeSshIdentity(deps: SshIdentityDeps, options: {
+    check: boolean;
+}): Promise<SshIdentityReport>;
+/** `~/.ssh` under the runtime's path-roots user home, joined by its path service. */
+export declare function resolveSshHome(runtime: RuntimeRef): Promise<SshHome>;
+/** Production dependencies: the handed runtime's `~/.ssh`, real `ssh-keygen`, the Forge API. */
+export declare function defaultSshIdentityDeps(runtime: VibesRuntime): SshIdentityDeps;
+//# sourceMappingURL=ssh-identity.d.ts.map

package/dist/cli/lib/ssh-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssh-identity.d.ts","sourceRoot":"","sources":["../../../src/cli/lib/ssh-identity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAIH,OAAO,EAA4D,KAAK,UAAU,EAAE,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnI,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEtD,OAAO,EAAqC,KAAK,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAGnF,eAAO,MAAM,cAAc,kBAAkB,CAAC;AAM9C;;;;GAIG;AACH,eAAO,MAAM,cAAc;+BACF,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,SAA3B,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC;iCACzB,MAAM,YAAY,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,UAAU,CAAC,SAAzD,MAAM,YAAY,MAAM,KAAK,OAAO,CAAC,MAAM,GAAG,UAAU,CAAC;6BAC7D,MAAM,KAAK,OAAO,CAAC,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC,SAAzD,MAAM,KAAK,OAAO,CAAC,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;8BACxD,MAAM,WAAW;QAAE,SAAS,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,SAAzD,MAAM,WAAW;QAAE,SAAS,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC;kCACrD,MAAM,QAAQ,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,SAAtC,MAAM,QAAQ,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC;iBAChE,CAAC;AACH,MAAM,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAEtD,0DAA0D;AAC1D,MAAM,WAAW,OAAO;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,CAAC,GAAG,QAAQ,EAAE,MAAM,EAAE,KAAK,MAAM,CAAC;IACxC,KAAK,EAAE,QAAQ,CAAC;IAChB;;;;OAIG;IACH,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACxD;AAED,MAAM,WAAW,eAAe;IAC/B,8CAA8C;IAC9C,IAAI,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,QAAQ,CAAC;IACf,IAAI,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE;QAAE,MAAM,EAAE,KAAK,GAAG,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,OAAO,CAAA;KAAE,KAAK,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;CACvG;AAED,MAAM,WAAW,iBAAiB;IACjC,EAAE,EAAE,OAAO,CAAC;IACZ,8EAA8E;IAC9E,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,SAAS,GAAG,KAAK,GAAG,SAAS,CAAC;IAC1C,SAAS,EAAE,OAAO,GAAG,SAAS,GAAG,SAAS,CAAC;IAC3C,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB;AAuED,2FAA2F;AAC3F,wBAAsB,sBAAsB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAUlF;AAED,iEAAiE;AACjE,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAUjE;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAU7E;AA0ED,qFAAqF;AACrF,wBAAsB,sBAAsB,CAC3C,IAAI,EAAE,eAAe,EACrB,OAAO,EAAE;IAAE,KAAK,EAAE,OAAO,CAAA;CAAE,GACzB,OAAO,CAAC,iBAAiB,CAAC,CAwC5B;AA+BD,qFAAqF;AACrF,wBAAsB,cAAc,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAY1E;AAED,gGAAgG;AAChG,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,YAAY,GAAG,eAAe,CAQ7E"}