@vibesdotdev/forge 0.0.0-stage → 1.0.0-rc.4

package/dist/cli/settings/forge-cli.settings.js

@@ -0,0 +1,62 @@
+/**
+ * The Forge CLI wait settings, read once per runtime.
+ *
+ * Every configurable wait this surface performs — the fetch deadline, the
+ * credential settle an opted-in smoke re-reads after, and the AI-review poll
+ * window and cadence — takes its value from the `forge.cli` settings
+ * descriptor. A host that composes a Config owner reads that manifest; a host
+ * with no declared `forge.cli` manifest gets the descriptor's declared
+ * defaults, with each documented environment alias applied. A malformed alias
+ * refuses naming its field rather than quietly becoming the default again.
+ */
+import { getVibesConfigClient } from '@vibesdotdev/config/client';
+import { CaughtFailureSchema, CapabilityError, isCapabilityError, settle } from '@vibesdotdev/kernel';
+import { getVibesClient } from '@vibesdotdev/kernel/client';
+import { ForgeCliConfigSchema, FORGE_CLI_CONFIG_MANIFEST_ID, resolveDeclaredForgeCliDefaults } from "./forge.cli.config.descriptor.js";
+const CONFIG_OWNER_RECOVERY = 'Compose a Config client (a `config` provider) with the `config/manifest` kind, or remove the Config kind from this host so the Forge CLI uses its declared defaults.';
+/**
+ * The settings for `runtime`. A host with no Config manifest for `forge.cli`
+ * gets this package's declared defaults. Any Config failure other than that
+ * exact absence is retained as the cause of a typed refusal.
+ */
+export async function loadForgeCliSettings(runtime) {
+    const result = await settle(async () => {
+        // Validate aliases with their descriptor-owned schema before Config normalizes errors.
+        const declaredDefaults = resolveDeclaredForgeCliDefaults(runtime);
+        const declaresManifest = runtime.hasKind('config/manifest') &&
+            runtime.query('config/manifest').withId(FORGE_CLI_CONFIG_MANIFEST_ID).descriptors().length > 0;
+        if (!declaresManifest)
+            return declaredDefaults;
+        const config = await getVibesConfigClient(runtime);
+        return config.read({ id: FORGE_CLI_CONFIG_MANIFEST_ID, schema: ForgeCliConfigSchema });
+    });
+    if (result.ok)
+        return result.value;
+    const failure = CaughtFailureSchema.parse(result.cause);
+    const capabilityFailure = isCapabilityError(failure) ? failure : undefined;
+    if (capabilityFailure?.reason === 'forge-cli-config-invalid')
+        throw capabilityFailure;
+    if (CapabilityError.isAbsenceOf(failure, 'config/manifest', FORGE_CLI_CONFIG_MANIFEST_ID) &&
+        capabilityFailure?.reason === 'config-manifest-unregistered' &&
+        capabilityFailure.details?.manifestId === FORGE_CLI_CONFIG_MANIFEST_ID) {
+        return resolveDeclaredForgeCliDefaults(runtime);
+    }
+    throw new CapabilityError('The Forge CLI could not read its settings from the Config owner of this host.', 'UNAVAILABLE', {
+        reason: 'forge-cli-config-unavailable',
+        retryable: false,
+        cause: failure,
+        details: { manifestId: FORGE_CLI_CONFIG_MANIFEST_ID },
+        recoveryHint: capabilityFailure?.reason === 'storage-adapter-absent'
+            ? "This host composes no store the Forge CLI manifest allows: declare `config['config.storage'] = { manifests: { 'forge.cli': 'none' } }` in its composition, or compose an allowed store."
+            : CONFIG_OWNER_RECOVERY
+    });
+}
+/** Settings captured once by the runtime-owned Forge CLI client, or loaded directly when the client is not composed. */
+export async function captureForgeCliSettings(runtime) {
+    if (!runtime.hasKind('runtime/client') || runtime.query('runtime/client').withId('forge.cli-auth').descriptors().length === 0) {
+        return loadForgeCliSettings(runtime);
+    }
+    const client = await getVibesClient('forge.cli-auth', runtime);
+    return client.settings();
+}
+//# sourceMappingURL=forge-cli.settings.js.map

package/dist/cli/settings/forge-cli.settings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"forge-cli.settings.js","sourceRoot":"","sources":["../../../src/cli/settings/forge-cli.settings.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,mBAAmB,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,EAAqB,MAAM,qBAAqB,CAAC;AACzH,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAE5D,OAAO,EACN,oBAAoB,EACpB,4BAA4B,EAC5B,+BAA+B,EAE/B,MAAM,kCAAkC,CAAC;AAE1C,MAAM,qBAAqB,GAC1B,sKAAsK,CAAC;AAExK;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAAqB;IAC/D,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,IAAI,EAAE;QACtC,uFAAuF;QACvF,MAAM,gBAAgB,GAAG,+BAA+B,CAAC,OAAO,CAAC,CAAC;QAClE,MAAM,gBAAgB,GACrB,OAAO,CAAC,OAAO,CAAC,iBAAiB,CAAC;YAClC,OAAO,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,MAAM,CAAC,4BAA4B,CAAC,CAAC,WAAW,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;QAChG,IAAI,CAAC,gBAAgB;YAAE,OAAO,gBAAgB,CAAC;QAE/C,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,CAAC;QACnD,OAAO,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,4BAA4B,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAAC;IACxF,CAAC,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,EAAE;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC;IAEnC,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACxD,MAAM,iBAAiB,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3E,IAAI,iBAAiB,EAAE,MAAM,KAAK,0BAA0B;QAAE,MAAM,iBAAiB,CAAC;IACtF,IACC,eAAe,CAAC,WAAW,CAAC,OAAO,EAAE,iBAAiB,EAAE,4BAA4B,CAAC;QACrF,iBAAiB,EAAE,MAAM,KAAK,8BAA8B;QAC5D,iBAAiB,CAAC,OAAO,EAAE,UAAU,KAAK,4BAA4B,EACrE,CAAC;QACF,OAAO,+BAA+B,CAAC,OAAO,CAAC,CAAC;IACjD,CAAC;IAED,MAAM,IAAI,eAAe,CAAC,+EAA+E,EAAE,aAAa,EAAE;QACzH,MAAM,EAAE,8BAA8B;QACtC,SAAS,EAAE,KAAK;QAChB,KAAK,EAAE,OAAO;QACd,OAAO,EAAE,EAAE,UAAU,EAAE,4BAA4B,EAAE;QACrD,YAAY,EACX,iBAAiB,EAAE,MAAM,KAAK,wBAAwB;YACrD,CAAC,CAAC,yLAAyL;YAC3L,CAAC,CAAC,qBAAqB;KACzB,CAAC,CAAC;AACJ,CAAC;AAED,wHAAwH;AACxH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,OAAqB;IAClE,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,IAAI,OAAO,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,WAAW,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC/H,OAAO,oBAAoB,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAqB,gBAAgB,EAAE,OAAO,CAAC,CAAC;IACnF,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC;AAC1B,CAAC"}

package/dist/cli/settings/forge.cli.config.descriptor.d.ts

@@ -0,0 +1,121 @@
+/**
+ * Forge CLI settings — the `config/manifest` the CLI transport and the
+ * operational smokes read their wait defaults from.
+ *
+ * Every configurable wait this surface performs has a field here: the fetch
+ * deadline, the credential settle an opted-in smoke re-reads after, and the
+ * AI-review poll window and cadence. The literal each one used to fall back to
+ * at its read site is this descriptor's declared default, so a host changes one
+ * by declaring it (composition, stored layer, or the documented environment
+ * alias) rather than by editing the reader.
+ *
+ * A malformed alias is refused naming its field — never silently replaced by
+ * the default — the same way the logging owner refuses a malformed level.
+ *
+ * Declared as data with `createRuntimeAsset` so the CLI surface takes no import
+ * edge on `@vibesdotdev/config` for the descriptor itself; the settings are read
+ * through the Config owner when the host composes one, and through these
+ * declared defaults when it does not.
+ */
+import { CapabilityError, type RuntimeRef } from '@vibesdotdev/kernel';
+import { type ForgeCliConfig } from '../../schemas/forge-cli-settings.ts';
+export { FORGE_CLI_SETTING_DEFAULTS, FORGE_CLI_SETTING_ENV, FORGE_CLI_SMOKE_OPT_IN_ENV, ForgeCliConfigSchema } from '../../schemas/forge-cli-settings.ts';
+export type { ForgeCliConfig } from '../../schemas/forge-cli-settings.ts';
+export declare const FORGE_CLI_CONFIG_MANIFEST_ID = "forge.cli";
+/** Build the typed, field-specific refusal used by both Config reads and declared defaults. */
+export declare function forgeCliConfigInvalidFailure(fields: readonly string[]): CapabilityError;
+/**
+ * The declared defaults of this host, with each environment alias applied.
+ * An alias is returned unvalidated so a malformed value refuses at the schema
+ * naming its field, instead of quietly becoming the default again.
+ */
+export declare function resolveDeclaredForgeCliDefaults(runtime: RuntimeRef): ForgeCliConfig;
+export declare const forgeCliConfigDescriptor: {
+    kind: "config/manifest";
+    id: string;
+    name: string;
+    namespace: string;
+    description: string;
+    tier: string;
+    category: string;
+    schema: import("zod").ZodObject<{
+        fetchTimeoutMs: import("zod").ZodDefault<import("zod").ZodNumber>;
+        credentialSettleMs: import("zod").ZodDefault<import("zod").ZodNumber>;
+        aiReviewPollIntervalMs: import("zod").ZodDefault<import("zod").ZodNumber>;
+        aiReviewPollTimeoutMs: import("zod").ZodDefault<import("zod").ZodNumber>;
+    }, import("zod/v4/core").$strict>;
+    storedLayer: string;
+    allowedAdapters: string[];
+    fields: {
+        fetchTimeoutMs: {
+            defaults: {
+                base: 90000;
+                resolver: ({ runtime }: {
+                    runtime: RuntimeRef;
+                }) => number;
+            };
+            ui: {
+                label: string;
+                description: string;
+                component: string;
+                group: string;
+            };
+        };
+        credentialSettleMs: {
+            defaults: {
+                base: 1200;
+                resolver: ({ runtime }: {
+                    runtime: RuntimeRef;
+                }) => number;
+            };
+            ui: {
+                label: string;
+                description: string;
+                component: string;
+                group: string;
+            };
+        };
+        aiReviewPollIntervalMs: {
+            defaults: {
+                base: 3000;
+                resolver: ({ runtime }: {
+                    runtime: RuntimeRef;
+                }) => number;
+            };
+            ui: {
+                label: string;
+                description: string;
+                component: string;
+                group: string;
+            };
+        };
+        aiReviewPollTimeoutMs: {
+            defaults: {
+                base: 30000;
+                resolver: ({ runtime }: {
+                    runtime: RuntimeRef;
+                }) => number;
+            };
+            ui: {
+                label: string;
+                description: string;
+                component: string;
+                group: string;
+            };
+        };
+    };
+    groups: {
+        id: string;
+        label: string;
+    }[];
+    scope: string;
+    customTables: boolean;
+    version: number;
+    internal: boolean;
+    context: {
+        surfaces: string[];
+    };
+    enabled: true;
+};
+export default forgeCliConfigDescriptor;
+//# sourceMappingURL=forge.cli.config.descriptor.d.ts.map

package/dist/cli/settings/forge.cli.config.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"forge.cli.config.descriptor.d.ts","sourceRoot":"","sources":["../../../src/cli/settings/forge.cli.config.descriptor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAsB,eAAe,EAAE,KAAK,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAC3F,OAAO,EAMN,KAAK,cAAc,EACnB,MAAM,qCAAqC,CAAC;AAE7C,OAAO,EACN,0BAA0B,EAC1B,qBAAqB,EACrB,0BAA0B,EAC1B,oBAAoB,EACpB,MAAM,qCAAqC,CAAC;AAC7C,YAAY,EAAE,cAAc,EAAE,MAAM,qCAAqC,CAAC;AAE1E,eAAO,MAAM,4BAA4B,cAAc,CAAC;AAExD,+FAA+F;AAC/F,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,eAAe,CAOvF;AAED;;;;GAIG;AACH,wBAAgB,+BAA+B,CAAC,OAAO,EAAE,UAAU,GAAG,cAAc,CAYnF;AAED,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;wCAeT;oBAAE,OAAO,EAAE,UAAU,CAAA;iBAAE;;;;;;;;;;;;wCAavB;oBAAE,OAAO,EAAE,UAAU,CAAA;iBAAE;;;;;;;;;;;;wCAavB;oBAAE,OAAO,EAAE,UAAU,CAAA;iBAAE;;;;;;;;;;;;wCAavB;oBAAE,OAAO,EAAE,UAAU,CAAA;iBAAE;;;;;;;;;;;;;;;;;;;;;;CAqBjD,CAAC;AAQH,eAAe,wBAAwB,CAAC"}

package/dist/cli/settings/forge.cli.config.descriptor.js

@@ -0,0 +1,127 @@
+/**
+ * Forge CLI settings — the `config/manifest` the CLI transport and the
+ * operational smokes read their wait defaults from.
+ *
+ * Every configurable wait this surface performs has a field here: the fetch
+ * deadline, the credential settle an opted-in smoke re-reads after, and the
+ * AI-review poll window and cadence. The literal each one used to fall back to
+ * at its read site is this descriptor's declared default, so a host changes one
+ * by declaring it (composition, stored layer, or the documented environment
+ * alias) rather than by editing the reader.
+ *
+ * A malformed alias is refused naming its field — never silently replaced by
+ * the default — the same way the logging owner refuses a malformed level.
+ *
+ * Declared as data with `createRuntimeAsset` so the CLI surface takes no import
+ * edge on `@vibesdotdev/config` for the descriptor itself; the settings are read
+ * through the Config owner when the host composes one, and through these
+ * declared defaults when it does not.
+ */
+import { createRuntimeAsset, CapabilityError } from '@vibesdotdev/kernel';
+import { FORGE_CLI_SETTING_DEFAULTS, FORGE_CLI_SETTING_ENV, FORGE_CLI_SETTING_IDS, FORGE_CLI_SMOKE_OPT_IN_ENV, ForgeCliConfigSchema } from "../../schemas/forge-cli-settings.js";
+export { FORGE_CLI_SETTING_DEFAULTS, FORGE_CLI_SETTING_ENV, FORGE_CLI_SMOKE_OPT_IN_ENV, ForgeCliConfigSchema } from "../../schemas/forge-cli-settings.js";
+export const FORGE_CLI_CONFIG_MANIFEST_ID = 'forge.cli';
+/** Build the typed, field-specific refusal used by both Config reads and declared defaults. */
+export function forgeCliConfigInvalidFailure(fields) {
+    return new CapabilityError('The Forge CLI settings are malformed.', 'INVALID_INPUT', {
+        reason: 'forge-cli-config-invalid',
+        retryable: false,
+        recoveryHint: `Correct or unset the malformed Forge CLI setting (${FORGE_CLI_SETTING_IDS.map((field) => `${FORGE_CLI_SETTING_ENV[field]}: an integer from ${field === 'credentialSettleMs' ? 0 : 1} through 2147483647 milliseconds`).join('; ')}) on this host's environment.`,
+        details: { manifestId: FORGE_CLI_CONFIG_MANIFEST_ID, fields: [...fields] }
+    });
+}
+/**
+ * The declared defaults of this host, with each environment alias applied.
+ * An alias is returned unvalidated so a malformed value refuses at the schema
+ * naming its field, instead of quietly becoming the default again.
+ */
+export function resolveDeclaredForgeCliDefaults(runtime) {
+    const declared = Object.fromEntries(FORGE_CLI_SETTING_IDS.map((field) => {
+        const raw = runtime.getEnv(FORGE_CLI_SETTING_ENV[field]);
+        return [field, raw === undefined ? FORGE_CLI_SETTING_DEFAULTS[field] : Number(raw)];
+    }));
+    const parsed = ForgeCliConfigSchema.safeParse(declared);
+    if (!parsed.success) {
+        throw forgeCliConfigInvalidFailure(parsed.error.issues.map((issue) => issue.path.join('.')));
+    }
+    return parsed.data;
+}
+export const forgeCliConfigDescriptor = createRuntimeAsset({
+    kind: 'config/manifest',
+    id: FORGE_CLI_CONFIG_MANIFEST_ID,
+    name: 'Forge CLI',
+    namespace: 'forge.cli',
+    description: 'Forge CLI wait settings: the API request deadline, the smoke credential settle, and the AI-review poll window',
+    tier: 'user',
+    category: 'runtime',
+    schema: ForgeCliConfigSchema,
+    storedLayer: 'none',
+    allowedAdapters: ['storage.json', 'storage.localdb'],
+    fields: {
+        fetchTimeoutMs: {
+            defaults: {
+                base: FORGE_CLI_SETTING_DEFAULTS.fetchTimeoutMs,
+                resolver: ({ runtime }) => envMilliseconds(runtime, FORGE_CLI_SETTING_ENV.fetchTimeoutMs, FORGE_CLI_SETTING_DEFAULTS.fetchTimeoutMs)
+            },
+            ui: {
+                label: 'Forge request timeout (ms)',
+                description: `Deadline for one Forge API request, owned by the runtime lifecycle (${FORGE_CLI_SETTING_ENV.fetchTimeoutMs})`,
+                component: 'number',
+                group: 'waits'
+            }
+        },
+        credentialSettleMs: {
+            defaults: {
+                base: FORGE_CLI_SETTING_DEFAULTS.credentialSettleMs,
+                resolver: ({ runtime }) => envMilliseconds(runtime, FORGE_CLI_SETTING_ENV.credentialSettleMs, FORGE_CLI_SETTING_DEFAULTS.credentialSettleMs)
+            },
+            ui: {
+                label: 'Smoke credential settle (ms)',
+                description: `How long an operational smoke opted in with ${FORGE_CLI_SMOKE_OPT_IN_ENV}=1 waits before re-reading a credential that may still be landing; 0 disables the pause (${FORGE_CLI_SETTING_ENV.credentialSettleMs})`,
+                component: 'number',
+                group: 'smokes'
+            }
+        },
+        aiReviewPollIntervalMs: {
+            defaults: {
+                base: FORGE_CLI_SETTING_DEFAULTS.aiReviewPollIntervalMs,
+                resolver: ({ runtime }) => envMilliseconds(runtime, FORGE_CLI_SETTING_ENV.aiReviewPollIntervalMs, FORGE_CLI_SETTING_DEFAULTS.aiReviewPollIntervalMs)
+            },
+            ui: {
+                label: 'AI review poll interval (ms)',
+                description: `Pause between polls of the background AI review (${FORGE_CLI_SETTING_ENV.aiReviewPollIntervalMs})`,
+                component: 'number',
+                group: 'smokes'
+            }
+        },
+        aiReviewPollTimeoutMs: {
+            defaults: {
+                base: FORGE_CLI_SETTING_DEFAULTS.aiReviewPollTimeoutMs,
+                resolver: ({ runtime }) => envMilliseconds(runtime, FORGE_CLI_SETTING_ENV.aiReviewPollTimeoutMs, FORGE_CLI_SETTING_DEFAULTS.aiReviewPollTimeoutMs)
+            },
+            ui: {
+                label: 'AI review poll window (ms)',
+                description: `Total window the background AI review is given to land, when --timeout does not name one (${FORGE_CLI_SETTING_ENV.aiReviewPollTimeoutMs})`,
+                component: 'number',
+                group: 'smokes'
+            }
+        }
+    },
+    groups: [
+        { id: 'waits', label: 'Request waits' },
+        { id: 'smokes', label: 'Operational smokes' }
+    ],
+    scope: 'global',
+    customTables: false,
+    version: 1,
+    internal: false,
+    context: { surfaces: ['cli'] },
+    enabled: true
+});
+/** An alias read returned unvalidated: absent is the declared default, anything else reaches the schema. */
+function envMilliseconds(runtime, alias, fallback) {
+    const raw = runtime.getEnv(alias);
+    return raw === undefined ? fallback : Number(raw);
+}
+export default forgeCliConfigDescriptor;
+//# sourceMappingURL=forge.cli.config.descriptor.js.map

package/dist/cli/settings/forge.cli.config.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"forge.cli.config.descriptor.js","sourceRoot":"","sources":["../../../src/cli/settings/forge.cli.config.descriptor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAmB,MAAM,qBAAqB,CAAC;AAC3F,OAAO,EACN,0BAA0B,EAC1B,qBAAqB,EACrB,qBAAqB,EACrB,0BAA0B,EAC1B,oBAAoB,EAEpB,MAAM,qCAAqC,CAAC;AAE7C,OAAO,EACN,0BAA0B,EAC1B,qBAAqB,EACrB,0BAA0B,EAC1B,oBAAoB,EACpB,MAAM,qCAAqC,CAAC;AAG7C,MAAM,CAAC,MAAM,4BAA4B,GAAG,WAAW,CAAC;AAExD,+FAA+F;AAC/F,MAAM,UAAU,4BAA4B,CAAC,MAAyB;IACrE,OAAO,IAAI,eAAe,CAAC,uCAAuC,EAAE,eAAe,EAAE;QACpF,MAAM,EAAE,0BAA0B;QAClC,SAAS,EAAE,KAAK;QAChB,YAAY,EAAE,qDAAqD,qBAAqB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,qBAAqB,CAAC,KAAK,CAAC,qBAAqB,KAAK,KAAK,oBAAoB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,kCAAkC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,+BAA+B;QAC/Q,OAAO,EAAE,EAAE,UAAU,EAAE,4BAA4B,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,EAAE;KAC1E,CAAC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,+BAA+B,CAAC,OAAmB;IAClE,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAClC,qBAAqB,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACnC,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC;QACzD,OAAO,CAAC,KAAK,EAAE,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,0BAA0B,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IACrF,CAAC,CAAC,CACF,CAAC;IACF,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IACxD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,4BAA4B,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC9F,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACpB,CAAC;AAED,MAAM,CAAC,MAAM,wBAAwB,GAAG,kBAAkB,CAAC;IAC1D,IAAI,EAAE,iBAAiB;IACvB,EAAE,EAAE,4BAA4B;IAChC,IAAI,EAAE,WAAW;IACjB,SAAS,EAAE,WAAW;IACtB,WAAW,EAAE,+GAA+G;IAC5H,IAAI,EAAE,MAAM;IACZ,QAAQ,EAAE,SAAS;IACnB,MAAM,EAAE,oBAAoB;IAC5B,WAAW,EAAE,MAAM;IACnB,eAAe,EAAE,CAAC,cAAc,EAAE,iBAAiB,CAAC;IACpD,MAAM,EAAE;QACP,cAAc,EAAE;YACf,QAAQ,EAAE;gBACT,IAAI,EAAE,0BAA0B,CAAC,cAAc;gBAC/C,QAAQ,EAAE,CAAC,EAAE,OAAO,EAA2B,EAAE,EAAE,CAClD,eAAe,CAAC,OAAO,EAAE,qBAAqB,CAAC,cAAc,EAAE,0BAA0B,CAAC,cAAc,CAAC;aAC1G;YACD,EAAE,EAAE;gBACH,KAAK,EAAE,4BAA4B;gBACnC,WAAW,EAAE,uEAAuE,qBAAqB,CAAC,cAAc,GAAG;gBAC3H,SAAS,EAAE,QAAQ;gBACnB,KAAK,EAAE,OAAO;aACd;SACD;QACD,kBAAkB,EAAE;YACnB,QAAQ,EAAE;gBACT,IAAI,EAAE,0BAA0B,CAAC,kBAAkB;gBACnD,QAAQ,EAAE,CAAC,EAAE,OAAO,EAA2B,EAAE,EAAE,CAClD,eAAe,CAAC,OAAO,EAAE,qBAAqB,CAAC,kBAAkB,EAAE,0BAA0B,CAAC,kBAAkB,CAAC;aAClH;YACD,EAAE,EAAE;gBACH,KAAK,EAAE,8BAA8B;gBACrC,WAAW,EAAE,+CAA+C,0BAA0B,4FAA4F,qBAAqB,CAAC,kBAAkB,GAAG;gBAC7N,SAAS,EAAE,QAAQ;gBACnB,KAAK,EAAE,QAAQ;aACf;SACD;QACD,sBAAsB,EAAE;YACvB,QAAQ,EAAE;gBACT,IAAI,EAAE,0BAA0B,CAAC,sBAAsB;gBACvD,QAAQ,EAAE,CAAC,EAAE,OAAO,EAA2B,EAAE,EAAE,CAClD,eAAe,CAAC,OAAO,EAAE,qBAAqB,CAAC,sBAAsB,EAAE,0BAA0B,CAAC,sBAAsB,CAAC;aAC1H;YACD,EAAE,EAAE;gBACH,KAAK,EAAE,8BAA8B;gBACrC,WAAW,EAAE,oDAAoD,qBAAqB,CAAC,sBAAsB,GAAG;gBAChH,SAAS,EAAE,QAAQ;gBACnB,KAAK,EAAE,QAAQ;aACf;SACD;QACD,qBAAqB,EAAE;YACtB,QAAQ,EAAE;gBACT,IAAI,EAAE,0BAA0B,CAAC,qBAAqB;gBACtD,QAAQ,EAAE,CAAC,EAAE,OAAO,EAA2B,EAAE,EAAE,CAClD,eAAe,CAAC,OAAO,EAAE,qBAAqB,CAAC,qBAAqB,EAAE,0BAA0B,CAAC,qBAAqB,CAAC;aACxH;YACD,EAAE,EAAE;gBACH,KAAK,EAAE,4BAA4B;gBACnC,WAAW,EAAE,6FAA6F,qBAAqB,CAAC,qBAAqB,GAAG;gBACxJ,SAAS,EAAE,QAAQ;gBACnB,KAAK,EAAE,QAAQ;aACf;SACD;KACD;IACD,MAAM,EAAE;QACP,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE;QACvC,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,oBAAoB,EAAE;KAC7C;IACD,KAAK,EAAE,QAAQ;IACf,YAAY,EAAE,KAAK;IACnB,OAAO,EAAE,CAAC;IACV,QAAQ,EAAE,KAAK;IACf,OAAO,EAAE,EAAE,QAAQ,EAAE,CAAC,KAAK,CAAC,EAAE;IAC9B,OAAO,EAAE,IAAI;CACb,CAAC,CAAC;AAEH,4GAA4G;AAC5G,SAAS,eAAe,CAAC,OAAmB,EAAE,KAAa,EAAE,QAAgB;IAC5E,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAClC,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AACnD,CAAC;AAED,eAAe,wBAAwB,CAAC"}

package/dist/cli/subscriptions/auth-login.projection-outcome.d.ts

@@ -0,0 +1,30 @@
+import { type CaughtFailure } from '@vibesdotdev/kernel';
+/**
+ * A post-login projection's outcome. A failed projection never fails the
+ * login: its failure is carried here, then logged on the login runtime and
+ * reported on its UI, never dropped.
+ */
+export type ProjectionOutcome = {
+    readonly failed: false;
+} | {
+    readonly failed: true;
+    readonly cause: CaughtFailure;
+};
+/** Run one post-login projection and carry its failure, if any. */
+export declare function settleProjection(project: () => Promise<void>): Promise<ProjectionOutcome>;
+/**
+ * A projection failure as a log record carries it: the failure's bounded
+ * facts (class, code, reason) and a bounded, credential-free excerpt of its
+ * message. Git and registry text can echo a remote's userinfo or a token.
+ */
+export declare function loggedFailure(cause: CaughtFailure): {
+    error: Readonly<{
+        name: string;
+        code?: string | undefined;
+        reason?: string | undefined;
+    }>;
+    detail: string;
+};
+/** A failure's text (an Error's message, a thrown value's description), bounded and credential-free. */
+export declare function failureExcerpt(cause: CaughtFailure): string;
+//# sourceMappingURL=auth-login.projection-outcome.d.ts.map

package/dist/cli/subscriptions/auth-login.projection-outcome.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-login.projection-outcome.d.ts","sourceRoot":"","sources":["../../../src/cli/subscriptions/auth-login.projection-outcome.ts"],"names":[],"mappings":"AAAA,OAAO,EAAyC,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGhG;;;;GAIG;AACH,MAAM,MAAM,iBAAiB,GAAG;IAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAA;CAAE,CAAC;AAEtH,mEAAmE;AACnE,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAO/F;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,aAAa;;;;;;;EAEjD;AAED,wGAAwG;AACxG,wBAAgB,cAAc,CAAC,KAAK,EAAE,aAAa,GAAG,MAAM,CAE3D"}

package/dist/cli/subscriptions/auth-login.projection-outcome.js

@@ -0,0 +1,25 @@
+import { CaughtFailureSchema, valueFreeFailure } from '@vibesdotdev/kernel';
+import { redactedExcerpt } from '@vibesdotdev/shared/utils';
+/** Run one post-login projection and carry its failure, if any. */
+export async function settleProjection(project) {
+    try {
+        await project();
+        return { failed: false };
+    }
+    catch (failure) {
+        return { failed: true, cause: CaughtFailureSchema.parse(failure) };
+    }
+}
+/**
+ * A projection failure as a log record carries it: the failure's bounded
+ * facts (class, code, reason) and a bounded, credential-free excerpt of its
+ * message. Git and registry text can echo a remote's userinfo or a token.
+ */
+export function loggedFailure(cause) {
+    return { error: valueFreeFailure(cause), detail: failureExcerpt(cause) };
+}
+/** A failure's text (an Error's message, a thrown value's description), bounded and credential-free. */
+export function failureExcerpt(cause) {
+    return redactedExcerpt(cause instanceof Error ? cause.message : cause.description);
+}
+//# sourceMappingURL=auth-login.projection-outcome.js.map

package/dist/cli/subscriptions/auth-login.projection-outcome.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-login.projection-outcome.js","sourceRoot":"","sources":["../../../src/cli/subscriptions/auth-login.projection-outcome.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,gBAAgB,EAAsB,MAAM,qBAAqB,CAAC;AAChG,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAS5D,mEAAmE;AACnE,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAA4B;IAClE,IAAI,CAAC;QACJ,MAAM,OAAO,EAAE,CAAC;QAChB,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC1B,CAAC;IAAC,OAAO,OAAO,EAAE,CAAC;QAClB,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;IACpE,CAAC;AACF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,KAAoB;IACjD,OAAO,EAAE,KAAK,EAAE,gBAAgB,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;AAC1E,CAAC;AAED,wGAAwG;AACxG,MAAM,UAAU,cAAc,CAAC,KAAoB;IAClD,OAAO,eAAe,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;AACpF,CAAC"}

package/dist/cli/subscriptions/auth-login.setup-git.descriptor.d.ts

@@ -0,0 +1,13 @@
+export declare const FORGE_AUTH_LOGIN_SETUP_GIT_SUBSCRIPTION_ID = "forge.subscriptions.on-auth-login-setup-git";
+declare const _default: {
+    kind: "runtime/subscription";
+    id: string;
+    name: string;
+    description: string;
+    event: string;
+    handler: string;
+    handlerType: string;
+    enabled: true;
+};
+export default _default;
+//# sourceMappingURL=auth-login.setup-git.descriptor.d.ts.map

package/dist/cli/subscriptions/auth-login.setup-git.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-login.setup-git.descriptor.d.ts","sourceRoot":"","sources":["../../../src/cli/subscriptions/auth-login.setup-git.descriptor.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,0CAA0C,gDACT,CAAC;;;;;;;;;;;AAE/C,wBAUG"}

package/dist/cli/subscriptions/auth-login.setup-git.descriptor.js

@@ -0,0 +1,13 @@
+import { createRuntimeAsset } from '@vibesdotdev/kernel';
+export const FORGE_AUTH_LOGIN_SETUP_GIT_SUBSCRIPTION_ID = 'forge.subscriptions.on-auth-login-setup-git';
+export default createRuntimeAsset({
+    kind: 'runtime/subscription',
+    id: FORGE_AUTH_LOGIN_SETUP_GIT_SUBSCRIPTION_ID,
+    name: 'Forge Git Setup After Login',
+    description: 'After a successful Vibes CLI login, migrate matching remotes to SSH without removing the optional HTTPS helper.',
+    event: 'auth.login.succeeded',
+    handler: 'inline',
+    handlerType: 'inline',
+    enabled: true
+});
+//# sourceMappingURL=auth-login.setup-git.descriptor.js.map

package/dist/cli/subscriptions/auth-login.setup-git.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-login.setup-git.descriptor.js","sourceRoot":"","sources":["../../../src/cli/subscriptions/auth-login.setup-git.descriptor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEzD,MAAM,CAAC,MAAM,0CAA0C,GACtD,6CAA6C,CAAC;AAE/C,eAAe,kBAAkB,CAAC;IACjC,IAAI,EAAE,sBAAsB;IAC5B,EAAE,EAAE,0CAA0C;IAC9C,IAAI,EAAE,6BAA6B;IACnC,WAAW,EACV,iHAAiH;IAClH,KAAK,EAAE,sBAAsB;IAC7B,OAAO,EAAE,QAAQ;IACjB,WAAW,EAAE,QAAQ;IACrB,OAAO,EAAE,IAAI;CACb,CAAC,CAAC"}

package/dist/cli/subscriptions/auth-login.setup-git.impl.d.ts

@@ -0,0 +1,24 @@
+import type { AuthLoginSucceededEvent } from '@vibesdotdev/auth/events/session-established';
+import { type VibesRuntime } from '@vibesdotdev/kernel';
+import { type GitExec } from '../lib/git-credential-setup.node.ts';
+import type { SshIdentityDeps } from '../lib/ssh-identity.ts';
+/**
+ * Project Forge Git onto SSH for the signed-in account. The checkout whose
+ * remotes move is the host's working directory (`localEnvironment.getCwd()`), never the
+ * process's.
+ */
+export declare function projectForgeGitAfterLogin(runtime: VibesRuntime, gitExec?: GitExec, identityDeps?: SshIdentityDeps): Promise<void>;
+/**
+ * Projects Forge Git after login and reports the outcome on the login
+ * runtime: its logger and its `cli/ui`. The kernel hands `handle` the runtime
+ * that wired this subscription, so nothing reads an ambient default runtime.
+ */
+export declare class AuthLoginSetupGitHandler {
+    private readonly project;
+    constructor(project?: (runtime: VibesRuntime) => Promise<void>);
+    handle(_payload: AuthLoginSucceededEvent, runtime: VibesRuntime): Promise<void>;
+}
+/** The one handler the kernel resolves for this subscription; it holds no per-runtime state. */
+declare const _default: import("@vibesdotdev/kernel").RuntimeImplementationWrapper<AuthLoginSetupGitHandler>;
+export default _default;
+//# sourceMappingURL=auth-login.setup-git.impl.d.ts.map

package/dist/cli/subscriptions/auth-login.setup-git.impl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-login.setup-git.impl.d.ts","sourceRoot":"","sources":["../../../src/cli/subscriptions/auth-login.setup-git.impl.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,8CAA8C,CAAC;AAE5F,OAAO,EAGN,KAAK,YAAY,EACjB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAkB,KAAK,OAAO,EAAE,MAAM,qCAAqC,CAAC;AAEnF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAK9D;;;;GAIG;AACH,wBAAsB,yBAAyB,CAC9C,OAAO,EAAE,YAAY,EACrB,OAAO,GAAE,OAAiC,EAC1C,YAAY,CAAC,EAAE,eAAe,GAC5B,OAAO,CAAC,IAAI,CAAC,CAUf;AAED;;;;GAIG;AACH,qBAAa,wBAAwB;IAEnC,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,GAAE,CAAC,OAAO,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAA6B;IAGzF,MAAM,CAAC,QAAQ,EAAE,uBAAuB,EAAE,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;CAmBrF;AAED,gGAAgG;;AAChG,wBAIG"}

package/dist/cli/subscriptions/auth-login.setup-git.impl.js

@@ -0,0 +1,57 @@
+import { getLogger } from '@vibesdotdev/logging';
+import { createRuntimeImplementation, requireRuntimeCwd } from '@vibesdotdev/kernel';
+import { runtimeGitExec } from "../lib/git-credential-setup.node.js";
+import { maybeSetWritePushUrl } from "../commands/forge.setup-git.command.impl.js";
+import { printSuccess, printWarning } from "../lib/output.js";
+import { FORGE_AUTH_LOGIN_SETUP_GIT_SUBSCRIPTION_ID } from "./auth-login.setup-git.descriptor.js";
+import { failureExcerpt, loggedFailure, settleProjection } from "./auth-login.projection-outcome.js";
+/**
+ * Project Forge Git onto SSH for the signed-in account. The checkout whose
+ * remotes move is the host's working directory (`localEnvironment.getCwd()`), never the
+ * process's.
+ */
+export async function projectForgeGitAfterLogin(runtime, gitExec = runtimeGitExec(runtime), identityDeps) {
+    const cwd = requireRuntimeCwd(runtime);
+    // The signed-in account gets this machine's SSH identity, so the first
+    // clone needs no key setup and no host-key prompt. Loaded when it runs: it
+    // reads ~/.ssh with node:fs (Constitution 11).
+    const { defaultSshIdentityDeps, ensureForgeSshIdentity } = await import("../lib/ssh-identity.js");
+    await ensureForgeSshIdentity(identityDeps ?? defaultSshIdentityDeps(runtime), { check: false });
+    // First-party remotes move to SSH. The optional Smart HTTPS helper is a
+    // user transport and must stay available after login.
+    await maybeSetWritePushUrl(gitExec, cwd);
+}
+/**
+ * Projects Forge Git after login and reports the outcome on the login
+ * runtime: its logger and its `cli/ui`. The kernel hands `handle` the runtime
+ * that wired this subscription, so nothing reads an ambient default runtime.
+ */
+export class AuthLoginSetupGitHandler {
+    project;
+    constructor(project = projectForgeGitAfterLogin) {
+        this.project = project;
+    }
+    async handle(_payload, runtime) {
+        const log = getLogger('forge-cli', runtime);
+        const ui = await runtime.context('cli/ui');
+        const projection = await settleProjection(() => this.project(runtime));
+        if (!projection.failed) {
+            log.info('Projected Forge remotes onto SSH after login', { host: 'git.vibes.dev' });
+            printSuccess(ui, 'Forge Git is ready over SSH. HTTPS stays available with `vibes forge setup-git --https`.');
+            return;
+        }
+        log.warn('Could not project Forge remotes onto SSH after login', {
+            host: 'git.vibes.dev',
+            ...loggedFailure(projection.cause)
+        });
+        // The reason shown is bounded and credential-free: git text can echo a remote's userinfo.
+        printWarning(ui, `Signed in, but Forge Git over SSH still needs setup (${failureExcerpt(projection.cause)}). Run: vibes forge setup-git`);
+    }
+}
+/** The one handler the kernel resolves for this subscription; it holds no per-runtime state. */
+export default createRuntimeImplementation({
+    kind: 'runtime/subscription',
+    id: FORGE_AUTH_LOGIN_SETUP_GIT_SUBSCRIPTION_ID,
+    implementation: new AuthLoginSetupGitHandler()
+});
+//# sourceMappingURL=auth-login.setup-git.impl.js.map

package/dist/cli/subscriptions/auth-login.setup-git.impl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-login.setup-git.impl.js","sourceRoot":"","sources":["../../../src/cli/subscriptions/auth-login.setup-git.impl.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAGjD,OAAO,EACN,2BAA2B,EAC3B,iBAAiB,EAEjB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,cAAc,EAAgB,MAAM,qCAAqC,CAAC;AACnF,OAAO,EAAE,oBAAoB,EAAE,MAAM,6CAA6C,CAAC;AAEnF,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,0CAA0C,EAAE,MAAM,sCAAsC,CAAC;AAClG,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,oCAAoC,CAAC;AAErG;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC9C,OAAqB,EACrB,UAAmB,cAAc,CAAC,OAAO,CAAC,EAC1C,YAA8B;IAE9B,MAAM,GAAG,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IACvC,uEAAuE;IACvE,2EAA2E;IAC3E,+CAA+C;IAC/C,MAAM,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;IAClG,MAAM,sBAAsB,CAAC,YAAY,IAAI,sBAAsB,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAChG,wEAAwE;IACxE,sDAAsD;IACtD,MAAM,oBAAoB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;AAC1C,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,wBAAwB;IAElB;IADlB,YACkB,UAAoD,yBAAyB;QAA7E,YAAO,GAAP,OAAO,CAAsE;IAC5F,CAAC;IAEJ,KAAK,CAAC,MAAM,CAAC,QAAiC,EAAE,OAAqB;QACpE,MAAM,GAAG,GAAG,SAAS,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAC5C,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,OAAO,CAAY,QAAQ,CAAC,CAAC;QACtD,MAAM,UAAU,GAAG,MAAM,gBAAgB,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;QACvE,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;YACxB,GAAG,CAAC,IAAI,CAAC,8CAA8C,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC;YACpF,YAAY,CAAC,EAAE,EAAE,0FAA0F,CAAC,CAAC;YAC7G,OAAO;QACR,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,sDAAsD,EAAE;YAChE,IAAI,EAAE,eAAe;YACrB,GAAG,aAAa,CAAC,UAAU,CAAC,KAAK,CAAC;SAClC,CAAC,CAAC;QACH,0FAA0F;QAC1F,YAAY,CACX,EAAE,EACF,wDAAwD,cAAc,CAAC,UAAU,CAAC,KAAK,CAAC,+BAA+B,CACvH,CAAC;IACH,CAAC;CACD;AAED,gGAAgG;AAChG,eAAe,2BAA2B,CAAC;IAC1C,IAAI,EAAE,sBAAsB;IAC5B,EAAE,EAAE,0CAA0C;IAC9C,cAAc,EAAE,IAAI,wBAAwB,EAAE;CAC9C,CAAC,CAAC"}

package/dist/cli/subscriptions/auth-login.setup-registry.descriptor.d.ts

@@ -0,0 +1,13 @@
+export declare const FORGE_AUTH_LOGIN_SETUP_REGISTRY_SUBSCRIPTION_ID = "forge.subscriptions.on-auth-login-setup-registry";
+declare const _default: {
+    kind: "runtime/subscription";
+    id: string;
+    name: string;
+    description: string;
+    event: string;
+    handler: string;
+    handlerType: string;
+    enabled: true;
+};
+export default _default;
+//# sourceMappingURL=auth-login.setup-registry.descriptor.d.ts.map

package/dist/cli/subscriptions/auth-login.setup-registry.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-login.setup-registry.descriptor.d.ts","sourceRoot":"","sources":["../../../src/cli/subscriptions/auth-login.setup-registry.descriptor.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,+CAA+C,qDACT,CAAC;;;;;;;;;;;AAEpD,wBAUG"}

package/dist/cli/subscriptions/auth-login.setup-registry.descriptor.js

@@ -0,0 +1,13 @@
+import { createRuntimeAsset } from '@vibesdotdev/kernel';
+export const FORGE_AUTH_LOGIN_SETUP_REGISTRY_SUBSCRIPTION_ID = 'forge.subscriptions.on-auth-login-setup-registry';
+export default createRuntimeAsset({
+    kind: 'runtime/subscription',
+    id: FORGE_AUTH_LOGIN_SETUP_REGISTRY_SUBSCRIPTION_ID,
+    name: 'Registry Client Setup After Login',
+    description: 'After a successful Vibes CLI login, write user-level npm/bun registry config and project package auth onto this machine.',
+    event: 'auth.login.succeeded',
+    handler: 'inline',
+    handlerType: 'inline',
+    enabled: true
+});
+//# sourceMappingURL=auth-login.setup-registry.descriptor.js.map

package/dist/cli/subscriptions/auth-login.setup-registry.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-login.setup-registry.descriptor.js","sourceRoot":"","sources":["../../../src/cli/subscriptions/auth-login.setup-registry.descriptor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEzD,MAAM,CAAC,MAAM,+CAA+C,GAC3D,kDAAkD,CAAC;AAEpD,eAAe,kBAAkB,CAAC;IACjC,IAAI,EAAE,sBAAsB;IAC5B,EAAE,EAAE,+CAA+C;IACnD,IAAI,EAAE,mCAAmC;IACzC,WAAW,EACV,0HAA0H;IAC3H,KAAK,EAAE,sBAAsB;IAC7B,OAAO,EAAE,QAAQ;IACjB,WAAW,EAAE,QAAQ;IACrB,OAAO,EAAE,IAAI;CACb,CAAC,CAAC"}

package/dist/cli/subscriptions/auth-login.setup-registry.impl.d.ts

@@ -0,0 +1,20 @@
+import type { AuthLoginSucceededEvent } from '@vibesdotdev/auth/events/session-established';
+import { type VibesRuntime } from '@vibesdotdev/kernel';
+import { type RegistryProjectionReport } from '../lib/registry-projection.ts';
+/** A projection that bound no package token leaves private installs unauthenticated: a typed refusal. */
+export declare function requireBoundRegistryAuth(report: Pick<RegistryProjectionReport, 'tokenBound'>): void;
+export declare function projectRegistryClientAfterLogin(runtime: VibesRuntime): Promise<void>;
+/**
+ * Projects registry auth after login and reports the outcome on the login
+ * runtime: its logger and its `cli/ui`. The kernel hands `handle` the runtime
+ * that wired this subscription, so nothing reads an ambient default runtime.
+ */
+export declare class AuthLoginSetupRegistryHandler {
+    private readonly project;
+    constructor(project?: (runtime: VibesRuntime) => Promise<void>);
+    handle(_payload: AuthLoginSucceededEvent, runtime: VibesRuntime): Promise<void>;
+}
+/** The one handler the kernel resolves for this subscription; it holds no per-runtime state. */
+declare const _default: import("@vibesdotdev/kernel").RuntimeImplementationWrapper<AuthLoginSetupRegistryHandler>;
+export default _default;
+//# sourceMappingURL=auth-login.setup-registry.impl.d.ts.map

package/dist/cli/subscriptions/auth-login.setup-registry.impl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-login.setup-registry.impl.d.ts","sourceRoot":"","sources":["../../../src/cli/subscriptions/auth-login.setup-registry.impl.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,8CAA8C,CAAC;AAE5F,OAAO,EAAgD,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEtG,OAAO,EAA6B,KAAK,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AAMzG,yGAAyG;AACzG,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,IAAI,CAAC,wBAAwB,EAAE,YAAY,CAAC,GAAG,IAAI,CAMnG;AAED,wBAAsB,+BAA+B,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAE1F;AAED;;;;GAIG;AACH,qBAAa,6BAA6B;IAExC,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,GAAE,CAAC,OAAO,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAmC;IAG/F,MAAM,CAAC,QAAQ,EAAE,uBAAuB,EAAE,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC;CAerF;AAED,gGAAgG;;AAChG,wBAIG"}