@vibesdotdev/forge 0.0.0-stage → 1.0.0-rc.5

package/dist/cli/commands/forge.collaborator.add.command.impl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"forge.collaborator.add.command.impl.js","sourceRoot":"","sources":["../../../src/cli/commands/forge.collaborator.add.command.impl.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EACN,SAAS,EACT,SAAS,EACT,YAAY,EACZ,SAAS,EACT,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACN,wBAAwB,EACxB,2BAA2B,EAE3B,MAAM,yBAAyB,CAAC;AAEjC,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC;AAClC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAC5B,IAAgB,EAChB,IAAgB,EAChB,OAAuB;IAEvB,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAC5B,MAAM,EAAE,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAC9B,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5D,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAE/D,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE;QACjC,IAAI,CAAC;YACJ,IAAI,CAAC,OAAO;gBACX,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;YACvF,MAAM,IAAI,GAAG,wBAAwB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;YACpD,MAAM,EAAE,GAAG,MAAM,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACvD,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAAuB,OAAO,EAAE;gBACjE,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,qBAAqB,kBAAkB,CAAC,EAAE,CAAC,gBAAgB;gBACjE,IAAI;aACJ,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACb,OAAO,EAAE,EAAE,EAAE,KAAc,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9D,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,IAAa,EAAE,YAAY,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QAC7D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,OAAO,EAAE,EAAE,EAAE,KAAc,EAAE,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,CAAC;IACF,CAAC,CAAC,EAAE,CAAC;IAEL,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QACjB,2BAA2B,CAAC,EAAE,EAAE,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,SAAS,CAAC,EAAE,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;QACpC,OAAO;IACR,CAAC;IACD,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;IAC1C,YAAY,CACX,EAAE,EACF,WAAW,YAAY,CAAC,IAAI,cAAc,YAAY,CAAC,MAAM,kBAAkB,YAAY,CAAC,YAAY,EAAE,CAC1G,CAAC;AACH,CAAC;AAED,eAAe,EAAE,OAAO,EAAE,CAAC"}

package/dist/cli/commands/forge.collaborator.list.command.descriptor.d.ts

@@ -0,0 +1,24 @@
+export declare const collaboratorListCommandDescriptor: {
+    readonly kind: "cli/command";
+    readonly id: "forge.collaborator.list";
+    readonly name: "list";
+    readonly description: "List explicit collaborators on a repository";
+    readonly group: "forge.collaborator";
+    readonly arguments: [{
+        readonly name: "repo";
+        readonly description: "Repository id, <owner>/<name>, or bare name";
+        readonly required: true;
+    }];
+    readonly options: [];
+    readonly surfaces: ["cli"];
+    readonly hardware: readonly ["consumer"];
+    readonly enabled: true;
+    readonly order: 10;
+    readonly examples: [{
+        readonly command: "vibes forge collaborator list my-app";
+        readonly description: "List explicit access grants for my-app";
+        readonly expectExit: 0;
+    }];
+};
+export default collaboratorListCommandDescriptor;
+//# sourceMappingURL=forge.collaborator.list.command.descriptor.d.ts.map

package/dist/cli/commands/forge.collaborator.list.command.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"forge.collaborator.list.command.descriptor.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/forge.collaborator.list.command.descriptor.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;;;;;CAqB5C,CAAC;AAEH,eAAe,iCAAiC,CAAC"}

package/dist/cli/commands/forge.collaborator.list.command.descriptor.js

@@ -0,0 +1,25 @@
+import { createRuntimeAsset } from '@vibesdotdev/kernel';
+export const collaboratorListCommandDescriptor = createRuntimeAsset({
+    kind: 'cli/command',
+    id: 'forge.collaborator.list',
+    name: 'list',
+    description: 'List explicit collaborators on a repository',
+    group: 'forge.collaborator',
+    arguments: [
+        { name: 'repo', description: 'Repository id, <owner>/<name>, or bare name', required: true }
+    ],
+    options: [],
+    surfaces: ['cli'],
+    hardware: ['consumer'],
+    enabled: true,
+    order: 10,
+    examples: [
+        {
+            command: 'vibes forge collaborator list my-app',
+            description: 'List explicit access grants for my-app',
+            expectExit: 0
+        }
+    ]
+});
+export default collaboratorListCommandDescriptor;
+//# sourceMappingURL=forge.collaborator.list.command.descriptor.js.map

package/dist/cli/commands/forge.collaborator.list.command.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"forge.collaborator.list.command.descriptor.js","sourceRoot":"","sources":["../../../src/cli/commands/forge.collaborator.list.command.descriptor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEzD,MAAM,CAAC,MAAM,iCAAiC,GAAG,kBAAkB,CAAC;IACnE,IAAI,EAAE,aAAa;IACnB,EAAE,EAAE,yBAAyB;IAC7B,IAAI,EAAE,MAAM;IACZ,WAAW,EAAE,6CAA6C;IAC1D,KAAK,EAAE,oBAAoB;IAC3B,SAAS,EAAE;QACV,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,6CAA6C,EAAE,QAAQ,EAAE,IAAI,EAAE;KAC5F;IACD,OAAO,EAAE,EAAE;IACX,QAAQ,EAAE,CAAC,KAAK,CAAC;IACjB,QAAQ,EAAE,CAAC,UAAU,CAAC;IACtB,OAAO,EAAE,IAAI;IACb,KAAK,EAAE,EAAE;IACT,QAAQ,EAAE;QACT;YACC,OAAO,EAAE,sCAAsC;YAC/C,WAAW,EAAE,wCAAwC;YACrD,UAAU,EAAE,CAAC;SACb;KACD;CACD,CAAC,CAAC;AAEH,eAAe,iCAAiC,CAAC"}

package/dist/cli/commands/forge.collaborator.list.command.impl.d.ts

@@ -0,0 +1,8 @@
+import type { CommandContext } from '@vibesdotdev/cli';
+import type { JsonObject } from '@vibesdotdev/kernel/schemas/json';
+export declare function execute(args: JsonObject, opts: JsonObject, context: CommandContext): Promise<void>;
+declare const _default: {
+    execute: typeof execute;
+};
+export default _default;
+//# sourceMappingURL=forge.collaborator.list.command.impl.d.ts.map

package/dist/cli/commands/forge.collaborator.list.command.impl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"forge.collaborator.list.command.impl.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/forge.collaborator.list.command.impl.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAEvD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kCAAkC,CAAC;AAkBnE,wBAAsB,OAAO,CAC5B,IAAI,EAAE,UAAU,EAChB,IAAI,EAAE,UAAU,EAChB,OAAO,EAAE,cAAc,GACrB,OAAO,CAAC,IAAI,CAAC,CAiCf;;;;AAED,wBAA2B"}

package/dist/cli/commands/forge.collaborator.list.command.impl.js

@@ -0,0 +1,43 @@
+import { CaughtFailureSchema } from '@vibesdotdev/kernel';
+import { sendForgeRequest } from "../lib/transport.js";
+import { resolveRepositoryId } from "../lib/repo-ref.js";
+import { commandUI, printJson, wantsJson } from "../lib/output.js";
+import { failWithForgeCliAccessError, renderCollaboratorsTable } from "../lib/collaborators.js";
+function isString(value) {
+    return typeof value === 'string';
+}
+export async function execute(args, opts, context) {
+    const { runtime } = context;
+    const ui = commandUI(context);
+    const repoRef = isString(args.repo) ? args.repo.trim() : '';
+    if (!repoRef) {
+        failWithForgeCliAccessError(ui, new Error('Usage: vibes forge collaborator list <repo>'), opts);
+    }
+    const outcome = await (async () => {
+        try {
+            const id = await resolveRepositoryId(runtime, repoRef);
+            const res = await sendForgeRequest(runtime, {
+                method: 'GET',
+                path: `/api/repositories/${encodeURIComponent(id)}/collaborators`
+            });
+            if (!res.ok) {
+                return { ok: false, error: new Error(res.message) };
+            }
+            const rows = res.data.results ?? [];
+            return { ok: true, rows };
+        }
+        catch (error) {
+            return { ok: false, error: CaughtFailureSchema.parse(error) };
+        }
+    })();
+    if (!outcome.ok) {
+        failWithForgeCliAccessError(ui, outcome.error, opts);
+    }
+    if (wantsJson(opts)) {
+        printJson(ui, outcome.rows);
+        return;
+    }
+    renderCollaboratorsTable(ui, outcome.rows);
+}
+export default { execute };
+//# sourceMappingURL=forge.collaborator.list.command.impl.js.map

package/dist/cli/commands/forge.collaborator.list.command.impl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"forge.collaborator.list.command.impl.js","sourceRoot":"","sources":["../../../src/cli/commands/forge.collaborator.list.command.impl.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EACN,SAAS,EACT,SAAS,EACT,SAAS,EACT,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACN,2BAA2B,EAC3B,wBAAwB,EAExB,MAAM,yBAAyB,CAAC;AAEjC,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC;AAClC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAC5B,IAAgB,EAChB,IAAgB,EAChB,OAAuB;IAEvB,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAC5B,MAAM,EAAE,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAC9B,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5D,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,2BAA2B,CAAC,EAAE,EAAE,IAAI,KAAK,CAAC,6CAA6C,CAAC,EAAE,IAAI,CAAC,CAAC;IACjG,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE;QACjC,IAAI,CAAC;YACJ,MAAM,EAAE,GAAG,MAAM,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACvD,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAA2B,OAAO,EAAE;gBACrE,MAAM,EAAE,KAAK;gBACb,IAAI,EAAE,qBAAqB,kBAAkB,CAAC,EAAE,CAAC,gBAAgB;aACjE,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACb,OAAO,EAAE,EAAE,EAAE,KAAc,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9D,CAAC;YACD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;YACpC,OAAO,EAAE,EAAE,EAAE,IAAa,EAAE,IAAI,EAAE,CAAC;QACpC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,OAAO,EAAE,EAAE,EAAE,KAAc,EAAE,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,CAAC;IACF,CAAC,CAAC,EAAE,CAAC;IAEL,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QACjB,2BAA2B,CAAC,EAAE,EAAE,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,SAAS,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;QAC5B,OAAO;IACR,CAAC;IACD,wBAAwB,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;AAC5C,CAAC;AAED,eAAe,EAAE,OAAO,EAAE,CAAC"}

package/dist/cli/commands/forge.collaborator.remove.command.descriptor.d.ts

@@ -0,0 +1,28 @@
+export declare const collaboratorRemoveCommandDescriptor: {
+    readonly kind: "cli/command";
+    readonly id: "forge.collaborator.remove";
+    readonly name: "remove";
+    readonly description: "Revoke an explicit repository collaborator grant";
+    readonly group: "forge.collaborator";
+    readonly arguments: [{
+        readonly name: "repo";
+        readonly description: "Repository id, <owner>/<name>, or bare name";
+        readonly required: true;
+    }, {
+        readonly name: "userId";
+        readonly description: "User id to revoke access from";
+        readonly required: true;
+    }];
+    readonly options: [];
+    readonly surfaces: ["cli"];
+    readonly hardware: readonly ["consumer"];
+    readonly enabled: true;
+    readonly order: 30;
+    readonly examples: [{
+        readonly command: "vibes forge collaborator remove my-app user_123";
+        readonly description: "Revoke explicit access for user_123";
+        readonly expectExit: 0;
+    }];
+};
+export default collaboratorRemoveCommandDescriptor;
+//# sourceMappingURL=forge.collaborator.remove.command.descriptor.d.ts.map

package/dist/cli/commands/forge.collaborator.remove.command.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"forge.collaborator.remove.command.descriptor.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/forge.collaborator.remove.command.descriptor.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,mCAAmC;;;;;;;;;;;;;;;;;;;;;;;;;CAsB9C,CAAC;AAEH,eAAe,mCAAmC,CAAC"}

package/dist/cli/commands/forge.collaborator.remove.command.descriptor.js

@@ -0,0 +1,26 @@
+import { createRuntimeAsset } from '@vibesdotdev/kernel';
+export const collaboratorRemoveCommandDescriptor = createRuntimeAsset({
+    kind: 'cli/command',
+    id: 'forge.collaborator.remove',
+    name: 'remove',
+    description: 'Revoke an explicit repository collaborator grant',
+    group: 'forge.collaborator',
+    arguments: [
+        { name: 'repo', description: 'Repository id, <owner>/<name>, or bare name', required: true },
+        { name: 'userId', description: 'User id to revoke access from', required: true }
+    ],
+    options: [],
+    surfaces: ['cli'],
+    hardware: ['consumer'],
+    enabled: true,
+    order: 30,
+    examples: [
+        {
+            command: 'vibes forge collaborator remove my-app user_123',
+            description: 'Revoke explicit access for user_123',
+            expectExit: 0
+        }
+    ]
+});
+export default collaboratorRemoveCommandDescriptor;
+//# sourceMappingURL=forge.collaborator.remove.command.descriptor.js.map

package/dist/cli/commands/forge.collaborator.remove.command.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"forge.collaborator.remove.command.descriptor.js","sourceRoot":"","sources":["../../../src/cli/commands/forge.collaborator.remove.command.descriptor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEzD,MAAM,CAAC,MAAM,mCAAmC,GAAG,kBAAkB,CAAC;IACrE,IAAI,EAAE,aAAa;IACnB,EAAE,EAAE,2BAA2B;IAC/B,IAAI,EAAE,QAAQ;IACd,WAAW,EAAE,kDAAkD;IAC/D,KAAK,EAAE,oBAAoB;IAC3B,SAAS,EAAE;QACV,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,6CAA6C,EAAE,QAAQ,EAAE,IAAI,EAAE;QAC5F,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,+BAA+B,EAAE,QAAQ,EAAE,IAAI,EAAE;KAChF;IACD,OAAO,EAAE,EAAE;IACX,QAAQ,EAAE,CAAC,KAAK,CAAC;IACjB,QAAQ,EAAE,CAAC,UAAU,CAAC;IACtB,OAAO,EAAE,IAAI;IACb,KAAK,EAAE,EAAE;IACT,QAAQ,EAAE;QACT;YACC,OAAO,EAAE,iDAAiD;YAC1D,WAAW,EAAE,qCAAqC;YAClD,UAAU,EAAE,CAAC;SACb;KACD;CACD,CAAC,CAAC;AAEH,eAAe,mCAAmC,CAAC"}

package/dist/cli/commands/forge.collaborator.remove.command.impl.d.ts

@@ -0,0 +1,8 @@
+import type { CommandContext } from '@vibesdotdev/cli';
+import type { JsonObject } from '@vibesdotdev/kernel/schemas/json';
+export declare function execute(args: JsonObject, opts: JsonObject, context: CommandContext): Promise<void>;
+declare const _default: {
+    execute: typeof execute;
+};
+export default _default;
+//# sourceMappingURL=forge.collaborator.remove.command.impl.d.ts.map

package/dist/cli/commands/forge.collaborator.remove.command.impl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"forge.collaborator.remove.command.impl.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/forge.collaborator.remove.command.impl.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAEvD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kCAAkC,CAAC;AAmBnE,wBAAsB,OAAO,CAC5B,IAAI,EAAE,UAAU,EAChB,IAAI,EAAE,UAAU,EAChB,OAAO,EAAE,cAAc,GACrB,OAAO,CAAC,IAAI,CAAC,CAsCf;;;;AAED,wBAA2B"}

package/dist/cli/commands/forge.collaborator.remove.command.impl.js

@@ -0,0 +1,46 @@
+import { CaughtFailureSchema } from '@vibesdotdev/kernel';
+import { sendForgeRequest } from "../lib/transport.js";
+import { resolveRepositoryId } from "../lib/repo-ref.js";
+import { commandUI, printJson, printSuccess, wantsJson } from "../lib/output.js";
+import { buildCollaboratorRemoveBody, failWithForgeCliAccessError } from "../lib/collaborators.js";
+function isString(value) {
+    return typeof value === 'string';
+}
+export async function execute(args, opts, context) {
+    const { runtime } = context;
+    const ui = commandUI(context);
+    const repoRef = isString(args.repo) ? args.repo.trim() : '';
+    const userId = isString(args.userId) ? args.userId.trim() : '';
+    const outcome = await (async () => {
+        try {
+            if (!repoRef)
+                throw new Error('Usage: vibes forge collaborator remove <repo> <user-id>');
+            const body = buildCollaboratorRemoveBody(userId);
+            const id = await resolveRepositoryId(runtime, repoRef);
+            const res = await sendForgeRequest(runtime, {
+                method: 'DELETE',
+                path: `/api/repositories/${encodeURIComponent(id)}/collaborators`,
+                body
+            });
+            if (!res.ok) {
+                return { ok: false, error: new Error(res.message) };
+            }
+            return { ok: true, result: res.data.result, id, body };
+        }
+        catch (error) {
+            return { ok: false, error: CaughtFailureSchema.parse(error) };
+        }
+    })();
+    if (!outcome.ok) {
+        failWithForgeCliAccessError(ui, outcome.error, opts);
+    }
+    if (wantsJson(opts)) {
+        printJson(ui, outcome.result);
+        return;
+    }
+    printSuccess(ui, outcome.result.removed
+        ? `Removed collaborator ${outcome.body.userId} from repository ${outcome.id}`
+        : `No explicit collaborator grant found for ${outcome.body.userId} on repository ${outcome.id}`);
+}
+export default { execute };
+//# sourceMappingURL=forge.collaborator.remove.command.impl.js.map

package/dist/cli/commands/forge.collaborator.remove.command.impl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"forge.collaborator.remove.command.impl.js","sourceRoot":"","sources":["../../../src/cli/commands/forge.collaborator.remove.command.impl.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE1D,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EACN,SAAS,EACT,SAAS,EACT,YAAY,EACZ,SAAS,EACT,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACN,2BAA2B,EAC3B,2BAA2B,EAE3B,MAAM,yBAAyB,CAAC;AAEjC,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC;AAClC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAC5B,IAAgB,EAChB,IAAgB,EAChB,OAAuB;IAEvB,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IAC5B,MAAM,EAAE,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAC9B,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5D,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAE/D,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE;QACjC,IAAI,CAAC;YACJ,IAAI,CAAC,OAAO;gBAAE,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;YACzF,MAAM,IAAI,GAAG,2BAA2B,CAAC,MAAM,CAAC,CAAC;YACjD,MAAM,EAAE,GAAG,MAAM,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACvD,MAAM,GAAG,GAAG,MAAM,gBAAgB,CAA6B,OAAO,EAAE;gBACvE,MAAM,EAAE,QAAQ;gBAChB,IAAI,EAAE,qBAAqB,kBAAkB,CAAC,EAAE,CAAC,gBAAgB;gBACjE,IAAI;aACJ,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACb,OAAO,EAAE,EAAE,EAAE,KAAc,EAAE,KAAK,EAAE,IAAI,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9D,CAAC;YACD,OAAO,EAAE,EAAE,EAAE,IAAa,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACjE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,OAAO,EAAE,EAAE,EAAE,KAAc,EAAE,KAAK,EAAE,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,CAAC;IACF,CAAC,CAAC,EAAE,CAAC;IAEL,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QACjB,2BAA2B,CAAC,EAAE,EAAE,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,SAAS,CAAC,EAAE,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAC9B,OAAO;IACR,CAAC;IACD,YAAY,CACX,EAAE,EACF,OAAO,CAAC,MAAM,CAAC,OAAO;QACrB,CAAC,CAAC,wBAAwB,OAAO,CAAC,IAAI,CAAC,MAAM,oBAAoB,OAAO,CAAC,EAAE,EAAE;QAC7E,CAAC,CAAC,4CAA4C,OAAO,CAAC,IAAI,CAAC,MAAM,kBAAkB,OAAO,CAAC,EAAE,EAAE,CAChG,CAAC;AACH,CAAC;AAED,eAAe,EAAE,OAAO,EAAE,CAAC"}

package/dist/cli/commands/forge.credential-helper.command.descriptor.d.ts

@@ -0,0 +1,24 @@
+export declare const credentialHelperCommandDescriptor: {
+    readonly kind: "cli/command";
+    readonly id: "forge.credential-helper";
+    readonly name: "credential-helper";
+    readonly description: "Explicit Smart HTTPS helper — exchange the active Vibes session for one short-lived repository-scoped credential";
+    readonly group: "forge";
+    readonly arguments: [{
+        readonly name: "operation";
+        readonly description: "git credential operation (get | store | erase)";
+        readonly required: true;
+    }];
+    readonly options: [];
+    readonly surfaces: ["cli"];
+    readonly hardware: readonly ["consumer"];
+    readonly enabled: true;
+    readonly order: 40;
+    readonly examples: [{
+        readonly command: "vibes forge credential-helper get";
+        readonly description: "Serve Git credential protocol input for an explicitly selected authenticated Smart HTTPS operation";
+        readonly expectExit: 0;
+    }];
+};
+export default credentialHelperCommandDescriptor;
+//# sourceMappingURL=forge.credential-helper.command.descriptor.d.ts.map

package/dist/cli/commands/forge.credential-helper.command.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"forge.credential-helper.command.descriptor.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/forge.credential-helper.command.descriptor.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,iCAAiC;;;;;;;;;;;;;;;;;;;;;CA2B5C,CAAC;AAEH,eAAe,iCAAiC,CAAC"}

package/dist/cli/commands/forge.credential-helper.command.descriptor.js

@@ -0,0 +1,29 @@
+import { createRuntimeAsset } from '@vibesdotdev/kernel';
+export const credentialHelperCommandDescriptor = createRuntimeAsset({
+    kind: 'cli/command',
+    id: 'forge.credential-helper',
+    name: 'credential-helper',
+    description: 'Explicit Smart HTTPS helper — exchange the active Vibes session for one short-lived repository-scoped credential',
+    group: 'forge',
+    arguments: [
+        {
+            name: 'operation',
+            description: 'git credential operation (get | store | erase)',
+            required: true
+        }
+    ],
+    options: [],
+    surfaces: ['cli'],
+    hardware: ['consumer'],
+    enabled: true,
+    order: 40,
+    examples: [
+        {
+            command: 'vibes forge credential-helper get',
+            description: 'Serve Git credential protocol input for an explicitly selected authenticated Smart HTTPS operation',
+            expectExit: 0
+        }
+    ]
+});
+export default credentialHelperCommandDescriptor;
+//# sourceMappingURL=forge.credential-helper.command.descriptor.js.map

package/dist/cli/commands/forge.credential-helper.command.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"forge.credential-helper.command.descriptor.js","sourceRoot":"","sources":["../../../src/cli/commands/forge.credential-helper.command.descriptor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEzD,MAAM,CAAC,MAAM,iCAAiC,GAAG,kBAAkB,CAAC;IACnE,IAAI,EAAE,aAAa;IACnB,EAAE,EAAE,yBAAyB;IAC7B,IAAI,EAAE,mBAAmB;IACzB,WAAW,EACV,kHAAkH;IACnH,KAAK,EAAE,OAAO;IACd,SAAS,EAAE;QACV;YACC,IAAI,EAAE,WAAW;YACjB,WAAW,EAAE,gDAAgD;YAC7D,QAAQ,EAAE,IAAI;SACd;KACD;IACD,OAAO,EAAE,EAAE;IACX,QAAQ,EAAE,CAAC,KAAK,CAAC;IACjB,QAAQ,EAAE,CAAC,UAAU,CAAC;IACtB,OAAO,EAAE,IAAI;IACb,KAAK,EAAE,EAAE;IACT,QAAQ,EAAE;QACT;YACC,OAAO,EAAE,mCAAmC;YAC5C,WAAW,EACV,oGAAoG;YACrG,UAAU,EAAE,CAAC;SACb;KACD;CACD,CAAC,CAAC;AAEH,eAAe,iCAAiC,CAAC"}

package/dist/cli/commands/forge.credential-helper.command.impl.d.ts

@@ -0,0 +1,72 @@
+import type { CommandContext } from '@vibesdotdev/cli';
+import type { FetchLike, ForgeRequestSpec, ForgeResponse } from '../lib/transport.ts';
+import { type GitCredentialRequest } from '../lib/credential-helper.ts';
+import { type ExecLike } from '../lib/ssh-keygen.ts';
+/** Untrusted transport data is validated by the credential response schemas below. */
+export type SendLike = (spec: ForgeRequestSpec, fetchImpl?: FetchLike) => Promise<ForgeResponse<unknown>>;
+export interface CredentialGetDeps {
+    send: SendLike;
+    exec: ExecLike;
+    /** Resolve `<owner>/<name>` → platform repository UUID. */
+    resolveRepo: (ref: string) => Promise<string>;
+    /**
+     * Private or public key selector passed to ssh-keygen signing, already
+     * resolved (`resolveSigningKeyPath(keyOpt, keyPathBase(runtime))`).
+     */
+    signingKeyPath: string;
+    /** Public key path to fingerprint (derived from `signingKeyPath` by default). */
+    publicKeyPath?: string;
+    /** Exact HTTPS host (including port when non-default). */
+    expectedHost?: string;
+}
+export interface SessionCredentialGetDeps {
+    send: SendLike;
+    /** Resolve `<owner>/<name>` → platform repository UUID. */
+    resolveRepo: (ref: string) => Promise<string>;
+    /** Exact HTTPS host (including port when non-default). */
+    expectedHost?: string;
+}
+export declare const DEFAULT_GIT_CREDENTIAL_HOST = "git.vibes.dev";
+export declare const WRITE_CREDENTIAL_USERNAME = "vibes-write";
+export declare const WRITE_CREDENTIAL_TTL_SECONDS = 1800;
+/** Validate the actual request Git sends before minting any repository token. */
+export declare function requireCanonicalCredentialRequest(req: GitCredentialRequest, expectedHost?: string): string;
+export interface EphemeralGitCredential {
+    username: string;
+    token: string;
+    tokenId: string;
+    expiresAt: string;
+    scopes: string[];
+}
+/**
+ * One SSH challenge mint: a fresh single-use challenge, signed and verified
+ * once. Nothing here retries or sleeps. A transient refusal is a typed,
+ * `retryable` outcome for the caller's declared retry policy; a retry is a
+ * whole new call, so it always starts from a fresh challenge and a consumed
+ * nonce is never submitted twice.
+ */
+export declare function mintEphemeralGitCredential(req: GitCredentialRequest, deps: CredentialGetDeps, scopes?: Array<'repo:read' | 'repo:write'>, ttlSeconds?: number): Promise<EphemeralGitCredential>;
+/**
+ * Run the credential `get` flow → the rendered git credential block. Throws on any
+ * failure (missing repo path, unknown key, challenge/verify rejection); the caller
+ * maps that to a non-zero exit. PURE w.r.t. its injected boundaries.
+ */
+export declare function runSshCredentialGet(req: GitCredentialRequest, deps: CredentialGetDeps): Promise<string>;
+/**
+ * Resolve a credential through the authenticated Forge session. The server owns
+ * repository RBAC and token scope; the CLI contributes only the canonical repo
+ * identity and Git's read/write intent.
+ */
+export declare function runCredentialGet(req: GitCredentialRequest, deps: SessionCredentialGetDeps): Promise<string>;
+/** The arguments the CLI hands `credential-helper`. */
+export interface CredentialHelperArgs {
+    operation?: string;
+}
+export declare function execute(args: CredentialHelperArgs, _opts: Readonly<{
+    json?: boolean;
+}>, context: CommandContext, deps?: Partial<SessionCredentialGetDeps>): Promise<void>;
+declare const _default: {
+    execute: typeof execute;
+};
+export default _default;
+//# sourceMappingURL=forge.credential-helper.command.impl.d.ts.map

package/dist/cli/commands/forge.credential-helper.command.impl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"forge.credential-helper.command.impl.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/forge.credential-helper.command.impl.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAuBvD,OAAO,KAAK,EAAE,SAAS,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAItF,OAAO,EAAgD,KAAK,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACtH,OAAO,EAAoC,KAAK,QAAQ,EAAE,MAAM,sBAAsB,CAAC;AAGvF,sFAAsF;AACtF,MAAM,MAAM,QAAQ,GAAG,CAAC,IAAI,EAAE,gBAAgB,EAAE,SAAS,CAAC,EAAE,SAAS,KAAK,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;AAE1G,MAAM,WAAW,iBAAiB;IACjC,IAAI,EAAE,QAAQ,CAAC;IACf,IAAI,EAAE,QAAQ,CAAC;IACf,2DAA2D;IAC3D,WAAW,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9C;;;OAGG;IACH,cAAc,EAAE,MAAM,CAAC;IACvB,iFAAiF;IACjF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,0DAA0D;IAC1D,YAAY,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,wBAAwB;IACxC,IAAI,EAAE,QAAQ,CAAC;IACf,2DAA2D;IAC3D,WAAW,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IAC9C,0DAA0D;IAC1D,YAAY,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,eAAO,MAAM,2BAA2B,kBAAkB,CAAC;AAC3D,eAAO,MAAM,yBAAyB,gBAAgB,CAAC;AACvD,eAAO,MAAM,4BAA4B,OAAO,CAAC;AAOjD,iFAAiF;AACjF,wBAAgB,iCAAiC,CAChD,GAAG,EAAE,oBAAoB,EACzB,YAAY,SAA8B,GACxC,MAAM,CAmBR;AAED,MAAM,WAAW,sBAAsB;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,EAAE,CAAC;CACjB;AAiDD;;;;;;GAMG;AACH,wBAAsB,0BAA0B,CAC/C,GAAG,EAAE,oBAAoB,EACzB,IAAI,EAAE,iBAAiB,EACvB,MAAM,GAAE,KAAK,CAAC,WAAW,GAAG,YAAY,CAAiB,EACzD,UAAU,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,sBAAsB,CAAC,CA0CjC;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,CACxC,GAAG,EAAE,oBAAoB,EACzB,IAAI,EAAE,iBAAiB,GACrB,OAAO,CAAC,MAAM,CAAC,CAYjB;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CACrC,GAAG,EAAE,oBAAoB,EACzB,IAAI,EAAE,wBAAwB,GAC5B,OAAO,CAAC,MAAM,CAAC,CA+BjB;AAED,uDAAuD;AACvD,MAAM,WAAW,oBAAoB;IACpC,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAkBD,wBAAsB,OAAO,CAC5B,IAAI,EAAE,oBAAoB,EAC1B,KAAK,EAAE,QAAQ,CAAC;IAAE,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,EACnC,OAAO,EAAE,cAAc,EACvB,IAAI,GAAE,OAAO,CAAC,wBAAwB,CAAM,GAC1C,OAAO,CAAC,IAAI,CAAC,CA+Bf;;;;AAED,wBAA2B"}

package/dist/cli/commands/forge.credential-helper.command.impl.js

@@ -0,0 +1,218 @@
+/**
+ * `vibes forge credential-helper <get|store|erase>` — git credential helper.
+ *
+ * On `get`, exchanges the existing Vibes login session for a short-lived,
+ * repository-scoped HTTPS token. `store`/`erase` are no-ops: the token is
+ * ephemeral and fetched fresh per operation. The helper accepts only the exact
+ * HTTPS forge host + canonical owner/repo.git path. Clone/fetch request read
+ * access; only Git's reserved `vibes-write` push intent requests bounded write
+ * access.
+ *
+ * Git's credential block is read through the handed runtime's stdin, and the
+ * credential is written once, on stdout, through the runtime's stdio. Nothing
+ * else reaches stdout, and the credential never reaches stderr, a log or a
+ * failure.
+ *
+ * The SSH challenge mint remains exported for the explicit `forge push` flow,
+ * but native Git integration intentionally has no second SSH-key onboarding gate.
+ */
+import * as z from 'zod/v4';
+import { CapabilityError, getRuntimeStdin, getRuntimeStdio } from '@vibesdotdev/kernel';
+import { sendForgeRequest } from "../lib/transport.js";
+import { forgeResponseFailure } from "../../request.js";
+import { resolveRepositoryId } from "../lib/repo-ref.js";
+import { parseCredentialInput, renderCredentialOutput } from "../lib/credential-helper.js";
+import { fingerprintPublicKey, signSshSig } from "../lib/ssh-keygen.js";
+import { publicKeyPathOf } from "../lib/ssh-key-source.js";
+export const DEFAULT_GIT_CREDENTIAL_HOST = 'git.vibes.dev';
+export const WRITE_CREDENTIAL_USERNAME = 'vibes-write';
+export const WRITE_CREDENTIAL_TTL_SECONDS = 1800;
+/** The most bytes of git's credential block the helper reads from stdin. */
+const CREDENTIAL_BLOCK_MAX_BYTES = 64 * 1024;
+const CANONICAL_REPOSITORY_PATH = /^(~?[A-Za-z0-9][A-Za-z0-9._-]*)\/([A-Za-z0-9][A-Za-z0-9._-]*)\.git$/;
+/** Validate the actual request Git sends before minting any repository token. */
+export function requireCanonicalCredentialRequest(req, expectedHost = DEFAULT_GIT_CREDENTIAL_HOST) {
+    if (req.protocol !== 'https' || req.host !== expectedHost || !req.path) {
+        throw new CapabilityError('git credential request does not match the canonical HTTPS forge target', 'INVALID_INPUT', { reason: 'git-credential-target-invalid', retryable: false });
+    }
+    const match = req.path.startsWith('/') || req.path.includes('%') || req.path.includes('\\')
+        ? null
+        : CANONICAL_REPOSITORY_PATH.exec(req.path);
+    if (!match) {
+        throw new CapabilityError('git credential request does not contain a canonical owner/repository path', 'INVALID_INPUT', { reason: 'git-credential-path-invalid', retryable: false });
+    }
+    return `${match[1]}/${match[2]}`;
+}
+/** What a git-auth challenge answers: one non-empty single-use nonce. */
+const ChallengeSchema = z.object({ challenge: z.string().min(1) });
+/** What git-auth verify answers: the repository credential. */
+const VerifiedCredentialSchema = z.object({
+    username: z.string(),
+    token: z.string().min(1),
+    tokenId: z.string().min(1),
+    expiresAt: z.string(),
+    scopes: z.array(z.string())
+});
+/** A credential line git can read back: non-empty, no line break. */
+const CredentialLineSchema = z.string().regex(/^[^\r\n]+$/);
+/** What the session clone-credential route answers. */
+const SessionCredentialSchema = z.object({
+    result: z.object({
+        username: z.union([CredentialLineSchema, z.literal('')]).optional(),
+        token: CredentialLineSchema
+    })
+});
+/**
+ * Transient forge transport statuses: network/unknown (0), rate-limit (429),
+ * and 5xx — git.vibes.dev cold-boots and intermittently returns these on the
+ * first hit. 4xx auth rejections are permanent.
+ */
+function isTransientForgeStatus(status) {
+    return status === 0 || status === 429 || status >= 500;
+}
+/**
+ * One refused git-auth step as a typed failure: the forge's own typed failure
+ * rides as the cause, and a transient status is `retryable` so the caller's
+ * declared retry policy (Workers owns retry) runs the whole mint again.
+ */
+function gitAuthRefusal(step, response) {
+    const cause = forgeResponseFailure(response);
+    return new CapabilityError(`The Forge git-auth ${step} was refused.`, cause.code, {
+        reason: `git-auth-${step}-refused`,
+        retryable: isTransientForgeStatus(response.status),
+        details: { status: response.status },
+        cause
+    });
+}
+/**
+ * One SSH challenge mint: a fresh single-use challenge, signed and verified
+ * once. Nothing here retries or sleeps. A transient refusal is a typed,
+ * `retryable` outcome for the caller's declared retry policy; a retry is a
+ * whole new call, so it always starts from a fresh challenge and a consumed
+ * nonce is never submitted twice.
+ */
+export async function mintEphemeralGitCredential(req, deps, scopes = ['repo:read'], ttlSeconds) {
+    const repoRef = requireCanonicalCredentialRequest(req, deps.expectedHost);
+    const publicKeyPath = deps.publicKeyPath ?? publicKeyPathOf(deps.signingKeyPath);
+    const fingerprint = await fingerprintPublicKey(publicKeyPath, deps.exec);
+    const repositoryId = await deps.resolveRepo(repoRef);
+    const challengeRes = await deps.send({
+        method: 'POST',
+        path: '/api/git-auth/challenge',
+        body: { fingerprint }
+    });
+    if (!challengeRes.ok)
+        throw gitAuthRefusal('challenge', challengeRes);
+    const issued = ChallengeSchema.safeParse(challengeRes.data);
+    if (!issued.success) {
+        throw new CapabilityError('The git-auth challenge response violated its wire contract.', 'UNAVAILABLE', {
+            reason: 'git-auth-challenge-invalid',
+            retryable: false
+        });
+    }
+    const { challenge } = issued.data;
+    const signature = await signSshSig(deps.signingKeyPath, challenge, deps.exec);
+    const verifyRes = await deps.send({
+        method: 'POST',
+        path: '/api/git-auth/verify',
+        body: { fingerprint, challenge, signature, repositoryId, scopes, ttlSeconds }
+    });
+    if (!verifyRes.ok)
+        throw gitAuthRefusal('verify', verifyRes);
+    const verified = VerifiedCredentialSchema.safeParse(verifyRes.data);
+    const requested = [...new Set(scopes)].sort();
+    const returned = verified.success ? [...new Set(verified.data.scopes)].sort() : [];
+    if (!verified.success ||
+        requested.length !== returned.length ||
+        requested.some((scope, index) => scope !== returned[index])) {
+        throw new CapabilityError('verify response did not provide the exact requested repository credential', 'UNAVAILABLE', { reason: 'git-auth-credential-invalid', retryable: false });
+    }
+    return verified.data;
+}
+/**
+ * Run the credential `get` flow → the rendered git credential block. Throws on any
+ * failure (missing repo path, unknown key, challenge/verify rejection); the caller
+ * maps that to a non-zero exit. PURE w.r.t. its injected boundaries.
+ */
+export async function runSshCredentialGet(req, deps) {
+    // Git's credential protocol does not identify clone/fetch vs push. A remote
+    // push URL with the reserved username is an explicit, standard-Git intent
+    // signal: fetch stays read-only; `git push` gets one bounded write credential.
+    const writeIntent = req.extra.username === WRITE_CREDENTIAL_USERNAME;
+    const { username, token } = await mintEphemeralGitCredential(req, deps, writeIntent ? ['repo:read', 'repo:write'] : ['repo:read'], writeIntent ? WRITE_CREDENTIAL_TTL_SECONDS : undefined);
+    return renderCredentialOutput({ username, password: token });
+}
+/**
+ * Resolve a credential through the authenticated Forge session. The server owns
+ * repository RBAC and token scope; the CLI contributes only the canonical repo
+ * identity and Git's read/write intent.
+ */
+export async function runCredentialGet(req, deps) {
+    const repoRef = requireCanonicalCredentialRequest(req, deps.expectedHost);
+    const repositoryId = await deps.resolveRepo(repoRef);
+    const access = req.extra.username === WRITE_CREDENTIAL_USERNAME ? 'write' : 'read';
+    const response = await deps.send({
+        method: 'GET',
+        path: `/api/repositories/${encodeURIComponent(repositoryId)}/clone-credential`,
+        query: { access }
+    });
+    if (!response.ok) {
+        const cause = forgeResponseFailure(response);
+        throw new CapabilityError('Forge refused the repository clone credential.', cause.code, {
+            reason: 'git-clone-credential-refused',
+            retryable: cause.retryable,
+            details: { status: response.status },
+            cause
+        });
+    }
+    // The body is never a cause: a malformed credential is still a credential.
+    const credential = SessionCredentialSchema.safeParse(response.data);
+    if (!credential.success) {
+        throw new CapabilityError('clone credential response did not provide a valid repository credential', 'UNAVAILABLE', { reason: 'git-clone-credential-invalid', retryable: false });
+    }
+    return renderCredentialOutput({
+        username: credential.data.result.username || 'vibes-deploy',
+        password: credential.data.result.token
+    });
+}
+const CredentialHelperArgsSchema = z.object({
+    operation: z.string().trim().catch('')
+});
+const CredentialOperationSchema = z.enum(['get', 'store', 'erase']);
+/**
+ * Git's credential block, read once through the handed runtime's stdin. Git
+ * writes the block and closes the pipe, so the read ends at EOF; a block
+ * larger than the bound is refused by the host, never cut.
+ */
+async function readCredentialBlock(runtime) {
+    const stdin = await getRuntimeStdin(runtime);
+    return (await stdin.readStdin({ maxBytes: CREDENTIAL_BLOCK_MAX_BYTES })).text;
+}
+export async function execute(args, _opts, context, deps = {}) {
+    const { runtime } = context;
+    const parsedArgs = CredentialHelperArgsSchema.safeParse(args);
+    const operation = CredentialOperationSchema.safeParse(parsedArgs.success ? parsedArgs.data.operation : '');
+    if (!operation.success) {
+        throw new CapabilityError('Unsupported git credential operation (expected get, store or erase).', 'INVALID_INPUT', { reason: 'git-credential-operation-unsupported', retryable: false });
+    }
+    // `store`/`erase` are no-ops — the token is ephemeral, nothing to persist/forget.
+    // git also drains our stdin; consume it so it doesn't block.
+    if (operation.data !== 'get') {
+        await readCredentialBlock(runtime);
+        return;
+    }
+    // Resolved before anything is minted: a host that cannot print the
+    // credential never asks the forge for one.
+    const stdio = await getRuntimeStdio(runtime);
+    const req = parseCredentialInput(await readCredentialBlock(runtime));
+    const output = await runCredentialGet(req, {
+        send: deps.send ?? ((spec, fetchImpl) => sendForgeRequest(runtime, spec, fetchImpl)),
+        resolveRepo: deps.resolveRepo ?? ((ref) => resolveRepositoryId(runtime, ref)),
+        expectedHost: deps.expectedHost
+    });
+    // On any failure above nothing reached stdout, so git falls back to its next
+    // helper or prompt instead of reading a half-written block.
+    stdio.write('stdout', output);
+}
+export default { execute };
+//# sourceMappingURL=forge.credential-helper.command.impl.js.map