@vibesdotdev/forge 0.0.0-stage → 1.0.0-rc.5

package/dist/extraction/source-evidence.consumer.js

@@ -0,0 +1,49 @@
+async function sha256(value) {
+    const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(value));
+    return Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, '0')).join('');
+}
+function stdout(result, operation, allowNoMatches = false) {
+    if (result.exitCode === 0)
+        return result.stdout.trim();
+    if (allowNoMatches && result.exitCode === 1)
+        return '';
+    throw new Error(`${operation} failed (exit ${result.exitCode}): ${result.stderr.trim()}`);
+}
+export async function collectExtractionSourceEvidence(git, cwd, path) {
+    const sourceSha = stdout(await git.raw(cwd, ['rev-parse', 'HEAD']), 'resolve source SHA');
+    const history = stdout(await git.raw(cwd, ['log', '--format=%H', '--', path]), 'collect path history');
+    const treeChecksum = stdout(await git.raw(cwd, ['rev-parse', `${sourceSha}:${path}`]), 'resolve source tree');
+    const lfsPathsOutput = stdout(await git.raw(cwd, [
+        'grep',
+        '-l',
+        'version https://git-lfs.github.com/spec/v1',
+        sourceSha,
+        '--',
+        path
+    ]), 'find Git LFS pointers', true);
+    const lfsEntries = [];
+    for (const rawPointerPath of lfsPathsOutput.split('\n').filter(Boolean).sort()) {
+        const pointerPath = rawPointerPath.startsWith(`${sourceSha}:`)
+            ? rawPointerPath.slice(sourceSha.length + 1)
+            : rawPointerPath;
+        const pointer = stdout(await git.raw(cwd, ['show', `${sourceSha}:${pointerPath}`]), `read Git LFS pointer ${pointerPath}`);
+        const oid = pointer.match(/^oid sha256:([a-f0-9]{64})$/m)?.[1];
+        if (!oid)
+            throw new Error(`Invalid Git LFS pointer at ${pointerPath}`);
+        lfsEntries.push(`${pointerPath}\0${oid}`);
+    }
+    const staged = stdout(await git.raw(cwd, ['ls-files', '--stage', '--', path]), 'collect submodule entries');
+    const submoduleEntries = staged
+        .split('\n')
+        .filter((line) => line.startsWith('160000 '))
+        .sort();
+    return {
+        path,
+        sourceSha,
+        historyChecksum: await sha256(history),
+        treeChecksum,
+        lfsChecksum: await sha256(lfsEntries.join('\n')),
+        submoduleChecksum: await sha256(submoduleEntries.join('\n'))
+    };
+}
+//# sourceMappingURL=source-evidence.consumer.js.map

package/dist/extraction/source-evidence.consumer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"source-evidence.consumer.js","sourceRoot":"","sources":["../../src/extraction/source-evidence.consumer.ts"],"names":[],"mappings":"AAGA,KAAK,UAAU,MAAM,CAAC,KAAa;IAClC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACtF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAClG,CAAC;AAED,SAAS,MAAM,CAAC,MAAoB,EAAE,SAAiB,EAAE,cAAc,GAAG,KAAK;IAC9E,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC;QAAE,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACvD,IAAI,cAAc,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACvD,MAAM,IAAI,KAAK,CAAC,GAAG,SAAS,iBAAiB,MAAM,CAAC,QAAQ,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;AAC3F,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,+BAA+B,CACpD,GAA2B,EAC3B,GAAW,EACX,IAAY;IAEZ,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,EAAE,oBAAoB,CAAC,CAAC;IAC1F,MAAM,OAAO,GAAG,MAAM,CACrB,MAAM,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,EACtD,sBAAsB,CACtB,CAAC;IACF,MAAM,YAAY,GAAG,MAAM,CAC1B,MAAM,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,GAAG,SAAS,IAAI,IAAI,EAAE,CAAC,CAAC,EACzD,qBAAqB,CACrB,CAAC;IACF,MAAM,cAAc,GAAG,MAAM,CAC5B,MAAM,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE;QAClB,MAAM;QACN,IAAI;QACJ,4CAA4C;QAC5C,SAAS;QACT,IAAI;QACJ,IAAI;KACJ,CAAC,EACF,uBAAuB,EACvB,IAAI,CACJ,CAAC;IACF,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,KAAK,MAAM,cAAc,IAAI,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAChF,MAAM,WAAW,GAAG,cAAc,CAAC,UAAU,CAAC,GAAG,SAAS,GAAG,CAAC;YAC7D,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC;YAC5C,CAAC,CAAC,cAAc,CAAC;QAClB,MAAM,OAAO,GAAG,MAAM,CACrB,MAAM,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,GAAG,SAAS,IAAI,WAAW,EAAE,CAAC,CAAC,EAC3D,wBAAwB,WAAW,EAAE,CACrC,CAAC;QACF,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,8BAA8B,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC/D,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,WAAW,EAAE,CAAC,CAAC;QACvE,UAAU,CAAC,IAAI,CAAC,GAAG,WAAW,KAAK,GAAG,EAAE,CAAC,CAAC;IAC3C,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CACpB,MAAM,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,UAAU,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,EACvD,2BAA2B,CAC3B,CAAC;IACF,MAAM,gBAAgB,GAAG,MAAM;SAC7B,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;SAC5C,IAAI,EAAE,CAAC;IAET,OAAO;QACN,IAAI;QACJ,SAAS;QACT,eAAe,EAAE,MAAM,MAAM,CAAC,OAAO,CAAC;QACtC,YAAY;QACZ,WAAW,EAAE,MAAM,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChD,iBAAiB,EAAE,MAAM,MAAM,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;KAC5D,CAAC;AACH,CAAC"}

package/dist/failures.d.ts

@@ -0,0 +1,9 @@
+/**
+ * Text forge did not write (a server's error body or `message`, git's stderr, a
+ * subprocess's output) as a failure's cause: control characters removed, every
+ * credential-shaped token and every value in `secrets` replaced by `[redacted]`,
+ * then at most 200 characters. Such text never enters a `CapabilityError`
+ * message; it rides only here, through the one shared redaction owner.
+ */
+export declare function redactedCause(text: string, secrets?: readonly string[]): Error;
+//# sourceMappingURL=failures.d.ts.map

package/dist/failures.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"failures.d.ts","sourceRoot":"","sources":["../src/failures.ts"],"names":[],"mappings":"AAEA;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,GAAE,SAAS,MAAM,EAAO,GAAG,KAAK,CAElF"}

package/dist/failures.js

@@ -0,0 +1,12 @@
+import { redactedExcerpt } from '@vibesdotdev/shared/utils';
+/**
+ * Text forge did not write (a server's error body or `message`, git's stderr, a
+ * subprocess's output) as a failure's cause: control characters removed, every
+ * credential-shaped token and every value in `secrets` replaced by `[redacted]`,
+ * then at most 200 characters. Such text never enters a `CapabilityError`
+ * message; it rides only here, through the one shared redaction owner.
+ */
+export function redactedCause(text, secrets = []) {
+    return new Error(redactedExcerpt(text, { secrets }));
+}
+//# sourceMappingURL=failures.js.map

package/dist/failures.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"failures.js","sourceRoot":"","sources":["../src/failures.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAE5D;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,UAA6B,EAAE;IAC1E,OAAO,IAAI,KAAK,CAAC,eAAe,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;AACtD,CAAC"}

package/dist/forge.api-client.d.ts

@@ -0,0 +1,14 @@
+import type { RuntimeRef } from '@vibesdotdev/kernel';
+import type { RuntimeKindDescriptor, KindContext } from '@vibesdotdev/kernel/schemas/kind';
+import type { ForgeResponse, ForgeRequestSpec } from './request.ts';
+import { type ForgeApiClientDescriptor } from './forge.api-client.descriptor.ts';
+/** Environment-neutral transport seam used by Forge domain capabilities. */
+export interface ForgeApiClientInterface {
+    readonly descriptor: ForgeApiClientDescriptor;
+    request<T>(spec: ForgeRequestSpec): Promise<ForgeResponse<T>>;
+    resolveRepositoryId(ref: string, ownerId?: string): Promise<string>;
+}
+export declare const forgeApiClientKind: RuntimeKindDescriptor<ForgeApiClientDescriptor, ForgeApiClientInterface, KindContext>;
+/** The `forge/api-client` implementation the runtime selects. */
+export declare function resolveForgeApiClient(runtime: Pick<RuntimeRef, 'query'>): Promise<ForgeApiClientInterface>;
+//# sourceMappingURL=forge.api-client.d.ts.map

package/dist/forge.api-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"forge.api-client.d.ts","sourceRoot":"","sources":["../src/forge.api-client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,KAAK,EAAE,qBAAqB,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AAC3F,OAAO,KAAK,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AACpE,OAAO,EAEN,KAAK,wBAAwB,EAC7B,MAAM,kCAAkC,CAAC;AAE1C,4EAA4E;AAC5E,MAAM,WAAW,uBAAuB;IACvC,QAAQ,CAAC,UAAU,EAAE,wBAAwB,CAAC;IAC9C,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9D,mBAAmB,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACpE;AAED,eAAO,MAAM,kBAAkB,EAAE,qBAAqB,CACrD,wBAAwB,EACxB,uBAAuB,EACvB,WAAW,CAKX,CAAC;AAEF,iEAAiE;AACjE,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,uBAAuB,CAAC,CAEhH"}

package/dist/forge.api-client.descriptor.d.ts

@@ -0,0 +1,52 @@
+import * as z from 'zod/v4';
+export declare const ForgeApiClientDescriptorSchema: z.ZodObject<{
+    id: z.ZodString;
+    description: z.ZodOptional<z.ZodString>;
+    tags: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    hardware: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    enabled: z.ZodOptional<z.ZodBoolean>;
+    capabilityId: z.ZodOptional<z.ZodString>;
+    requiredContext: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    optionalContext: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    config: z.ZodOptional<z.ZodUnknown>;
+    retention: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodObject<{
+        maxAgeDays: z.ZodOptional<z.ZodNumber>;
+        maxEntries: z.ZodOptional<z.ZodNumber>;
+        maxBytes: z.ZodOptional<z.ZodNumber>;
+        cascadeFrom: z.ZodOptional<z.ZodString>;
+        ageField: z.ZodOptional<z.ZodString>;
+        reason: z.ZodString;
+        enforcedBy: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>]>>;
+    kind: z.ZodLiteral<"forge/api-client">;
+    name: z.ZodDefault<z.ZodString>;
+    priority: z.ZodDefault<z.ZodNumber>;
+}, z.core.$strip>;
+export type ForgeApiClientDescriptor = z.infer<typeof ForgeApiClientDescriptorSchema>;
+export declare function createForgeApiClientDescriptor(options: Omit<Partial<ForgeApiClientDescriptor>, 'kind'> & {
+    id: string;
+}): ForgeApiClientDescriptor;
+export declare const forgeApiClientDescriptor: {
+    id: string;
+    kind: "forge/api-client";
+    name: string;
+    priority: number;
+    description?: string | undefined;
+    tags?: string[] | undefined;
+    hardware?: string[] | undefined;
+    enabled?: boolean | undefined;
+    capabilityId?: string | undefined;
+    requiredContext?: string[] | undefined;
+    optionalContext?: string[] | undefined;
+    config?: unknown;
+    retention?: string | {
+        reason: string;
+        maxAgeDays?: number | undefined;
+        maxEntries?: number | undefined;
+        maxBytes?: number | undefined;
+        cascadeFrom?: string | undefined;
+        ageField?: string | undefined;
+        enforcedBy?: string | undefined;
+    } | undefined;
+};
+//# sourceMappingURL=forge.api-client.descriptor.d.ts.map

package/dist/forge.api-client.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"forge.api-client.descriptor.d.ts","sourceRoot":"","sources":["../src/forge.api-client.descriptor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAG5B,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;iBAIzC,CAAC;AAEH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF,wBAAgB,8BAA8B,CAC7C,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,wBAAwB,CAAC,EAAE,MAAM,CAAC,GAAG;IAAE,EAAE,EAAE,MAAM,CAAA;CAAE,GACvE,wBAAwB,CAE1B;AAED,eAAO,MAAM,wBAAwB;;;;;;;;;;;;;;;;;;;;;;CAKnC,CAAC"}

package/dist/forge.api-client.descriptor.js

@@ -0,0 +1,17 @@
+import * as z from 'zod/v4';
+import { RuntimeDescriptorSchema } from '@vibesdotdev/kernel/schemas/descriptor';
+export const ForgeApiClientDescriptorSchema = RuntimeDescriptorSchema.extend({
+    kind: z.literal('forge/api-client'),
+    name: z.string().default('Forge API Client'),
+    priority: z.number().int().default(100)
+});
+export function createForgeApiClientDescriptor(options) {
+    return ForgeApiClientDescriptorSchema.parse({ ...options, kind: 'forge/api-client' });
+}
+export const forgeApiClientDescriptor = createForgeApiClientDescriptor({
+    id: 'forge-api-client',
+    name: 'Forge API Client',
+    description: 'Authenticated, environment-resolved transport for Forge collaboration capabilities.',
+    priority: 100
+});
+//# sourceMappingURL=forge.api-client.descriptor.js.map

package/dist/forge.api-client.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"forge.api-client.descriptor.js","sourceRoot":"","sources":["../src/forge.api-client.descriptor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AAEjF,MAAM,CAAC,MAAM,8BAA8B,GAAG,uBAAuB,CAAC,MAAM,CAAC;IAC5E,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC;IACnC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,kBAAkB,CAAC;IAC5C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;CACvC,CAAC,CAAC;AAIH,MAAM,UAAU,8BAA8B,CAC7C,OAAyE;IAEzE,OAAO,8BAA8B,CAAC,KAAK,CAAC,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,CAAC;AACvF,CAAC;AAED,MAAM,CAAC,MAAM,wBAAwB,GAAG,8BAA8B,CAAC;IACtE,EAAE,EAAE,kBAAkB;IACtB,IAAI,EAAE,kBAAkB;IACxB,WAAW,EAAE,qFAAqF;IAClG,QAAQ,EAAE,GAAG;CACb,CAAC,CAAC"}

package/dist/forge.api-client.js

@@ -0,0 +1,11 @@
+import { ForgeApiClientDescriptorSchema } from "./forge.api-client.descriptor.js";
+export const forgeApiClientKind = {
+    id: 'forge/api-client',
+    descriptorSchema: ForgeApiClientDescriptorSchema,
+    contexts: []
+};
+/** The `forge/api-client` implementation the runtime selects. */
+export async function resolveForgeApiClient(runtime) {
+    return runtime.query('forge/api-client').withId('forge-api-client').resolve();
+}
+//# sourceMappingURL=forge.api-client.js.map

package/dist/forge.api-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"forge.api-client.js","sourceRoot":"","sources":["../src/forge.api-client.ts"],"names":[],"mappings":"AAGA,OAAO,EACN,8BAA8B,EAE9B,MAAM,kCAAkC,CAAC;AAS1C,MAAM,CAAC,MAAM,kBAAkB,GAI3B;IACH,EAAE,EAAE,kBAAkB;IACtB,gBAAgB,EAAE,8BAA8B;IAChD,QAAQ,EAAE,EAAE;CACZ,CAAC;AAEF,iEAAiE;AACjE,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,OAAkC;IAC7E,OAAO,OAAO,CAAC,KAAK,CAAoD,kBAAkB,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,OAAO,EAAE,CAAC;AAClI,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,15 @@
+export * from "./forge.api-client.descriptor.ts";
+export * from "./forge.api-client.ts";
+export * from "./pull-request/index.ts";
+export * from "./auth.ts";
+export * from "./request.ts";
+export * from "./ci/index.ts";
+export * from "./ci-stuck-checks.ts";
+export * from "./schemas.ts";
+export * from "./evidence-client.ts";
+export * from "./pr-idempotency.ts";
+export * from "./extraction/index.ts";
+export * from "./tracking/index.ts";
+export * from "./storage/index.ts";
+export { ForgeClient } from './client.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,kCAAkC,CAAC;AACjD,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC;AACxC,cAAc,WAAW,CAAC;AAC1B,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC;AAC9B,cAAc,sBAAsB,CAAC;AACrC,cAAc,cAAc,CAAC;AAC7B,cAAc,sBAAsB,CAAC;AACrC,cAAc,qBAAqB,CAAC;AACpC,cAAc,uBAAuB,CAAC;AACtC,cAAc,qBAAqB,CAAC;AACpC,cAAc,oBAAoB,CAAC;AACnC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC"}

package/dist/index.js

@@ -0,0 +1,15 @@
+export * from "./forge.api-client.descriptor.js";
+export * from "./forge.api-client.js";
+export * from "./pull-request/index.js";
+export * from "./auth.js";
+export * from "./request.js";
+export * from "./ci/index.js";
+export * from "./ci-stuck-checks.js";
+export * from "./schemas.js";
+export * from "./evidence-client.js";
+export * from "./pr-idempotency.js";
+export * from "./extraction/index.js";
+export * from "./tracking/index.js";
+export * from "./storage/index.js";
+export { ForgeClient } from "./client.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,kCAAkC,CAAC;AACjD,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC;AACxC,cAAc,WAAW,CAAC;AAC1B,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC;AAC9B,cAAc,sBAAsB,CAAC;AACrC,cAAc,cAAc,CAAC;AAC7B,cAAc,sBAAsB,CAAC;AACrC,cAAc,qBAAqB,CAAC;AACpC,cAAc,uBAAuB,CAAC;AACtC,cAAc,qBAAqB,CAAC;AACpC,cAAc,oBAAoB,CAAC;AACnC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC"}

package/dist/jobs/stack-operation-host.context.d.ts

@@ -0,0 +1,36 @@
+import type { ForgeStackOperationRecoveryJobOutput } from './stack-operation-recovery.job.descriptor.ts';
+export declare const FORGE_STACK_OPERATION_HOST_CONTEXT_ID = "forge/stack-operation-host";
+/** App-owned persistence/execution capability consumed by Forge stack recovery policy. */
+export interface ForgeStackOperationHost {
+    processQueued(limit: number): Promise<ForgeStackOperationRecoveryJobOutput>;
+}
+declare const _default: {
+    id: string;
+    kind: "context";
+    name?: string | undefined;
+    description?: string | undefined;
+    tags?: string[] | undefined;
+    hardware?: string[] | undefined;
+    enabled?: boolean | undefined;
+    priority?: number | undefined;
+    capabilityId?: string | undefined;
+    requiredContext?: string[] | undefined;
+    optionalContext?: string[] | undefined;
+    retention?: string | {
+        reason: string;
+        maxAgeDays?: number | undefined;
+        maxEntries?: number | undefined;
+        maxBytes?: number | undefined;
+        cascadeFrom?: string | undefined;
+        ageField?: string | undefined;
+        enforcedBy?: string | undefined;
+    } | undefined;
+    valueKind?: "data" | "service" | undefined;
+    valueSchema?: unknown;
+    config?: {
+        sources: ("literal" | "workspace" | "floor")[];
+        subset?: true | undefined;
+    } | undefined;
+};
+export default _default;
+//# sourceMappingURL=stack-operation-host.context.d.ts.map

package/dist/jobs/stack-operation-host.context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stack-operation-host.context.d.ts","sourceRoot":"","sources":["../../src/jobs/stack-operation-host.context.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,oCAAoC,EAAE,MAAM,8CAA8C,CAAC;AAEzG,eAAO,MAAM,qCAAqC,+BAA+B,CAAC;AAElF,0FAA0F;AAC1F,MAAM,WAAW,uBAAuB;IACvC,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,oCAAoC,CAAC,CAAC;CAC5E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAED,wBAIG"}

package/dist/jobs/stack-operation-host.context.js

@@ -0,0 +1,8 @@
+import { createContextDescriptor } from '@vibesdotdev/kernel/factory/context';
+export const FORGE_STACK_OPERATION_HOST_CONTEXT_ID = 'forge/stack-operation-host';
+export default createContextDescriptor({
+    id: FORGE_STACK_OPERATION_HOST_CONTEXT_ID,
+    description: 'Owner-app persistence and connector adapter for Forge stack operation recovery.',
+    hardware: ['cloud']
+});
+//# sourceMappingURL=stack-operation-host.context.js.map

package/dist/jobs/stack-operation-host.context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stack-operation-host.context.js","sourceRoot":"","sources":["../../src/jobs/stack-operation-host.context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,qCAAqC,CAAC;AAG9E,MAAM,CAAC,MAAM,qCAAqC,GAAG,4BAA4B,CAAC;AAOlF,eAAe,uBAAuB,CAAC;IACtC,EAAE,EAAE,qCAAqC;IACzC,WAAW,EAAE,iFAAiF;IAC9F,QAAQ,EAAE,CAAC,OAAO,CAAC;CACnB,CAAC,CAAC"}

package/dist/jobs/stack-operation-recovery.d.ts

@@ -0,0 +1,5 @@
+export { default } from './stack-operation-recovery.job.descriptor.ts';
+export * from './stack-operation-recovery.job.descriptor.ts';
+export { FORGE_STACK_OPERATION_HOST_CONTEXT_ID, type ForgeStackOperationHost } from './stack-operation-host.context.ts';
+export { runForgeStackOperationRecoveryWith } from './stack-operation-recovery.job.impl.ts';
+//# sourceMappingURL=stack-operation-recovery.d.ts.map

package/dist/jobs/stack-operation-recovery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stack-operation-recovery.d.ts","sourceRoot":"","sources":["../../src/jobs/stack-operation-recovery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,8CAA8C,CAAC;AACvE,cAAc,8CAA8C,CAAC;AAC7D,OAAO,EACN,qCAAqC,EACrC,KAAK,uBAAuB,EAC5B,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,kCAAkC,EAAE,MAAM,wCAAwC,CAAC"}

package/dist/jobs/stack-operation-recovery.job.descriptor.d.ts

@@ -0,0 +1,18 @@
+import type { JobDescriptor } from '@vibesdotdev/kernel/kinds';
+import * as z from 'zod/v4';
+export declare const FORGE_STACK_OPERATION_RECOVERY_JOB_ID = "forge.pr-stacks.process-operations";
+export declare const FORGE_STACK_OPERATION_RECOVERY_CRON = "* * * * *";
+export declare const ForgeStackOperationRecoveryJobInputSchema: z.ZodObject<{
+    scheduledTime: z.ZodISODateTime;
+}, z.core.$strip>;
+export declare const ForgeStackOperationRecoveryJobOutputSchema: z.ZodObject<{
+    processed: z.ZodNumber;
+    succeeded: z.ZodNumber;
+    requeued: z.ZodNumber;
+    failed: z.ZodNumber;
+}, z.core.$strip>;
+export type ForgeStackOperationRecoveryJobInput = z.infer<typeof ForgeStackOperationRecoveryJobInputSchema>;
+export type ForgeStackOperationRecoveryJobOutput = z.infer<typeof ForgeStackOperationRecoveryJobOutputSchema>;
+declare const _default: JobDescriptor;
+export default _default;
+//# sourceMappingURL=stack-operation-recovery.job.descriptor.d.ts.map

package/dist/jobs/stack-operation-recovery.job.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stack-operation-recovery.job.descriptor.d.ts","sourceRoot":"","sources":["../../src/jobs/stack-operation-recovery.job.descriptor.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,eAAO,MAAM,qCAAqC,uCAAuC,CAAC;AAC1F,eAAO,MAAM,mCAAmC,cAAc,CAAC;AAE/D,eAAO,MAAM,yCAAyC;;iBAEpD,CAAC;AAEH,eAAO,MAAM,0CAA0C;;;;;iBAKrD,CAAC;AAEH,MAAM,MAAM,mCAAmC,GAAG,CAAC,CAAC,KAAK,CACxD,OAAO,yCAAyC,CAChD,CAAC;AACF,MAAM,MAAM,oCAAoC,GAAG,CAAC,CAAC,KAAK,CACzD,OAAO,0CAA0C,CACjD,CAAC;;AAEF,wBAqBG"}

package/dist/jobs/stack-operation-recovery.job.descriptor.js

@@ -0,0 +1,35 @@
+import { createRuntimeAsset } from '@vibesdotdev/kernel';
+import * as z from 'zod/v4';
+export const FORGE_STACK_OPERATION_RECOVERY_JOB_ID = 'forge.pr-stacks.process-operations';
+export const FORGE_STACK_OPERATION_RECOVERY_CRON = '* * * * *';
+export const ForgeStackOperationRecoveryJobInputSchema = z.object({
+    scheduledTime: z.iso.datetime()
+});
+export const ForgeStackOperationRecoveryJobOutputSchema = z.object({
+    processed: z.number().int().nonnegative(),
+    succeeded: z.number().int().nonnegative(),
+    requeued: z.number().int().nonnegative(),
+    failed: z.number().int().nonnegative()
+});
+export default createRuntimeAsset({
+    kind: 'workers/job',
+    id: FORGE_STACK_OPERATION_RECOVERY_JOB_ID,
+    name: 'Process Forge pull-request stack operations',
+    description: 'Resumes queued or safely stale stacked-PR restack and ordered-merge operations from durable platform state.',
+    queue: 'forge-control-plane',
+    type: 'scheduled',
+    schedule: FORGE_STACK_OPERATION_RECOVERY_CRON,
+    dispatch: 'inline',
+    isolation: 'inline',
+    retries: { maxAttempts: 1, backoff: 'fixed', delay: 0 },
+    // Host ceiling is 9m and connector ceiling is 10m; leave projection/requeue headroom.
+    timeout: 11 * 60_000,
+    schemas: {
+        input: ForgeStackOperationRecoveryJobInputSchema,
+        output: ForgeStackOperationRecoveryJobOutputSchema
+    },
+    hardware: ['cloud'],
+    tags: ['forge', 'pull-requests', 'stacks', 'recovery'],
+    enabled: true
+});
+//# sourceMappingURL=stack-operation-recovery.job.descriptor.js.map

package/dist/jobs/stack-operation-recovery.job.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stack-operation-recovery.job.descriptor.js","sourceRoot":"","sources":["../../src/jobs/stack-operation-recovery.job.descriptor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEzD,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,MAAM,CAAC,MAAM,qCAAqC,GAAG,oCAAoC,CAAC;AAC1F,MAAM,CAAC,MAAM,mCAAmC,GAAG,WAAW,CAAC;AAE/D,MAAM,CAAC,MAAM,yCAAyC,GAAG,CAAC,CAAC,MAAM,CAAC;IACjE,aAAa,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE;CAC/B,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC,CAAC,MAAM,CAAC;IAClE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACzC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACzC,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACxC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;CACtC,CAAC,CAAC;AASH,eAAe,kBAAkB,CAAgB;IAChD,IAAI,EAAE,aAAa;IACnB,EAAE,EAAE,qCAAqC;IACzC,IAAI,EAAE,6CAA6C;IACnD,WAAW,EACV,6GAA6G;IAC9G,KAAK,EAAE,qBAAqB;IAC5B,IAAI,EAAE,WAAW;IACjB,QAAQ,EAAE,mCAAmC;IAC7C,QAAQ,EAAE,QAAQ;IAClB,SAAS,EAAE,QAAQ;IACnB,OAAO,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE;IACvD,sFAAsF;IACtF,OAAO,EAAE,EAAE,GAAG,MAAM;IACpB,OAAO,EAAE;QACR,KAAK,EAAE,yCAAyC;QAChD,MAAM,EAAE,0CAA0C;KAClD;IACD,QAAQ,EAAE,CAAC,OAAO,CAAC;IACnB,IAAI,EAAE,CAAC,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,UAAU,CAAC;IACtD,OAAO,EAAE,IAAI;CACb,CAAC,CAAC"}

package/dist/jobs/stack-operation-recovery.job.impl.d.ts

@@ -0,0 +1,8 @@
+import type { JobExecutionContext } from '@vibesdotdev/kernel/kinds';
+import { type ForgeStackOperationRecoveryJobInput, type ForgeStackOperationRecoveryJobOutput } from './stack-operation-recovery.job.descriptor.ts';
+import type { ForgeStackOperationHost } from './stack-operation-host.context.ts';
+export declare function runForgeStackOperationRecoveryWith(raw: ForgeStackOperationRecoveryJobInput, host: ForgeStackOperationHost): Promise<ForgeStackOperationRecoveryJobOutput>;
+export declare function createForgeStackOperationRecoveryJobImplementation(host: ForgeStackOperationHost): {
+    handle(context: JobExecutionContext<ForgeStackOperationRecoveryJobInput>): Promise<ForgeStackOperationRecoveryJobOutput>;
+};
+//# sourceMappingURL=stack-operation-recovery.job.impl.d.ts.map

package/dist/jobs/stack-operation-recovery.job.impl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stack-operation-recovery.job.impl.d.ts","sourceRoot":"","sources":["../../src/jobs/stack-operation-recovery.job.impl.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,EAEN,KAAK,mCAAmC,EACxC,KAAK,oCAAoC,EACzC,MAAM,8CAA8C,CAAC;AACtD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,mCAAmC,CAAC;AAEjF,wBAAsB,kCAAkC,CACvD,GAAG,EAAE,mCAAmC,EACxC,IAAI,EAAE,uBAAuB,GAC3B,OAAO,CAAC,oCAAoC,CAAC,CAI/C;AAED,wBAAgB,kDAAkD,CAAC,IAAI,EAAE,uBAAuB;oBAGpF,mBAAmB,CAAC,mCAAmC,CAAC,GAC/D,OAAO,CAAC,oCAAoC,CAAC;EAIjD"}

package/dist/jobs/stack-operation-recovery.job.impl.js

@@ -0,0 +1,14 @@
+import { ForgeStackOperationRecoveryJobInputSchema } from "./stack-operation-recovery.job.descriptor.js";
+export async function runForgeStackOperationRecoveryWith(raw, host) {
+    ForgeStackOperationRecoveryJobInputSchema.parse(raw);
+    // One repository-scale Git operation can consume the full host deadline.
+    return host.processQueued(1);
+}
+export function createForgeStackOperationRecoveryJobImplementation(host) {
+    return {
+        async handle(context) {
+            return runForgeStackOperationRecoveryWith(context.data, host);
+        }
+    };
+}
+//# sourceMappingURL=stack-operation-recovery.job.impl.js.map

package/dist/jobs/stack-operation-recovery.job.impl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stack-operation-recovery.job.impl.js","sourceRoot":"","sources":["../../src/jobs/stack-operation-recovery.job.impl.ts"],"names":[],"mappings":"AACA,OAAO,EACN,yCAAyC,EAGzC,MAAM,8CAA8C,CAAC;AAGtD,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACvD,GAAwC,EACxC,IAA6B;IAE7B,yCAAyC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACrD,yEAAyE;IACzE,OAAO,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,kDAAkD,CAAC,IAA6B;IAC/F,OAAO;QACN,KAAK,CAAC,MAAM,CACX,OAAiE;YAEjE,OAAO,kCAAkC,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAC/D,CAAC;KACD,CAAC;AACH,CAAC"}

package/dist/jobs/stack-operation-recovery.js

@@ -0,0 +1,5 @@
+export { default } from "./stack-operation-recovery.job.descriptor.js";
+export * from "./stack-operation-recovery.job.descriptor.js";
+export { FORGE_STACK_OPERATION_HOST_CONTEXT_ID } from "./stack-operation-host.context.js";
+export { runForgeStackOperationRecoveryWith } from "./stack-operation-recovery.job.impl.js";
+//# sourceMappingURL=stack-operation-recovery.js.map

package/dist/jobs/stack-operation-recovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stack-operation-recovery.js","sourceRoot":"","sources":["../../src/jobs/stack-operation-recovery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,8CAA8C,CAAC;AACvE,cAAc,8CAA8C,CAAC;AAC7D,OAAO,EACN,qCAAqC,EAErC,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,kCAAkC,EAAE,MAAM,wCAAwC,CAAC"}

package/dist/migration/ssh-contract.d.ts

@@ -0,0 +1,54 @@
+import * as z from 'zod/v4';
+/**
+ * One source-owned assertion. Platform re-resolves the repository row and
+ * canonical SSH host identity; neither field grants authority by itself.
+ */
+export declare const ForgeRepositoryMigrationSshLeaseRequestSchema: z.ZodObject<{
+    migrationId: z.ZodString;
+    repositoryId: z.ZodString;
+    hostIdentity: z.ZodString;
+}, z.core.$strict>;
+export type ForgeRepositoryMigrationSshLeaseRequest = z.infer<typeof ForgeRepositoryMigrationSshLeaseRequestSchema>;
+export declare const ForgeRepositoryMigrationSshKnownHostSchema: z.ZodObject<{
+    hostname: z.ZodLiteral<"git.vibes.dev">;
+    port: z.ZodLiteral<22>;
+    keyType: z.ZodLiteral<"ssh-ed25519">;
+    publicKeyOpenSsh: z.ZodString;
+    fingerprint: z.ZodString;
+}, z.core.$strict>;
+/**
+ * Private key material is returned once and must live only in executor memory
+ * or tmpfs. Three pack uses are exact: preflight refs, mirror clone, stable
+ * second refs pass. Completion revokes their shared transient gitd JTI.
+ */
+export declare const ForgeRepositoryMigrationSshLeaseSchema: z.ZodObject<{
+    kind: z.ZodLiteral<"ssh-key-lease">;
+    purpose: z.ZodLiteral<"repository-migration">;
+    sshLeaseId: z.ZodString;
+    migrationId: z.ZodString;
+    repositoryId: z.ZodString;
+    hostIdentity: z.ZodString;
+    cloneUrl: z.ZodString;
+    privateKeyOpenSsh: z.ZodString;
+    publicKeyOpenSsh: z.ZodString;
+    fingerprint: z.ZodString;
+    scope: z.ZodLiteral<"repo:read">;
+    maxPackUses: z.ZodLiteral<3>;
+    expiresAt: z.ZodISODateTime;
+    knownHost: z.ZodObject<{
+        hostname: z.ZodLiteral<"git.vibes.dev">;
+        port: z.ZodLiteral<22>;
+        keyType: z.ZodLiteral<"ssh-ed25519">;
+        publicKeyOpenSsh: z.ZodString;
+        fingerprint: z.ZodString;
+    }, z.core.$strict>;
+}, z.core.$strict>;
+export type ForgeRepositoryMigrationSshLease = z.infer<typeof ForgeRepositoryMigrationSshLeaseSchema>;
+export declare const ForgeRepositoryMigrationSshLeaseCompletionSchema: z.ZodObject<{
+    outcome: z.ZodEnum<{
+        failed: "failed";
+        succeeded: "succeeded";
+    }>;
+}, z.core.$strict>;
+export type ForgeRepositoryMigrationSshLeaseCompletion = z.infer<typeof ForgeRepositoryMigrationSshLeaseCompletionSchema>;
+//# sourceMappingURL=ssh-contract.d.ts.map

package/dist/migration/ssh-contract.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssh-contract.d.ts","sourceRoot":"","sources":["../../src/migration/ssh-contract.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AA2B5B;;;GAGG;AACH,eAAO,MAAM,6CAA6C;;;;kBAMhD,CAAC;AACX,MAAM,MAAM,uCAAuC,GAAG,CAAC,CAAC,KAAK,CAC5D,OAAO,6CAA6C,CACpD,CAAC;AAEF,eAAO,MAAM,0CAA0C;;;;;;kBAQ7C,CAAC;AAEX;;;;GAIG;AACH,eAAO,MAAM,sCAAsC;;;;;;;;;;;;;;;;;;;;;kBAuBzC,CAAC;AACX,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CACrD,OAAO,sCAAsC,CAC7C,CAAC;AAEF,eAAO,MAAM,gDAAgD;;;;;kBAEnD,CAAC;AACX,MAAM,MAAM,0CAA0C,GAAG,CAAC,CAAC,KAAK,CAC/D,OAAO,gDAAgD,CACvD,CAAC"}

package/dist/migration/ssh-contract.js

@@ -0,0 +1,76 @@
+import * as z from 'zod/v4';
+const RepositoryIdSchema = z.string().uuid();
+const MigrationIdSchema = z
+    .string()
+    .min(1)
+    .max(63)
+    .regex(/^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/);
+const HostIdentitySchema = z
+    .string()
+    .min(3)
+    .max(512)
+    .regex(/^[~A-Za-z0-9][~A-Za-z0-9._-]*\/[A-Za-z0-9][A-Za-z0-9._-]*$/);
+const ForgeSshCloneUrlSchema = z
+    .string()
+    .url()
+    .regex(/^ssh:\/\/git@git\.vibes\.dev\/[~A-Za-z0-9][~A-Za-z0-9._-]*\/[A-Za-z0-9][A-Za-z0-9._-]*\.git$/);
+const SshPublicKeySchema = z
+    .string()
+    .min(1)
+    .max(1024)
+    .regex(/^ssh-ed25519 [A-Za-z0-9+/]+={0,2}$/);
+const SshFingerprintSchema = z
+    .string()
+    .max(128)
+    .regex(/^SHA256:[A-Za-z0-9+/]{43}$/);
+/**
+ * One source-owned assertion. Platform re-resolves the repository row and
+ * canonical SSH host identity; neither field grants authority by itself.
+ */
+export const ForgeRepositoryMigrationSshLeaseRequestSchema = z
+    .object({
+    migrationId: MigrationIdSchema,
+    repositoryId: RepositoryIdSchema,
+    hostIdentity: HostIdentitySchema
+})
+    .strict();
+export const ForgeRepositoryMigrationSshKnownHostSchema = z
+    .object({
+    hostname: z.literal('git.vibes.dev'),
+    port: z.literal(22),
+    keyType: z.literal('ssh-ed25519'),
+    publicKeyOpenSsh: SshPublicKeySchema,
+    fingerprint: SshFingerprintSchema
+})
+    .strict();
+/**
+ * Private key material is returned once and must live only in executor memory
+ * or tmpfs. Three pack uses are exact: preflight refs, mirror clone, stable
+ * second refs pass. Completion revokes their shared transient gitd JTI.
+ */
+export const ForgeRepositoryMigrationSshLeaseSchema = z
+    .object({
+    kind: z.literal('ssh-key-lease'),
+    purpose: z.literal('repository-migration'),
+    sshLeaseId: z.string().uuid(),
+    migrationId: MigrationIdSchema,
+    repositoryId: RepositoryIdSchema,
+    hostIdentity: HostIdentitySchema,
+    cloneUrl: ForgeSshCloneUrlSchema,
+    privateKeyOpenSsh: z
+        .string()
+        .min(1)
+        .max(32 * 1024)
+        .regex(/^-----BEGIN OPENSSH PRIVATE KEY-----\n[A-Za-z0-9+/=\n]+\n-----END OPENSSH PRIVATE KEY-----\n$/),
+    publicKeyOpenSsh: SshPublicKeySchema,
+    fingerprint: SshFingerprintSchema,
+    scope: z.literal('repo:read'),
+    maxPackUses: z.literal(3),
+    expiresAt: z.iso.datetime(),
+    knownHost: ForgeRepositoryMigrationSshKnownHostSchema
+})
+    .strict();
+export const ForgeRepositoryMigrationSshLeaseCompletionSchema = z
+    .object({ outcome: z.enum(['succeeded', 'failed']) })
+    .strict();
+//# sourceMappingURL=ssh-contract.js.map

package/dist/migration/ssh-contract.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ssh-contract.js","sourceRoot":"","sources":["../../src/migration/ssh-contract.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,MAAM,kBAAkB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;AAC7C,MAAM,iBAAiB,GAAG,CAAC;KACzB,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,EAAE,CAAC;KACP,KAAK,CAAC,mCAAmC,CAAC,CAAC;AAC7C,MAAM,kBAAkB,GAAG,CAAC;KAC1B,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,GAAG,CAAC;KACR,KAAK,CAAC,4DAA4D,CAAC,CAAC;AACtE,MAAM,sBAAsB,GAAG,CAAC;KAC9B,MAAM,EAAE;KACR,GAAG,EAAE;KACL,KAAK,CAAC,8FAA8F,CAAC,CAAC;AACxG,MAAM,kBAAkB,GAAG,CAAC;KAC1B,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,IAAI,CAAC;KACT,KAAK,CAAC,oCAAoC,CAAC,CAAC;AAC9C,MAAM,oBAAoB,GAAG,CAAC;KAC5B,MAAM,EAAE;KACR,GAAG,CAAC,GAAG,CAAC;KACR,KAAK,CAAC,4BAA4B,CAAC,CAAC;AAEtC;;;GAGG;AACH,MAAM,CAAC,MAAM,6CAA6C,GAAG,CAAC;KAC5D,MAAM,CAAC;IACP,WAAW,EAAE,iBAAiB;IAC9B,YAAY,EAAE,kBAAkB;IAChC,YAAY,EAAE,kBAAkB;CAChC,CAAC;KACD,MAAM,EAAE,CAAC;AAKX,MAAM,CAAC,MAAM,0CAA0C,GAAG,CAAC;KACzD,MAAM,CAAC;IACP,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC;IACpC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACnB,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;IACjC,gBAAgB,EAAE,kBAAkB;IACpC,WAAW,EAAE,oBAAoB;CACjC,CAAC;KACD,MAAM,EAAE,CAAC;AAEX;;;;GAIG;AACH,MAAM,CAAC,MAAM,sCAAsC,GAAG,CAAC;KACrD,MAAM,CAAC;IACP,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,eAAe,CAAC;IAChC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,sBAAsB,CAAC;IAC1C,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE;IAC7B,WAAW,EAAE,iBAAiB;IAC9B,YAAY,EAAE,kBAAkB;IAChC,YAAY,EAAE,kBAAkB;IAChC,QAAQ,EAAE,sBAAsB;IAChC,iBAAiB,EAAE,CAAC;SAClB,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,EAAE,GAAG,IAAI,CAAC;SACd,KAAK,CACL,+FAA+F,CAC/F;IACF,gBAAgB,EAAE,kBAAkB;IACpC,WAAW,EAAE,oBAAoB;IACjC,KAAK,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;IAC7B,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACzB,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE;IAC3B,SAAS,EAAE,0CAA0C;CACrD,CAAC;KACD,MAAM,EAAE,CAAC;AAKX,MAAM,CAAC,MAAM,gDAAgD,GAAG,CAAC;KAC/D,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC,EAAE,CAAC;KACpD,MAAM,EAAE,CAAC"}

package/dist/plugin.d.ts

@@ -0,0 +1,3 @@
+declare const forgePlugin: import("@vibesdotdev/kernel").RuntimePlugin;
+export default forgePlugin;
+//# sourceMappingURL=plugin.d.ts.map

package/dist/plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../src/plugin.ts"],"names":[],"mappings":"AAsBA,QAAA,MAAM,WAAW,6CAyDf,CAAC;AAEH,eAAe,WAAW,CAAC"}