@vibesdotdev/forge 0.0.0-stage → 1.0.0-rc.5

package/dist/schemas/match.js

@@ -0,0 +1,263 @@
+/**
+ * Trigger-matching + ref-guard for forge-actions.
+ *
+ * Given a validated `.forge/actions.yml` (`Actions`) and a forge event, decide
+ * which jobs run. Pure functions over plain data — no worker / session / DB — so
+ * the platform ingest route can call them synchronously and they're unit-testable
+ * in isolation.
+ *
+ * Two event flavors:
+ *   - `push` → matched per changed ref; a job with `on: push` runs once for a ref
+ *     whose name passes the job's `if` guard. The engine de-dupes to the lead ref
+ *     so a multi-ref push fires each push job at most once (against the lead ref).
+ *   - `pr`   → a job with `on: pr` runs against the PR head ref; its result is the
+ *     gating status-check.
+ */
+import { DEFAULT_FORGE_ACTIONS_RUNNER_PROFILE, isScheduleTrigger } from "./actions.js";
+import { planDag } from '@vibesdotdev/shared/schemas';
+/** Does this trigger list include the simple `push` trigger? */
+export function hasPushTrigger(on) {
+    return on.some((t) => t === 'push');
+}
+/** Does this trigger list include the simple `pr` trigger? */
+export function hasPrTrigger(on) {
+    return on.some((t) => t === 'pr');
+}
+/** Every cron expression declared on this trigger list (for the schedule layer). */
+export function scheduleCrons(on) {
+    return on.filter(isScheduleTrigger).map((t) => t.schedule);
+}
+export function evaluateRefGuard(guard, refName) {
+    if (guard === undefined)
+        return { passes: true };
+    const trimmed = guard.trim();
+    const m = trimmed.match(/^ref\s*==\s*(['"])(.*)\1$/);
+    if (!m)
+        return { passes: false, unsupported: guard };
+    return { passes: m[2] === refName };
+}
+/** The zero-sentinel sha (ref delete) — a deleted ref triggers no job. */
+const ZERO_SHA = '0'.repeat(40);
+/**
+ * Pick the lead ref of a push: the first branch head (`refs/heads/*`) that was
+ * created or updated (non-delete). Falls back to the first non-delete ref of any
+ * kind, else undefined (a delete-only push runs nothing). This is the ref push
+ * jobs run against — one CI run per push, not per ref, matching the design's
+ * "skip merge-commit / non-head refs" intent (a branch head is the natural CI
+ * target; a bare tag push or a delete doesn't start a pipeline).
+ */
+export function leadPushedRef(refs) {
+    const live = refs.filter((r) => r.newSha !== ZERO_SHA);
+    return live.find((r) => r.name.startsWith('refs/heads/')) ?? live[0];
+}
+/**
+ * Does at least one changed file match at least one glob pattern?
+ *
+ * Canonical matcher for a job's `paths` filter, exported so the platform ingest
+ * route can apply the same semantics it sees here. Patterns are
+ * repository-root-relative and anchored at the root (a leading `./` is
+ * accepted and ignored):
+ *
+ *   - `*` matches within one path segment (never `/`);
+ *   - `**` matches across segments; a globstar immediately followed by `/`
+ *     also matches zero segments, so root-level and nested files both match;
+ *   - `?` matches exactly one character (never `/`);
+ *   - a trailing `/` is a directory prefix (`dir/` == `dir/**`);
+ *   - every other character is a literal, so a literal path matches exactly.
+ *
+ * An empty pattern list returns false — absent-vs-empty is the caller's call
+ * (`matchPushJobs` / `matchPrJobs` treat an absent or empty filter as "no
+ * filter"). An empty changed-file list also returns false: no file matched.
+ */
+export function jobPathsMatch(patterns, changedFiles) {
+    if (patterns.length === 0)
+        return false;
+    const matchers = patterns.map(globToRegExp);
+    return changedFiles.some((file) => {
+        const path = file.startsWith('./') ? file.slice(2) : file;
+        return matchers.some((matcher) => matcher.test(path));
+    });
+}
+/** Compile one anchored glob pattern into a regular expression. */
+function globToRegExp(pattern) {
+    let source = pattern.startsWith('./') ? pattern.slice(2) : pattern;
+    // `dir/` is a directory prefix: `dir/` == `dir/**`.
+    if (source.endsWith('/'))
+        source += '**';
+    let regex = '^';
+    for (let i = 0; i < source.length; i++) {
+        const ch = source[i];
+        if (ch === '*') {
+            if (source[i + 1] === '*') {
+                i += 1;
+                if (source[i + 1] === '/') {
+                    // A `**/` globstar spans zero or more whole segments, so
+                    // `**/*.test.ts` also matches a root-level `x.test.ts`.
+                    i += 1;
+                    regex += '(?:[^/]+/)*';
+                }
+                else {
+                    // A trailing (or adjacent) globstar spans anything, `/` included.
+                    regex += '.*';
+                }
+            }
+            else {
+                regex += '[^/]*';
+            }
+            continue;
+        }
+        if (ch === '?') {
+            regex += '[^/]';
+            continue;
+        }
+        regex += /[\\^$+.()|[\]{}]/.test(ch) ? `\\${ch}` : ch;
+    }
+    return new RegExp(`${regex}$`);
+}
+/**
+ * Does a job's optional `paths` filter pass for this event?
+ *
+ * No filter (absent or empty) always passes. A filtered job fails open when
+ * the changed-file list is unavailable and fails closed for an explicit empty
+ * list — "we couldn't compute a diff" must not silently skip declared CI, while
+ * "the diff is empty" legitimately matches nothing.
+ */
+function pathFilterPasses(patterns, changedFiles) {
+    if (!patterns || patterns.length === 0)
+        return true;
+    if (changedFiles === undefined)
+        return true;
+    return jobPathsMatch(patterns, changedFiles);
+}
+/**
+ * Match `on: push` jobs for a `repo.pushed` event. Runs each push job at most
+ * once, against the push's lead ref, when the job's `if` guard passes for that
+ * ref and its optional `paths` filter passes for the push's changed files. A
+ * delete-only push (no live ref) matches nothing.
+ */
+export function matchPushJobs(actions, refs, options) {
+    const lead = leadPushedRef(refs);
+    if (!lead)
+        return [];
+    const out = [];
+    for (const [id, job] of Object.entries(actions.jobs ?? {})) {
+        if (!hasPushTrigger(job.on))
+            continue;
+        if (!evaluateRefGuard(job.if, lead.name).passes)
+            continue;
+        if (!pathFilterPasses(job.paths, options?.changedFiles))
+            continue;
+        out.push({ id, job, ref: lead.name, sha: lead.newSha, trigger: 'push' });
+    }
+    return out;
+}
+/**
+ * Match `on: pr` jobs for a PR event. The job runs against the PR head ref/sha;
+ * the `if` guard (when present) is evaluated against the PR head ref name, and
+ * the optional `paths` filter against the PR's changed files (when known).
+ * These are the jobs whose results become the gating status-checks.
+ */
+export function matchPrJobs(actions, pr) {
+    const out = [];
+    for (const [id, job] of Object.entries(actions.jobs ?? {})) {
+        if (!hasPrTrigger(job.on))
+            continue;
+        if (!evaluateRefGuard(job.if, pr.headRef).passes)
+            continue;
+        if (!pathFilterPasses(job.paths, pr.changedFiles))
+            continue;
+        out.push({ id, job, ref: pr.headRef, sha: pr.headSha, trigger: 'pr' });
+    }
+    return out;
+}
+/**
+ * Executors in the caller's list that can serve a whole selection at once.
+ *
+ * Checking each axis against the union of the list would accept a combination
+ * no single executor can run. An empty list matches nothing.
+ */
+export function forgeCiExecutorsFor(selection, executors) {
+    return executors.filter((executor) => executor.profiles.includes(selection.profile) &&
+        executor.os.includes(selection.os) &&
+        (selection.arch === undefined || executor.arch.includes(selection.arch)));
+}
+/**
+ * The executor id that will run a selection, taken from the caller's list.
+ *
+ * The control plane plans an attempt's `executorId` and the worker claims under
+ * the executor it resolves. Those two must be the same string: the state
+ * machine refuses a claim whose executor differs from the plan, and the
+ * host-action broker refuses a request whose executor differs from the lease.
+ *
+ * A hardcoded id planned every attempt as one vendor regardless of profile, so
+ * a fleet job's claim was refused and the attempt sat `queued`. This function
+ * does not supply that id. The caller passes the executors it has.
+ *
+ * Returns undefined when nothing in that list serves the selection, including
+ * when the list is empty. `runnerAvailability` turns that into an author-facing
+ * refusal.
+ */
+export function forgeCiExecutorIdFor(selection, executors) {
+    return forgeCiExecutorsFor(selection, executors)[0]?.id;
+}
+/**
+ * Decide whether any executor in the caller's list can serve a job's runner
+ * selection. A missing `runsOn` is treated as `linux`, a missing `arch` as
+ * "no arch constraint", and a missing profile as `standard` (the job schema
+ * defaults).
+ *
+ * The list is required. An empty list is unavailable and names no executor.
+ * An unavailable selection launches no process and becomes a terminal error
+ * in the canonical attempt ledger.
+ */
+export function runnerAvailability(job, executors) {
+    const requestedOs = job.runsOn ?? 'linux';
+    const requestedArch = job.arch;
+    const requestedProfile = job.runnerProfile ?? DEFAULT_FORGE_ACTIONS_RUNNER_PROFILE;
+    // One executor must satisfy the WHOLE selection. Checking each axis against
+    // the union of all executors would accept a combination none can run.
+    if (forgeCiExecutorsFor({ os: requestedOs, arch: requestedArch, profile: requestedProfile }, executors).length > 0) {
+        return { available: true, requestedOs, requestedArch, requestedProfile };
+    }
+    const selection = `profile '${requestedProfile}' on os '${requestedOs}'` +
+        (requestedArch ? ` arch '${requestedArch}'` : '');
+    const offered = executors
+        .map((executor) => `${executor.id} (${executor.description}): profiles ${executor.profiles.join('|')}, ` +
+        `os ${executor.os.join('|')}, arch ${executor.arch.join('|')}`)
+        .join('; ');
+    return {
+        available: false,
+        requestedOs,
+        requestedArch,
+        requestedProfile,
+        reason: `no Forge CI executor can serve ${selection}. Available — ${offered}. ` +
+            `No executor can run this declared check`
+    };
+}
+export function orderJobs(matched) {
+    const byId = new Map();
+    for (const job of matched) {
+        if (!byId.has(job.id))
+            byId.set(job.id, job);
+    }
+    const unique = [...byId.values()];
+    const dependsOnById = new Map(unique.map((m) => [m.id, (m.job.needs ?? []).filter((dep) => byId.has(dep))]));
+    const plan = planDag({
+        nodes: unique.map((m) => ({
+            id: m.id,
+            dependsOn: dependsOnById.get(m.id) ?? []
+        }))
+    });
+    const cyclic = new Set();
+    for (const cohort of plan.cohorts) {
+        const isSelfLoop = cohort.length === 1 && (dependsOnById.get(cohort[0]) ?? []).includes(cohort[0]);
+        const dependsOnCyclic = cohort.some((id) => (dependsOnById.get(id) ?? []).some((dep) => cyclic.has(dep)));
+        if (cohort.length > 1 || isSelfLoop || dependsOnCyclic) {
+            for (const id of cohort)
+                cyclic.add(id);
+        }
+    }
+    const ordered = plan.order.filter((id) => !cyclic.has(id)).map((id) => byId.get(id));
+    return { ordered, cyclic: [...cyclic] };
+}
+//# sourceMappingURL=match.js.map

package/dist/schemas/match.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"match.js","sourceRoot":"","sources":["../../src/schemas/match.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAWH,OAAO,EACN,oCAAoC,EACpC,iBAAiB,EACjB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,OAAO,EAAE,MAAM,6BAA6B,CAAC;AAEtD,gEAAgE;AAChE,MAAM,UAAU,cAAc,CAAC,EAAa;IAC3C,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC;AACrC,CAAC;AACD,8DAA8D;AAC9D,MAAM,UAAU,YAAY,CAAC,EAAa;IACzC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;AACnC,CAAC;AACD,oFAAoF;AACpF,MAAM,UAAU,aAAa,CAAC,EAAa;IAC1C,OAAO,EAAE,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;AAC5D,CAAC;AAiBD,MAAM,UAAU,gBAAgB,CAC/B,KAAyB,EACzB,OAAe;IAEf,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACjD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC;IACrD,IAAI,CAAC,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;IACrD,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,OAAO,EAAE,CAAC;AACrC,CAAC;AAED,0EAA0E;AAC1E,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAqBhC;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,IAAsB;IACnD,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC;IACvD,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;AACtE,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,aAAa,CAC5B,QAA2B,EAC3B,YAA+B;IAE/B,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;IAC5C,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;QACjC,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC1D,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;AACJ,CAAC;AAED,mEAAmE;AACnE,SAAS,YAAY,CAAC,OAAe;IACpC,IAAI,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IACnE,oDAAoD;IACpD,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,IAAI,CAAC;IAEzC,IAAI,KAAK,GAAG,GAAG,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACrB,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAChB,IAAI,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBAC3B,CAAC,IAAI,CAAC,CAAC;gBACP,IAAI,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;oBAC3B,yDAAyD;oBACzD,wDAAwD;oBACxD,CAAC,IAAI,CAAC,CAAC;oBACP,KAAK,IAAI,aAAa,CAAC;gBACxB,CAAC;qBAAM,CAAC;oBACP,kEAAkE;oBAClE,KAAK,IAAI,IAAI,CAAC;gBACf,CAAC;YACF,CAAC;iBAAM,CAAC;gBACP,KAAK,IAAI,OAAO,CAAC;YAClB,CAAC;YACD,SAAS;QACV,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YAChB,KAAK,IAAI,MAAM,CAAC;YAChB,SAAS;QACV,CAAC;QACD,KAAK,IAAI,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACvD,CAAC;IACD,OAAO,IAAI,MAAM,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;AAChC,CAAC;AAaD;;;;;;;GAOG;AACH,SAAS,gBAAgB,CACxB,QAAuC,EACvC,YAA2C;IAE3C,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,IAAI,YAAY,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5C,OAAO,aAAa,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAC5B,OAAgB,EAChB,IAAsB,EACtB,OAA2B;IAE3B,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,CAAC,IAAI;QAAE,OAAO,EAAE,CAAC;IACrB,MAAM,GAAG,GAAiB,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC;QAC5D,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,SAAS;QACtC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM;YAAE,SAAS;QAC1D,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,YAAY,CAAC;YAAE,SAAS;QAClE,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAC1B,OAAgB,EAChB,EAA0E;IAE1E,MAAM,GAAG,GAAiB,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC;QAC5D,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,SAAS;QACpC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,MAAM;YAAE,SAAS;QAC3D,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC;YAAE,SAAS;QAC5D,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC;AAoBD;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAClC,SAIC,EACD,SAA+C;IAE/C,OAAO,SAAS,CAAC,MAAM,CACtB,CAAC,QAAQ,EAAE,EAAE,CACZ,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC;QAC7C,QAAQ,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAClC,CAAC,SAAS,CAAC,IAAI,KAAK,SAAS,IAAI,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CACzE,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,oBAAoB,CACnC,SAIC,EACD,SAA+C;IAE/C,OAAO,mBAAmB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AACzD,CAAC;AAuBD;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CACjC,GAAwD,EACxD,SAA+C;IAE/C,MAAM,WAAW,GAAa,GAAG,CAAC,MAAM,IAAI,OAAO,CAAC;IACpD,MAAM,aAAa,GAAG,GAAG,CAAC,IAAI,CAAC;IAC/B,MAAM,gBAAgB,GAAG,GAAG,CAAC,aAAa,IAAI,oCAAoC,CAAC;IAEnF,4EAA4E;IAC5E,sEAAsE;IACtE,IACC,mBAAmB,CAClB,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,gBAAgB,EAAE,EACnE,SAAS,CACT,CAAC,MAAM,GAAG,CAAC,EACX,CAAC;QACF,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,aAAa,EAAE,gBAAgB,EAAE,CAAC;IAC1E,CAAC;IAED,MAAM,SAAS,GACd,YAAY,gBAAgB,YAAY,WAAW,GAAG;QACtD,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,aAAa,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACnD,MAAM,OAAO,GAAG,SAAS;SACvB,GAAG,CACH,CAAC,QAAQ,EAAE,EAAE,CACZ,GAAG,QAAQ,CAAC,EAAE,KAAK,QAAQ,CAAC,WAAW,eAAe,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI;QACrF,MAAM,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAC/D;SACA,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,OAAO;QACN,SAAS,EAAE,KAAK;QAChB,WAAW;QACX,aAAa;QACb,gBAAgB;QAChB,MAAM,EACL,kCAAkC,SAAS,iBAAiB,OAAO,IAAI;YACvE,yCAAyC;KAC1C,CAAC;AACH,CAAC;AAcD,MAAM,UAAU,SAAS,CAAC,OAAqB;IAC9C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC3C,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC3B,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IAC9C,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IAClC,MAAM,aAAa,GAAG,IAAI,GAAG,CAC5B,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAC7E,CAAC;IACF,MAAM,IAAI,GAAG,OAAO,CAAC;QACpB,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACzB,EAAE,EAAE,CAAC,CAAC,EAAE;YACR,SAAS,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,EAAE;SACxC,CAAC,CAAC;KACH,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;QACnC,MAAM,UAAU,GACf,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAE,CAAC,CAAC;QACnF,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAC1C,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAC5D,CAAC;QACF,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,UAAU,IAAI,eAAe,EAAE,CAAC;YACxD,KAAK,MAAM,EAAE,IAAI,MAAM;gBAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACzC,CAAC;IACF,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAE,CAAC,CAAC;IACtF,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC;AACzC,CAAC"}

package/dist/schemas/package-root.d.ts

@@ -0,0 +1,24 @@
+/**
+ * The canonical safe repository-relative package root.
+ *
+ * Its own module because it is the shared leaf of a cycle-free pair:
+ * `./actions.ts` (the `.forge/actions.yml` DSL) and `../ci/publish-targets.ts`
+ * (the `ci/publish-target` kind) each need it, and `./actions.ts` already
+ * imports the publish-target module for `CiPublishTargetIdSchema`. Restating the
+ * rule in either direction is how a publish target came to accept
+ * `defaultPaths: ['--dry-run']` while an authored `paths:` refused it.
+ */
+import * as z from 'zod/v4';
+/**
+ * CANONICAL safe repository-relative package root — the one rule every path a CI
+ * step shells as an argument must satisfy: `.` or a relative path of safe
+ * segments. A leading `-` is refused because such a value reaches a CLI as an
+ * option (`--dry-run`), not as a path.
+ *
+ * This is the single owner: `DeployTargetSchema` composes it for a `deploy:`
+ * directory, `PublishPackageRootSchema` names it for an authored `publish:` path
+ * AND for a publish target descriptor's `defaultPaths`.
+ */
+export declare const SafePackageRootSchema: z.ZodString;
+export type SafePackageRoot = z.infer<typeof SafePackageRootSchema>;
+//# sourceMappingURL=package-root.d.ts.map

package/dist/schemas/package-root.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"package-root.d.ts","sourceRoot":"","sources":["../../src/schemas/package-root.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B;;;;;;;;;GASG;AACH,eAAO,MAAM,qBAAqB,aAoBhC,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC"}

package/dist/schemas/package-root.js

@@ -0,0 +1,40 @@
+/**
+ * The canonical safe repository-relative package root.
+ *
+ * Its own module because it is the shared leaf of a cycle-free pair:
+ * `./actions.ts` (the `.forge/actions.yml` DSL) and `../ci/publish-targets.ts`
+ * (the `ci/publish-target` kind) each need it, and `./actions.ts` already
+ * imports the publish-target module for `CiPublishTargetIdSchema`. Restating the
+ * rule in either direction is how a publish target came to accept
+ * `defaultPaths: ['--dry-run']` while an authored `paths:` refused it.
+ */
+import * as z from 'zod/v4';
+/**
+ * CANONICAL safe repository-relative package root — the one rule every path a CI
+ * step shells as an argument must satisfy: `.` or a relative path of safe
+ * segments. A leading `-` is refused because such a value reaches a CLI as an
+ * option (`--dry-run`), not as a path.
+ *
+ * This is the single owner: `DeployTargetSchema` composes it for a `deploy:`
+ * directory, `PublishPackageRootSchema` names it for an authored `publish:` path
+ * AND for a publish target descriptor's `defaultPaths`.
+ */
+export const SafePackageRootSchema = z
+    .string()
+    .trim()
+    .min(1)
+    .max(240)
+    .refine((path) => {
+    if (path === '.')
+        return true;
+    if (path.startsWith('-'))
+        return false;
+    if (path.startsWith('/'))
+        return false;
+    const segments = path.split('/');
+    return segments.every((segment) => segment.length > 0 &&
+        segment !== '.' &&
+        segment !== '..' &&
+        /^[A-Za-z0-9._-]+$/.test(segment));
+}, 'expected . or a safe repository-relative package root (never an option)');
+//# sourceMappingURL=package-root.js.map

package/dist/schemas/package-root.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"package-root.js","sourceRoot":"","sources":["../../src/schemas/package-root.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC;KACpC,MAAM,EAAE;KACR,IAAI,EAAE;KACN,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,GAAG,CAAC;KACR,MAAM,CACN,CAAC,IAAI,EAAE,EAAE;IACR,IAAI,IAAI,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAC9B,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACvC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,OAAO,QAAQ,CAAC,KAAK,CACpB,CAAC,OAAO,EAAE,EAAE,CACX,OAAO,CAAC,MAAM,GAAG,CAAC;QAClB,OAAO,KAAK,GAAG;QACf,OAAO,KAAK,IAAI;QAChB,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,CAClC,CAAC;AACH,CAAC,EACD,yEAAyE,CACzE,CAAC"}