@vibesdotdev/host-bun 0.0.0-stage → 1.0.0-rc.3

package/dist/resolution-root.impl.bun.d.ts

@@ -0,0 +1,170 @@
+/**
+ * The resolution root R: the ONE module-graph root a process (or, per
+ * ADR-0020, a worker-thread graph) loads every first-party name from.
+ *
+ * One resolver answers R for the thin shim (`vibes --version`'s `[scope]`) and
+ * for the runtime host that authorizes a workspace thread's module root, so the
+ * two can never disagree about which graph a workspace runs on.
+ *
+ * Hard constraint: this module is compiled into the thin shim, whose artifact
+ * must contain no framework module (module identity is realpath; a framework
+ * copy baked into `/$bunfs` forks the graph). It imports `node:fs`,
+ * `node:path` and Bun globals only, and it names no framework package other
+ * than the host package it probes for.
+ *
+ * R is the MODULE-GRAPH root only. This module never computes, reads or
+ * publishes workspace identity.
+ */
+import * as z from 'zod/v4';
+/** Package whose presence under a directory makes it a host root. */
+export declare const HOST_PACKAGE_NAME = "@vibesdotdev/plugins";
+/**
+ * The shim's probe target: a plain file it can `stat` with no package
+ * resolver. `@vibesdotdev/plugins` ships it in `files`, and it trampolines to
+ * `src/bun/host.ts` (linked checkout) or `dist/bun/host.js` (registry tarball).
+ */
+export declare const HOST_ENTRY_FILE = "host.mjs";
+/** How R was chosen. `[scope]` in the `--version` line. */
+export type HostScope = 'workspace' | 'bundle' | 'global→hostWorkspace' | 'global';
+export interface RootResolution {
+    /** Absolute resolution root R. */
+    root: string;
+    scope: HostScope;
+    source: 'env' | 'walk' | 'bundle' | 'hostWorkspace' | 'home';
+    /** Absolute path of the host entry under R, or null when R has no host. */
+    hostEntry: string | null;
+    /** Directory of the `@vibesdotdev/plugins` package that supplied the entry. */
+    hostPackageDir: string | null;
+    /** Every workspace candidate seen on the walk, innermost first. */
+    candidates: string[];
+}
+export interface ResolveRootInput {
+    /** `VIBES_WORKSPACE_PATH ?? cwd` — where the ancestor walk starts. */
+    start: string;
+    /** `VIBES_HOST_ROOT`: execution custody. A process tree never changes root. */
+    hostRootEnv?: string | undefined;
+    /** `$VIBES_HOME`. */
+    vibesHome: string;
+    /** `process.execPath`, for the bundle-adjacent candidate. */
+    execPath?: string | undefined;
+    /**
+     * `compose` forces workspace discovery for this resolution even inside a
+     * `$VIBES_HOME` `vibes.ignoreWorkspaceDiscovery` root (`bun vibes-dev`).
+     * Absent applies the home's list.
+     */
+    workspaceDiscovery?: 'compose' | undefined;
+}
+/** The refusal code and reason a malformed `vibes.ignoreWorkspaceDiscovery` carries. */
+export declare const WORKSPACE_DISCOVERY_IGNORE_INVALID: {
+    readonly code: "INVALID_INPUT";
+    readonly reason: "workspace-discovery-ignore-invalid";
+};
+export declare const WorkspaceDiscoveryIgnoreListSchema: z.ZodArray<z.ZodString>;
+/**
+ * `$VIBES_HOME/package.json#vibes.ignoreWorkspaceDiscovery`, or `[]` when the
+ * home declares none. Malformed refuses `WorkspaceDiscoveryIgnoreInvalidError`.
+ */
+export declare function readWorkspaceDiscoveryIgnore(vibesHome: string): string[];
+/** The listed root (real path) that contains `path`, or null. A listed root that does not exist contains nothing. */
+export declare function ignoredDiscoveryRootFor(path: string, roots: readonly string[]): string | null;
+/**
+ * The `package.json` fields the resolver reads, parsed at the I/O boundary.
+ *
+ * Deliberately four fields and nothing else: the resolver must not develop
+ * opinions about a manifest it does not own. Sibling `vibes.*` keys (`cli-bin`'s
+ * `{visibility}`, `plugins`' `{registry}`, the developer root's `{budgets}`)
+ * pass through untouched — a strict schema over the whole `vibes` block would
+ * reject every real repository.
+ */
+export interface ShimManifest {
+    readonly name: string | null;
+    readonly version: string | null;
+    readonly workspaces: readonly string[];
+    readonly hostWorkspace: string | null;
+}
+/** The four manifest fields at `path`, or null when the file is absent or JSON `null`; a malformed file throws. */
+export declare function readManifest(path: string): ShimManifest | null;
+/**
+ * Static parent + scanned pattern of a bun `workspaces` glob. Mirrors the
+ * kernel bootstrap's `splitWorkspaceGlob` — this module cannot import it (it is
+ * compiled into the thin shim), and R must be the SAME directory both
+ * resolvers pick or the process would publish a `VIBES_HOST_ROOT` the
+ * framework then disagrees with.
+ */
+export interface WorkspaceGlobParts {
+    /** The directory that must exist for the glob to match anything. */
+    readonly parent: string;
+    /** The pattern scanned beneath `parent`; empty for a literal path. */
+    readonly pattern: string;
+}
+export declare function splitWorkspaceGlob(glob: string): WorkspaceGlobParts;
+/**
+ * Directory of the member named `HOST_PACKAGE_NAME` among `root`'s `workspaces`
+ * globs, or null. Scans manifests directly instead of expanding every member:
+ * the developer root's 25 brace globs expand to ~232 manifests and this runs on
+ * the `--version` path, which is gated at 50 ms.
+ */
+export declare function findHostMember(root: string, globs: readonly string[]): string | null;
+/**
+ * The `@vibesdotdev/plugins` directory `dir` materializes, or null.
+ *
+ * Two ways, in cost order: installed under `node_modules` (one `existsSync`),
+ * or expanded from `package.json#workspaces`. The installed check must come
+ * first — it is what keeps the ancestor walk cheap on a machine whose root
+ * carries 25 globs.
+ */
+export declare function hostPackageDirAt(dir: string): string | null;
+/**
+ * Identify the root of a host that the executable's own module resolver has
+ * already selected. This is for installed JS executables, which must declare
+ * the graph they actually imported rather than adopting an unrelated cwd or
+ * an inherited shim channel. The entry comparison also handles linked source.
+ */
+/**
+ * The recovery a refused loaded-host root names. Ownership is refused, never
+ * guessed: more than one candidate graph linking the same entry (the linked
+ * developer layout) or none containing it. This leaf imports no framework
+ * module (the compiled shim carries it), so the refusal is a plain Error whose
+ * message names the cause and this hint, as `./cli-checkout` refuses.
+ */
+export declare const LOADED_HOST_ROOT_RECOVERY = "Run it through the vibes shim, or start the host with an explicit host.root (the directory whose node_modules supplies the framework).";
+export declare function resolveLoadedHostRoot(input: {
+    start: string;
+    hostEntry: string;
+}): string;
+/** Declare the actual loaded graph and re-entry command for a Bun JS executable. */
+export declare function loadedCliHostDeclaration(input: {
+    scriptUrl: string;
+    hostEntryUrl: string;
+}): {
+    root: string;
+    selfSpawn: {
+        argv: string[];
+        source: "bun-source";
+    };
+};
+/**
+ * The Desktop bundle's root (plan §2.2 step 2c, critic HIGH).
+ * `bridge-native/scripts/bundle-macos.ts` copies the binary to
+ * `Contents/Resources/bin/vibes` and `verify-packaged-runtime-macos.ts` runs it
+ * against a fresh temp `VIBES_HOME` and a `plugins: []` workspace, requiring PM
+ * self-spawn to re-enter the bundled binary. Without this candidate that is an
+ * exit 78 — or, worse, a network install inside a packaged app.
+ */
+export declare function bundleAdjacentRoot(execPath: string | undefined): string | null;
+/**
+ * Resolve R for this module graph — ONE resolution root per graph, plan §2.2
+ * step 2 as amended by ADR-0020 decision 3.
+ *
+ * (a) `VIBES_HOST_ROOT` (execution custody: a process tree never changes root
+ * mid-life); (b) the OUTERMOST ancestor of `start` that materializes the host
+ * package — outermost, so a nested provider checkout (`repos/platform/framework`
+ * has its own `.git` and `workspaces: ['*']`) resolves to the developer root
+ * that links it instead of forking a second graph; (c) the bundle-adjacent
+ * home; (d) `$VIBES_HOME/package.json#vibes.hostWorkspace`, same lookup there;
+ * (e) `$VIBES_HOME` itself. Step (b) skips every candidate inside a
+ * `$VIBES_HOME` `vibes.ignoreWorkspaceDiscovery` root unless the caller
+ * declares `workspaceDiscovery: 'compose'`.
+ */
+export declare function resolveResolutionRoot(input: ResolveRootInput): RootResolution;
+//# sourceMappingURL=resolution-root.impl.bun.d.ts.map

package/dist/resolution-root.impl.bun.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolution-root.impl.bun.d.ts","sourceRoot":"","sources":["../src/resolution-root.impl.bun.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAKH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,qEAAqE;AACrE,eAAO,MAAM,iBAAiB,yBAAyB,CAAC;AAExD;;;;GAIG;AACH,eAAO,MAAM,eAAe,aAAa,CAAC;AAE1C,2DAA2D;AAC3D,MAAM,MAAM,SAAS,GAAG,WAAW,GAAG,QAAQ,GAAG,sBAAsB,GAAG,QAAQ,CAAC;AAEnF,MAAM,WAAW,cAAc;IAC9B,kCAAkC;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,SAAS,CAAC;IACjB,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,QAAQ,GAAG,eAAe,GAAG,MAAM,CAAC;IAC7D,2EAA2E;IAC3E,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,+EAA+E;IAC/E,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,mEAAmE;IACnE,UAAU,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,gBAAgB;IAChC,sEAAsE;IACtE,KAAK,EAAE,MAAM,CAAC;IACd,+EAA+E;IAC/E,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,qBAAqB;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,6DAA6D;IAC7D,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;CAC3C;AAED,wFAAwF;AACxF,eAAO,MAAM,kCAAkC;;;CAAmF,CAAC;AAgCnI,eAAO,MAAM,kCAAkC,yBAM7C,CAAC;AAEH;;;GAGG;AACH,wBAAgB,4BAA4B,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,EAAE,CAWxE;AAaD,qHAAqH;AACrH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,GAAG,IAAI,CAQ7F;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,YAAY;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IACvC,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CACtC;AAkCD,mHAAmH;AACnH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAU9D;AASD;;;;;;GAMG;AACH,MAAM,WAAW,kBAAkB;IAClC,oEAAoE;IACpE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,sEAAsE;IACtE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CACzB;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,kBAAkB,CAQnE;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,GAAG,IAAI,CAepF;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAQ3D;AAeD;;;;;GAKG;AACH;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,2IAA2I,CAAC;AAElL,wBAAgB,qBAAqB,CAAC,KAAK,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAkBzF;AAED,oFAAoF;AACpF,wBAAgB,wBAAwB,CAAC,KAAK,EAAE;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE;;;;;;EAM1F;AAQD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAQ9E;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,gBAAgB,GAAG,cAAc,CAyE7E"}

package/dist/resolution-root.impl.bun.js

@@ -0,0 +1,373 @@
+/**
+ * The resolution root R: the ONE module-graph root a process (or, per
+ * ADR-0020, a worker-thread graph) loads every first-party name from.
+ *
+ * One resolver answers R for the thin shim (`vibes --version`'s `[scope]`) and
+ * for the runtime host that authorizes a workspace thread's module root, so the
+ * two can never disagree about which graph a workspace runs on.
+ *
+ * Hard constraint: this module is compiled into the thin shim, whose artifact
+ * must contain no framework module (module identity is realpath; a framework
+ * copy baked into `/$bunfs` forks the graph). It imports `node:fs`,
+ * `node:path` and Bun globals only, and it names no framework package other
+ * than the host package it probes for.
+ *
+ * R is the MODULE-GRAPH root only. This module never computes, reads or
+ * publishes workspace identity.
+ */
+import { existsSync, readFileSync, realpathSync, statSync } from 'node:fs';
+import { dirname, isAbsolute, join, relative, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import * as z from 'zod/v4';
+/** Package whose presence under a directory makes it a host root. */
+export const HOST_PACKAGE_NAME = '@vibesdotdev/plugins';
+/**
+ * The shim's probe target: a plain file it can `stat` with no package
+ * resolver. `@vibesdotdev/plugins` ships it in `files`, and it trampolines to
+ * `src/bun/host.ts` (linked checkout) or `dist/bun/host.js` (registry tarball).
+ */
+export const HOST_ENTRY_FILE = 'host.mjs';
+/** The refusal code and reason a malformed `vibes.ignoreWorkspaceDiscovery` carries. */
+export const WORKSPACE_DISCOVERY_IGNORE_INVALID = { code: 'INVALID_INPUT', reason: 'workspace-discovery-ignore-invalid' };
+/**
+ * A malformed `$VIBES_HOME/package.json#vibes.ignoreWorkspaceDiscovery`
+ * refuses with {@link WORKSPACE_DISCOVERY_IGNORE_INVALID} and the file path
+ * (this module compiles into the framework-free shim, so the kernel's
+ * CapabilityError is projected by shape). A malformed entry is never dropped.
+ */
+function workspaceDiscoveryIgnoreInvalid(path, issues) {
+    return Object.assign(new Error(`[vibes] ${path} vibes.ignoreWorkspaceDiscovery is invalid: ${issues}. Fix or remove the entry (internal org setup writes it).`), { ...WORKSPACE_DISCOVERY_IGNORE_INVALID, details: { path } });
+}
+/**
+ * Mirror of the kernel's `WorkspaceDiscoveryIgnoreListSchema`
+ * (`@vibesdotdev/kernel/schemas/package-plugins`): this module compiles into
+ * the framework-free shim and cannot import it. `resolution-root.test.ts`
+ * holds both to one table of cases.
+ */
+const AbsoluteDirectoryPathSchema = z
+    .string()
+    .min(1)
+    .max(4096)
+    .refine((value) => value.trim() === value, { message: 'must not carry leading or trailing whitespace' })
+    .refine((value) => Array.from(value).every((character) => character.charCodeAt(0) >= 32 && character.charCodeAt(0) !== 127), {
+    message: 'must not contain control characters'
+})
+    .refine((value) => value.startsWith('/') || /^[A-Za-z]:[\\/]/.test(value) || value.startsWith('\\\\'), {
+    message: 'must be an absolute directory path'
+});
+export const WorkspaceDiscoveryIgnoreListSchema = z.array(AbsoluteDirectoryPathSchema).max(256).superRefine((entries, ctx) => {
+    const seen = new Set();
+    for (const [index, entry] of entries.entries()) {
+        if (seen.has(entry))
+            ctx.addIssue({ code: 'custom', path: [index], message: `duplicate root ${entry}` });
+        seen.add(entry);
+    }
+});
+/**
+ * `$VIBES_HOME/package.json#vibes.ignoreWorkspaceDiscovery`, or `[]` when the
+ * home declares none. Malformed refuses `WorkspaceDiscoveryIgnoreInvalidError`.
+ */
+export function readWorkspaceDiscoveryIgnore(vibesHome) {
+    const path = join(resolve(vibesHome), 'package.json');
+    const raw = readJson(path);
+    const block = z.object({ vibes: z.object({ ignoreWorkspaceDiscovery: z.unknown() }).loose() }).loose().safeParse(raw);
+    const declared = block.success ? block.data.vibes.ignoreWorkspaceDiscovery : undefined;
+    if (declared === undefined)
+        return [];
+    const parsed = WorkspaceDiscoveryIgnoreListSchema.safeParse(declared);
+    if (!parsed.success) {
+        throw workspaceDiscoveryIgnoreInvalid(path, parsed.error.issues.map((issue) => `[${issue.path.join('.')}] ${issue.message}`).join('; '));
+    }
+    return parsed.data;
+}
+/** Real path of an existing directory, or null; the filesystem decides case folding and symlinks. */
+function canonicalDirectory(path) {
+    return existsSync(path) ? realpathSync(path) : null;
+}
+/** `child` is `parent` or under it; both canonical. */
+function isInside(parent, child) {
+    const offset = relative(parent, child);
+    return offset === '' || (!isAbsolute(offset) && offset.split(/[\\/]+/)[0] !== '..');
+}
+/** The listed root (real path) that contains `path`, or null. A listed root that does not exist contains nothing. */
+export function ignoredDiscoveryRootFor(path, roots) {
+    const target = canonicalDirectory(resolve(path));
+    if (target === null)
+        return null;
+    for (const entry of roots) {
+        const root = canonicalDirectory(entry);
+        if (root !== null && isInside(root, target))
+            return root;
+    }
+    return null;
+}
+/** Any JSON value; `readManifest` narrows it. A missing file reads as null; malformed JSON throws, naming the file. */
+function readJson(path) {
+    // Absence is confirmed by the probe; any read failure past it propagates.
+    if (!existsSync(path))
+        return null;
+    const text = readFileSync(path, 'utf8');
+    // A malformed manifest on the resolution path is a defect to fix, never a
+    // silent non-member: the parse failure propagates, naming the file.
+    let value;
+    try {
+        value = JSON.parse(text);
+    }
+    catch (error) {
+        throw new Error(`Malformed package.json at ${path}`, { cause: error });
+    }
+    return z.json().parse(value);
+}
+/**
+ * The four fields, each read on its own: a field of the wrong type reads as
+ * null (or `[]`), and a non-object manifest reads as all-empty, exactly as
+ * the shim always has. Sibling keys pass through untouched.
+ */
+const ManifestSchema = z.object({
+    name: z.string().nullable().catch(null),
+    version: z.string().nullable().catch(null),
+    workspaces: z.array(z.json()).catch([]).transform((entries) => entries.flatMap((entry) => {
+        const value = z.string().safeParse(entry);
+        return value.success ? [value.data] : [];
+    })),
+    vibes: z.object({ hostWorkspace: z.string().nullable().catch(null) }).catch({ hostWorkspace: null })
+}).catch({ name: null, version: null, workspaces: [], vibes: { hostWorkspace: null } });
+/** The four manifest fields at `path`, or null when the file is absent or JSON `null`; a malformed file throws. */
+export function readManifest(path) {
+    const raw = readJson(path);
+    if (raw === null)
+        return null;
+    const manifest = ManifestSchema.parse(raw);
+    return {
+        name: manifest.name ?? null,
+        version: manifest.version ?? null,
+        workspaces: manifest.workspaces,
+        hostWorkspace: manifest.vibes.hostWorkspace ?? null
+    };
+}
+/** `existsSync` confirms absence (including a path through a non-directory); any stat failure past it propagates. */
+function isDirectory(path) {
+    return existsSync(path) && statSync(path).isDirectory();
+}
+const GLOB_CHARS = /[*?[\]{}]/;
+export function splitWorkspaceGlob(glob) {
+    const segments = glob.split('/');
+    const firstGlob = segments.findIndex((segment) => GLOB_CHARS.test(segment));
+    if (firstGlob === -1)
+        return { parent: glob, pattern: '' };
+    return {
+        parent: segments.slice(0, firstGlob).join('/') || (isAbsolute(glob) ? '/' : '.'),
+        pattern: segments.slice(firstGlob).join('/')
+    };
+}
+/**
+ * Directory of the member named `HOST_PACKAGE_NAME` among `root`'s `workspaces`
+ * globs, or null. Scans manifests directly instead of expanding every member:
+ * the developer root's 25 brace globs expand to ~232 manifests and this runs on
+ * the `--version` path, which is gated at 50 ms.
+ */
+export function findHostMember(root, globs) {
+    for (const glob of globs) {
+        const { parent, pattern } = splitWorkspaceGlob(glob);
+        const parentDir = isAbsolute(parent) ? parent : resolve(root, parent);
+        if (!isDirectory(parentDir))
+            continue;
+        const manifestGlob = pattern ? `${pattern}/package.json` : 'package.json';
+        // parentDir is a confirmed directory, so a scan failure is a real failure.
+        const matches = [...new Bun.Glob(manifestGlob).scanSync({ cwd: parentDir, onlyFiles: true })];
+        for (const relative of matches.sort()) {
+            const manifestPath = join(parentDir, relative);
+            if (readManifest(manifestPath)?.name !== HOST_PACKAGE_NAME)
+                continue;
+            return dirname(manifestPath);
+        }
+    }
+    return null;
+}
+/**
+ * The `@vibesdotdev/plugins` directory `dir` materializes, or null.
+ *
+ * Two ways, in cost order: installed under `node_modules` (one `existsSync`),
+ * or expanded from `package.json#workspaces`. The installed check must come
+ * first — it is what keeps the ancestor walk cheap on a machine whose root
+ * carries 25 globs.
+ */
+export function hostPackageDirAt(dir) {
+    const manifestPath = join(dir, 'package.json');
+    if (!existsSync(manifestPath))
+        return null;
+    const installed = join(dir, 'node_modules', ...HOST_PACKAGE_NAME.split('/'));
+    if (existsSync(join(installed, HOST_ENTRY_FILE)))
+        return installed;
+    const globs = readManifest(manifestPath)?.workspaces ?? [];
+    if (globs.length === 0)
+        return null;
+    return findHostMember(dir, globs);
+}
+function walkCandidates(start) {
+    const found = [];
+    let dir = resolve(start);
+    for (let depth = 0; depth < 64; depth++) {
+        const hostPackageDir = hostPackageDirAt(dir);
+        if (hostPackageDir)
+            found.push({ dir, hostPackageDir });
+        const parent = dirname(dir);
+        if (parent === dir)
+            break;
+        dir = parent;
+    }
+    return found;
+}
+/**
+ * Identify the root of a host that the executable's own module resolver has
+ * already selected. This is for installed JS executables, which must declare
+ * the graph they actually imported rather than adopting an unrelated cwd or
+ * an inherited shim channel. The entry comparison also handles linked source.
+ */
+/**
+ * The recovery a refused loaded-host root names. Ownership is refused, never
+ * guessed: more than one candidate graph linking the same entry (the linked
+ * developer layout) or none containing it. This leaf imports no framework
+ * module (the compiled shim carries it), so the refusal is a plain Error whose
+ * message names the cause and this hint, as `./cli-checkout` refuses.
+ */
+export const LOADED_HOST_ROOT_RECOVERY = 'Run it through the vibes shim, or start the host with an explicit host.root (the directory whose node_modules supplies the framework).';
+export function resolveLoadedHostRoot(input) {
+    const selected = realpathSync(input.hostEntry);
+    let match;
+    let dir = resolve(input.start);
+    for (let depth = 0; depth < 64; depth++) {
+        const installed = join(dir, 'node_modules', ...HOST_PACKAGE_NAME.split('/'));
+        const packageDir = existsSync(join(installed, 'host-start.mjs')) ? installed : hostPackageDirAt(dir);
+        const entry = packageDir && join(packageDir, 'host-start.mjs');
+        if (entry && existsSync(entry) && realpathSync(entry) === selected) {
+            if (match)
+                throw new Error(`The loaded CLI host belongs to multiple candidate graphs (${match} and ${dir}).\n${LOADED_HOST_ROOT_RECOVERY}`);
+            match = dir;
+        }
+        const parent = dirname(dir);
+        if (parent === dir)
+            break;
+        dir = parent;
+    }
+    if (!match)
+        throw new Error(`The loaded CLI host is not present in the executable package graph.\n${LOADED_HOST_ROOT_RECOVERY}`);
+    return match;
+}
+/** Declare the actual loaded graph and re-entry command for a Bun JS executable. */
+export function loadedCliHostDeclaration(input) {
+    const script = fileURLToPath(input.scriptUrl);
+    return {
+        root: resolveLoadedHostRoot({ start: dirname(script), hostEntry: fileURLToPath(input.hostEntryUrl) }),
+        selfSpawn: { argv: [process.execPath, script], source: 'bun-source' }
+    };
+}
+function entryOf(hostPackageDir) {
+    if (!hostPackageDir)
+        return null;
+    const entry = join(hostPackageDir, HOST_ENTRY_FILE);
+    return existsSync(entry) ? entry : null;
+}
+/**
+ * The Desktop bundle's root (plan §2.2 step 2c, critic HIGH).
+ * `bridge-native/scripts/bundle-macos.ts` copies the binary to
+ * `Contents/Resources/bin/vibes` and `verify-packaged-runtime-macos.ts` runs it
+ * against a fresh temp `VIBES_HOME` and a `plugins: []` workspace, requiring PM
+ * self-spawn to re-enter the bundled binary. Without this candidate that is an
+ * exit 78 — or, worse, a network install inside a packaged app.
+ */
+export function bundleAdjacentRoot(execPath) {
+    if (!execPath)
+        return null;
+    // A missing executable path keeps its spelling; any realpath failure past the probe propagates.
+    const real = existsSync(execPath) ? realpathSync(execPath) : execPath;
+    const candidate = resolve(dirname(real), '..', 'vibes-home');
+    return existsSync(join(candidate, 'node_modules', ...HOST_PACKAGE_NAME.split('/'), HOST_ENTRY_FILE))
+        ? candidate
+        : null;
+}
+/**
+ * Resolve R for this module graph — ONE resolution root per graph, plan §2.2
+ * step 2 as amended by ADR-0020 decision 3.
+ *
+ * (a) `VIBES_HOST_ROOT` (execution custody: a process tree never changes root
+ * mid-life); (b) the OUTERMOST ancestor of `start` that materializes the host
+ * package — outermost, so a nested provider checkout (`repos/platform/framework`
+ * has its own `.git` and `workspaces: ['*']`) resolves to the developer root
+ * that links it instead of forking a second graph; (c) the bundle-adjacent
+ * home; (d) `$VIBES_HOME/package.json#vibes.hostWorkspace`, same lookup there;
+ * (e) `$VIBES_HOME` itself. Step (b) skips every candidate inside a
+ * `$VIBES_HOME` `vibes.ignoreWorkspaceDiscovery` root unless the caller
+ * declares `workspaceDiscovery: 'compose'`.
+ */
+export function resolveResolutionRoot(input) {
+    const custody = input.hostRootEnv?.trim();
+    if (custody) {
+        const root = resolve(custody);
+        const hostPackageDir = hostPackageDirAt(root);
+        return {
+            root,
+            scope: 'workspace',
+            source: 'env',
+            hostEntry: entryOf(hostPackageDir),
+            hostPackageDir,
+            candidates: []
+        };
+    }
+    // Inside a `vibes.ignoreWorkspaceDiscovery` root the walk does not offer
+    // that root's linked graph: R falls through to the bundle or the home, so
+    // the installed host runs (the kernel composer skips the workspace's own
+    // composition by the same rule). `workspaceDiscovery: 'compose'` keeps it.
+    const walked = walkCandidates(input.start);
+    const ignore = walked.length > 0 && input.workspaceDiscovery !== 'compose' ? readWorkspaceDiscoveryIgnore(input.vibesHome) : [];
+    const candidates = ignore.length === 0 ? walked : walked.filter((candidate) => ignoredDiscoveryRootFor(candidate.dir, ignore) === null);
+    if (candidates.length > 0) {
+        const outermost = candidates[candidates.length - 1];
+        return {
+            root: outermost.dir,
+            scope: 'workspace',
+            source: 'walk',
+            hostEntry: entryOf(outermost.hostPackageDir),
+            hostPackageDir: outermost.hostPackageDir,
+            candidates: candidates.map((c) => c.dir)
+        };
+    }
+    const bundle = bundleAdjacentRoot(input.execPath);
+    if (bundle) {
+        const hostPackageDir = hostPackageDirAt(bundle);
+        return {
+            root: bundle,
+            scope: 'bundle',
+            source: 'bundle',
+            hostEntry: entryOf(hostPackageDir),
+            hostPackageDir,
+            candidates: []
+        };
+    }
+    const home = resolve(input.vibesHome);
+    const hostWorkspace = readManifest(join(home, 'package.json'))?.hostWorkspace?.trim() ?? '';
+    if (hostWorkspace) {
+        const delegated = walkCandidates(hostWorkspace);
+        const chosen = delegated[delegated.length - 1];
+        const root = chosen?.dir ?? resolve(hostWorkspace);
+        const hostPackageDir = chosen?.hostPackageDir ?? hostPackageDirAt(root);
+        return {
+            root,
+            scope: 'global→hostWorkspace',
+            source: 'hostWorkspace',
+            hostEntry: entryOf(hostPackageDir),
+            hostPackageDir,
+            candidates: delegated.map((c) => c.dir)
+        };
+    }
+    const hostPackageDir = hostPackageDirAt(home);
+    return {
+        root: home,
+        scope: 'global',
+        source: 'home',
+        hostEntry: entryOf(hostPackageDir),
+        hostPackageDir,
+        candidates: []
+    };
+}
+//# sourceMappingURL=resolution-root.impl.bun.js.map

package/dist/resolution-root.impl.bun.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolution-root.impl.bun.js","sourceRoot":"","sources":["../src/resolution-root.impl.bun.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC3E,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,qEAAqE;AACrE,MAAM,CAAC,MAAM,iBAAiB,GAAG,sBAAsB,CAAC;AAExD;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,UAAU,CAAC;AAmC1C,wFAAwF;AACxF,MAAM,CAAC,MAAM,kCAAkC,GAAG,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,oCAAoC,EAAW,CAAC;AAEnI;;;;;GAKG;AACH,SAAS,+BAA+B,CAAC,IAAY,EAAE,MAAc;IACpE,OAAO,MAAM,CAAC,MAAM,CACnB,IAAI,KAAK,CAAC,WAAW,IAAI,+CAA+C,MAAM,2DAA2D,CAAC,EAC1I,EAAE,GAAG,kCAAkC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,EAAE,CAC5D,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,2BAA2B,GAAG,CAAC;KACnC,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,IAAI,CAAC;KACT,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,KAAK,EAAE,EAAE,OAAO,EAAE,+CAA+C,EAAE,CAAC;KACvG,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,EAAE;IAC5H,OAAO,EAAE,qCAAqC;CAC9C,CAAC;KACD,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE;IACtG,OAAO,EAAE,oCAAoC;CAC7C,CAAC,CAAC;AACJ,MAAM,CAAC,MAAM,kCAAkC,GAAG,CAAC,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE;IAC5H,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;QAChD,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,kBAAkB,KAAK,EAAE,EAAE,CAAC,CAAC;QACzG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACjB,CAAC;AACF,CAAC,CAAC,CAAC;AAEH;;;GAGG;AACH,MAAM,UAAU,4BAA4B,CAAC,SAAiB;IAC7D,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,cAAc,CAAC,CAAC;IACtD,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC3B,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,wBAAwB,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACtH,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC,CAAC,SAAS,CAAC;IACvF,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACtC,MAAM,MAAM,GAAG,kCAAkC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IACtE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACrB,MAAM,+BAA+B,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1I,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACpB,CAAC;AAED,qGAAqG;AACrG,SAAS,kBAAkB,CAAC,IAAY;IACvC,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACrD,CAAC;AAED,uDAAuD;AACvD,SAAS,QAAQ,CAAC,MAAc,EAAE,KAAa;IAC9C,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACvC,OAAO,MAAM,KAAK,EAAE,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;AACrF,CAAC;AAED,qHAAqH;AACrH,MAAM,UAAU,uBAAuB,CAAC,IAAY,EAAE,KAAwB;IAC7E,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACjD,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACjC,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,IAAI,KAAK,IAAI,IAAI,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;IAC1D,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAkBD,uHAAuH;AACvH,SAAS,QAAQ,CAAC,IAAY;IAC7B,0EAA0E;IAC1E,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACxC,0EAA0E;IAC1E,oEAAoE;IACpE,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACJ,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACxE,CAAC;IACD,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED;;;;GAIG;AACH,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC;IAC/B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;IACvC,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;IAC1C,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,EAAE,CAC7D,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;QACzB,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAC1C,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1C,CAAC,CAAC,CAAC;IACJ,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;CACpG,CAAC,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;AAExF,mHAAmH;AACnH,MAAM,UAAU,YAAY,CAAC,IAAY;IACxC,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC3B,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC9B,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3C,OAAO;QACN,IAAI,EAAE,QAAQ,CAAC,IAAI,IAAI,IAAI;QAC3B,OAAO,EAAE,QAAQ,CAAC,OAAO,IAAI,IAAI;QACjC,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,aAAa,EAAE,QAAQ,CAAC,KAAK,CAAC,aAAa,IAAI,IAAI;KACnD,CAAC;AACH,CAAC;AAED,qHAAqH;AACrH,SAAS,WAAW,CAAC,IAAY;IAChC,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;AACzD,CAAC;AAED,MAAM,UAAU,GAAG,WAAW,CAAC;AAgB/B,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5E,IAAI,SAAS,KAAK,CAAC,CAAC;QAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAC3D,OAAO;QACN,MAAM,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QAChF,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;KAC5C,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,KAAwB;IACpE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1B,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;QACrD,MAAM,SAAS,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACtE,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC;YAAE,SAAS;QACtC,MAAM,YAAY,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,eAAe,CAAC,CAAC,CAAC,cAAc,CAAC;QAC1E,2EAA2E;QAC3E,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAC9F,KAAK,MAAM,QAAQ,IAAI,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;YACvC,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;YAC/C,IAAI,YAAY,CAAC,YAAY,CAAC,EAAE,IAAI,KAAK,iBAAiB;gBAAE,SAAS;YACrE,OAAO,OAAO,CAAC,YAAY,CAAC,CAAC;QAC9B,CAAC;IACF,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC3C,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAC/C,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE,GAAG,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7E,IAAI,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACnE,MAAM,KAAK,GAAG,YAAY,CAAC,YAAY,CAAC,EAAE,UAAU,IAAI,EAAE,CAAC;IAC3D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,OAAO,cAAc,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,cAAc,CAAC,KAAa;IACpC,MAAM,KAAK,GAA8C,EAAE,CAAC;IAC5D,IAAI,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IACzB,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC;QACzC,MAAM,cAAc,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QAC7C,IAAI,cAAc;YAAE,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,cAAc,EAAE,CAAC,CAAC;QACxD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,KAAK,GAAG;YAAE,MAAM;QAC1B,GAAG,GAAG,MAAM,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,wIAAwI,CAAC;AAElL,MAAM,UAAU,qBAAqB,CAAC,KAA2C;IAChF,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC/C,IAAI,KAAyB,CAAC;IAC9B,IAAI,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC/B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC;QACzC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,EAAE,GAAG,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7E,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACrG,MAAM,KAAK,GAAG,UAAU,IAAI,IAAI,CAAC,UAAU,EAAE,gBAAgB,CAAC,CAAC;QAC/D,IAAI,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,YAAY,CAAC,KAAK,CAAC,KAAK,QAAQ,EAAE,CAAC;YACpE,IAAI,KAAK;gBAAE,MAAM,IAAI,KAAK,CAAC,6DAA6D,KAAK,QAAQ,GAAG,OAAO,yBAAyB,EAAE,CAAC,CAAC;YAC5I,KAAK,GAAG,GAAG,CAAC;QACb,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,KAAK,GAAG;YAAE,MAAM;QAC1B,GAAG,GAAG,MAAM,CAAC;IACd,CAAC;IACD,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,wEAAwE,yBAAyB,EAAE,CAAC,CAAC;IACjI,OAAO,KAAK,CAAC;AACd,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,wBAAwB,CAAC,KAAkD;IAC1F,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC9C,OAAO;QACN,IAAI,EAAE,qBAAqB,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,aAAa,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;QACrG,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,YAAqB,EAAE;KAC9E,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,cAA6B;IAC7C,IAAI,CAAC,cAAc;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,KAAK,GAAG,IAAI,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC;IACpD,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AACzC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAA4B;IAC9D,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,gGAAgG;IAChG,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IACtE,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC;IAC7D,OAAO,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,EAAE,GAAG,iBAAiB,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,eAAe,CAAC,CAAC;QACnG,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,IAAI,CAAC;AACT,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAuB;IAC5D,MAAM,OAAO,GAAG,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC;IAC1C,IAAI,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAC9B,MAAM,cAAc,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC9C,OAAO;YACN,IAAI;YACJ,KAAK,EAAE,WAAW;YAClB,MAAM,EAAE,KAAK;YACb,SAAS,EAAE,OAAO,CAAC,cAAc,CAAC;YAClC,cAAc;YACd,UAAU,EAAE,EAAE;SACd,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,0EAA0E;IAC1E,yEAAyE;IACzE,2EAA2E;IAC3E,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,kBAAkB,KAAK,SAAS,CAAC,CAAC,CAAC,4BAA4B,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAChI,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,uBAAuB,CAAC,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;IACxI,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,SAAS,GAAG,UAAU,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC;QACrD,OAAO;YACN,IAAI,EAAE,SAAS,CAAC,GAAG;YACnB,KAAK,EAAE,WAAW;YAClB,MAAM,EAAE,MAAM;YACd,SAAS,EAAE,OAAO,CAAC,SAAS,CAAC,cAAc,CAAC;YAC5C,cAAc,EAAE,SAAS,CAAC,cAAc;YACxC,UAAU,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;SACxC,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAClD,IAAI,MAAM,EAAE,CAAC;QACZ,MAAM,cAAc,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAChD,OAAO;YACN,IAAI,EAAE,MAAM;YACZ,KAAK,EAAE,QAAQ;YACf,MAAM,EAAE,QAAQ;YAChB,SAAS,EAAE,OAAO,CAAC,cAAc,CAAC;YAClC,cAAc;YACd,UAAU,EAAE,EAAE;SACd,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACtC,MAAM,aAAa,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC5F,IAAI,aAAa,EAAE,CAAC;QACnB,MAAM,SAAS,GAAG,cAAc,CAAC,aAAa,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC/C,MAAM,IAAI,GAAG,MAAM,EAAE,GAAG,IAAI,OAAO,CAAC,aAAa,CAAC,CAAC;QACnD,MAAM,cAAc,GAAG,MAAM,EAAE,cAAc,IAAI,gBAAgB,CAAC,IAAI,CAAC,CAAC;QACxE,OAAO;YACN,IAAI;YACJ,KAAK,EAAE,sBAAsB;YAC7B,MAAM,EAAE,eAAe;YACvB,SAAS,EAAE,OAAO,CAAC,cAAc,CAAC;YAClC,cAAc;YACd,UAAU,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;SACvC,CAAC;IACH,CAAC;IAED,MAAM,cAAc,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAC9C,OAAO;QACN,IAAI,EAAE,IAAI;QACV,KAAK,EAAE,QAAQ;QACf,MAAM,EAAE,MAAM;QACd,SAAS,EAAE,OAAO,CAAC,cAAc,CAAC;QAClC,cAAc;QACd,UAAU,EAAE,EAAE;KACd,CAAC;AACH,CAAC"}

package/dist/restricted-execute.darwin.impl.bun.d.ts

@@ -0,0 +1,19 @@
+import { type RestrictedHost } from '@vibesdotdev/execution-local';
+import { type RestrictedExecutorOptions, type RestrictedSupervisorResource } from './schemas/restricted-execute.ts';
+import { type RuntimeHostCommandInvocation } from '@vibesdotdev/kernel';
+import { type RestrictedExecuteOptions, type RestrictedExecuteResult } from '@vibesdotdev/kernel/execution';
+/** Capture the selected host command once; absent capability never guesses a runtime. */
+export declare function captureRestrictedSupervisor(invocation: RuntimeHostCommandInvocation | undefined): RuntimeHostCommandInvocation;
+export type { RestrictedEnforcerSpawn, RestrictedExecutorOptions, RestrictedGroupSignal, RestrictedSupervisorResource } from './schemas/restricted-execute.ts';
+/** The one resource the host composes: the packaged supervisor, its bytes embedded, and its pinned hash. */
+export declare const PINNED_SUPERVISOR: RestrictedSupervisorResource;
+/**
+ * The executor over one supervisor resource. The host composes only
+ * {@link PINNED_SUPERVISOR} with the real group signal; a probe supplies another
+ * file or hash to prove the refusals that guard it (tampered bytes, a supervisor
+ * inside the writable root), or a group signal that fails to prove the cleanup
+ * refusal.
+ */
+export declare function createRestrictedDarwinExecutor(resource: RestrictedSupervisorResource, options?: RestrictedExecutorOptions): (input: RestrictedExecuteOptions, host: RestrictedHost) => Promise<RestrictedExecuteResult>;
+export declare const executeRestrictedDarwin: (input: RestrictedExecuteOptions, host: RestrictedHost) => Promise<RestrictedExecuteResult>;
+//# sourceMappingURL=restricted-execute.darwin.impl.bun.d.ts.map

package/dist/restricted-execute.darwin.impl.bun.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"restricted-execute.darwin.impl.bun.d.ts","sourceRoot":"","sources":["../src/restricted-execute.darwin.impl.bun.ts"],"names":[],"mappings":"AAYA,OAAO,EAEN,KAAK,cAAc,EACnB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EAA+F,KAAK,yBAAyB,EAA8B,KAAK,4BAA4B,EAAE,MAAM,iCAAiC,CAAC;AAO7O,OAAO,EAA0D,KAAK,4BAA4B,EAAyB,MAAM,qBAAqB,CAAC;AAEvJ,OAAO,EAEN,KAAK,wBAAwB,EAC7B,KAAK,uBAAuB,EAC5B,MAAM,+BAA+B,CAAC;AAiBvC,yFAAyF;AACzF,wBAAgB,2BAA2B,CAAC,UAAU,EAAE,4BAA4B,GAAG,SAAS,GAAG,4BAA4B,CAM9H;AAwKD,YAAY,EAAE,uBAAuB,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,4BAA4B,EAAE,MAAM,iCAAiC,CAAC;AAE/J,4GAA4G;AAC5G,eAAO,MAAM,iBAAiB,EAAE,4BAA2H,CAAC;AAa5J;;;;;;GAMG;AACH,wBAAgB,8BAA8B,CAAC,QAAQ,EAAE,4BAA4B,EAAE,OAAO,GAAE,yBAA8B,IAMrH,OAAO,wBAAwB,EAAE,MAAM,cAAc,KAAG,OAAO,CAAC,uBAAuB,CAAC,CAEhG;AAED,eAAO,MAAM,uBAAuB,UAJpB,wBAAwB,QAAQ,cAAc,KAAG,OAAO,CAAC,uBAAuB,CAIR,CAAC"}