@vibesdotdev/infra-core 0.0.1 → 1.0.0-rc.11

package/dist/deployment-budget.js

@@ -0,0 +1,660 @@
+/**
+ * Deployment and build budgets, and the bundling-correctness gate a deploy runs before upload.
+ *
+ * A Worker bundle is correct when it carries only modules that belong in the scope it serves. A
+ * deploy walks the module graph the provider will bundle from the Worker entry and refuses
+ * (`deployment-scope-violation`, every violation at once) when that graph reaches:
+ *  - a built-in module the provider does not supply, or supplies only as a non-functional stub;
+ *  - a module whose file-scope suffix, or the export name that publishes it, declares a scope the
+ *    provider's bundle does not serve (`*.consumer.*`, `*.cli.*`, `*.browser.*`), read by the
+ *    kernel's one scope grammar;
+ *  - a host package (`vibes.host`) the provider does not run on;
+ *  - a browser-only target (`?worker`) or a path the app's `forbidden` list names.
+ * The provider declares what it supplies, the scopes it serves, how its bundler resolves and its
+ * hard upload limits (`infra/deployment-provider` `bundle`); none of it is a constant here.
+ *
+ * Size is evidence, not a rule. The total, the largest files with their package and importer
+ * chain, and the heaviest packages are measured and reported, and a declared `vibes.budgets`
+ * ceiling is compared and reported prominently, but a deploy refuses on bytes only past the
+ * provider's own hard limit, where the upload would fail anyway (`deployment-platform-limit-exceeded`).
+ *
+ *   "vibes": { "budgets": {
+ *     "build": { "maxSeconds": 120 },
+ *     "deployment": {
+ *       "outputDir": ".svelte-kit/cloudflare",
+ *       "entry": ".svelte-kit/cloudflare/_worker.js",
+ *       "maxBytes": 4194304,
+ *       "forbidden": ["monaco"],
+ *       "assets": { "maxBytes": 67108864, "maxFileBytes": 26214400 } } } }
+ *
+ * The deploy driver enforces it before any upload and the workspace check reports it; both read
+ * this one owner.
+ */
+import * as z from 'zod/v4';
+import { CapabilityError, matchesScope, parseScopeTokens, RuntimeHardwareSchema, RuntimeSurfaceSchema, SCOPE_HARDWARE_TOKENS, SCOPE_PURPOSE_TOKENS, SCOPE_SURFACE_TOKENS } from '@vibesdotdev/kernel';
+import { jsoncCodec } from '@vibesdotdev/shared/jsonc';
+import { chainOf, exportSubpathsOf, joinPath, ModuleResolver, normalizePath, relativeTo, walkModuleGraph } from "./deployment-graph.js";
+export { scanModule } from "./deployment-graph.js";
+/** How many of the largest files and packages a report names. */
+export const DEPLOYMENT_LARGEST_FILE_COUNT = 10;
+const ceiling = z.number().finite().nonnegative();
+export const PackageBudgetsSchema = z.object({
+    build: z.object({ maxSeconds: ceiling.optional(), note: z.string().optional() }).optional(),
+    deployment: z
+        .object({
+        outputDir: z.string().min(1).optional(),
+        /** The Worker script entry, relative to the package. Absent, the provider's prepared upload paths. */
+        entry: z.string().min(1).optional(),
+        /** The Worker script size the owner expects: evidence, compared and reported, never a refusal. */
+        maxBytes: ceiling.optional(),
+        /** Substrings no Worker script file, bundled module or package may contain. */
+        forbidden: z.array(z.string()).optional(),
+        /** The static asset sizes the owner expects: evidence, compared and reported. */
+        assets: z.object({ maxBytes: ceiling.optional(), maxFileBytes: ceiling.optional() }).optional(),
+        note: z.string().optional()
+    })
+        .optional()
+});
+/** The manifest fields budgets read. Unknown fields are other owners' business. */
+export const BudgetManifestSchema = z.object({
+    name: z.string().optional(),
+    scripts: z.record(z.string(), z.string()).optional(),
+    vibes: z.object({ budgets: PackageBudgetsSchema.optional() }).optional()
+});
+/** How a provider supplies one built-in module (named without its `node:` prefix). */
+export const BundleBuiltinSchema = z.object({
+    /** `native` works; `partial` works for some of its API; `stub` imports but does nothing or throws. */
+    support: z.enum(['native', 'partial', 'stub']),
+    /** The provider compatibility date from which it is supplied, when it is date-gated. */
+    since: z.string().optional(),
+    /** The provider flag that supplies it before `since`. */
+    flag: z.string().optional(),
+    /** What works, or what does not, in the provider's words. */
+    note: z.string().optional()
+});
+/**
+ * What a deployment provider's Worker bundle is, declared by the provider on its
+ * `infra/deployment-provider` descriptor: the scopes the bundle serves, how its bundler resolves,
+ * which built-in modules it supplies and its hard size limits.
+ */
+export const DeploymentBundleTargetSchema = z.object({
+    /** The runtime scopes one bundle serves. A module whose declared scope admits none of them does not belong. */
+    scopes: z.array(z.object({ hardware: RuntimeHardwareSchema, surface: RuntimeSurfaceSchema })).min(1),
+    /** Package `exports` conditions the provider's bundler resolves, in its order. */
+    conditions: z.array(z.string().min(1)).min(1),
+    /** Manifest fields read when a package declares no `exports`, in order. */
+    mainFields: z.array(z.string().min(1)).default(['module', 'main']),
+    /** Built-in modules by name, without the `node:` prefix. A `node:` module not named here is not supplied. */
+    builtins: z.record(z.string().min(1), BundleBuiltinSchema).default({}),
+    /** Specifier schemes the provider supplies whole (`cloudflare:`), and exact specifiers it injects. */
+    providedSchemes: z.array(z.string().regex(/^[a-z][a-z0-9+.-]*:$/)).default([]),
+    providedModules: z.array(z.string().min(1)).default([]),
+    /** Host packages (`vibes.host`) this provider runs; every other host package is out of scope. */
+    hostPackages: z.array(z.string().min(1)).default([]),
+    /**
+     * The field of the provider's rendered deployment artifact that names the Worker entry, relative
+     * to the app (`main` in a wrangler config), so a build-only check finds the entry without preparing.
+     */
+    entryField: z.string().min(1).optional(),
+    /** The provider's hard ceiling on one Worker script, past which its upload refuses. */
+    maxScriptBytes: ceiling.optional(),
+    /** The provider's hard ceiling on one static asset. */
+    maxAssetFileBytes: ceiling.optional()
+});
+/** The budgets a manifest declares; a malformed ceiling throws a zod error naming the field. */
+export function budgetsOf(manifest) {
+    return PackageBudgetsSchema.parse(manifest?.vibes?.budgets ?? {});
+}
+/**
+ * Merge a package's budgets over the workspace defaults. `deployment` resolves whenever an output
+ * directory is known: the caller's (a deploy knows what it ships), the package's, or the
+ * workspace's, so no deployed package goes unmeasured. A build budget above the workspace's needs
+ * the package's own note; deployment sizes are evidence and need none.
+ */
+export function resolveBudgets(defaults, own, options = {}) {
+    const checkedDefaults = PackageBudgetsSchema.parse(defaults);
+    const checkedOwn = PackageBudgetsSchema.parse(own);
+    const problems = [];
+    const buildMax = checkedOwn.build?.maxSeconds ?? checkedDefaults.build?.maxSeconds;
+    const buildNote = checkedOwn.build?.note;
+    let build;
+    if (buildMax !== undefined)
+        build = buildNote ? { maxSeconds: buildMax, note: buildNote } : { maxSeconds: buildMax };
+    const defaultBuildMax = checkedDefaults.build?.maxSeconds;
+    if (build && defaultBuildMax !== undefined && build.maxSeconds > defaultBuildMax && !build.note) {
+        problems.push({
+            dimension: 'build',
+            message: `build budget raised to ${build.maxSeconds}s, above the workspace default of ${defaultBuildMax}s, with no note explaining why`
+        });
+    }
+    const ownDeployment = checkedOwn.deployment;
+    const workspaceDeployment = checkedDefaults.deployment;
+    const outputDir = options.outputDir ?? ownDeployment?.outputDir ?? workspaceDeployment?.outputDir;
+    let deployment;
+    if (outputDir !== undefined) {
+        const ownMax = ownDeployment?.maxBytes;
+        const maxBytes = ownMax ?? workspaceDeployment?.maxBytes;
+        const assetsMax = ownDeployment?.assets?.maxBytes ?? workspaceDeployment?.assets?.maxBytes;
+        const assetFileMax = ownDeployment?.assets?.maxFileBytes ?? workspaceDeployment?.assets?.maxFileBytes;
+        const entry = ownDeployment?.entry ?? workspaceDeployment?.entry;
+        const forbidden = ownDeployment?.forbidden ?? workspaceDeployment?.forbidden;
+        const note = ownDeployment?.note ?? workspaceDeployment?.note;
+        let assets = {};
+        if (assetsMax !== undefined)
+            assets = { ...assets, maxBytes: assetsMax };
+        if (assetFileMax !== undefined)
+            assets = { ...assets, maxFileBytes: assetFileMax };
+        let built = { outputDir, assets };
+        if (maxBytes !== undefined)
+            built = { ...built, maxBytes, source: ownMax !== undefined ? 'package' : 'workspace' };
+        if (entry)
+            built = { ...built, entry };
+        if (forbidden)
+            built = { ...built, forbidden };
+        if (note)
+            built = { ...built, note };
+        deployment = built;
+    }
+    const resolved = { problems };
+    if (build)
+        resolved.build = build;
+    if (deployment)
+        resolved.deployment = deployment;
+    return resolved;
+}
+export function humanBytes(bytes) {
+    return bytes >= 1024 * 1024 ? `${(bytes / 1024 / 1024).toFixed(2)} MB` : `${Math.round(bytes / 1024)} KB`;
+}
+export const DeploymentViolationRuleSchema = z.enum(['builtin-unsupported', 'module-scope', 'host-package', 'browser-only', 'forbidden']);
+async function filesUnder(files, directory, into) {
+    for (const entry of (await files.list(directory)) ?? []) {
+        const path = joinPath(directory, entry.name);
+        if (entry.kind === 'directory')
+            await filesUnder(files, path, into);
+        else if (entry.kind === 'file')
+            into.set(path, entry.sizeBytes ?? (await files.size(path)));
+    }
+}
+const ViteManifestSchema = z.record(z.string(), z.object({
+    file: z.string(),
+    src: z.string().optional(),
+    name: z.string().optional(),
+    isEntry: z.boolean().optional(),
+    imports: z.array(z.string()).optional(),
+    dynamicImports: z.array(z.string()).optional()
+}));
+/** A manifest that is not JSON or not Vite's shape is no attribution evidence; the measurement stands without it. */
+function parseViteManifest(text) {
+    const decoded = jsoncCodec.parse(text);
+    if (decoded.errorOffsets.length > 0)
+        return undefined;
+    const parsed = ViteManifestSchema.safeParse(decoded.value);
+    return parsed.success ? parsed.data : undefined;
+}
+const METADATA_SKIPPED = new Set(['node_modules', '.git', 'src', 'static']);
+const METADATA_DEPTH = 4;
+/** Every `.vite/manifest.json` under `directory`, to a bounded depth. A malformed one is skipped: it is evidence, not a gate. */
+async function viteManifestsUnder(files, directory, depth = 0) {
+    if (depth > METADATA_DEPTH)
+        return [];
+    const found = [];
+    for (const entry of (await files.list(directory)) ?? []) {
+        if (entry.kind !== 'directory' || METADATA_SKIPPED.has(entry.name))
+            continue;
+        const path = joinPath(directory, entry.name);
+        if (entry.name === '.vite') {
+            const text = await files.readText(joinPath(path, 'manifest.json'));
+            const manifest = text === undefined ? undefined : parseViteManifest(text);
+            if (manifest)
+                found.push({ base: directory, manifest });
+            continue;
+        }
+        found.push(...(await viteManifestsUnder(files, path, depth + 1)));
+    }
+    return found;
+}
+const CHAIN_DEPTH = 8;
+/** The importing chain of one Vite manifest key, entry first and the key's own module last. */
+export function importerChain(manifest, own) {
+    const importers = new Map();
+    for (const key of Object.keys(manifest)) {
+        const entry = manifest[key];
+        for (const imported of [...(entry?.imports ?? []), ...(entry?.dynamicImports ?? [])]) {
+            const list = importers.get(imported) ?? [];
+            list.push(key);
+            importers.set(imported, list);
+        }
+    }
+    const label = (key) => manifest[key]?.src ?? manifest[key]?.name ?? key;
+    const chain = [own];
+    const seen = new Set(chain);
+    let current = own;
+    while (chain.length < CHAIN_DEPTH && !manifest[current]?.isEntry) {
+        const next = (importers.get(current) ?? []).find((candidate) => !seen.has(candidate));
+        if (next === undefined)
+            break;
+        chain.push(next);
+        seen.add(next);
+        current = next;
+    }
+    return chain.reverse().map(label);
+}
+/** The npm package a bundled module source comes from; a workspace source keeps its leading path. */
+export function packageOfModule(source) {
+    const index = source.lastIndexOf('node_modules/');
+    if (index >= 0) {
+        const [first, second] = source.slice(index + 'node_modules/'.length).split('/');
+        return first?.startsWith('@') && second ? `${first}/${second}` : (first ?? source);
+    }
+    return source.split('/').filter((segment) => segment !== '..' && segment !== '.').slice(0, 3).join('/');
+}
+/** The source module a Vite manifest names for a built chunk, relative to the manifest's package. */
+function manifestSource(manifests, path) {
+    for (const located of manifests) {
+        for (const entry of Object.values(located.manifest)) {
+            if (normalizePath(joinPath(located.base, entry.file)) === path && entry.src)
+                return entry.src;
+        }
+    }
+    return undefined;
+}
+function largestFirst(entries) {
+    return [...entries].sort((left, right) => right[1] - left[1]);
+}
+const SCOPE_TOKENS = new Set([...SCOPE_HARDWARE_TOKENS, ...SCOPE_SURFACE_TOKENS, ...SCOPE_PURPOSE_TOKENS]);
+const SOURCE_EXTENSION = /\.(?:m|c)?[jt]sx?$|\.svelte$|\.json$/;
+/**
+ * The scope a file's name declares, read by the kernel's grammar: the scope tokens among the
+ * dot-separated segments after its stem (`report.impl.consumer.ts` is `consumer`,
+ * `ai.browser.plugin.ts` is `browser`). A file with none is universal.
+ */
+export function fileScopeOf(path) {
+    const base = (path.split(/[?#]/)[0] ?? path).split('/').at(-1) ?? '';
+    const segments = base.replace(SOURCE_EXTENSION, '').split('.').slice(1);
+    return parseScopeTokens(segments.filter((segment) => SCOPE_TOKENS.has(segment)).join('.'), path);
+}
+/** A `*.descriptor.*` module: universal by contract, whatever scope tokens its name carries. */
+export function isDescriptorFile(path) {
+    const base = (path.split(/[?#]/)[0] ?? path).split('/').at(-1) ?? '';
+    return base.replace(SOURCE_EXTENSION, '').split('.').slice(1).includes('descriptor');
+}
+/**
+ * The scope an export name claims, read by the same grammar: every scope token among its path
+ * and dot segments (`./consumer/plugin` is `consumer`, `./browser-automation/cli.plugin` is `cli`).
+ * An export name is an environment claim.
+ */
+export function exportScopeOf(subpath) {
+    const tokens = subpath
+        .split('/')
+        .flatMap((segment) => segment.split('.'))
+        .filter((segment) => SCOPE_TOKENS.has(segment));
+    return parseScopeTokens(tokens.join('.'), subpath);
+}
+/** Whether a declared scope admits any scope the bundle serves. Purposes have no bearing on placement. */
+export function scopeAdmitsTarget(constraint, target) {
+    if (!constraint)
+        return true;
+    const placement = {};
+    if (constraint.hardware?.length)
+        placement.hardware = constraint.hardware;
+    if (constraint.surfaces?.length)
+        placement.surfaces = constraint.surfaces;
+    return target.scopes.some((scope) => matchesScope({ hardware: scope.hardware, surface: scope.surface }, placement));
+}
+function spelling(constraint) {
+    return [...(constraint.hardware ?? []), ...(constraint.surfaces ?? []), ...(constraint.purposes ?? [])].join('.');
+}
+function targetSpelling(target) {
+    return target.scopes.map((scope) => `${scope.hardware}.${scope.surface}`).join(', ');
+}
+const BROWSER_ONLY_QUERY = /[?&](?:worker|sharedworker)(?:&|$)/;
+/** Violations of one module, collected per (rule, package, detail) so a barrel that drags in fifty files reads as one finding. */
+class ViolationCollector {
+    #byKey = new Map();
+    add(violation, groupBy) {
+        const key = `${violation.rule}\u0000${violation.package ?? ''}\u0000${groupBy}`;
+        const existing = this.#byKey.get(key);
+        if (existing)
+            existing.occurrences += 1;
+        else
+            this.#byKey.set(key, { violation, occurrences: 1 });
+    }
+    list() {
+        return [...this.#byKey.values()].map(({ violation, occurrences }) => ({ ...violation, occurrences }));
+    }
+}
+function moduleScopeDetail(module, target) {
+    const owner = module.owner;
+    // The file-scope grammar is the Vibes convention; third-party packages name files their own way
+    // (an `index.browser.js` is that package's choice for the `browser` condition the bundler asked for).
+    if (!owner?.vibes)
+        return undefined;
+    // A descriptor imports in every scope whatever scope its name carries: carrying no
+    // implementation is the point (kernel SPEC, file-scope grammar).
+    if (isDescriptorFile(module.path))
+        return undefined;
+    const suffix = fileScopeOf(module.path);
+    if (suffix && !scopeAdmitsTarget(suffix, target)) {
+        return `its file name declares scope '${spelling(suffix)}', which serves none of ${targetSpelling(target)}`;
+    }
+    const claims = exportSubpathsOf(owner, module.path)
+        .map((subpath) => ({ subpath, scope: exportScopeOf(subpath) }))
+        .filter((claim) => claim.scope !== undefined);
+    if (claims.length > 0 && !claims.some((claim) => scopeAdmitsTarget(claim.scope, target))) {
+        const [first] = claims;
+        if (first)
+            return `${owner.name} publishes it as '${first.subpath}', which claims scope '${spelling(first.scope)}' and serves none of ${targetSpelling(target)}`;
+    }
+    return undefined;
+}
+/**
+ * Measure a built deployment and check its Worker graph. `entries` are the Worker script entries
+ * (absolute); the declared `entry` wins over them. A missing output directory is a typed refusal:
+ * an unbuilt output is not a small one. Without a provider `target`, the graph is measured and
+ * the app's `forbidden` list applies, but no provider scope or built-in rule can.
+ */
+export async function measureDeploymentOutput(input) {
+    const { files, packageDir, outputDirectory, budget } = input;
+    const target = input.target ? DeploymentBundleTargetSchema.parse(input.target) : undefined;
+    if ((await files.list(outputDirectory)) === undefined) {
+        throw new CapabilityError(`The deployment output ${outputDirectory} does not exist, so it cannot be measured.`, 'NOT_FOUND', {
+            reason: 'deployment-output-missing',
+            details: { outputDirectory },
+            recoveryHint: 'Build the app first; an unbuilt output is not a small one.'
+        });
+    }
+    const output = new Map();
+    await filesUnder(files, outputDirectory, output);
+    const entries = budget.entry ? [normalizePath(joinPath(packageDir, budget.entry))] : [...(input.entries ?? [])].map(normalizePath);
+    const resolver = new ModuleResolver(files, {
+        conditions: target?.conditions ?? ['import', 'module'],
+        mainFields: target?.mainFields ?? ['module', 'main'],
+        builtinNames: new Set(Object.keys(target?.builtins ?? {}))
+    });
+    let worker;
+    let graph;
+    if (entries.length > 0) {
+        graph = await walkModuleGraph(resolver, files, entries);
+        worker = await measureWorker({ graph, resolver, files, packageDir, budget, target, entries });
+    }
+    const shipped = new Set(graph ? [...graph.files.keys()] : []);
+    const assetFiles = [];
+    for (const [path, bytes] of largestFirst(output)) {
+        if (shipped.has(path) || shipped.has(await resolver.real(path)))
+            continue;
+        assetFiles.push({ path: relativeTo(packageDir, path), bytes });
+    }
+    const assetTotal = assetFiles.reduce((sum, file) => sum + file.bytes, 0);
+    const assetFileMax = budget.assets.maxFileBytes;
+    const oversized = assetFileMax === undefined ? [] : assetFiles.filter((file) => file.bytes > assetFileMax);
+    const platformAssetMax = target?.maxAssetFileBytes;
+    const assets = {
+        totalBytes: assetTotal,
+        fileCount: assetFiles.length,
+        largest: assetFiles.slice(0, DEPLOYMENT_LARGEST_FILE_COUNT),
+        oversized,
+        overPlatformLimit: platformAssetMax === undefined ? [] : assetFiles.filter((file) => file.bytes > platformAssetMax),
+        overBudget: (budget.assets.maxBytes !== undefined && assetTotal > budget.assets.maxBytes) || oversized.length > 0
+    };
+    let measurement = { outputDirectory, budget, assets };
+    if (target)
+        measurement = { ...measurement, target };
+    if (worker)
+        measurement = { ...measurement, worker };
+    return measurement;
+}
+async function measureWorker(input) {
+    const { graph, resolver, files, packageDir, budget, target } = input;
+    const realPackageDir = await resolver.real(packageDir);
+    const label = (path) => relativeTo(realPackageDir, path);
+    const chain = (path) => chainOf(graph, path).map(label);
+    const appPackage = await resolver.packageAt(realPackageDir);
+    const isOwnOutput = (path) => !path.includes('/node_modules/') && (path === realPackageDir || path.startsWith(`${realPackageDir}/`));
+    const manifests = await viteManifestsUnder(files, packageDir);
+    const weights = new Map();
+    const weigh = (name, bytes) => weights.set(name, (weights.get(name) ?? 0) + bytes);
+    const violations = new ViolationCollector();
+    const notices = [];
+    const forbidden = budget.forbidden ?? [];
+    let outputBytes = 0;
+    let dependencyBytes = 0;
+    const measured = [];
+    const checkModule = (module, packageName, staticallyReachable) => {
+        const relative = label(module.path);
+        const packageField = packageName ? { package: packageName } : {};
+        for (const pattern of forbidden) {
+            if (relative.includes(pattern) || (packageName ?? '').includes(pattern)) {
+                violations.add({ rule: 'forbidden', module: relative, importers: module.importers, detail: `the app forbids '${pattern}' in its Worker`, ...packageField }, pattern);
+            }
+        }
+        if (staticallyReachable && BROWSER_ONLY_QUERY.test(module.path)) {
+            violations.add({ rule: 'browser-only', module: relative, importers: module.importers, detail: 'a Web Worker target is browser-only and cannot run in a Worker script', ...packageField }, relative);
+        }
+        if (!target)
+            return;
+        if (module.owner?.host && !target.hostPackages.includes(module.owner.name)) {
+            violations.add({ rule: 'host-package', module: relative, importers: module.importers, detail: `${module.owner.name} is a host package (vibes.host) this provider does not run`, ...packageField }, module.owner.name);
+        }
+        const scoped = moduleScopeDetail(module, target);
+        if (scoped && staticallyReachable)
+            violations.add({ rule: 'module-scope', module: relative, importers: module.importers, detail: scoped, ...packageField }, relative);
+    };
+    for (const file of graph.files.values()) {
+        const fileStatic = graph.staticReachable.has(file.path);
+        const own = isOwnOutput(file.path);
+        const fileChain = chain(file.path);
+        const packageName = file.package?.name ?? appPackage?.name;
+        if (own)
+            outputBytes += file.bytes;
+        else
+            dependencyBytes += file.bytes;
+        let attributed = 0;
+        const regionWeights = new Map();
+        if (file.regions.length > 0) {
+            for (const region of file.regions) {
+                const source = region.source.startsWith('\0') ? undefined : normalizePath(joinPath(realPackageDir, region.source.split('?')[0] ?? region.source));
+                const owner = source ? await resolver.ownerOf(source) : undefined;
+                const name = owner?.name ?? packageOfModule(region.source);
+                weigh(name, region.bytes);
+                regionWeights.set(name, (regionWeights.get(name) ?? 0) + region.bytes);
+                attributed += region.bytes;
+                if (source) {
+                    const query = region.source.includes('?') ? `?${region.source.split('?').slice(1).join('?')}` : '';
+                    let module = { path: `${source}${query}`, importers: [...fileChain, label(source)] };
+                    if (owner)
+                        module = { ...module, owner };
+                    checkModule(module, owner?.name ?? name, fileStatic);
+                }
+            }
+        }
+        // A built chunk without region markers is attributed by the bundler's manifest, when it names a source.
+        const source = own ? manifestSource(manifests, file.path) : undefined;
+        const sourceOwner = source && !source.startsWith('\0') ? await resolver.ownerOf(normalizePath(joinPath(realPackageDir, source))) : undefined;
+        const fallback = sourceOwner?.name ?? (source ? packageOfModule(source) : undefined) ?? packageName ?? '(unattributed)';
+        // A file is listed under the package that contributes most of its bytes.
+        const [dominant] = largestFirst(regionWeights);
+        const listedPackage = dominant && dominant[1] > file.bytes - attributed ? dominant[0] : fallback;
+        if (file.regions.length === 0) {
+            let module = { path: file.path, importers: fileChain };
+            if (file.package)
+                module = { ...module, owner: file.package };
+            checkModule(module, fallback, fileStatic);
+        }
+        const remainder = file.bytes - attributed;
+        if (remainder > 0)
+            weigh(fallback, remainder);
+        let entry = { path: label(file.path), bytes: file.bytes, importers: fileChain };
+        if (listedPackage !== '(unattributed)')
+            entry = { ...entry, package: listedPackage };
+        measured.push(entry);
+    }
+    for (const leaf of graph.builtins) {
+        const importerFile = graph.files.get(leaf.importer);
+        const importerPackage = importerFile?.package?.name ?? appPackage?.name;
+        const importers = [...chain(leaf.importer), leaf.specifier];
+        const packageField = importerPackage ? { package: importerPackage } : {};
+        if (!target)
+            continue;
+        if (target.providedModules.includes(leaf.specifier))
+            continue;
+        const scheme = /^([a-z][a-z0-9+.-]*:)/i.exec(leaf.specifier)?.[1];
+        if (scheme && scheme !== 'node:') {
+            if (target.providedSchemes.includes(scheme))
+                continue;
+            violations.add({ rule: 'builtin-unsupported', module: leaf.specifier, importers, detail: `the provider supplies no '${scheme}' modules`, ...packageField }, leaf.specifier);
+            continue;
+        }
+        const name = leaf.name;
+        const declared = target.builtins[name] ?? target.builtins[name.split('/')[0] ?? name];
+        if (!declared) {
+            violations.add({ rule: 'builtin-unsupported', module: `node:${name}`, importers, detail: `the provider does not supply node:${name}`, ...packageField }, name);
+        }
+        else if (declared.support === 'stub') {
+            violations.add({ rule: 'builtin-unsupported', module: `node:${name}`, importers, detail: `the provider supplies node:${name} only as a non-functional stub${declared.note ? ` (${declared.note})` : ''}`, ...packageField }, name);
+        }
+        else if (declared.support === 'partial') {
+            notices.push({ module: `node:${name}`, importers, detail: `the provider supplies node:${name} in part${declared.note ? `: ${declared.note}` : ''}`, ...packageField });
+        }
+    }
+    const totalBytes = outputBytes + dependencyBytes;
+    const sorted = [...measured].sort((left, right) => right.bytes - left.bytes);
+    return {
+        entries: input.entries.map((entry) => relativeTo(packageDir, entry)),
+        totalBytes,
+        fileCount: measured.length,
+        outputBytes,
+        dependencyBytes,
+        largest: sorted.slice(0, DEPLOYMENT_LARGEST_FILE_COUNT),
+        packages: largestFirst(weights).slice(0, DEPLOYMENT_LARGEST_FILE_COUNT).map(([name, bytes]) => ({ name, bytes })),
+        violations: violations.list(),
+        notices: dedupeNotices(notices),
+        unresolved: graph.unresolved.map((leaf) => ({ specifier: leaf.specifier, importer: label(leaf.importer) })),
+        overBudget: budget.maxBytes !== undefined && totalBytes > budget.maxBytes,
+        overPlatformLimit: target?.maxScriptBytes !== undefined && totalBytes > target.maxScriptBytes
+    };
+}
+function dedupeNotices(notices) {
+    const byKey = new Map();
+    for (const notice of notices) {
+        const key = `${notice.module}\u0000${notice.package ?? ''}`;
+        if (!byKey.has(key))
+            byKey.set(key, notice);
+    }
+    return [...byKey.values()];
+}
+const CHAIN_SHOWN = 10;
+function chainText(importers) {
+    if (importers.length <= 1)
+        return '';
+    const shown = importers.length > CHAIN_SHOWN ? [...importers.slice(0, 3), '…', ...importers.slice(-(CHAIN_SHOWN - 4))] : importers;
+    return ` (imported via ${shown.join(' > ')})`;
+}
+function fileLines(list) {
+    return list.map((file, index) => {
+        const owner = file.package ? ` [${file.package}]` : '';
+        return `  ${index + 1}. ${humanBytes(file.bytes)} ${file.path}${owner}${chainText(file.importers ?? [])}`;
+    });
+}
+function declaredSize(budget) {
+    if (budget.maxBytes === undefined)
+        return 'no declared size';
+    return `a declared ${humanBytes(budget.maxBytes)} (${budget.source === 'package' ? 'the app' : 'workspace default'})`;
+}
+/** One line per violation: rule, module, package, why, and the chain that reached it. */
+export function formatDeploymentViolations(violations) {
+    return violations.map((violation, index) => {
+        const owner = violation.package ? ` [${violation.package}]` : '';
+        const more = violation.occurrences > 1 ? ` (+${violation.occurrences - 1} more like it)` : '';
+        return `  ${index + 1}. ${violation.rule}: ${violation.module}${owner}: ${violation.detail}${more}${chainText(violation.importers)}`;
+    });
+}
+/** The Worker script and static asset report of a measurement: scope violations first, then the size evidence. */
+export function formatDeploymentMeasurement(label, measurement) {
+    const { budget, worker, assets, target } = measurement;
+    const lines = [];
+    if (worker) {
+        if (worker.violations.length > 0) {
+            lines.push(`${label} Worker graph has ${worker.violations.length} scope violation(s): modules that do not belong in a ${target ? targetSpelling(target) : 'Worker'} bundle.`, ...formatDeploymentViolations(worker.violations));
+        }
+        else {
+            lines.push(`${label} Worker graph is scope-clean${target ? ` for ${targetSpelling(target)}` : ' (the provider declares no bundle scope, so only the forbidden list applied)'}.`);
+        }
+        if (worker.overPlatformLimit && target?.maxScriptBytes !== undefined) {
+            lines.push(`${label} Worker graph is ${humanBytes(worker.totalBytes)}, over the provider's hard script limit of ${humanBytes(target.maxScriptBytes)}: the upload would fail.`);
+        }
+        if (worker.overBudget && budget.maxBytes !== undefined) {
+            lines.push(`SIZE: ${label} Worker graph is ${humanBytes(worker.totalBytes)}, over ${declaredSize(budget)}. Size is evidence: find what the scope violations or the heaviest packages below brought in.`);
+        }
+        lines.push(`${label} Worker graph is ${humanBytes(worker.totalBytes)} in ${worker.fileCount} file(s) reachable from ${worker.entries.join(', ')} (${humanBytes(worker.outputBytes)} built output, ${humanBytes(worker.dependencyBytes)} resolved from packages; pre-minify, pre-tree-shake), against ${declaredSize(budget)}.`, 'Largest Worker files:', ...fileLines(worker.largest), 'Heaviest packages in the Worker:', ...worker.packages.map((weight, index) => `  ${index + 1}. ${humanBytes(weight.bytes)} ${weight.name}`));
+        if (worker.notices.length > 0) {
+            lines.push('Built-ins the provider supplies in part (check the APIs used):', ...worker.notices.map((notice, index) => `  ${index + 1}. ${notice.module}${notice.package ? ` [${notice.package}]` : ''}: ${notice.detail}${chainText(notice.importers)}`));
+        }
+        if (worker.unresolved.length > 0) {
+            lines.push(`Unresolved specifiers (${worker.unresolved.length}): ${worker.unresolved.slice(0, DEPLOYMENT_LARGEST_FILE_COUNT).map((leaf) => `${leaf.specifier} from ${leaf.importer}`).join('; ')}`);
+        }
+    }
+    else {
+        lines.push(`${label} Worker script not measured: no entry is declared (vibes.budgets.deployment.entry) and the provider prepared none.`);
+    }
+    const assetBudget = [
+        budget.assets.maxBytes !== undefined ? `${humanBytes(budget.assets.maxBytes)} total` : undefined,
+        budget.assets.maxFileBytes !== undefined ? `${humanBytes(budget.assets.maxFileBytes)} per file` : undefined
+    ].filter((part) => part !== undefined);
+    lines.push(`${label} static assets are ${humanBytes(assets.totalBytes)} in ${assets.fileCount} file(s)${assetBudget.length > 0 ? `, against a declared ${assetBudget.join(' and ')}` : ''}.`);
+    if (assets.overBudget)
+        lines.push(`SIZE: ${label} static assets are over their declared size; ${assets.oversized.length} file(s) over the declared per-file size.`);
+    for (const file of assets.overPlatformLimit) {
+        lines.push(`${label} static asset ${file.path} is ${humanBytes(file.bytes)}, over the provider's hard per-asset limit of ${humanBytes(target?.maxAssetFileBytes ?? 0)}: the upload would fail.`);
+    }
+    return lines.join('\n');
+}
+const SCOPE_RECOVERY_HINT = 'Fix each import at its owner: a broad barrel, a static import of an implementation or optional peer, or a plugin composed for the wrong scope. Consumer, CLI and browser code reaches a cloud bundle only through a *.consumer.plugin.ts or browser entry this bundle never imports. Run `vibes infra deploy run --build-only` to iterate without uploading.';
+function violationDetails(measurement) {
+    const { worker, assets, target } = measurement;
+    return {
+        outputDirectory: measurement.outputDirectory,
+        scopes: target ? target.scopes.map((scope) => `${scope.hardware}.${scope.surface}`) : [],
+        violations: (worker?.violations ?? []).map((violation) => ({
+            rule: violation.rule,
+            module: violation.module,
+            package: violation.package ?? null,
+            importers: [...violation.importers],
+            detail: violation.detail,
+            occurrences: violation.occurrences
+        })),
+        worker: worker
+            ? {
+                entries: [...worker.entries],
+                totalBytes: worker.totalBytes,
+                maxScriptBytes: target?.maxScriptBytes ?? null,
+                overPlatformLimit: worker.overPlatformLimit,
+                largest: worker.largest.map((file) => ({ path: file.path, bytes: file.bytes, package: file.package ?? null, importers: [...(file.importers ?? [])] })),
+                packages: worker.packages.map((weight) => ({ name: weight.name, bytes: weight.bytes }))
+            }
+            : null,
+        assets: { totalBytes: assets.totalBytes, maxAssetFileBytes: target?.maxAssetFileBytes ?? null, overPlatformLimit: assets.overPlatformLimit.map((file) => file.path) }
+    };
+}
+/**
+ * The typed refusal for a measurement that must not ship. `deployment-scope-violation` lists every
+ * module that does not belong; `deployment-platform-limit-exceeded` is a Worker script or asset over
+ * the provider's own hard limit. Declared sizes never refuse. Undefined when it may ship.
+ */
+export function deploymentRefusal(label, measurement) {
+    const { worker, assets } = measurement;
+    const summary = formatDeploymentMeasurement(label, measurement);
+    const details = violationDetails(measurement);
+    if (worker && worker.violations.length > 0) {
+        return new CapabilityError([`${label} Worker bundle carries ${worker.violations.length} module(s) that do not belong in its scope:`, ...formatDeploymentViolations(worker.violations), '', summary].join('\n'), 'INVALID_INPUT', { reason: 'deployment-scope-violation', retryable: false, details, recoveryHint: SCOPE_RECOVERY_HINT });
+    }
+    if (worker?.overPlatformLimit || assets.overPlatformLimit.length > 0) {
+        return new CapabilityError([`${label} deployment is over the provider's hard upload limit; the upload would fail.`, summary].join('\n'), 'INVALID_INPUT', {
+            reason: 'deployment-platform-limit-exceeded',
+            retryable: false,
+            details,
+            recoveryHint: 'Find what the heaviest packages and largest files brought in and remove it at its owner; the provider will not accept this upload.'
+        });
+    }
+    return undefined;
+}
+//# sourceMappingURL=deployment-budget.js.map