@vibesdotdev/infra-deploy 0.0.1 → 1.0.0-rc.4

package/dist/cli/npm/publish/command-options.js

@@ -0,0 +1,85 @@
+/**
+ * Parsing of loosely typed CLI option values and the release contract version.
+ */
+import { resolveFileSystemAdapter } from "@vibesdotdev/filesystem";
+import { getRuntimePath } from "@vibesdotdev/paths";
+import { CapabilityError, CaughtFailureSchema, settle, valueFreeFailure } from "@vibesdotdev/kernel";
+import { z } from "zod/v4";
+import { parseWorkspaceRootManifest } from "./publisher-manifest.js";
+/** A trimmed non-empty string option, else undefined. */
+export function readString(value) {
+    const parsed = z.string().safeParse(value);
+    if (!parsed.success)
+        return undefined;
+    const trimmed = parsed.data.trim();
+    return trimmed.length > 0 ? trimmed : undefined;
+}
+/** CLI/wire contract version. v1 cannot represent a build-only closure. */
+export function parseReleaseContractVersion(value) {
+    const parsed = z
+        .union([z.null(), z.undefined(), z.number().int(), z.string()])
+        .safeParse(value);
+    if (!parsed.success) {
+        throw new CapabilityError("Registry release contract version must be 1 or 2", "INVALID_INPUT");
+    }
+    if (parsed.data === null || parsed.data === undefined)
+        return 1;
+    const asNumber = z.number().safeParse(parsed.data);
+    const text = asNumber.success ? String(asNumber.data) : readString(parsed.data);
+    if (text === "1")
+        return 1;
+    if (text === "2")
+        return 2;
+    throw new CapabilityError("Registry release contract version must be 1 or 2", "INVALID_INPUT");
+}
+/**
+ * Release contract version for this run. The CLI flag wins; otherwise the
+ * release workspace root declares it via `vibes.release.contractVersion` in
+ * its package.json; otherwise v1. An unreadable root manifest or an invalid
+ * configured value fails closed with the file named: a release must never
+ * silently run under a contract the operator did not choose.
+ */
+export async function resolveReleaseContractVersion(options) {
+    if (options.flagValue !== undefined && options.flagValue !== null) {
+        return parseReleaseContractVersion(options.flagValue);
+    }
+    const manifestPath = (await getRuntimePath(options.runtime)).join(options.workspaceRoot, "package.json");
+    const files = await resolveFileSystemAdapter(options.runtime);
+    const read = await settle(async () => JSON.parse(z.string().parse(await files.readFile(manifestPath, "utf8"))));
+    if (!read.ok) {
+        throw new CapabilityError(`Cannot resolve the release contract version: ${manifestPath} is unreadable`, "INVALID_INPUT", { cause: valueFreeFailure(read.cause) });
+    }
+    const manifest = parseWorkspaceRootManifest(read.value);
+    const configured = manifest.vibes?.release?.contractVersion;
+    if (configured === undefined || configured === null)
+        return 1;
+    try {
+        return parseReleaseContractVersion(configured);
+    }
+    catch (error) {
+        throw new CapabilityError(`Registry release contract version must be 1 or 2 (vibes.release.contractVersion in ${manifestPath})`, "INVALID_INPUT", { cause: valueFreeFailure(CaughtFailureSchema.parse(error)) });
+    }
+}
+/** A flag option: true for `true`, `"true"` or `"yes"`. */
+export function readBoolean(value) {
+    const parsed = z.union([z.literal(true), z.literal("true"), z.literal("yes")]).safeParse(value);
+    return parsed.success;
+}
+/** A finite numeric option (number or numeric string), else `fallback`. */
+export function readNumber(value, fallback) {
+    const asNumber = z.number().safeParse(value);
+    if (asNumber.success && Number.isFinite(asNumber.data))
+        return asNumber.data;
+    const asText = z.string().safeParse(value);
+    if (!asText.success || asText.data.trim().length === 0)
+        return fallback;
+    const parsed = Number(asText.data);
+    return Number.isFinite(parsed) ? parsed : fallback;
+}
+/** `value` floored and clamped at zero; `fallback` when not finite. */
+export function positiveInteger(value, fallback) {
+    if (!Number.isFinite(value))
+        return fallback;
+    return Math.max(0, Math.floor(value));
+}
+//# sourceMappingURL=command-options.js.map

package/dist/cli/npm/publish/command-options.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"command-options.js","sourceRoot":"","sources":["../../../../src/cli/npm/publish/command-options.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACrG,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;AAE3B,OAAO,EAAE,0BAA0B,EAAE,MAAM,yBAAyB,CAAC;AAGrE,yDAAyD;AACzD,MAAM,UAAU,UAAU,CAAC,KAAc;IACvC,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IACtC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IACnC,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AAClD,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,2BAA2B,CAAC,KAAc;IACxD,MAAM,MAAM,GAAG,CAAC;SACb,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;SAC9D,SAAS,CAAC,KAAK,CAAC,CAAC;IACpB,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,eAAe,CACvB,kDAAkD,EAClD,eAAe,CAChB,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACnD,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAChF,IAAI,IAAI,KAAK,GAAG;QAAE,OAAO,CAAC,CAAC;IAC3B,IAAI,IAAI,KAAK,GAAG;QAAE,OAAO,CAAC,CAAC;IAC3B,MAAM,IAAI,eAAe,CACvB,kDAAkD,EAClD,eAAe,CAChB,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,OAInD;IACC,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,OAAO,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QAClE,OAAO,2BAA2B,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACxD,CAAC;IACD,MAAM,YAAY,GAAG,CAAC,MAAM,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAC/D,OAAO,CAAC,aAAa,EACrB,cAAc,CACf,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,wBAAwB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9D,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,KAAK,IAAI,EAAE,CACnC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,CACzE,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,MAAM,IAAI,eAAe,CACvB,gDAAgD,YAAY,gBAAgB,EAC5E,eAAe,EACf,EAAE,KAAK,EAAE,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CACxC,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAA0B,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/E,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,EAAE,OAAO,EAAE,eAAe,CAAC;IAC5D,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,CAAC,CAAC;IAC9D,IAAI,CAAC;QACH,OAAO,2BAA2B,CAAC,UAAU,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,eAAe,CACvB,sFAAsF,YAAY,GAAG,EACrG,eAAe,EACf,EAAE,KAAK,EAAE,gBAAgB,CAAC,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAC9D,CAAC;IACJ,CAAC;AACH,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAChG,OAAO,MAAM,CAAC,OAAO,CAAC;AACxB,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,UAAU,CAAC,KAAc,EAAE,QAAgB;IACzD,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC7C,IAAI,QAAQ,CAAC,OAAO,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,QAAQ,CAAC,IAAI,CAAC;IAC7E,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IACxE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACnC,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;AACrD,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,eAAe,CAAC,KAAa,EAAE,QAAgB;IAC7D,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC7C,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;AACxC,CAAC"}

package/dist/cli/npm/publish/concurrency.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Bounded-concurrency mapping used by Registry probes, Git inspection and
+ * Registry input sealing.
+ */
+export declare function mapWithConcurrency<T, R>(values: readonly T[], limit: number, map: (value: T, index: number) => Promise<R>): Promise<R[]>;
+/**
+ * `mapWithConcurrency` for work whose side effects must not outlive a failure
+ * (child processes in a temp root the caller removes once this rejects). After
+ * the first rejection no further value starts and `signal` aborts, so a started
+ * mapping can skip work it no longer needs; every started mapping settles, and
+ * then the rejection with the lowest index is rethrown.
+ *
+ * Values start in index order, so every value below a failing one has started
+ * by then, and the error is the one a sequential loop would have thrown, as
+ * long as a mapping honours `signal` only where its remaining work cannot
+ * reject. A rejection with `signal.reason` is that stop, not a failure.
+ */
+export declare function mapWithConcurrencyUntilFirstFailure<T, R>(values: readonly T[], limit: number, map: (value: T, index: number, signal: AbortSignal) => Promise<R>): Promise<R[]>;
+//# sourceMappingURL=concurrency.d.ts.map

package/dist/cli/npm/publish/concurrency.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"concurrency.d.ts","sourceRoot":"","sources":["../../../../src/cli/npm/publish/concurrency.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,wBAAsB,kBAAkB,CAAC,CAAC,EAAE,CAAC,EAC3C,MAAM,EAAE,SAAS,CAAC,EAAE,EACpB,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,GAC3C,OAAO,CAAC,CAAC,EAAE,CAAC,CAiBd;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,mCAAmC,CAAC,CAAC,EAAE,CAAC,EAC5D,MAAM,EAAE,SAAS,CAAC,EAAE,EACpB,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,KAAK,OAAO,CAAC,CAAC,CAAC,GAChE,OAAO,CAAC,CAAC,EAAE,CAAC,CA0Bd"}

package/dist/cli/npm/publish/concurrency.js

@@ -0,0 +1,60 @@
+/**
+ * Bounded-concurrency mapping used by Registry probes, Git inspection and
+ * Registry input sealing.
+ */
+import { settle } from "@vibesdotdev/kernel";
+export async function mapWithConcurrency(values, limit, map) {
+    const results = [];
+    results.length = values.length;
+    let cursor = 0;
+    const workers = Array.from({ length: Math.min(Math.max(1, limit), values.length) }, async () => {
+        while (true) {
+            const index = cursor;
+            cursor += 1;
+            if (index >= values.length)
+                return;
+            results[index] = await map(values[index], index);
+        }
+    });
+    await Promise.all(workers);
+    return results;
+}
+/**
+ * `mapWithConcurrency` for work whose side effects must not outlive a failure
+ * (child processes in a temp root the caller removes once this rejects). After
+ * the first rejection no further value starts and `signal` aborts, so a started
+ * mapping can skip work it no longer needs; every started mapping settles, and
+ * then the rejection with the lowest index is rethrown.
+ *
+ * Values start in index order, so every value below a failing one has started
+ * by then, and the error is the one a sequential loop would have thrown, as
+ * long as a mapping honours `signal` only where its remaining work cannot
+ * reject. A rejection with `signal.reason` is that stop, not a failure.
+ */
+export async function mapWithConcurrencyUntilFirstFailure(values, limit, map) {
+    const stop = new AbortController();
+    let failure;
+    const settled = await mapWithConcurrency(values, limit, async (value, index) => {
+        if (stop.signal.aborted)
+            return undefined;
+        const outcome = await settle(() => map(value, index, stop.signal));
+        if (outcome.ok)
+            return { result: outcome.value };
+        if (stop.signal.aborted && outcome.cause === stop.signal.reason)
+            return undefined;
+        if (!failure || index < failure.index)
+            failure = { index, cause: outcome.cause };
+        stop.abort(new Error("Stopped after an earlier mapping failed"));
+        return undefined;
+    });
+    if (failure) {
+        const cause = failure.cause;
+        throw cause instanceof Error ? cause : cause.value;
+    }
+    return settled.map((entry, index) => {
+        if (!entry)
+            throw new Error(`Mapping ${index} settled without a result`);
+        return entry.result;
+    });
+}
+//# sourceMappingURL=concurrency.js.map

package/dist/cli/npm/publish/concurrency.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"concurrency.js","sourceRoot":"","sources":["../../../../src/cli/npm/publish/concurrency.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,MAAM,EAAsB,MAAM,qBAAqB,CAAC;AAEjE,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAoB,EACpB,KAAa,EACb,GAA4C;IAE5C,MAAM,OAAO,GAAQ,EAAE,CAAC;IACxB,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC/B,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CACxB,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,EACvD,KAAK,IAAI,EAAE;QACT,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,KAAK,GAAG,MAAM,CAAC;YACrB,MAAM,IAAI,CAAC,CAAC;YACZ,IAAI,KAAK,IAAI,MAAM,CAAC,MAAM;gBAAE,OAAO;YACnC,OAAO,CAAC,KAAK,CAAC,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,KAAK,CAAE,EAAE,KAAK,CAAC,CAAC;QACpD,CAAC;IACH,CAAC,CACF,CAAC;IACF,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC3B,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACvD,MAAoB,EACpB,KAAa,EACb,GAAiE;IAEjE,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;IACnC,IAAI,OAA4D,CAAC;IACjE,MAAM,OAAO,GAAG,MAAM,kBAAkB,CACtC,MAAM,EACN,KAAK,EACL,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;QACrB,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,SAAS,CAAC;QAC1C,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QACnE,IAAI,OAAO,CAAC,EAAE;YAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;QACjD,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,OAAO,CAAC,KAAK,KAAK,IAAI,CAAC,MAAM,CAAC,MAAM;YAC7D,OAAO,SAAS,CAAC;QACnB,IAAI,CAAC,OAAO,IAAI,KAAK,GAAG,OAAO,CAAC,KAAK;YACnC,OAAO,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;QAC5C,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC,CAAC;QACjE,OAAO,SAAS,CAAC;IACnB,CAAC,CACF,CAAC;IACF,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC5B,MAAM,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC;IACrD,CAAC;IACD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QAClC,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,WAAW,KAAK,2BAA2B,CAAC,CAAC;QACzE,OAAO,KAAK,CAAC,MAAM,CAAC;IACtB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/cli/npm/publish/consumer-smoke.d.ts

@@ -0,0 +1,83 @@
+/**
+ * Publisher consumer smoke: install the sealed batch as a plain consumer and
+ * import every reachable export target, refusing every failed runtime import.
+ */
+import type { ChildEnvRuntime } from "../../shared/runtime-execution.ts";
+import type { UIContext } from "@vibesdotdev/cli/providers";
+import type { RegistryPublishManifest } from "@vibesdotdev/registry";
+import type { RuntimeExecution } from "@vibesdotdev/kernel/execution";
+import type { ReleaseConsumerSourceRegistry } from "./proof-registry.ts";
+/**
+ * Every import-time export-map/main target this package could load at runtime, following
+ * the same enumeration `verifyPackedPackage` uses to prove every target
+ * exists in the tarball. Wildcard subpaths (`./*`) have no single concrete
+ * file to import, and non-script targets (`.d.ts`, `.svelte`, `.css`, …) are
+ * not importable by a bare Node/Bun runtime — both are already covered by
+ * `verifyPackedPackage`'s existence check and the SvelteKit SSR proof, so
+ * this only returns the concrete `.js`/`.mjs`/`.cjs` files a plain
+ * `import()` can actually execute.
+ */
+export declare function publisherConsumerSmokeImportTargets(manifest: Pick<RegistryPublishManifest, "main" | "exports">): string[];
+/** One sealed batch member the smoke installs from its packed tarball. */
+export type PublisherConsumerSmokeMember = {
+    name: string;
+    version: string;
+    tarball: string;
+};
+/** What the smoke installed and imported, and any consumer check it ran. */
+export type PublisherConsumerSmokeResult = {
+    installed: number;
+    imports: string[];
+    durationMs: number;
+    consumerCheck?: {
+        ok: boolean;
+        log: string;
+    };
+};
+/** Upper bound for the smoke consumer's install. */
+export declare const PUBLISHER_CONSUMER_INSTALL_TIMEOUT_MS = 120000;
+/**
+ * Installs every non-skipped sealed batch member into a throwaway consumer by
+ * its packed tarball (`file:<path>`, the exact bytes about to be uploaded)
+ * and imports every export-map/main target from the installed copy. This
+ * closes the gap `verifyPackedPackage` cannot: that gate inspects the
+ * tarball's file *list*, not what happens when a real installer (hoisting,
+ * peer resolution, duplicate dependency trees) lays the batch out and a
+ * runtime actually loads it. A `.ts` import specifier surviving into a
+ * shipped `.js` file, or an export target missing after a real install,
+ * throws here — before any package in the batch reaches the registry.
+ *
+ * Reuses the already-packed, already-retained tarballs from the seal phase —
+ * no rebuild, no re-pack — so this stays fast enough to run on every publish
+ * and every `--dry-run`.
+ */
+export declare function runPublisherConsumerSmoke(options: {
+    members: readonly PublisherConsumerSmokeMember[];
+    workspaceRoot: string;
+    execution: RuntimeExecution;
+    /** The runtime child environments are composed from. */
+    runtime: ChildEnvRuntime;
+    ui: UIContext;
+    quiet: boolean;
+    sourceRegistry?: ReleaseConsumerSourceRegistry;
+    consumerPath?: string;
+}): Promise<PublisherConsumerSmokeResult>;
+/**
+ * The optional heavier proof: install the exact batch tarballs into a real
+ * consumer checkout (e.g. a `vibes-app-template` clone) with `bun add`, then
+ * run its own `check`/`build`. Off by default (`--consumer` is unset in
+ * ordinary publishes); this exercises a real project's own toolchain against
+ * the batch, which the throwaway-consumer import smoke above does not.
+ */
+export declare function runPublisherConsumerSmokeConsumerCheck(options: {
+    consumerPath: string;
+    members: readonly PublisherConsumerSmokeMember[];
+    execution: RuntimeExecution;
+    /** The runtime child environments are composed from. */
+    runtime: ChildEnvRuntime;
+    sourceRegistry?: ReleaseConsumerSourceRegistry;
+}): Promise<{
+    ok: boolean;
+    log: string;
+}>;
+//# sourceMappingURL=consumer-smoke.d.ts.map

package/dist/cli/npm/publish/consumer-smoke.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consumer-smoke.d.ts","sourceRoot":"","sources":["../../../../src/cli/npm/publish/consumer-smoke.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAQ5D,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAGrE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAQtE,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,qBAAqB,CAAC;AAwGzE;;;;;;;;;GASG;AACH,wBAAgB,mCAAmC,CACjD,QAAQ,EAAE,IAAI,CAAC,uBAAuB,EAAE,MAAM,GAAG,SAAS,CAAC,GAC1D,MAAM,EAAE,CAgCV;AAqCD,0EAA0E;AAC1E,MAAM,MAAM,4BAA4B,GAAG;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,4EAA4E;AAC5E,MAAM,MAAM,4BAA4B,GAAG;IACzC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;CAC9C,CAAC;AAEF,oDAAoD;AACpD,eAAO,MAAM,qCAAqC,SAAU,CAAC;AAE7D;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,yBAAyB,CAAC,OAAO,EAAE;IACvD,OAAO,EAAE,SAAS,4BAA4B,EAAE,CAAC;IACjD,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,gBAAgB,CAAC;IAC5B,wDAAwD;IACxD,OAAO,EAAE,eAAe,CAAC;IACzB,EAAE,EAAE,SAAS,CAAC;IACd,KAAK,EAAE,OAAO,CAAC;IACf,cAAc,CAAC,EAAE,6BAA6B,CAAC;IAC/C,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GAAG,OAAO,CAAC,4BAA4B,CAAC,CA8LxC;AAED;;;;;;GAMG;AACH,wBAAsB,sCAAsC,CAAC,OAAO,EAAE;IACpE,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,SAAS,4BAA4B,EAAE,CAAC;IACjD,SAAS,EAAE,gBAAgB,CAAC;IAC5B,wDAAwD;IACxD,OAAO,EAAE,eAAe,CAAC;IACzB,cAAc,CAAC,EAAE,6BAA6B,CAAC;CAChD,GAAG,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CA8DxC"}

package/dist/cli/npm/publish/consumer-smoke.js

@@ -0,0 +1,371 @@
+import { resolveFileSystemAdapter } from "@vibesdotdev/filesystem";
+import { getRuntimePath } from "@vibesdotdev/paths";
+import { CapabilityError, isCapabilityError, settle, valueFreeFailure } from "@vibesdotdev/kernel";
+import { JsonObjectSchema, } from "@vibesdotdev/kernel/schemas/json";
+import { z } from "zod/v4";
+import { parsePublisherManifest } from "./publisher-manifest.js";
+import { runRuntimeCommand, registryTokenEnv, } from "../../shared/runtime-execution.js";
+import { mapWithConcurrency } from "./concurrency.js";
+import { requirePathFileURL } from "./fs-paths.js";
+import { writeIsolatedBunfig } from "./npm-exec.js";
+import { writeFreshReleaseConsumerSourceNpmrc } from "./proof-source-credentials.js";
+import { createReleaseTempRoot, defaultSensitiveTempFileAuthorities, scrubSensitiveTempFile, reportedSensitiveTempCleanup, SENSITIVE_TEMP_ROOT_PREFIXES, } from "./sensitive-temp.js";
+/**
+ * Export conditions that name an environment this smoke is not: a target
+ * reachable ONLY under one of them is unreachable to the plain consumer the
+ * smoke plays, so evaluating it proves nothing and fails for the wrong reason
+ * (`Cannot find package 'bun'` under node).
+ */
+const SMOKE_FOREIGN_CONDITIONS = new Set([
+    "bun",
+    "browser",
+    "deno",
+    "workerd",
+    "worker",
+    "react-native",
+    "cef",
+]);
+/** Conditions a plain node/bun consumer actually resolves through. */
+const SMOKE_CONSUMER_CONDITIONS = new Set([
+    "node",
+    "import",
+    "require",
+    "default",
+    "module",
+]);
+/**
+ * Subpath segments whose entry is compiled by a bundler, never evaluated by a
+ * runtime: `@vibesdotdev/surface-sveltekit/svelte` re-exports `.svelte` files, which no
+ * runtime can load without a Svelte plugin. The publisher proves those through
+ * the installed-style Svelte surface build instead.
+ */
+const SMOKE_BUNDLER_ONLY_SEGMENTS = new Set(["svelte", "tui"]);
+function collectSmokeTargets(key, value, conditions, out) {
+    const text = z.string().safeParse(value);
+    if (text.success) {
+        if (text.data.startsWith("./"))
+            out.push({ key, conditions, target: text.data.slice(2) });
+        return;
+    }
+    if (Array.isArray(value)) {
+        for (const entry of value)
+            collectSmokeTargets(key, entry, conditions, out);
+        return;
+    }
+    const record = JsonObjectSchema.safeParse(value);
+    if (record.success) {
+        for (const [condition, entry] of Object.entries(record.data)) {
+            collectSmokeTargets(key, entry, [...conditions, condition], out);
+        }
+    }
+}
+/**
+ * An export that loads at import time (CORRECT.md §1 #3): the package root, a plugin, a schema
+ * or a descriptor entry. It must load in a consumer that installed none of the package's optional
+ * peers; an implementation subpath may need its peer and is proven by the installed release proof.
+ */
+function isImportTimeExportKey(key) {
+    if (key === ".")
+        return true;
+    // Match the role as a whole word (`./cloud.plugin`, `./schemas/x`, `./db-schema`),
+    // never a substring: `./runtime-plugin-host/runtime-thread.shim.bun` is a worker program.
+    return key
+        .split(/[./]/)
+        .some((token) => /^(?:plugin|schema|descriptor)s?-|(?:plugin|schema|descriptor)s?$/i.test(token));
+}
+function smokeTargetIsReachable(entry) {
+    if (!isImportTimeExportKey(entry.key))
+        return false;
+    if (entry.key
+        .split("/")
+        .some((segment) => SMOKE_BUNDLER_ONLY_SEGMENTS.has(segment)))
+        return false;
+    const foreign = entry.conditions.filter((condition) => SMOKE_FOREIGN_CONDITIONS.has(condition));
+    if (foreign.length === 0)
+        return true;
+    return entry.conditions.some((condition) => SMOKE_CONSUMER_CONDITIONS.has(condition));
+}
+/**
+ * Every import-time export-map/main target this package could load at runtime, following
+ * the same enumeration `verifyPackedPackage` uses to prove every target
+ * exists in the tarball. Wildcard subpaths (`./*`) have no single concrete
+ * file to import, and non-script targets (`.d.ts`, `.svelte`, `.css`, …) are
+ * not importable by a bare Node/Bun runtime — both are already covered by
+ * `verifyPackedPackage`'s existence check and the SvelteKit SSR proof, so
+ * this only returns the concrete `.js`/`.mjs`/`.cjs` files a plain
+ * `import()` can actually execute.
+ */
+export function publisherConsumerSmokeImportTargets(manifest) {
+    const entries = [];
+    const exportsValue = manifest.exports;
+    const exportText = z.string().safeParse(exportsValue);
+    const exportRecord = JsonObjectSchema.safeParse(exportsValue);
+    if (exportText.success) {
+        collectSmokeTargets(".", exportText.data, [], entries);
+    }
+    else if (exportRecord.success) {
+        for (const [key, value] of Object.entries(exportRecord.data)) {
+            // A top-level key is a subpath when it looks like one; anything else
+            // (a bare condition on a sugar export) keeps the root subpath.
+            const isSubpath = key === "." || key.startsWith("./");
+            collectSmokeTargets(isSubpath ? key : ".", value, isSubpath ? [] : [key], entries);
+        }
+    }
+    const targets = new Set();
+    for (const entry of entries) {
+        if (smokeTargetIsReachable(entry))
+            targets.add(entry.target);
+    }
+    const main = z.string().safeParse(manifest.main);
+    if (main.success && main.data.startsWith("./")) {
+        targets.add(main.data.slice(2));
+    }
+    return [...targets]
+        .filter((target) => !target.includes("*"))
+        .filter((target) => /\.(?:js|mjs|cjs)$/i.test(target))
+        .sort();
+}
+async function readTarballPackageJson(tarballPath, execution, runtime) {
+    const result = await runRuntimeCommand({
+        runtime,
+        execution,
+        command: "tar",
+        args: ["-xzO", "-f", tarballPath, "package/package.json"],
+        cwd: (await getRuntimePath(runtime)).dirname(tarballPath),
+    });
+    if (result.code !== 0) {
+        throw new Error(`Publisher consumer smoke could not read package.json from ${tarballPath}: ${result.stderr || result.stdout}`);
+    }
+    const parsed = await settle(() => Promise.resolve(parsePublisherManifest(JSON.parse(result.stdout))));
+    if (!parsed.ok) {
+        if (isCapabilityError(parsed.cause))
+            throw parsed.cause;
+        throw new CapabilityError("Publisher consumer smoke found an unparsable package.json.", "INVALID_INPUT", {
+            reason: "consumer-smoke-manifest-unreadable",
+            cause: valueFreeFailure(parsed.cause),
+            details: { tarball: tarballPath },
+        });
+    }
+    return parsed.value;
+}
+/** Upper bound for the smoke consumer's install. */
+export const PUBLISHER_CONSUMER_INSTALL_TIMEOUT_MS = 120_000;
+/**
+ * Installs every non-skipped sealed batch member into a throwaway consumer by
+ * its packed tarball (`file:<path>`, the exact bytes about to be uploaded)
+ * and imports every export-map/main target from the installed copy. This
+ * closes the gap `verifyPackedPackage` cannot: that gate inspects the
+ * tarball's file *list*, not what happens when a real installer (hoisting,
+ * peer resolution, duplicate dependency trees) lays the batch out and a
+ * runtime actually loads it. A `.ts` import specifier surviving into a
+ * shipped `.js` file, or an export target missing after a real install,
+ * throws here — before any package in the batch reaches the registry.
+ *
+ * Reuses the already-packed, already-retained tarballs from the seal phase —
+ * no rebuild, no re-pack — so this stays fast enough to run on every publish
+ * and every `--dry-run`.
+ */
+export async function runPublisherConsumerSmoke(options) {
+    const startedAt = Date.now();
+    if (options.members.length === 0) {
+        return { installed: 0, imports: [], durationMs: Date.now() - startedAt };
+    }
+    const tempRoot = await createReleaseTempRoot(options.runtime, options.workspaceRoot, SENSITIVE_TEMP_ROOT_PREFIXES.consumerSmoke);
+    const paths = await getRuntimePath(options.runtime);
+    const files = await resolveFileSystemAdapter(options.runtime, { binding: false });
+    const consumerDir = paths.join(tempRoot, "consumer");
+    const npmrcPath = paths.join(consumerDir, ".npmrc");
+    let npmrcWritten = false;
+    try {
+        await files.mkdir(consumerDir, { recursive: true });
+        // cwd is this nested consumer, not tempRoot: pin bunfig here so bun does
+        // not walk up to the worktree file under envMode:replace.
+        await writeIsolatedBunfig(options.runtime, consumerDir);
+        const manifests = await mapWithConcurrency(options.members, 4, async (member) => ({
+            member,
+            manifest: await readTarballPackageJson(member.tarball, options.execution, options.runtime),
+        }));
+        const dependencies = {};
+        for (const { member } of manifests)
+            dependencies[member.name] = `file:${member.tarball}`;
+        await files.writeFile(paths.join(consumerDir, "package.json"), `${JSON.stringify({
+            name: "vibes-publisher-consumer-smoke",
+            private: true,
+            version: "0.0.0",
+            // Members only, no optional peer: an import-time entry that needs one is the defect.
+            dependencies,
+            // Members depend on each other by caret range, and the versions
+            // in this batch are not on the registry yet: without overrides
+            // bun satisfies an intra-batch range from the REGISTRY, nests a
+            // second copy of (say) @vibesdotdev/kernel under a sibling, and
+            // the runtime's one-process-one-graph guard rejects the import.
+            // The smoke must exercise the batch, never a mix of the batch and
+            // the versions it is about to replace.
+            overrides: dependencies,
+        }, null, 2)}\n`);
+        if (options.sourceRegistry) {
+            npmrcWritten = true;
+            await writeFreshReleaseConsumerSourceNpmrc(npmrcPath, options.sourceRegistry, options.runtime);
+        }
+        if (!options.quiet) {
+            options.ui.info(`Installing ${manifests.length} packed tarball(s) into a throwaway consumer...`);
+        }
+        const install = await runRuntimeCommand({
+            runtime: options.runtime,
+            execution: options.execution,
+            command: "bun",
+            args: ["install", "--linker=hoisted", "--no-save", "--ignore-scripts"],
+            cwd: consumerDir,
+            env: { HOME: consumerDir, USERPROFILE: consumerDir },
+            timeout: PUBLISHER_CONSUMER_INSTALL_TIMEOUT_MS,
+        });
+        if (install.code !== 0) {
+            throw new Error(`Publisher consumer smoke install failed:\n${install.stdout}\n${install.stderr}`);
+        }
+        if (npmrcWritten) {
+            await scrubSensitiveTempFile(npmrcPath, defaultSensitiveTempFileAuthorities(options.runtime));
+            npmrcWritten = false;
+        }
+        const imports = [];
+        const failures = [];
+        for (const { member, manifest } of manifests) {
+            const targets = publisherConsumerSmokeImportTargets(manifest);
+            const packageDir = paths.join(consumerDir, "node_modules", member.name);
+            // These packages are consumed by bun hosts (the vibes CLI, every app's
+            // dev server and build). Loading a published artifact under node was an
+            // assumption, and it fails for the wrong reason on every bun-runtime
+            // module reachable from a node-shaped export condition
+            // (`dist/bun/index.js`, `dist/router-server/server.js`, `dist/lsp/index.js`).
+            // A package that must load under node says so in its manifest.
+            // A package whose published modules are FRAMEWORK-COMPILED output — Svelte 5
+            // runes ($state), $env/* imports, .svelte and .css — has no runtime that can
+            // evaluate them; only a build can. Such a package declares
+            // vibes.publishSmoke: "static" and the packed-content checks (declared files,
+            // export targets exist, no .ts specifier) remain its proof.
+            const vibes = JsonObjectSchema.safeParse(manifest.vibes);
+            if (vibes.success &&
+                z.literal("static").safeParse(vibes.data.publishSmoke).success) {
+                if (!options.quiet) {
+                    options.ui.info(`${member.name}@${member.version}: framework-compiled; static checks only`);
+                }
+                continue;
+            }
+            const runtime = manifest.vibes?.publishLoadRuntime === "node" ? "node" : "bun";
+            for (const target of targets) {
+                const label = `${member.name}@${member.version}: ${target}`;
+                imports.push(label);
+                const specifierUrl = requirePathFileURL(paths, paths.join(packageDir, target)).href;
+                const result = await runRuntimeCommand({
+                    runtime: options.runtime,
+                    execution: options.execution,
+                    command: runtime,
+                    args: runtime === "node"
+                        ? [
+                            "--input-type=module",
+                            "--eval",
+                            `import(${JSON.stringify(specifierUrl)})`,
+                        ]
+                        : ["--eval", `await import(${JSON.stringify(specifierUrl)})`],
+                    cwd: consumerDir,
+                });
+                if (result.code !== 0) {
+                    const output = (result.stderr || result.stdout).trim();
+                    failures.push(`${label}: ${output}`);
+                }
+            }
+        }
+        if (failures.length > 0) {
+            throw new Error(`Publisher consumer smoke refuses this publish; the installed copy failed to load:\n${failures.join("\n")}`);
+        }
+        let consumerCheck;
+        if (options.consumerPath) {
+            if (!options.quiet) {
+                options.ui.info(`Installing the batch into ${options.consumerPath} for check/build...`);
+            }
+            consumerCheck = await runPublisherConsumerSmokeConsumerCheck({
+                consumerPath: options.consumerPath,
+                members: options.members,
+                execution: options.execution,
+                runtime: options.runtime,
+                sourceRegistry: options.sourceRegistry,
+            });
+            if (!consumerCheck.ok) {
+                throw new Error(`Publisher consumer smoke refuses this publish; ${options.consumerPath} check/build failed:\n${consumerCheck.log}`);
+            }
+        }
+        const result = {
+            installed: manifests.length,
+            imports,
+            durationMs: Date.now() - startedAt,
+        };
+        if (consumerCheck !== undefined)
+            result.consumerCheck = consumerCheck;
+        return result;
+    }
+    finally {
+        await reportedSensitiveTempCleanup(options.runtime, npmrcWritten ? { npmrcPath, root: tempRoot } : { root: tempRoot });
+    }
+}
+/**
+ * The optional heavier proof: install the exact batch tarballs into a real
+ * consumer checkout (e.g. a `vibes-app-template` clone) with `bun add`, then
+ * run its own `check`/`build`. Off by default (`--consumer` is unset in
+ * ordinary publishes); this exercises a real project's own toolchain against
+ * the batch, which the throwaway-consumer import smoke above does not.
+ */
+export async function runPublisherConsumerSmokeConsumerCheck(options) {
+    const npmrcPath = (await getRuntimePath(options.runtime)).join(options.consumerPath, ".npmrc");
+    let npmrcWritten = false;
+    try {
+        if (options.sourceRegistry) {
+            npmrcWritten = true;
+            await writeFreshReleaseConsumerSourceNpmrc(npmrcPath, options.sourceRegistry, options.runtime);
+        }
+        const install = await runRuntimeCommand({
+            runtime: options.runtime,
+            execution: options.execution,
+            command: "bun",
+            env: await registryTokenEnv(options.runtime),
+            args: [
+                "add",
+                "--linker=hoisted",
+                ...options.members.map((member) => `${member.name}@file:${member.tarball}`),
+            ],
+            cwd: options.consumerPath,
+        });
+        if (install.code !== 0) {
+            return { ok: false, log: `${install.stdout}\n${install.stderr}` };
+        }
+        if (npmrcWritten) {
+            await scrubSensitiveTempFile(npmrcPath, defaultSensitiveTempFileAuthorities(options.runtime));
+            npmrcWritten = false;
+        }
+        const check = await runRuntimeCommand({
+            runtime: options.runtime,
+            execution: options.execution,
+            command: "bun",
+            args: ["run", "check"],
+            cwd: options.consumerPath,
+        });
+        if (check.code !== 0) {
+            return { ok: false, log: `${check.stdout}\n${check.stderr}` };
+        }
+        const build = await runRuntimeCommand({
+            runtime: options.runtime,
+            execution: options.execution,
+            command: "bun",
+            args: ["run", "build"],
+            cwd: options.consumerPath,
+        });
+        return {
+            ok: build.code === 0,
+            log: [check.stdout, check.stderr, build.stdout, build.stderr]
+                .filter(Boolean)
+                .join("\n"),
+        };
+    }
+    finally {
+        await reportedSensitiveTempCleanup(options.runtime, npmrcWritten ? { npmrcPath } : {});
+    }
+}
+//# sourceMappingURL=consumer-smoke.js.map