@vibesdotdev/infra-deploy 0.0.1 → 1.0.0-rc.4

package/dist/cli/npm/publish/registry-credentials.d.ts

@@ -0,0 +1,108 @@
+/**
+ * Registry identity and credentials: registry URL normalization, publish and
+ * read token selection, session JWT renewal rules, and operator guidance for
+ * auth failures. Credential values are resolved here and never printed.
+ */
+import { type ValueFreeFailure, type RuntimeRef, type VibesRuntime } from "@vibesdotdev/kernel";
+import type { PackageJson } from "./types.ts";
+/** The public npm registry. */
+export declare const PUBLIC_NPM_REGISTRY = "https://registry.npmjs.org";
+/** The Registry identity selected by the handed runtime's infra.services configuration. */
+export declare function registryServiceOrigin(runtime: RuntimeRef): Promise<string>;
+/** Secret key of a public npm publish token. */
+export declare const PUBLIC_NPM_TOKEN_KEY = "NPM_TOKEN";
+/** Secret key of a static Vibes Registry token. */
+export declare const VIBES_NPM_TOKEN_KEY = "VIBES_NPM_TOKEN";
+/** A registry URL without surrounding whitespace or trailing slashes. */
+export declare function normalizeRegistryUrl(registry: string): string;
+/**
+ * Public npm is treated as an install-time passthrough during release consumer
+ * proof: planned external roots that resolve there are still npm-packed and
+ * sealed, but their transitive public graph is not pre-packed (that walk is
+ * thousands of network packs and ETIMEDOUTs on large first-party packages).
+ * First-party / private registries keep a fully sealed transitive graph.
+ */
+export declare function isPublicNpmProofRegistry(registry: string): boolean;
+/**
+ * The registry a package publishes to: the override, else `publishConfig.registry`.
+ */
+export declare function resolvePublishRegistry(pkg: PackageJson, registryOverride?: string): string;
+/**
+ * The default publish token key for one registry; multiple registries need `--token-key`.
+ */
+export declare function defaultTokenKeyForRegistries(registries: string[], registryOrigin: string): string;
+type RegistryReadTokenResolution = {
+    value?: string;
+    source?: string;
+    environment: string;
+    tier: string;
+};
+type RegistrySessionJwtClaims = {
+    expiresAtMs: number;
+    subject: string;
+    issuer: string;
+    audience: string[];
+};
+/** A session JWT closer than this to expiry is renewed before use. */
+export declare const REGISTRY_SESSION_JWT_MIN_LIFETIME_MS: number;
+export declare function registrySessionJwtClaims(token: string, 
+/** The runtime whose logger reports a three-part token that does not decode. */
+runtime: RuntimeRef): RegistrySessionJwtClaims | undefined;
+/** True when a renewed JWT carries the same session authority. */
+export declare function registrySessionJwtContinuityMatches(current: RegistrySessionJwtClaims, renewed: RegistrySessionJwtClaims): boolean;
+/** The error for a read credential that could not be renewed. */
+export declare function registryReadCredentialRenewalError(registry: string, reason: string, failure?: ValueFreeFailure): Error;
+/** The release's Registry read credential and its optional session renewer. */
+export type RegistryReleaseReadCredential = {
+    tokenKey?: string;
+    resolution?: RegistryReadTokenResolution;
+    refreshSessionJwt?: () => Promise<string | null | undefined>;
+};
+/**
+ * The Registry read credential for a release: an explicit token key, an explicit
+ * JWT, or the signed-in session (renewable).
+ */
+export declare function resolveRegistryReleaseReadCredential(options: {
+    /** The runtime whose logger reports a credential that is not a decodable session JWT. */
+    runtime: RuntimeRef;
+    registries: string[];
+    explicitTokenKey?: string;
+    registryJwt?: string;
+    resolveSessionJwt: () => Promise<string | null | undefined>;
+    resolveFreshSessionJwt: () => Promise<string | null | undefined>;
+    resolveNamedToken: (key: string) => Promise<RegistryReadTokenResolution>;
+}): Promise<RegistryReleaseReadCredential>;
+/**
+ * The publish token key: explicit, the dry-run default, or the registry default.
+ */
+export declare function resolvePublishTokenKey(options: {
+    registryOrigin: string;
+    registries: string[];
+    explicitTokenKey?: string;
+    dryRun: boolean;
+}): string;
+export { VIBES_REGISTRY_READ_TOKEN_KEY } from '@vibesdotdev/registry/publish-authentication';
+/** Read-token keys present in `env` that a Registry write ignores. */
+export declare function ignoredRegistryWriteCredentialKeys(env: Record<string, string | undefined>): string[];
+/** Operator note that present read tokens do not authorize the publish. */
+export declare function formatIgnoredRegistryWriteCredentials(keys: readonly string[]): string;
+/**
+ * Guidance when npm output shows the Vibes Registry rejected the publish credential.
+ */
+export declare function formatVibesRegistryPublishAuthFailure(npmOutputText: string): string | undefined;
+/** Where to get or store a publish token for the target registries. */
+export declare function publishTokenSetupHint(tokenKey: string, registries: string[], registryOrigin: string): string;
+/**
+ * A token from the runtime's secrets stores, with its source and tier. The host
+ * environment is never a credential source (D3).
+ */
+export declare function resolveTokenFromSecrets(runtime: VibesRuntime, key: string, options: {
+    environment?: string;
+    backend?: string;
+}): Promise<{
+    value?: string;
+    source?: string;
+    environment: string;
+    tier: string;
+}>;
+//# sourceMappingURL=registry-credentials.d.ts.map

package/dist/cli/npm/publish/registry-credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry-credentials.d.ts","sourceRoot":"","sources":["../../../../src/cli/npm/publish/registry-credentials.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAA+B,KAAK,gBAAgB,EAAE,KAAK,UAAU,EAAE,KAAK,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAgB7H,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C,+BAA+B;AAC/B,eAAO,MAAM,mBAAmB,+BAA+B,CAAC;AAEhE,2FAA2F;AAC3F,wBAAsB,qBAAqB,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAEhF;AACD,gDAAgD;AAChD,eAAO,MAAM,oBAAoB,cAAc,CAAC;AAChD,mDAAmD;AACnD,eAAO,MAAM,mBAAmB,oBAAoB,CAAC;AAErD,yEAAyE;AACzE,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAIlE;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,WAAW,EAChB,gBAAgB,CAAC,EAAE,MAAM,GACxB,MAAM,CAaR;AAQD;;GAEG;AACH,wBAAgB,4BAA4B,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,cAAc,EAAE,MAAM,GAAG,MAAM,CAUjG;AAED,KAAK,2BAA2B,GAAG;IACjC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,KAAK,wBAAwB,GAAG;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB,CAAC;AAEF,sEAAsE;AACtE,eAAO,MAAM,oCAAoC,QAAgB,CAAC;AAkBlE,wBAAgB,wBAAwB,CACtC,KAAK,EAAE,MAAM;AACb,gFAAgF;AAChF,OAAO,EAAE,UAAU,GAClB,wBAAwB,GAAG,SAAS,CAoCtC;AAED,kEAAkE;AAClE,wBAAgB,mCAAmC,CACjD,OAAO,EAAE,wBAAwB,EACjC,OAAO,EAAE,wBAAwB,GAChC,OAAO,CAOT;AAED,iEAAiE;AACjE,wBAAgB,kCAAkC,CAChD,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,gBAAgB,GACzB,KAAK,CAQP;AAED,+EAA+E;AAC/E,MAAM,MAAM,6BAA6B,GAAG;IAC1C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,2BAA2B,CAAC;IACzC,iBAAiB,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;CAC9D,CAAC;AAEF;;;GAGG;AACH,wBAAsB,oCAAoC,CAAC,OAAO,EAAE;IAClE,yFAAyF;IACzF,OAAO,EAAE,UAAU,CAAC;IACpB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iBAAiB,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;IAC5D,sBAAsB,EAAE,MAAM,OAAO,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;IACjE,iBAAiB,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,2BAA2B,CAAC,CAAC;CAC1E,GAAG,OAAO,CAAC,6BAA6B,CAAC,CAuDzC;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE;IAC9C,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,EAAE,OAAO,CAAC;CACjB,GAAG,MAAM,CAKT;AAED,OAAO,EAAE,6BAA6B,EAAE,MAAM,8CAA8C,CAAC;AAE7F,sEAAsE;AACtE,wBAAgB,kCAAkC,CAChD,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GACtC,MAAM,EAAE,CAGV;AAED,2EAA2E;AAC3E,wBAAgB,qCAAqC,CACnD,IAAI,EAAE,SAAS,MAAM,EAAE,GACtB,MAAM,CAUR;AAED;;GAEG;AACH,wBAAgB,qCAAqC,CACnD,aAAa,EAAE,MAAM,GACpB,MAAM,GAAG,SAAS,CAapB;AAED,uEAAuE;AACvE,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,MAAM,EAChB,UAAU,EAAE,MAAM,EAAE,EACpB,cAAc,EAAE,MAAM,GACrB,MAAM,CAWR;AAED;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,YAAY,EACrB,GAAG,EAAE,MAAM,EACX,OAAO,EAAE;IAAE,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAClD,OAAO,CAAC;IACT,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC,CAwCD"}

package/dist/cli/npm/publish/registry-credentials.js

@@ -0,0 +1,290 @@
+/**
+ * Registry identity and credentials: registry URL normalization, publish and
+ * read token selection, session JWT renewal rules, and operator guidance for
+ * auth failures. Credential values are resolved here and never printed.
+ */
+import { settleNow, valueFreeFailure } from "@vibesdotdev/kernel";
+import { serviceOrigin } from '@vibesdotdev/infra-core/service';
+import { VIBES_REGISTRY_READ_TOKEN_KEY } from '@vibesdotdev/registry/publish-authentication';
+import { JsonObjectSchema, } from "@vibesdotdev/kernel/schemas/json";
+import { isGenericSecretsStoreDescriptor, resolveSecretsEnvironment, } from "@vibesdotdev/secrets";
+import { z } from "zod/v4";
+import { infraDeployLogger } from "../../../logger.js";
+import { readString } from "./command-options.js";
+/** The public npm registry. */
+export const PUBLIC_NPM_REGISTRY = "https://registry.npmjs.org";
+/** The Registry identity selected by the handed runtime's infra.services configuration. */
+export async function registryServiceOrigin(runtime) {
+    return normalizeRegistryUrl(await serviceOrigin(runtime, 'registry'));
+}
+/** Secret key of a public npm publish token. */
+export const PUBLIC_NPM_TOKEN_KEY = "NPM_TOKEN";
+/** Secret key of a static Vibes Registry token. */
+export const VIBES_NPM_TOKEN_KEY = "VIBES_NPM_TOKEN";
+/** A registry URL without surrounding whitespace or trailing slashes. */
+export function normalizeRegistryUrl(registry) {
+    return registry.trim().replace(/\/+$/, "");
+}
+/**
+ * Public npm is treated as an install-time passthrough during release consumer
+ * proof: planned external roots that resolve there are still npm-packed and
+ * sealed, but their transitive public graph is not pre-packed (that walk is
+ * thousands of network packs and ETIMEDOUTs on large first-party packages).
+ * First-party / private registries keep a fully sealed transitive graph.
+ */
+export function isPublicNpmProofRegistry(registry) {
+    return (normalizeRegistryUrl(registry) === normalizeRegistryUrl(PUBLIC_NPM_REGISTRY));
+}
+/**
+ * The registry a package publishes to: the override, else `publishConfig.registry`.
+ */
+export function resolvePublishRegistry(pkg, registryOverride) {
+    const registry = readString(registryOverride) ?? readString(pkg.publishConfig?.registry);
+    if (registry)
+        return registry;
+    const label = pkg.name && pkg.version
+        ? `${pkg.name}@${pkg.version}`
+        : (pkg.name ?? "package");
+    throw new Error(`${label} has no publishConfig.registry and no --registry override. ` +
+        "Set publishConfig.registry to the intended registry or pass --registry explicitly.");
+}
+function defaultTokenKeyForRegistry(registry, registryOrigin) {
+    return normalizeRegistryUrl(registry) === normalizeRegistryUrl(registryOrigin)
+        ? VIBES_NPM_TOKEN_KEY
+        : PUBLIC_NPM_TOKEN_KEY;
+}
+/**
+ * The default publish token key for one registry; multiple registries need `--token-key`.
+ */
+export function defaultTokenKeyForRegistries(registries, registryOrigin) {
+    const unique = [
+        ...new Set(registries.map((registry) => normalizeRegistryUrl(registry))),
+    ];
+    if (unique.length === 0)
+        return PUBLIC_NPM_TOKEN_KEY;
+    if (unique.length === 1)
+        return defaultTokenKeyForRegistry(unique[0], registryOrigin);
+    throw new Error(`Publish targets span multiple registries (${unique.join(", ")}). ` +
+        "Publish one registry per run or pass --token-key explicitly.");
+}
+/** A session JWT closer than this to expiry is renewed before use. */
+export const REGISTRY_SESSION_JWT_MIN_LIFETIME_MS = 2 * 60 * 1000;
+/**
+ * Expiry, subject, issuer and audience of a session JWT (unverified), if it is one.
+ */
+/** String audience members, including a single string. Other members stay out. */
+function sessionJwtAudience(value) {
+    const text = z.string().safeParse(value);
+    if (text.success)
+        return [text.data];
+    if (!Array.isArray(value))
+        return [];
+    const audience = [];
+    for (const entry of value) {
+        const item = z.string().safeParse(entry);
+        if (item.success)
+            audience.push(item.data);
+    }
+    return audience;
+}
+export function registrySessionJwtClaims(token, 
+/** The runtime whose logger reports a three-part token that does not decode. */
+runtime) {
+    const parts = token.split(".");
+    if (parts.length !== 3)
+        return undefined;
+    const decoded = settleNow(() => JSON.parse(Buffer.from(parts[1] ?? "", "base64url").toString("utf8")));
+    if (!decoded.ok) {
+        // Not a decodable session JWT: report the value-free class and treat it
+        // as one without claims. The decode text can echo credential bytes.
+        infraDeployLogger(runtime).warn("Registry credential is not a decodable session JWT", {
+            reason: valueFreeFailure(decoded.cause).name,
+        });
+        return undefined;
+    }
+    const claims = JsonObjectSchema.safeParse(decoded.value);
+    if (!claims.success)
+        return undefined;
+    const exp = z.number().finite().safeParse(claims.data.exp);
+    const sub = z.string().safeParse(claims.data.sub);
+    const iss = z.string().safeParse(claims.data.iss);
+    const audience = sessionJwtAudience(claims.data.aud);
+    if (!exp.success ||
+        !sub.success ||
+        sub.data.trim().length === 0 ||
+        !iss.success ||
+        iss.data.trim().length === 0 ||
+        audience.length === 0) {
+        return undefined;
+    }
+    return {
+        expiresAtMs: exp.data * 1000,
+        subject: sub.data,
+        issuer: iss.data,
+        audience: [...new Set(audience)].sort(),
+    };
+}
+/** True when a renewed JWT carries the same session authority. */
+export function registrySessionJwtContinuityMatches(current, renewed) {
+    return (current.subject === renewed.subject &&
+        current.issuer === renewed.issuer &&
+        current.audience.length === renewed.audience.length &&
+        current.audience.every((value, index) => value === renewed.audience[index]));
+}
+/** The error for a read credential that could not be renewed. */
+export function registryReadCredentialRenewalError(registry, reason, failure) {
+    const options = {};
+    if (failure !== undefined)
+        options.cause = failure;
+    return new Error(`Release consumer proof read credential for ${registry} may be expired or concealed as a Registry 404, and signed-session renewal ${reason}. ` +
+        `Sign in again or pass --token-key ${VIBES_NPM_TOKEN_KEY} for a static Registry read credential.`, options);
+}
+/**
+ * The Registry read credential for a release: an explicit token key, an explicit
+ * JWT, or the signed-in session (renewable).
+ */
+export async function resolveRegistryReleaseReadCredential(options) {
+    const registryOrigin = await registryServiceOrigin(options.runtime);
+    const explicitTokenKey = readString(options.explicitTokenKey);
+    const uniqueRegistries = [
+        ...new Set(options.registries.map((registry) => normalizeRegistryUrl(registry))),
+    ];
+    if (!explicitTokenKey &&
+        uniqueRegistries.length === 1 &&
+        uniqueRegistries[0] === registryOrigin) {
+        const namedRead = await options.resolveNamedToken(VIBES_REGISTRY_READ_TOKEN_KEY);
+        if (readString(namedRead.value)) {
+            return { tokenKey: VIBES_REGISTRY_READ_TOKEN_KEY, resolution: namedRead };
+        }
+        const registryJwt = readString(options.registryJwt);
+        if (registryJwt) {
+            const credential = {
+                resolution: {
+                    value: registryJwt,
+                    source: "runtime-credential",
+                    environment: "runtime",
+                    tier: "runtime",
+                },
+            };
+            // Only a decodable session JWT is renewable.
+            if (registrySessionJwtClaims(registryJwt, options.runtime)) {
+                credential.refreshSessionJwt = options.resolveFreshSessionJwt;
+            }
+            return credential;
+        }
+        const sessionJwt = readString(await options.resolveSessionJwt());
+        if (sessionJwt?.split(".").length === 3 && sessionJwt.length > 20) {
+            const credential = {
+                resolution: {
+                    value: sessionJwt,
+                    source: "signed-session",
+                    environment: "session",
+                    tier: "session",
+                },
+            };
+            // Only a decodable session JWT is renewable.
+            if (registrySessionJwtClaims(sessionJwt, options.runtime)) {
+                credential.refreshSessionJwt = options.resolveFreshSessionJwt;
+            }
+            return credential;
+        }
+    }
+    const tokenKey = explicitTokenKey ?? defaultTokenKeyForRegistries(options.registries, registryOrigin);
+    return { tokenKey, resolution: await options.resolveNamedToken(tokenKey) };
+}
+/**
+ * The publish token key: explicit, the dry-run default, or the registry default.
+ */
+export function resolvePublishTokenKey(options) {
+    const explicit = readString(options.explicitTokenKey);
+    if (explicit)
+        return explicit;
+    if (options.dryRun)
+        return PUBLIC_NPM_TOKEN_KEY;
+    return defaultTokenKeyForRegistries(options.registries, options.registryOrigin);
+}
+export { VIBES_REGISTRY_READ_TOKEN_KEY } from '@vibesdotdev/registry/publish-authentication';
+/** Read-token keys present in `env` that a Registry write ignores. */
+export function ignoredRegistryWriteCredentialKeys(env) {
+    const value = z.string().min(1).safeParse(env[VIBES_REGISTRY_READ_TOKEN_KEY]);
+    return value.success ? [VIBES_REGISTRY_READ_TOKEN_KEY] : [];
+}
+/** Operator note that present read tokens do not authorize the publish. */
+export function formatIgnoredRegistryWriteCredentials(keys) {
+    if (keys.length === 0)
+        return "";
+    const listed = keys.join(", ");
+    const verb = keys.length === 1 ? "is" : "are";
+    const pronoun = keys.length === 1 ? "it" : "them";
+    return (`${listed} ${verb} present but this write does not consume ${pronoun}. ` +
+        "Registry publish authenticates with the signed-in session " +
+        "and a one-use lease. VIBES_REGISTRY_TOKEN is the install/read token. Check `vibes auth status`.");
+}
+/**
+ * Guidance when npm output shows the Vibes Registry rejected the publish credential.
+ */
+export function formatVibesRegistryPublishAuthFailure(npmOutputText) {
+    if (!/(?:E401|401 Unauthorized|unable to authenticate|need:\s*Bearer)/i.test(npmOutputText)) {
+        return undefined;
+    }
+    return ("Registry rejected the publish credential. Do not run `npm login`. " +
+        "Check `vibes auth status`, then retry `vibes registry publish` or `vibes infra npm publish` " +
+        "without injecting VIBES_REGISTRY_TOKEN.");
+}
+/** Where to get or store a publish token for the target registries. */
+export function publishTokenSetupHint(tokenKey, registries, registryOrigin) {
+    const unique = [
+        ...new Set(registries.map((registry) => normalizeRegistryUrl(registry))),
+    ];
+    if (unique.length === 1 && unique[0] === normalizeRegistryUrl(registryOrigin)) {
+        return `Store the ${normalizeRegistryUrl(registryOrigin).replace(/^https?:\/\//, "")} publish token as ${tokenKey} with \`vibes secrets set ${tokenKey}\`.`;
+    }
+    if (unique.length === 1 && unique[0] === PUBLIC_NPM_REGISTRY) {
+        return "Create a publish token at https://www.npmjs.com/settings/tokens";
+    }
+    return `Store a publish token for ${unique.join(", ")} as ${tokenKey} with \`vibes secrets set ${tokenKey}\`.`;
+}
+/**
+ * A token from the runtime's secrets stores, with its source and tier. The host
+ * environment is never a credential source (D3).
+ */
+export async function resolveTokenFromSecrets(runtime, key, options) {
+    const environment = await resolveSecretsEnvironment(runtime, null, options.environment);
+    if (!runtime.hasKind("secrets/store")) {
+        return { environment: environment.name, tier: environment.tier };
+    }
+    const descriptors = runtime
+        .query("secrets/store")
+        .descriptors()
+        .filter((descriptor) => {
+        if (options.backend)
+            return descriptor.id === options.backend;
+        if (!isGenericSecretsStoreDescriptor(descriptor))
+            return false;
+        if (descriptor.backend === "encrypted-local")
+            return true;
+        if (descriptor.tiers.length === 0)
+            return true;
+        return descriptor.tiers.includes(environment.tier);
+    })
+        .sort((a, b) => (b.priority ?? 0) - (a.priority ?? 0));
+    for (const descriptor of descriptors) {
+        const store = await runtime
+            .query("secrets/store")
+            .withId(descriptor.id)
+            .resolve();
+        if (!store)
+            continue;
+        const value = await store.get(environment.name, key);
+        if (value && value.length > 0) {
+            return {
+                value,
+                source: descriptor.id,
+                environment: environment.name,
+                tier: environment.tier,
+            };
+        }
+    }
+    return { environment: environment.name, tier: environment.tier };
+}
+//# sourceMappingURL=registry-credentials.js.map

package/dist/cli/npm/publish/registry-credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry-credentials.js","sourceRoot":"","sources":["../../../../src/cli/npm/publish/registry-credentials.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAA6D,MAAM,qBAAqB,CAAC;AAC7H,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAChE,OAAO,EAAE,6BAA6B,EAAE,MAAM,8CAA8C,CAAC;AAC7F,OAAO,EACL,gBAAgB,GAEjB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,+BAA+B,EAC/B,yBAAyB,GAG1B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;AAC3B,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAGlD,+BAA+B;AAC/B,MAAM,CAAC,MAAM,mBAAmB,GAAG,4BAA4B,CAAC;AAEhE,2FAA2F;AAC3F,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,OAAmB;IAC7D,OAAO,oBAAoB,CAAC,MAAM,aAAa,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC;AACxE,CAAC;AACD,gDAAgD;AAChD,MAAM,CAAC,MAAM,oBAAoB,GAAG,WAAW,CAAC;AAChD,mDAAmD;AACnD,MAAM,CAAC,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;AAErD,yEAAyE;AACzE,MAAM,UAAU,oBAAoB,CAAC,QAAgB;IACnD,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAC7C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CAAC,QAAgB;IACvD,OAAO,CACL,oBAAoB,CAAC,QAAQ,CAAC,KAAK,oBAAoB,CAAC,mBAAmB,CAAC,CAC7E,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB,CACpC,GAAgB,EAChB,gBAAyB;IAEzB,MAAM,QAAQ,GACZ,UAAU,CAAC,gBAAgB,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;IAC1E,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAE9B,MAAM,KAAK,GACT,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO;QACrB,CAAC,CAAC,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,EAAE;QAC9B,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,IAAI,SAAS,CAAC,CAAC;IAC9B,MAAM,IAAI,KAAK,CACb,GAAG,KAAK,6DAA6D;QACnE,oFAAoF,CACvF,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B,CAAC,QAAgB,EAAE,cAAsB;IAC1E,OAAO,oBAAoB,CAAC,QAAQ,CAAC,KAAK,oBAAoB,CAAC,cAAc,CAAC;QAC5E,CAAC,CAAC,mBAAmB;QACrB,CAAC,CAAC,oBAAoB,CAAC;AAC3B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,4BAA4B,CAAC,UAAoB,EAAE,cAAsB;IACvF,MAAM,MAAM,GAAG;QACb,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC,CAAC;KACzE,CAAC;IACF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,oBAAoB,CAAC;IACrD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,0BAA0B,CAAC,MAAM,CAAC,CAAC,CAAE,EAAE,cAAc,CAAC,CAAC;IACvF,MAAM,IAAI,KAAK,CACb,6CAA6C,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;QACjE,8DAA8D,CACjE,CAAC;AACJ,CAAC;AAgBD,sEAAsE;AACtE,MAAM,CAAC,MAAM,oCAAoC,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AAElE;;GAEG;AACH,kFAAkF;AAClF,SAAS,kBAAkB,CAAC,KAAoC;IAC9D,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACzC,IAAI,IAAI,CAAC,OAAO;QAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;QAC1B,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACzC,IAAI,IAAI,CAAC,OAAO;YAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,KAAa;AACb,gFAAgF;AAChF,OAAmB;IAEnB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACzC,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,EAAE,CAC7B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CACtE,CAAC;IACF,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAChB,wEAAwE;QACxE,oEAAoE;QACpE,iBAAiB,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,oDAAoD,EAAE;YACpF,MAAM,EAAE,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,IAAI;SAC7C,CAAC,CAAC;QACH,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACzD,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IACtC,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3D,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClD,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACrD,IACE,CAAC,GAAG,CAAC,OAAO;QACZ,CAAC,GAAG,CAAC,OAAO;QACZ,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QAC5B,CAAC,GAAG,CAAC,OAAO;QACZ,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QAC5B,QAAQ,CAAC,MAAM,KAAK,CAAC,EACrB,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO;QACL,WAAW,EAAE,GAAG,CAAC,IAAI,GAAG,IAAI;QAC5B,OAAO,EAAE,GAAG,CAAC,IAAI;QACjB,MAAM,EAAE,GAAG,CAAC,IAAI;QAChB,QAAQ,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE;KACxC,CAAC;AACJ,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,mCAAmC,CACjD,OAAiC,EACjC,OAAiC;IAEjC,OAAO,CACL,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO;QACnC,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM;QACjC,OAAO,CAAC,QAAQ,CAAC,MAAM,KAAK,OAAO,CAAC,QAAQ,CAAC,MAAM;QACnD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAC5E,CAAC;AACJ,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,kCAAkC,CAChD,QAAgB,EAChB,MAAc,EACd,OAA0B;IAE1B,MAAM,OAAO,GAAiB,EAAE,CAAC;IACjC,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,CAAC,KAAK,GAAG,OAAO,CAAC;IACnD,OAAO,IAAI,KAAK,CACd,8CAA8C,QAAQ,8EAA8E,MAAM,IAAI;QAC5I,qCAAqC,mBAAmB,yCAAyC,EACnG,OAAO,CACR,CAAC;AACJ,CAAC;AASD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,oCAAoC,CAAC,OAS1D;IACC,MAAM,cAAc,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACpE,MAAM,gBAAgB,GAAG,UAAU,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC9D,MAAM,gBAAgB,GAAG;QACvB,GAAG,IAAI,GAAG,CACR,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC,CACrE;KACF,CAAC;IACF,IACE,CAAC,gBAAgB;QACjB,gBAAgB,CAAC,MAAM,KAAK,CAAC;QAC7B,gBAAgB,CAAC,CAAC,CAAC,KAAK,cAAc,EACtC,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,iBAAiB,CAC/C,6BAA6B,CAC9B,CAAC;QACF,IAAI,UAAU,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;YAChC,OAAO,EAAE,QAAQ,EAAE,6BAA6B,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;QAC5E,CAAC;QACD,MAAM,WAAW,GAAG,UAAU,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QACpD,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,UAAU,GAAkC;gBAChD,UAAU,EAAE;oBACV,KAAK,EAAE,WAAW;oBAClB,MAAM,EAAE,oBAAoB;oBAC5B,WAAW,EAAE,SAAS;oBACtB,IAAI,EAAE,SAAS;iBAChB;aACF,CAAC;YACF,6CAA6C;YAC7C,IAAI,wBAAwB,CAAC,WAAW,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC3D,UAAU,CAAC,iBAAiB,GAAG,OAAO,CAAC,sBAAsB,CAAC;YAChE,CAAC;YACD,OAAO,UAAU,CAAC;QACpB,CAAC;QACD,MAAM,UAAU,GAAG,UAAU,CAAC,MAAM,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAAC;QACjE,IAAI,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,UAAU,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YAClE,MAAM,UAAU,GAAkC;gBAChD,UAAU,EAAE;oBACV,KAAK,EAAE,UAAU;oBACjB,MAAM,EAAE,gBAAgB;oBACxB,WAAW,EAAE,SAAS;oBACtB,IAAI,EAAE,SAAS;iBAChB;aACF,CAAC;YACF,6CAA6C;YAC7C,IAAI,wBAAwB,CAAC,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC1D,UAAU,CAAC,iBAAiB,GAAG,OAAO,CAAC,sBAAsB,CAAC;YAChE,CAAC;YACD,OAAO,UAAU,CAAC;QACpB,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GACZ,gBAAgB,IAAI,4BAA4B,CAAC,OAAO,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;IACvF,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC,iBAAiB,CAAC,QAAQ,CAAC,EAAE,CAAC;AAC7E,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAKtC;IACC,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACtD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,IAAI,OAAO,CAAC,MAAM;QAAE,OAAO,oBAAoB,CAAC;IAChD,OAAO,4BAA4B,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;AAClF,CAAC;AAED,OAAO,EAAE,6BAA6B,EAAE,MAAM,8CAA8C,CAAC;AAE7F,sEAAsE;AACtE,MAAM,UAAU,kCAAkC,CAChD,GAAuC;IAEvC,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC,CAAC;IAC9E,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC9D,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,qCAAqC,CACnD,IAAuB;IAEvB,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;IAC9C,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;IAClD,OAAO,CACL,GAAG,MAAM,IAAI,IAAI,4CAA4C,OAAO,IAAI;QACxE,4DAA4D;QAC5D,iGAAiG,CAClG,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,qCAAqC,CACnD,aAAqB;IAErB,IACE,CAAC,kEAAkE,CAAC,IAAI,CACtE,aAAa,CACd,EACD,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,CACL,oEAAoE;QACpE,8FAA8F;QAC9F,yCAAyC,CAC1C,CAAC;AACJ,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,qBAAqB,CACnC,QAAgB,EAChB,UAAoB,EACpB,cAAsB;IAEtB,MAAM,MAAM,GAAG;QACb,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAAC,CAAC;KACzE,CAAC;IACF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,oBAAoB,CAAC,cAAc,CAAC,EAAE,CAAC;QAC9E,OAAO,aAAa,oBAAoB,CAAC,cAAc,CAAC,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,qBAAqB,QAAQ,6BAA6B,QAAQ,KAAK,CAAC;IAC9J,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,mBAAmB,EAAE,CAAC;QAC7D,OAAO,iEAAiE,CAAC;IAC3E,CAAC;IACD,OAAO,6BAA6B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,QAAQ,6BAA6B,QAAQ,KAAK,CAAC;AACjH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAqB,EACrB,GAAW,EACX,OAAmD;IAOnD,MAAM,WAAW,GAAG,MAAM,yBAAyB,CACjD,OAAO,EACP,IAAI,EACJ,OAAO,CAAC,WAAW,CACpB,CAAC;IACF,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC;QACtC,OAAO,EAAE,WAAW,EAAE,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,CAAC,IAAI,EAAE,CAAC;IACnE,CAAC;IAED,MAAM,WAAW,GAAG,OAAO;SACxB,KAAK,CAAqD,eAAe,CAAC;SAC1E,WAAW,EAAE;SACb,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE;QACrB,IAAI,OAAO,CAAC,OAAO;YAAE,OAAO,UAAU,CAAC,EAAE,KAAK,OAAO,CAAC,OAAO,CAAC;QAC9D,IAAI,CAAC,+BAA+B,CAAC,UAAU,CAAC;YAAE,OAAO,KAAK,CAAC;QAC/D,IAAI,UAAU,CAAC,OAAO,KAAK,iBAAiB;YAAE,OAAO,IAAI,CAAC;QAC1D,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC/C,OAAO,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IACrD,CAAC,CAAC;SACD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC;IAEzD,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,MAAM,KAAK,GAAG,MAAM,OAAO;aACxB,KAAK,CAAqD,eAAe,CAAC;aAC1E,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;aACrB,OAAO,EAAE,CAAC;QACb,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACrD,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,OAAO;gBACL,KAAK;gBACL,MAAM,EAAE,UAAU,CAAC,EAAE;gBACrB,WAAW,EAAE,WAAW,CAAC,IAAI;gBAC7B,IAAI,EAAE,WAAW,CAAC,IAAI;aACvB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,WAAW,EAAE,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,CAAC,IAAI,EAAE,CAAC;AACnE,CAAC"}

package/dist/cli/npm/publish/registry-reads.d.ts

@@ -0,0 +1,42 @@
+import { type JsonValue } from "@vibesdotdev/kernel/schemas/json";
+import type { ChildEnvRuntime } from "../../shared/runtime-execution.ts";
+import type { RegistryPublishedArtifactIdentity } from "@vibesdotdev/registry";
+import type { RuntimeExecution } from "@vibesdotdev/kernel/execution";
+/**
+ * The integrity, repository, gitHead and tarball of an `npm view --json` record;
+ * only a full commit hash counts as a gitHead.
+ */
+export declare function parsePublishedArtifactIdentity(name: string, version: string, value: JsonValue): RegistryPublishedArtifactIdentity;
+/**
+ * The published identity of `name@version`, or null when the Registry does not have it.
+ */
+export declare function npmPublishedArtifactIdentity(options: {
+    name: string;
+    version: string;
+    registry: string;
+    scope?: string;
+    cwd: string;
+    env: Record<string, string>;
+    execution: RuntimeExecution;
+    /** The runtime child environments are composed from. */
+    runtime: ChildEnvRuntime;
+    redactValues?: readonly string[];
+    retryConcealedNotFound?: () => Promise<boolean>;
+}): Promise<RegistryPublishedArtifactIdentity | null>;
+/**
+ * Every version the Registry publishes for `name`, or null when the package is
+ * absent. A rejected read credential is blindness and throws; a concealed 404
+ * retries once when the caller can renew its credential.
+ */
+export declare function npmListPublishedVersions(options: {
+    name: string;
+    registry: string;
+    cwd: string;
+    env: Record<string, string>;
+    execution: RuntimeExecution;
+    /** The runtime child environments are composed from. */
+    runtime: ChildEnvRuntime;
+    redactValues?: readonly string[];
+    retryConcealedNotFound?: () => Promise<boolean>;
+}): Promise<readonly string[] | null>;
+//# sourceMappingURL=registry-reads.d.ts.map

package/dist/cli/npm/publish/registry-reads.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry-reads.d.ts","sourceRoot":"","sources":["../../../../src/cli/npm/publish/registry-reads.ts"],"names":[],"mappings":"AAMA,OAAO,EAIL,KAAK,SAAS,EACf,MAAM,kCAAkC,CAAC;AAC1C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,KAAK,EAAE,iCAAiC,EAAE,MAAM,uBAAuB,CAAC;AAC/E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAsBtE;;;GAGG;AACH,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,SAAS,GACf,iCAAiC,CAenC;AAED;;GAEG;AACH,wBAAsB,4BAA4B,CAAC,OAAO,EAAE;IAC1D,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,SAAS,EAAE,gBAAgB,CAAC;IAC5B,wDAAwD;IACxD,OAAO,EAAE,eAAe,CAAC;IACzB,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,sBAAsB,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;CACjD,GAAG,OAAO,CAAC,iCAAiC,GAAG,IAAI,CAAC,CAwCpD;AAED;;;;GAIG;AACH,wBAAsB,wBAAwB,CAAC,OAAO,EAAE;IACtD,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,SAAS,EAAE,gBAAgB,CAAC;IAC5B,wDAAwD;IACxD,OAAO,EAAE,eAAe,CAAC;IACzB,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,sBAAsB,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;CACjD,GAAG,OAAO,CAAC,SAAS,MAAM,EAAE,GAAG,IAAI,CAAC,CA0FpC"}

package/dist/cli/npm/publish/registry-reads.js

@@ -0,0 +1,164 @@
+/**
+ * Registry reads through npm: a published version's artifact identity and the
+ * list of every published version of a package. A concealed 404 may retry once
+ * with a renewed read credential; a rejected credential is blindness and throws.
+ */
+import { CapabilityError, settle, valueFreeFailure } from "@vibesdotdev/kernel";
+import { JsonObjectSchema, JsonValueSchema, } from "@vibesdotdev/kernel/schemas/json";
+import { z } from "zod/v4";
+import { NpmCommandError, runNpm, versionSpec } from "./npm-exec.js";
+const GitHeadSchema = z.string().regex(/^[0-9a-f]{40,64}$/i);
+function jsonObject(value) {
+    const parsed = JsonObjectSchema.safeParse(value);
+    return parsed.success ? parsed.data : {};
+}
+function jsonString(value) {
+    const parsed = z.string().safeParse(value);
+    return parsed.success ? parsed.data : "";
+}
+function readRepository(value) {
+    const text = z.string().safeParse(value);
+    if (text.success)
+        return text.data;
+    return jsonString(jsonObject(value).url);
+}
+/**
+ * The integrity, repository, gitHead and tarball of an `npm view --json` record;
+ * only a full commit hash counts as a gitHead.
+ */
+export function parsePublishedArtifactIdentity(name, version, value) {
+    const record = jsonObject(value);
+    const dist = jsonObject(record.dist);
+    const gitHead = GitHeadSchema.safeParse(record.gitHead);
+    return {
+        name,
+        version,
+        integrity: jsonString(dist.integrity),
+        repository: readRepository(record.repository),
+        // Only a complete commit hash is a historical identity; a symbolic ref
+        // ('HEAD', a branch name, an abbreviated sha) would resolve against the
+        // current checkout, so coerce it to missing and fail closed.
+        gitHead: gitHead.success ? gitHead.data : "",
+        tarball: jsonString(dist.tarball),
+    };
+}
+/**
+ * The published identity of `name@version`, or null when the Registry does not have it.
+ */
+export async function npmPublishedArtifactIdentity(options) {
+    const args = [
+        "view",
+        versionSpec(options.name, options.version),
+        "--registry",
+        options.registry,
+        "--json",
+    ];
+    if (options.scope)
+        args.push(`--${options.scope}:registry=${options.registry}`);
+    const runView = () => runNpm(options.execution, args, {
+        runtime: options.runtime,
+        cwd: options.cwd,
+        env: options.env,
+        quiet: true,
+        allowFailure: true,
+        redactValues: options.redactValues,
+    });
+    let result = await runView();
+    let output = `${result.stdout}\n${result.stderr}`;
+    const concealedNotFound = /\bE404\b|404 Not Found|is not in this registry/i;
+    if (result.status !== 0 &&
+        concealedNotFound.test(output) &&
+        options.retryConcealedNotFound &&
+        (await options.retryConcealedNotFound())) {
+        result = await runView();
+        output = `${result.stdout}\n${result.stderr}`;
+    }
+    if (result.status === 0) {
+        return parsePublishedArtifactIdentity(options.name, options.version, JSON.parse(result.stdout));
+    }
+    if (concealedNotFound.test(output))
+        return null;
+    throw new NpmCommandError(args, result);
+}
+/**
+ * Every version the Registry publishes for `name`, or null when the package is
+ * absent. A rejected read credential is blindness and throws; a concealed 404
+ * retries once when the caller can renew its credential.
+ */
+export async function npmListPublishedVersions(options) {
+    const args = [
+        "view",
+        options.name,
+        "versions",
+        "--json",
+        "--registry",
+        options.registry,
+    ];
+    const scope = options.name.startsWith("@")
+        ? options.name.slice(0, options.name.indexOf("/"))
+        : undefined;
+    if (scope)
+        args.push(`--${scope}:registry=${options.registry}`);
+    const view = () => runNpm(options.execution, args, {
+        runtime: options.runtime,
+        cwd: options.cwd,
+        env: options.env,
+        quiet: true,
+        allowFailure: true,
+        redactValues: options.redactValues,
+    });
+    const concealedNotFound = /\bE404\b|404 Not Found|is not in this registry/i;
+    let result = await view();
+    if (result.status !== 0 &&
+        concealedNotFound.test(`${result.stdout}\n${result.stderr}`) &&
+        options.retryConcealedNotFound &&
+        (await options.retryConcealedNotFound())) {
+        result = await view();
+    }
+    if (result.status !== 0) {
+        const output = `${result.stdout}\n${result.stderr}`;
+        if (concealedNotFound.test(output))
+            return null;
+        if (/401 Unauthorized|403 Forbidden/i.test(output)) {
+            throw new Error(`Cannot read ${options.name} from ${options.registry}: the read credential was rejected. ` +
+                "This is blindness, not evidence the package is unpublished. " +
+                "Check `vibes auth status` and that VIBES_REGISTRY_TOKEN can install from packages.vibes.dev.");
+        }
+        throw new NpmCommandError(args, result);
+    }
+    // Unreadable output is not evidence of absence: an empty listing would
+    // assign a version the Registry may already hold.
+    const stdout = result.stdout.trim();
+    const decoded = await settle(() => Promise.resolve(stdout ? JSON.parse(stdout) : []));
+    if (!decoded.ok) {
+        throw new CapabilityError(`Registry version listing for ${options.name} is not JSON`, "INVALID_INPUT", {
+            reason: "registry-version-listing-not-json",
+            details: { package: options.name },
+            cause: valueFreeFailure(decoded.cause),
+        });
+    }
+    const admitted = JsonValueSchema.safeParse(decoded.value);
+    if (!admitted.success) {
+        throw new CapabilityError(`Registry version listing for ${options.name} is malformed`, "INVALID_INPUT", {
+            reason: "registry-version-listing-malformed",
+            details: { package: options.name },
+        });
+    }
+    const single = z.string().safeParse(admitted.data);
+    if (single.success)
+        return [single.data];
+    if (Array.isArray(admitted.data)) {
+        const versions = [];
+        for (const item of admitted.data) {
+            const version = z.string().safeParse(item);
+            if (version.success)
+                versions.push(version.data);
+        }
+        return versions;
+    }
+    throw new CapabilityError(`Registry version listing for ${options.name} is malformed`, "INVALID_INPUT", {
+        reason: "registry-version-listing-malformed",
+        details: { package: options.name },
+    });
+}
+//# sourceMappingURL=registry-reads.js.map

package/dist/cli/npm/publish/registry-reads.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry-reads.js","sourceRoot":"","sources":["../../../../src/cli/npm/publish/registry-reads.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAChF,OAAO,EACL,gBAAgB,EAChB,eAAe,GAGhB,MAAM,kCAAkC,CAAC;AAI1C,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;AAC3B,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAErE,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;AAE7D,SAAS,UAAU,CAAC,KAA4B;IAC9C,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACjD,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;AAC3C,CAAC;AAED,SAAS,UAAU,CAAC,KAA4B;IAC9C,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC3C,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;AAC3C,CAAC;AAED,SAAS,cAAc,CAAC,KAA4B;IAClD,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACzC,IAAI,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC;IACnC,OAAO,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC;AAC3C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,8BAA8B,CAC5C,IAAY,EACZ,OAAe,EACf,KAAgB;IAEhB,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,OAAO,GAAG,aAAa,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACxD,OAAO;QACL,IAAI;QACJ,OAAO;QACP,SAAS,EAAE,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC;QACrC,UAAU,EAAE,cAAc,CAAC,MAAM,CAAC,UAAU,CAAC;QAC7C,uEAAuE;QACvE,wEAAwE;QACxE,6DAA6D;QAC7D,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;QAC5C,OAAO,EAAE,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC;KAClC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,OAYlD;IACC,MAAM,IAAI,GAAG;QACX,MAAM;QACN,WAAW,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC;QAC1C,YAAY;QACZ,OAAO,CAAC,QAAQ;QAChB,QAAQ;KACT,CAAC;IACF,IAAI,OAAO,CAAC,KAAK;QACf,IAAI,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,KAAK,aAAa,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,GAAG,EAAE,CACnB,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE;QAC9B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,KAAK,EAAE,IAAI;QACX,YAAY,EAAE,IAAI;QAClB,YAAY,EAAE,OAAO,CAAC,YAAY;KACnC,CAAC,CAAC;IACL,IAAI,MAAM,GAAG,MAAM,OAAO,EAAE,CAAC;IAC7B,IAAI,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;IAClD,MAAM,iBAAiB,GAAG,iDAAiD,CAAC;IAC5E,IACE,MAAM,CAAC,MAAM,KAAK,CAAC;QACnB,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC;QAC9B,OAAO,CAAC,sBAAsB;QAC9B,CAAC,MAAM,OAAO,CAAC,sBAAsB,EAAE,CAAC,EACxC,CAAC;QACD,MAAM,GAAG,MAAM,OAAO,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;IAChD,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,8BAA8B,CACnC,OAAO,CAAC,IAAI,EACZ,OAAO,CAAC,OAAO,EACf,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAC1B,CAAC;IACJ,CAAC;IACD,IAAI,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAChD,MAAM,IAAI,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAC1C,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,OAU9C;IACC,MAAM,IAAI,GAAG;QACX,MAAM;QACN,OAAO,CAAC,IAAI;QACZ,UAAU;QACV,QAAQ;QACR,YAAY;QACZ,OAAO,CAAC,QAAQ;KACjB,CAAC;IACF,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QACxC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAClD,CAAC,CAAC,SAAS,CAAC;IACd,IAAI,KAAK;QAAE,IAAI,CAAC,IAAI,CAAC,KAAK,KAAK,aAAa,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IAChE,MAAM,IAAI,GAAG,GAAG,EAAE,CAChB,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE;QAC9B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,KAAK,EAAE,IAAI;QACX,YAAY,EAAE,IAAI;QAClB,YAAY,EAAE,OAAO,CAAC,YAAY;KACnC,CAAC,CAAC;IACL,MAAM,iBAAiB,GAAG,iDAAiD,CAAC;IAC5E,IAAI,MAAM,GAAG,MAAM,IAAI,EAAE,CAAC;IAC1B,IACE,MAAM,CAAC,MAAM,KAAK,CAAC;QACnB,iBAAiB,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;QAC5D,OAAO,CAAC,sBAAsB;QAC9B,CAAC,MAAM,OAAO,CAAC,sBAAsB,EAAE,CAAC,EACxC,CAAC;QACD,MAAM,GAAG,MAAM,IAAI,EAAE,CAAC;IACxB,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;QACpD,IAAI,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QAChD,IAAI,iCAAiC,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACnD,MAAM,IAAI,KAAK,CACb,eAAe,OAAO,CAAC,IAAI,SAAS,OAAO,CAAC,QAAQ,sCAAsC;gBACxF,8DAA8D;gBAC9D,8FAA8F,CACjG,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC1C,CAAC;IACD,uEAAuE;IACvE,kDAAkD;IAClD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACpC,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,CAChC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAClD,CAAC;IACF,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAChB,MAAM,IAAI,eAAe,CACvB,gCAAgC,OAAO,CAAC,IAAI,cAAc,EAC1D,eAAe,EACf;YACE,MAAM,EAAE,mCAAmC;YAC3C,OAAO,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE;YAClC,KAAK,EAAE,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC;SACvC,CACF,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,eAAe,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC1D,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtB,MAAM,IAAI,eAAe,CACvB,gCAAgC,OAAO,CAAC,IAAI,eAAe,EAC3D,eAAe,EACf;YACE,MAAM,EAAE,oCAAoC;YAC5C,OAAO,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE;SACnC,CACF,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACnD,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC;YACjC,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAC3C,IAAI,OAAO,CAAC,OAAO;gBAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACnD,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,IAAI,eAAe,CACvB,gCAAgC,OAAO,CAAC,IAAI,eAAe,EAC3D,eAAe,EACf;QACE,MAAM,EAAE,oCAAoC;QAC5C,OAAO,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE;KACnC,CACF,CAAC;AACJ,CAAC"}