@vibesdotdev/infra-deploy 0.0.1 → 1.0.0-rc.4

package/dist/cli/npm/put-attested-packument.js

@@ -0,0 +1,240 @@
+/**
+ * First-party PUT of an npm publish document that keeps `_vibes_source`.
+ *
+ * `npm publish` copies package.json into the PUT `versions` map and drops
+ * underscore-prefixed fields. packages.vibes.dev requires the attested stamp
+ * on that JSON body. Build the document from the packed tarball ourselves.
+ */
+import { resolveFileSystemAdapter } from '@vibesdotdev/filesystem';
+import { parseRegistryPublishManifest } from '@vibesdotdev/registry';
+import { CapabilityError, settle, settleNow, valueFreeFailure } from '@vibesdotdev/kernel';
+import { MAX_CAUSE_CHARS, redactCredentials } from '@vibesdotdev/shared/utils';
+import { gt, prerelease, valid } from 'semver';
+import { z } from 'zod/v4';
+/** The npm pack root member. Nested `package.json` files belong to bundled dependencies. */
+const NPM_PACK_MANIFEST = 'package/package.json';
+/** packages.vibes.dev answers every refusal with a value-free `{ error }` body. */
+const RegistryErrorBodySchema = z.object({ error: z.string() });
+/**
+ * The registry's `{ error }` text for a failed response, only when it is
+ * short and reads the same after the shared credential redaction (with the
+ * request's token as a secret). Any other body is never read into a failure.
+ */
+export async function registryErrorText(response, secrets) {
+    const read = await settle(() => response.text());
+    if (!read.ok)
+        return undefined;
+    const decoded = settleNow(() => JSON.parse(read.value));
+    if (!decoded.ok)
+        return undefined;
+    const body = RegistryErrorBodySchema.safeParse(decoded.value);
+    if (!body.success)
+        return undefined;
+    const text = body.data.error;
+    if (text.length === 0 || text.length > MAX_CAUSE_CHARS)
+        return undefined;
+    return redactCredentials(text, secrets) === text ? text : undefined;
+}
+export function tarballFilename(name, version) {
+    const unscoped = name.includes('/') ? name.split('/')[1] : name;
+    return `${unscoped}-${version}.tgz`;
+}
+async function gunzip(gzipBytes) {
+    const body = new Response(new Uint8Array(gzipBytes)).body;
+    if (body === null)
+        throw new Error('gzip body is missing');
+    const tar = body.pipeThrough(new DecompressionStream('gzip'));
+    return new Uint8Array(await new Response(tar).arrayBuffer());
+}
+export async function extractPackageJsonFromTgz(gzipBytes) {
+    const tarBytes = await gunzip(gzipBytes);
+    const decoder = new TextDecoder();
+    let manifestText;
+    let offset = 0;
+    while (offset + 512 <= tarBytes.length) {
+        const header = tarBytes.subarray(offset, offset + 512);
+        if (header.every((byte) => byte === 0))
+            break;
+        const name = readTarString(header, 0, 100);
+        const prefix = readTarString(header, 345, 155);
+        const fullName = (prefix ? `${prefix}/${name}` : name).replace(/^\.\//, '');
+        const size = readTarOctal(header, 124, 12);
+        const type = header[156];
+        const dataStart = offset + 512;
+        const dataEnd = dataStart + size;
+        if (dataEnd > tarBytes.length) {
+            throw new Error(`invalid tar entry size for ${fullName}`);
+        }
+        if ((type === 0 || type === 48) && fullName === NPM_PACK_MANIFEST) {
+            if (manifestText !== undefined) {
+                throw new CapabilityError(`packed tarball has duplicate ${NPM_PACK_MANIFEST}`, 'INVALID_INPUT', {
+                    reason: 'tarball-manifest-invalid'
+                });
+            }
+            manifestText = decoder.decode(tarBytes.subarray(dataStart, dataEnd));
+        }
+        offset = dataStart + Math.ceil(size / 512) * 512;
+    }
+    if (manifestText === undefined)
+        throw new Error('packed tarball has no package.json');
+    const decoded = settleNow(() => JSON.parse(manifestText));
+    if (!decoded.ok) {
+        throw new CapabilityError('packed package.json is not valid JSON', 'INVALID_INPUT', {
+            reason: 'registry-manifest-invalid',
+            cause: valueFreeFailure(decoded.cause)
+        });
+    }
+    return parseRegistryPublishManifest(decoded.value);
+}
+function readTarString(bytes, offset, length) {
+    const end = offset + length;
+    let actualEnd = offset;
+    while (actualEnd < end && bytes[actualEnd] !== 0)
+        actualEnd++;
+    return new TextDecoder().decode(bytes.subarray(offset, actualEnd));
+}
+function readTarOctal(bytes, offset, length) {
+    const raw = readTarString(bytes, offset, length).trim();
+    if (!raw)
+        return 0;
+    const parsed = Number.parseInt(raw, 8);
+    if (!Number.isFinite(parsed))
+        throw new Error(`invalid tar octal size: ${raw}`);
+    return parsed;
+}
+export function bytesToBase64(bytes) {
+    let binary = '';
+    for (const byte of bytes)
+        binary += String.fromCharCode(byte);
+    return btoa(binary);
+}
+/** Default dist-tag when no explicit tag is supplied: `rc` for prereleases, `latest` for stable releases. */
+export function defaultDistTagForVersion(version) {
+    return prerelease(version) !== null ? 'rc' : 'latest';
+}
+export async function buildAttestedPublishPayload(options) {
+    const manifest = await extractPackageJsonFromTgz(options.tarball);
+    if (!manifest.name || !manifest.version) {
+        throw new Error('packed package.json is missing name or version');
+    }
+    const name = manifest.name;
+    const version = manifest.version;
+    if (!manifest._vibes_source?.repo || !manifest._vibes_source.sha || !manifest._vibes_source.workspaceDigest) {
+        throw new Error(`packed ${name}@${version} is missing _vibes_source {repo, sha, workspaceDigest}`);
+    }
+    const attested = { ...manifest, name, version };
+    const file = tarballFilename(name, version);
+    const registry = options.registry.replace(/\/$/, '');
+    const tarballUrl = `${registry}/${name}/-/${file}`;
+    const resolvedTag = options.tag ?? defaultDistTagForVersion(version);
+    const payload = {
+        _id: name,
+        name,
+        'dist-tags': { [resolvedTag]: version },
+        versions: {
+            [version]: {
+                ...attested,
+                dist: { ...options.dist, tarball: tarballUrl }
+            }
+        },
+        _attachments: {
+            [file]: {
+                content_type: 'application/octet-stream',
+                data: bytesToBase64(options.tarball),
+                length: options.tarball.byteLength
+            }
+        }
+    };
+    if (options.access)
+        payload.access = options.access;
+    return {
+        name,
+        version,
+        payload,
+        url: `${registry}/${encodeURIComponent(name)}`
+    };
+}
+export async function putAttestedPackument(options) {
+    const tarball = 'bytes' in options.tarball
+        ? options.tarball.bytes
+        : z.instanceof(Uint8Array).parse(await (await resolveFileSystemAdapter(options.runtime, { binding: false })).readFile(options.tarball.path));
+    const built = await buildAttestedPublishPayload({
+        tarball,
+        registry: options.registry,
+        tag: options.tag,
+        access: options.access,
+        dist: options.dist
+    });
+    const fetchImpl = options.fetchImpl ?? fetch;
+    // `latest` names the current stable release line. A non-`latest` publish that displaces `latest`
+    // (see `latestDisplacedBy`) moves `latest` in the same PUT; prereleases never displace `latest`.
+    const resolvedTag = options.tag ?? defaultDistTagForVersion(built.version);
+    let latestTag = { state: 'unchanged' };
+    if (resolvedTag !== 'latest') {
+        const read = await settle(() => readDistTags({ ...options, fetchImpl, name: built.name }));
+        if (!read.ok)
+            latestTag = { state: 'unread', failure: valueFreeFailure(read.cause) };
+        else if (latestDisplacedBy(read.value.latest, built.version)) {
+            built.payload['dist-tags'].latest = built.version;
+            latestTag = { state: 'moved' };
+        }
+    }
+    const response = await fetchImpl(built.url, {
+        method: 'PUT',
+        headers: {
+            authorization: `Bearer ${options.token}`,
+            'content-type': 'application/json',
+            accept: 'application/json'
+        },
+        body: JSON.stringify(built.payload)
+    });
+    if (!response.ok) {
+        const registryError = await registryErrorText(response, [options.token]);
+        const said = registryError === undefined ? '' : `: ${registryError}`;
+        throw new CapabilityError(`Attested publish PUT ${built.name}@${built.version} failed (${response.status})${said}`, 'UNAVAILABLE', {
+            reason: 'registry-put-failed',
+            // The registry sends `retry-after` only with its bounded-CAS 409; every other 409 is final.
+            // A rate limit or a server failure may run again; a retry after a PUT that did store is
+            // refused as an existing version, which the publisher skips.
+            retryable: (response.status === 409 && response.headers.has('retry-after')) || response.status === 429 || response.status >= 500,
+            details: { status: response.status }
+        });
+    }
+    return { name: built.name, version: built.version, status: response.status, latestTag };
+}
+/**
+ * Whether `published`, released on a tag other than `latest`, displaces the
+ * package's current `latest`. Prereleases (`1.0.0-rc.*`, etc.) are published on
+ * `rc` only and never displace `latest`. A stable release displaces `latest`
+ * when `latest` is absent (or not a version) or when `latest` is an older
+ * prerelease (`gt(published, latest)`). A stable published on another tag never
+ * displaces an existing stable `latest`. The publish PUT and the train's latest
+ * reconcile share this rule.
+ */
+export function latestDisplacedBy(latest, published) {
+    if (!valid(published) || prerelease(published) !== null)
+        return false;
+    if (latest === undefined || !valid(latest))
+        return true;
+    if (prerelease(latest) !== null)
+        return gt(published, latest);
+    return false;
+}
+const DistTagsSchema = z.object({ 'dist-tags': z.record(z.string(), z.string()).default({}) });
+/** The package's current dist-tags; empty for a package the registry does not hold yet. */
+export async function readDistTags(options) {
+    const registry = options.registry.replace(/\/$/, '');
+    const current = await options.fetchImpl(`${registry}/${encodeURIComponent(options.name)}`, {
+        headers: { authorization: `Bearer ${options.token}`, accept: 'application/json' }
+    });
+    if (current.status === 404) {
+        await current.body?.cancel();
+        return {};
+    }
+    if (!current.ok) {
+        const said = await registryErrorText(current, [options.token]);
+        throw new CapabilityError(`Reading ${options.name}'s dist-tags failed (${current.status})${said === undefined ? '' : `: ${said}`}`, 'UNAVAILABLE', { reason: 'registry-dist-tag-read-failed', retryable: current.status === 429 || current.status >= 500, details: { status: current.status } });
+    }
+    return DistTagsSchema.parse(await current.json())['dist-tags'];
+}
+//# sourceMappingURL=put-attested-packument.js.map

package/dist/cli/npm/put-attested-packument.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"put-attested-packument.js","sourceRoot":"","sources":["../../../src/cli/npm/put-attested-packument.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,4BAA4B,EAAgC,MAAM,uBAAuB,CAAC;AACnG,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,EAAE,gBAAgB,EAAmB,MAAM,qBAAqB,CAAC;AAC5G,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC/E,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AAC/C,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;AAE3B,4FAA4F;AAC5F,MAAM,iBAAiB,GAAG,sBAAsB,CAAC;AAEjD,mFAAmF;AACnF,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAEhE;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,QAAkB,EAAE,OAA0B;IACrF,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IACjD,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,SAAS,CAAC;IAC/B,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IACxD,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,SAAS,CAAC;IAClC,MAAM,IAAI,GAAG,uBAAuB,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC9D,IAAI,CAAC,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IACpC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;IAC7B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,eAAe;QAAE,OAAO,SAAS,CAAC;IACzE,OAAO,iBAAiB,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACrE,CAAC;AAmBD,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,OAAe;IAC5D,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACjE,OAAO,GAAG,QAAQ,IAAI,OAAO,MAAM,CAAC;AACrC,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,SAAqB;IAC1C,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1D,IAAI,IAAI,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAC3D,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,IAAI,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9D,OAAO,IAAI,UAAU,CAAC,MAAM,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,SAAqB;IACpE,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,IAAI,YAAgC,CAAC;IACrC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,OAAO,MAAM,GAAG,GAAG,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,GAAG,CAAC,CAAC;QACvD,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,CAAC;YAAE,MAAM;QAC9C,MAAM,IAAI,GAAG,aAAa,CAAC,MAAM,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC;QAC3C,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QAC/C,MAAM,QAAQ,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QAC5E,MAAM,IAAI,GAAG,YAAY,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QACzB,MAAM,SAAS,GAAG,MAAM,GAAG,GAAG,CAAC;QAC/B,MAAM,OAAO,GAAG,SAAS,GAAG,IAAI,CAAC;QACjC,IAAI,OAAO,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,8BAA8B,QAAQ,EAAE,CAAC,CAAC;QAC3D,CAAC;QACD,IAAI,CAAC,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,EAAE,CAAC,IAAI,QAAQ,KAAK,iBAAiB,EAAE,CAAC;YACnE,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;gBAChC,MAAM,IAAI,eAAe,CAAC,gCAAgC,iBAAiB,EAAE,EAAE,eAAe,EAAE;oBAC/F,MAAM,EAAE,0BAA0B;iBAClC,CAAC,CAAC;YACJ,CAAC;YACD,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,GAAG,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,GAAG,GAAG,CAAC;IAClD,CAAC;IACD,IAAI,YAAY,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACtF,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC;IAC1D,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,eAAe,CAAC,uCAAuC,EAAE,eAAe,EAAE;YACnF,MAAM,EAAE,2BAA2B;YACnC,KAAK,EAAE,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC;SACtC,CAAC,CAAC;IACJ,CAAC;IACD,OAAO,4BAA4B,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,aAAa,CAAC,KAAiB,EAAE,MAAc,EAAE,MAAc;IACvE,MAAM,GAAG,GAAG,MAAM,GAAG,MAAM,CAAC;IAC5B,IAAI,SAAS,GAAG,MAAM,CAAC;IACvB,OAAO,SAAS,GAAG,GAAG,IAAI,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC;QAAE,SAAS,EAAE,CAAC;IAC9D,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,YAAY,CAAC,KAAiB,EAAE,MAAc,EAAE,MAAc;IACtE,MAAM,GAAG,GAAG,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IACxD,IAAI,CAAC,GAAG;QAAE,OAAO,CAAC,CAAC;IACnB,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IACvC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,EAAE,CAAC,CAAC;IAChF,OAAO,MAAM,CAAC;AACf,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAiB;IAC9C,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IAC9D,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC;AACrB,CAAC;AAED,6GAA6G;AAC7G,MAAM,UAAU,wBAAwB,CAAC,OAAe;IACvD,OAAO,UAAU,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC;AACvD,CAAC;AAKD,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,OAOjD;IACA,MAAM,QAAQ,GAAG,MAAM,yBAAyB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAClE,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC;IAC3B,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC;IACjC,IAAI,CAAC,QAAQ,CAAC,aAAa,EAAE,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,eAAe,EAAE,CAAC;QAC7G,MAAM,IAAI,KAAK,CACd,UAAU,IAAI,IAAI,OAAO,wDAAwD,CACjF,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAA4B,EAAE,GAAG,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IACzE,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACrD,MAAM,UAAU,GAAG,GAAG,QAAQ,IAAI,IAAI,MAAM,IAAI,EAAE,CAAC;IACnD,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,IAAI,wBAAwB,CAAC,OAAO,CAAC,CAAC;IACrE,MAAM,OAAO,GAA2B;QACvC,GAAG,EAAE,IAAI;QACT,IAAI;QACJ,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,EAAE,OAAO,EAAE;QACvC,QAAQ,EAAE;YACT,CAAC,OAAO,CAAC,EAAE;gBACV,GAAG,QAAQ;gBACX,IAAI,EAAE,EAAE,GAAG,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE;aAC9C;SACD;QACD,YAAY,EAAE;YACb,CAAC,IAAI,CAAC,EAAE;gBACP,YAAY,EAAE,0BAA0B;gBACxC,IAAI,EAAE,aAAa,CAAC,OAAO,CAAC,OAAO,CAAC;gBACpC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU;aAClC;SACD;KACD,CAAC;IACF,IAAI,OAAO,CAAC,MAAM;QAAE,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IACpD,OAAO;QACN,IAAI;QACJ,OAAO;QACP,OAAO;QACP,GAAG,EAAE,GAAG,QAAQ,IAAI,kBAAkB,CAAC,IAAI,CAAC,EAAE;KAC9C,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAU1C;IACA,MAAM,OAAO,GAAG,OAAO,IAAI,OAAO,CAAC,OAAO;QACzC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK;QACvB,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,KAAK,CAC9B,MAAM,CAAC,MAAM,wBAAwB,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAC1G,CAAC;IACJ,MAAM,KAAK,GAAG,MAAM,2BAA2B,CAAC;QAC/C,OAAO;QACP,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,IAAI,EAAE,OAAO,CAAC,IAAI;KAClB,CAAC,CAAC;IACH,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;IAC7C,iGAAiG;IACjG,iGAAiG;IACjG,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,IAAI,wBAAwB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC3E,IAAI,SAAS,GAAqB,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;IACzD,IAAI,WAAW,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;QAC3F,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,SAAS,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;aAChF,IAAI,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9D,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC;YAClD,SAAS,GAAG,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;QAChC,CAAC;IACF,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE;QAC3C,MAAM,EAAE,KAAK;QACb,OAAO,EAAE;YACR,aAAa,EAAE,UAAU,OAAO,CAAC,KAAK,EAAE;YACxC,cAAc,EAAE,kBAAkB;YAClC,MAAM,EAAE,kBAAkB;SAC1B;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC;KACnC,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QACzE,MAAM,IAAI,GAAG,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,aAAa,EAAE,CAAC;QACrE,MAAM,IAAI,eAAe,CACxB,wBAAwB,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,OAAO,YAAY,QAAQ,CAAC,MAAM,IAAI,IAAI,EAAE,EACxF,aAAa,EACb;YACC,MAAM,EAAE,qBAAqB;YAC7B,4FAA4F;YAC5F,wFAAwF;YACxF,6DAA6D;YAC7D,SAAS,EAAE,CAAC,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG;YAChI,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE;SACpC,CACD,CAAC;IACH,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC;AACzF,CAAC;AAOD;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAA0B,EAAE,SAAiB;IAC9E,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACtE,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IACxD,IAAI,UAAU,CAAC,MAAM,CAAC,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAC9D,OAAO,KAAK,CAAC;AACd,CAAC;AAED,MAAM,cAAc,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;AAE/F,2FAA2F;AAC3F,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAAmF;IACrH,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,GAAG,QAAQ,IAAI,kBAAkB,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE;QAC1F,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,OAAO,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;KACjF,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,MAAM,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;QAC7B,OAAO,EAAE,CAAC;IACX,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QAC/D,MAAM,IAAI,eAAe,CACxB,WAAW,OAAO,CAAC,IAAI,wBAAwB,OAAO,CAAC,MAAM,IAAI,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,EAAE,EACxG,aAAa,EACb,EAAE,MAAM,EAAE,+BAA+B,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,KAAK,GAAG,IAAI,OAAO,CAAC,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,EAAE,CAC5I,CAAC;IACH,CAAC;IACD,OAAO,cAAc,CAAC,KAAK,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC;AAChE,CAAC"}

package/dist/cli/npm/reconcile-latest.d.ts

@@ -0,0 +1,55 @@
+/**
+ * The release train's `latest` reconcile. After a train publishes, each graph
+ * package whose registry `latest` is displaced (`latestDisplacedBy`, the same
+ * rule the publish PUT applies) by its newest version on the release tag has
+ * `latest` moved through the registry's dist-tag operation, leaves first.
+ *
+ * Authority is the caller's: the bearer token is the one its publish ran
+ * under. A registry refusal (with its status and `{ error }` text) or a failed
+ * read is reported for that package, never retried around, and the reconcile
+ * continues with the next package.
+ */
+import { valueFreeFailure } from '@vibesdotdev/kernel';
+/** What the reconcile did to one package's `latest`. */
+export type LatestReconcileOutcome = {
+    name: string;
+    state: 'moved';
+    from: string | undefined;
+    to: string;
+} | {
+    name: string;
+    state: 'unchanged';
+    latest: string | undefined;
+    release: string;
+} | {
+    name: string;
+    state: 'untagged';
+}
+/** The registry answered the dist-tag operation with a refusal: its status and `{ error }` text. */
+ | {
+    name: string;
+    state: 'refused';
+    release: string;
+    status: number;
+    error: string | undefined;
+}
+/** The packument read or the request itself failed. */
+ | {
+    name: string;
+    state: 'failed';
+    failure: ReturnType<typeof valueFreeFailure>;
+};
+/**
+ * Reconcile `latest` for `packages`, which must be in dependency order
+ * (leaves first, as a release plan's `publishOrder` is). Each package is read
+ * and, when displaced, moved before the next is touched.
+ */
+export declare function reconcileLatestDistTags(options: {
+    registry: string;
+    token: string;
+    /** The release tag the train published on (e.g. `rc`). */
+    tag: string;
+    packages: readonly string[];
+    fetchImpl?: typeof fetch;
+}): Promise<LatestReconcileOutcome[]>;
+//# sourceMappingURL=reconcile-latest.d.ts.map

package/dist/cli/npm/reconcile-latest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reconcile-latest.d.ts","sourceRoot":"","sources":["../../../src/cli/npm/reconcile-latest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAA2B,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAGhF,wDAAwD;AACxD,MAAM,MAAM,sBAAsB,GAC/B;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GACtE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GACjF;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,UAAU,CAAA;CAAE;AACrC,oGAAoG;GAClG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE;AAChG,uDAAuD;GACrD;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,QAAQ,CAAC;IAAC,OAAO,EAAE,UAAU,CAAC,OAAO,gBAAgB,CAAC,CAAA;CAAE,CAAC;AAEnF;;;;GAIG;AACH,wBAAsB,uBAAuB,CAAC,OAAO,EAAE;IACtD,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,0DAA0D;IAC1D,GAAG,EAAE,MAAM,CAAC;IACZ,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CACzB,GAAG,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAcpC"}

package/dist/cli/npm/reconcile-latest.js

@@ -0,0 +1,59 @@
+/**
+ * The release train's `latest` reconcile. After a train publishes, each graph
+ * package whose registry `latest` is displaced (`latestDisplacedBy`, the same
+ * rule the publish PUT applies) by its newest version on the release tag has
+ * `latest` moved through the registry's dist-tag operation, leaves first.
+ *
+ * Authority is the caller's: the bearer token is the one its publish ran
+ * under. A registry refusal (with its status and `{ error }` text) or a failed
+ * read is reported for that package, never retried around, and the reconcile
+ * continues with the next package.
+ */
+import { CapabilityError, settle, valueFreeFailure } from '@vibesdotdev/kernel';
+import { latestDisplacedBy, readDistTags, registryErrorText } from "./put-attested-packument.js";
+/**
+ * Reconcile `latest` for `packages`, which must be in dependency order
+ * (leaves first, as a release plan's `publishOrder` is). Each package is read
+ * and, when displaced, moved before the next is touched.
+ */
+export async function reconcileLatestDistTags(options) {
+    if (options.tag === 'latest') {
+        throw new CapabilityError('The latest reconcile reads a release tag other than latest.', 'INVALID_INPUT', {
+            reason: 'latest-reconcile-tag-invalid'
+        });
+    }
+    const fetchImpl = options.fetchImpl ?? fetch;
+    const registry = options.registry.replace(/\/$/, '');
+    const outcomes = [];
+    for (const name of options.packages) {
+        const reconciled = await settle(() => reconcileOne({ ...options, registry, fetchImpl, name }));
+        outcomes.push(reconciled.ok ? reconciled.value : { name, state: 'failed', failure: valueFreeFailure(reconciled.cause) });
+    }
+    return outcomes;
+}
+async function reconcileOne(options) {
+    const { name } = options;
+    const tags = await readDistTags(options);
+    const release = tags[options.tag];
+    if (release === undefined)
+        return { name, state: 'untagged' };
+    const latest = tags.latest;
+    if (!latestDisplacedBy(latest, release))
+        return { name, state: 'unchanged', latest, release };
+    const response = await options.fetchImpl(`${options.registry}/-/package/${encodeURIComponent(name)}/dist-tags/latest`, {
+        method: 'PUT',
+        headers: {
+            authorization: `Bearer ${options.token}`,
+            'content-type': 'application/json',
+            accept: 'application/json'
+        },
+        body: JSON.stringify(release)
+    });
+    if (!response.ok) {
+        const error = await registryErrorText(response, [options.token]);
+        return { name, state: 'refused', release, status: response.status, error };
+    }
+    await response.body?.cancel();
+    return { name, state: 'moved', from: latest, to: release };
+}
+//# sourceMappingURL=reconcile-latest.js.map

package/dist/cli/npm/reconcile-latest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reconcile-latest.js","sourceRoot":"","sources":["../../../src/cli/npm/reconcile-latest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAChF,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,6BAA6B,CAAC;AAYjG;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,OAO7C;IACA,IAAI,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,eAAe,CAAC,6DAA6D,EAAE,eAAe,EAAE;YACzG,MAAM,EAAE,8BAA8B;SACtC,CAAC,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;IAC7C,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACrD,MAAM,QAAQ,GAA6B,EAAE,CAAC;IAC9C,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACrC,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAC/F,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,gBAAgB,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC1H,CAAC;IACD,OAAO,QAAQ,CAAC;AACjB,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,OAM3B;IACA,MAAM,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC;IACzB,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IAC9D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAC3B,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,OAAO,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC9F,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,SAAS,CACvC,GAAG,OAAO,CAAC,QAAQ,cAAc,kBAAkB,CAAC,IAAI,CAAC,mBAAmB,EAC5E;QACC,MAAM,EAAE,KAAK;QACb,OAAO,EAAE;YACR,aAAa,EAAE,UAAU,OAAO,CAAC,KAAK,EAAE;YACxC,cAAc,EAAE,kBAAkB;YAClC,MAAM,EAAE,kBAAkB;SAC1B;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC;KAC7B,CACD,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;QACjE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC;IAC5E,CAAC;IACD,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IAC9B,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC;AAC5D,CAAC"}

package/dist/cli/observability/blind-spots.d.ts

@@ -0,0 +1,10 @@
+import type { ObservabilitySnapshot } from '@vibesdotdev/infra-core/kinds';
+/**
+ * Workers whose logs miss invocations: logs off, or head sampling below full
+ * capture. Logs on with no reported rate is full capture (the provider default
+ * rate is 1). Unreadable workers are reported separately, never as covered.
+ */
+export declare function observabilityBlindSpots(snapshots: readonly ObservabilitySnapshot[]): string[];
+/** How to close a blind spot durably, and between deploys. */
+export declare const OBSERVABILITY_BLIND_SPOT_REMEDY: string;
+//# sourceMappingURL=blind-spots.d.ts.map

package/dist/cli/observability/blind-spots.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"blind-spots.d.ts","sourceRoot":"","sources":["../../../src/cli/observability/blind-spots.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAE3E;;;;GAIG;AACH,wBAAgB,uBAAuB,CACtC,SAAS,EAAE,SAAS,qBAAqB,EAAE,GACzC,MAAM,EAAE,CAQV;AAED,8DAA8D;AAC9D,eAAO,MAAM,+BAA+B,QAG+B,CAAC"}

package/dist/cli/observability/blind-spots.js

@@ -0,0 +1,19 @@
+/**
+ * Workers whose logs miss invocations: logs off, or head sampling below full
+ * capture. Logs on with no reported rate is full capture (the provider default
+ * rate is 1). Unreadable workers are reported separately, never as covered.
+ */
+export function observabilityBlindSpots(snapshots) {
+    return snapshots
+        .filter((snapshot) => !snapshot.failure)
+        .filter((snapshot) => {
+        const logs = snapshot.settings.logs;
+        return !logs?.enabled || (logs.headSamplingRate ?? 1) < 1;
+    })
+        .map((snapshot) => snapshot.workerName);
+}
+/** How to close a blind spot durably, and between deploys. */
+export const OBSERVABILITY_BLIND_SPOT_REMEDY = 'declare `observability: { enabled: true }` in the app deployment config (the deploy ' +
+    'helper writes full capture), or between deploys run ' +
+    '`vibes infra observability set --worker <name> --logs true --sampling 1`';
+//# sourceMappingURL=blind-spots.js.map

package/dist/cli/observability/blind-spots.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"blind-spots.js","sourceRoot":"","sources":["../../../src/cli/observability/blind-spots.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CACtC,SAA2C;IAE3C,OAAO,SAAS;SACd,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;SACvC,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE;QACpB,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC;QACpC,OAAO,CAAC,IAAI,EAAE,OAAO,IAAI,CAAC,IAAI,CAAC,gBAAgB,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;IAC3D,CAAC,CAAC;SACD,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;AAC1C,CAAC;AAED,8DAA8D;AAC9D,MAAM,CAAC,MAAM,+BAA+B,GAC3C,sFAAsF;IACtF,sDAAsD;IACtD,0EAA0E,CAAC"}

package/dist/cli/observability/infra-observability-exports-list.cli-command.impl.d.ts

@@ -0,0 +1,6 @@
+import type { CommandContext, CommandOptions } from '@vibesdotdev/cli';
+declare const _default: {
+    execute(_args: CommandOptions, opts: CommandOptions, context: CommandContext): Promise<void>;
+};
+export default _default;
+//# sourceMappingURL=infra-observability-exports-list.cli-command.impl.d.ts.map

package/dist/cli/observability/infra-observability-exports-list.cli-command.impl.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"infra-observability-exports-list.cli-command.impl.d.ts","sourceRoot":"","sources":["../../../src/cli/observability/infra-observability-exports-list.cli-command.impl.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;;mBAiBjD,cAAc,QAAQ,cAAc,WAAW,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC;;AADnG,wBAuFE"}

package/dist/cli/observability/infra-observability-exports-list.cli-command.impl.js

@@ -0,0 +1,75 @@
+import { CapabilityError } from '@vibesdotdev/kernel';
+import { ObservabilityExportInventorySchema, sanitizeInfraProviderFailure } from '@vibesdotdev/infra-core';
+import { readString } from "../shared/option-strings.js";
+export default {
+    async execute(_args, opts, context) {
+        const runtime = context.runtime;
+        const ui = await runtime.context('cli/ui');
+        const worker = readString(opts.worker);
+        const filter = readString(opts.filter);
+        const provider = readString(opts.provider);
+        const environment = readString(opts.environment);
+        const output = readString(opts.output) ?? 'text';
+        if (!['text', 'json'].includes(output))
+            throw new CapabilityError('Output must be text or json.', 'INVALID_INPUT');
+        if (!runtime.hasKind('infra/observability')) {
+            throw new CapabilityError('No observability provider is registered; export inventory is unavailable.', 'UNAVAILABLE');
+        }
+        const descriptors = runtime
+            .query('infra/observability')
+            .enabled()
+            .descriptors();
+        const target = provider
+            ? descriptors.find((descriptor) => descriptor.id === provider || descriptor.adapter === provider)
+            : descriptors[0];
+        if (!target)
+            throw new CapabilityError('No matching observability provider for export inventory.', 'NOT_FOUND');
+        const scope = worker
+            ? { kind: 'worker', workerName: worker }
+            : filter
+                ? { kind: 'account-wide', filter }
+                : { kind: 'account-wide' };
+        let raw;
+        let implementation;
+        try {
+            const resolved = await runtime
+                .query('infra/observability')
+                .withId(target.id)
+                .resolve();
+            implementation = 'create' in resolved ? await resolved.create({ environment }) : resolved;
+        }
+        catch (error) {
+            const failure = sanitizeInfraProviderFailure(error);
+            throw new CapabilityError(failure.message, 'UNAVAILABLE');
+        }
+        if (!implementation.listExports)
+            throw new CapabilityError('This observability provider does not support export inventory.', 'UNAVAILABLE');
+        try {
+            raw = await implementation.listExports(scope);
+        }
+        catch (error) {
+            throw new CapabilityError(sanitizeInfraProviderFailure(error).message, 'UNAVAILABLE');
+        }
+        const parsed = ObservabilityExportInventorySchema.safeParse(raw);
+        if (!parsed.success)
+            throw new CapabilityError('Provider returned an invalid export inventory.', 'INTERNAL');
+        const inventory = parsed.data;
+        if (output === 'json') {
+            ui.json(inventory);
+            return;
+        }
+        ui.info('Export inventory is configuration evidence; it does not certify collector delivery.');
+        for (const destination of inventory.destinations) {
+            ui.info(`${destination.id} (${destination.name}): ${destination.signal}, enabled=${destination.enabled}, ${destination.endpointOrigin ?? 'unknown endpoint'}; header names: ${destination.headerNames.join(', ') || 'none'}`);
+        }
+        if (inventory.destinations.length === 0)
+            ui.info('No export destinations reported by the provider.');
+        for (const worker of inventory.workers) {
+            if (worker.failure)
+                ui.warn(`${worker.workerName}: unreadable (${worker.failure.code}: ${worker.failure.message})`);
+            else
+                ui.info(`${worker.workerName}: logs=[${worker.logs.join(', ')}] traces=[${worker.traces.join(', ')}]`);
+        }
+    }
+};
+//# sourceMappingURL=infra-observability-exports-list.cli-command.impl.js.map

package/dist/cli/observability/infra-observability-exports-list.cli-command.impl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"infra-observability-exports-list.cli-command.impl.js","sourceRoot":"","sources":["../../../src/cli/observability/infra-observability-exports-list.cli-command.impl.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAGtD,OAAO,EACN,kCAAkC,EAClC,4BAA4B,EAI5B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAQzD,eAAe;IACd,KAAK,CAAC,OAAO,CAAC,KAAqB,EAAE,IAAoB,EAAE,OAAuB;QACjF,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAChC,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC,OAAO,CAAY,QAAQ,CAAC,CAAC;QACtD,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvC,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvC,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC3C,MAAM,WAAW,GAAG,UAAU,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACjD,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC;QACjD,IAAI,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;YACrC,MAAM,IAAI,eAAe,CAAC,8BAA8B,EAAE,eAAe,CAAC,CAAC;QAC5E,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,qBAAqB,CAAC,EAAE,CAAC;YAC7C,MAAM,IAAI,eAAe,CACxB,2EAA2E,EAC3E,aAAa,CACb,CAAC;QACH,CAAC;QACD,MAAM,WAAW,GAAG,OAAO;aACzB,KAAK,CAA+B,qBAAqB,CAAC;aAC1D,OAAO,EAAE;aACT,WAAW,EAAE,CAAC;QAChB,MAAM,MAAM,GAAG,QAAQ;YACtB,CAAC,CAAC,WAAW,CAAC,IAAI,CAChB,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,EAAE,KAAK,QAAQ,IAAI,UAAU,CAAC,OAAO,KAAK,QAAQ,CAC7E;YACF,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,CAAC,MAAM;YACV,MAAM,IAAI,eAAe,CACxB,0DAA0D,EAC1D,WAAW,CACX,CAAC;QACH,MAAM,KAAK,GAAuB,MAAM;YACvC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE;YACxC,CAAC,CAAC,MAAM;gBACP,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE;gBAClC,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;QAC7B,IAAI,GAAY,CAAC;QACjB,IAAI,cAA2C,CAAC;QAChD,IAAI,CAAC;YACJ,MAAM,QAAQ,GAAG,MAAM,OAAO;iBAC5B,KAAK,CACL,qBAAqB,CACrB;iBACA,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;iBACjB,OAAO,EAAE,CAAC;YACZ,cAAc,GAAG,QAAQ,IAAI,QAAQ,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC3F,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,OAAO,GAAG,4BAA4B,CAAC,KAAK,CAAC,CAAC;YACpD,MAAM,IAAI,eAAe,CAAC,OAAO,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QAC3D,CAAC;QACD,IAAI,CAAC,cAAc,CAAC,WAAW;YAC9B,MAAM,IAAI,eAAe,CACxB,gEAAgE,EAChE,aAAa,CACb,CAAC;QACH,IAAI,CAAC;YACJ,GAAG,GAAG,MAAM,cAAc,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAC/C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,IAAI,eAAe,CAAC,4BAA4B,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QACvF,CAAC;QACD,MAAM,MAAM,GAAG,kCAAkC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACjE,IAAI,CAAC,MAAM,CAAC,OAAO;YAClB,MAAM,IAAI,eAAe,CAAC,gDAAgD,EAAE,UAAU,CAAC,CAAC;QACzF,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC;QAC9B,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACvB,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACnB,OAAO;QACR,CAAC;QACD,EAAE,CAAC,IAAI,CAAC,qFAAqF,CAAC,CAAC;QAC/F,KAAK,MAAM,WAAW,IAAI,SAAS,CAAC,YAAY,EAAE,CAAC;YAClD,EAAE,CAAC,IAAI,CACN,GAAG,WAAW,CAAC,EAAE,KAAK,WAAW,CAAC,IAAI,MAAM,WAAW,CAAC,MAAM,aAAa,WAAW,CAAC,OAAO,KAAK,WAAW,CAAC,cAAc,IAAI,kBAAkB,mBAAmB,WAAW,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,MAAM,EAAE,CACpN,CAAC;QACH,CAAC;QACD,IAAI,SAAS,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC;YACtC,EAAE,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC;QAC7D,KAAK,MAAM,MAAM,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;YACxC,IAAI,MAAM,CAAC,OAAO;gBACjB,EAAE,CAAC,IAAI,CACN,GAAG,MAAM,CAAC,UAAU,iBAAiB,MAAM,CAAC,OAAO,CAAC,IAAI,KAAK,MAAM,CAAC,OAAO,CAAC,OAAO,GAAG,CACtF,CAAC;;gBAEF,EAAE,CAAC,IAAI,CACN,GAAG,MAAM,CAAC,UAAU,WAAW,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC7F,CAAC;QACJ,CAAC;IACF,CAAC;CACD,CAAC"}

package/dist/cli/observability/infra-observability-set.cli-command.descriptor.d.ts

@@ -1,25 +1,46 @@
 declare const _default: {
-    id: string;
-    kind: "cli/command";
-    name: string;
-    description: string;
-    group: string;
-    options: ({
-        flags: string;
-        description: string;
-        default?: undefined;
-    } | {
-        flags: string;
-        description: string;
-        default: boolean;
-    } | {
-        flags: string;
-        description: string;
-        default: string;
-    })[];
-    surfaces: string[];
-    hardware: string[];
-    enabled: true;
+    readonly id: "infra-observability.set";
+    readonly kind: "cli/command";
+    readonly name: "set";
+    readonly description: "Update observability config (sampling, logs/traces enabled) on Worker(s)";
+    readonly group: "infra-observability";
+    readonly options: [{
+        readonly flags: "--worker <name>";
+        readonly description: "Scope to a single Worker (omit for fleet-wide apply)";
+    }, {
+        readonly flags: "--filter <glob>";
+        readonly description: "Glob to narrow the fleet apply (e.g. \"worker-*\")";
+    }, {
+        readonly flags: "--sampling <rate>";
+        readonly description: "Logs head sampling rate (0..1; 1 captures every invocation)";
+    }, {
+        readonly flags: "--logs <enabled>";
+        readonly description: "Enable/disable logs (true|false)";
+    }, {
+        readonly flags: "--traces <enabled>";
+        readonly description: "Enable/disable traces (true|false)";
+    }, {
+        readonly flags: "--provider <id>";
+        readonly description: "Provider impl id (default: cloudflare-workers-observability)";
+    }, {
+        readonly flags: "--environment <name>";
+        readonly description: "Vibes environment for secret resolution (local|dev|staging|production)";
+    }, {
+        readonly flags: "--dry-run";
+        readonly description: "Show what would change; do not write";
+        readonly default: false;
+    }, {
+        readonly flags: "-y, --yes";
+        readonly description: "Skip confirmation prompt for multi-worker changes";
+        readonly default: false;
+    }, {
+        readonly flags: "-o, --output <format>";
+        readonly description: "Output format (text|json)";
+        readonly default: "text";
+    }];
+    readonly surfaces: ["cli"];
+    readonly hardware: ["consumer", "cloud"];
+    readonly enabled: true;
 };
 export default _default;
 //# sourceMappingURL=infra-observability-set.cli-command.descriptor.d.ts.map

package/dist/cli/observability/infra-observability-set.cli-command.descriptor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"infra-observability-set.cli-command.descriptor.d.ts","sourceRoot":"","sources":["../../../src/cli/observability/infra-observability-set.cli-command.descriptor.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAEA,wBAsDG"}
+{"version":3,"file":"infra-observability-set.cli-command.descriptor.d.ts","sourceRoot":"","sources":["../../../src/cli/observability/infra-observability-set.cli-command.descriptor.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEA,wBAsDG"}

package/dist/cli/observability/infra-observability-set.cli-command.descriptor.js

@@ -1,4 +1,4 @@
-import { createRuntimeAsset } from '@vibesdotdev/runtime';
+import { createRuntimeAsset } from '@vibesdotdev/kernel';
 export default createRuntimeAsset({
     id: 'infra-observability.set',
     kind: 'cli/command',
@@ -12,11 +12,11 @@ export default createRuntimeAsset({
         },
         {
             flags: '--filter <glob>',
-            description: 'Glob to narrow the fleet apply (e.g. "vibes-*")'
+            description: 'Glob to narrow the fleet apply (e.g. "worker-*")'
         },
         {
             flags: '--sampling <rate>',
-            description: 'Logs head sampling rate (0..1; e.g. 0.1 for 10%)'
+            description: 'Logs head sampling rate (0..1; 1 captures every invocation)'
         },
         {
             flags: '--logs <enabled>',

package/dist/cli/observability/infra-observability-set.cli-command.descriptor.js.map

@@ -1 +1 @@
-{"version":3,"file":"infra-observability-set.cli-command.descriptor.js","sourceRoot":"","sources":["../../../src/cli/observability/infra-observability-set.cli-command.descriptor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE1D,eAAe,kBAAkB,CAAC;IACjC,EAAE,EAAE,yBAAyB;IAC7B,IAAI,EAAE,aAAa;IACnB,IAAI,EAAE,KAAK;IACX,WAAW,EAAE,0EAA0E;IACvF,KAAK,EAAE,qBAAqB;IAC5B,OAAO,EAAE;QACR;YACC,KAAK,EAAE,iBAAiB;YACxB,WAAW,EAAE,sDAAsD;SACnE;QACD;YACC,KAAK,EAAE,iBAAiB;YACxB,WAAW,EAAE,iDAAiD;SAC9D;QACD;YACC,KAAK,EAAE,mBAAmB;YAC1B,WAAW,EAAE,kDAAkD;SAC/D;QACD;YACC,KAAK,EAAE,kBAAkB;YACzB,WAAW,EAAE,kCAAkC;SAC/C;QACD;YACC,KAAK,EAAE,oBAAoB;YAC3B,WAAW,EAAE,oCAAoC;SACjD;QACD;YACC,KAAK,EAAE,iBAAiB;YACxB,WAAW,EAAE,8DAA8D;SAC3E;QACD;YACC,KAAK,EAAE,sBAAsB;YAC7B,WAAW,EAAE,wEAAwE;SACrF;QACD;YACC,KAAK,EAAE,WAAW;YAClB,WAAW,EAAE,sCAAsC;YACnD,OAAO,EAAE,KAAK;SACd;QACD;YACC,KAAK,EAAE,WAAW;YAClB,WAAW,EAAE,mDAAmD;YAChE,OAAO,EAAE,KAAK;SACd;QACD;YACC,KAAK,EAAE,uBAAuB;YAC9B,WAAW,EAAE,2BAA2B;YACxC,OAAO,EAAE,MAAM;SACf;KACD;IACD,QAAQ,EAAE,CAAC,KAAK,CAAC;IACjB,QAAQ,EAAE,CAAC,UAAU,EAAE,OAAO,CAAC;IAC/B,OAAO,EAAE,IAAI;CACb,CAAC,CAAC"}
+{"version":3,"file":"infra-observability-set.cli-command.descriptor.js","sourceRoot":"","sources":["../../../src/cli/observability/infra-observability-set.cli-command.descriptor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEzD,eAAe,kBAAkB,CAAC;IACjC,EAAE,EAAE,yBAAyB;IAC7B,IAAI,EAAE,aAAa;IACnB,IAAI,EAAE,KAAK;IACX,WAAW,EAAE,0EAA0E;IACvF,KAAK,EAAE,qBAAqB;IAC5B,OAAO,EAAE;QACR;YACC,KAAK,EAAE,iBAAiB;YACxB,WAAW,EAAE,sDAAsD;SACnE;QACD;YACC,KAAK,EAAE,iBAAiB;YACxB,WAAW,EAAE,kDAAkD;SAC/D;QACD;YACC,KAAK,EAAE,mBAAmB;YAC1B,WAAW,EAAE,6DAA6D;SAC1E;QACD;YACC,KAAK,EAAE,kBAAkB;YACzB,WAAW,EAAE,kCAAkC;SAC/C;QACD;YACC,KAAK,EAAE,oBAAoB;YAC3B,WAAW,EAAE,oCAAoC;SACjD;QACD;YACC,KAAK,EAAE,iBAAiB;YACxB,WAAW,EAAE,8DAA8D;SAC3E;QACD;YACC,KAAK,EAAE,sBAAsB;YAC7B,WAAW,EAAE,wEAAwE;SACrF;QACD;YACC,KAAK,EAAE,WAAW;YAClB,WAAW,EAAE,sCAAsC;YACnD,OAAO,EAAE,KAAK;SACd;QACD;YACC,KAAK,EAAE,WAAW;YAClB,WAAW,EAAE,mDAAmD;YAChE,OAAO,EAAE,KAAK;SACd;QACD;YACC,KAAK,EAAE,uBAAuB;YAC9B,WAAW,EAAE,2BAA2B;YACxC,OAAO,EAAE,MAAM;SACf;KACD;IACD,QAAQ,EAAE,CAAC,KAAK,CAAC;IACjB,QAAQ,EAAE,CAAC,UAAU,EAAE,OAAO,CAAC;IAC/B,OAAO,EAAE,IAAI;CACb,CAAC,CAAC"}