@vibesdotdev/infra-deploy 0.0.1 → 1.0.0-rc.4

package/dist/cli/run/git-source-identity.d.ts

@@ -0,0 +1,21 @@
+import { type RuntimeRef } from '@vibesdotdev/kernel';
+import type { RuntimeExecution } from '@vibesdotdev/kernel/execution';
+import { type ChildEnvRuntime } from '../shared/runtime-execution.ts';
+/** What source identity reads from the runtime it is handed: its captured env and its child environment. */
+export type GitIdentityRuntime = ChildEnvRuntime & Pick<RuntimeRef, 'getEnv'>;
+export type GitSourceIdentity = {
+    commit?: string;
+    branch?: string;
+};
+/** Resolve the repository that owns an app without inheriting the CLI host cwd. */
+export declare function resolveGitRepositoryRoot(runtime: ChildEnvRuntime, execution: Pick<RuntimeExecution, 'spawn'>, cwd: string): Promise<string | undefined>;
+/**
+ * Resolve deploy source identity: CI-provided env vars win, then the local git
+ * checkout explicitly supplied by the deploy owner. Requiring `cwd` prevents
+ * an embedded CLI host from stamping its own commit onto another app. Manual
+ * operator deploys (the normal case while CI is disabled) otherwise record
+ * NULL commits in the marker/ledger tables, making "is HEAD deployed?"
+ * unanswerable after the fact.
+ */
+export declare function resolveGitSourceIdentity(runtime: GitIdentityRuntime, execution: Pick<RuntimeExecution, 'spawn'>, cwd: string): Promise<GitSourceIdentity>;
+//# sourceMappingURL=git-source-identity.d.ts.map

package/dist/cli/run/git-source-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-source-identity.d.ts","sourceRoot":"","sources":["../../../src/cli/run/git-source-identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,KAAK,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAE9D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAEtE,OAAO,EAAqB,KAAK,eAAe,EAAE,MAAM,gCAAgC,CAAC;AASzF,4GAA4G;AAC5G,MAAM,MAAM,kBAAkB,GAAG,eAAe,GAAG,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;AAE9E,MAAM,MAAM,iBAAiB,GAAG;IAC/B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AA0BF,mFAAmF;AACnF,wBAAsB,wBAAwB,CAC7C,OAAO,EAAE,eAAe,EACxB,SAAS,EAAE,IAAI,CAAC,gBAAgB,EAAE,OAAO,CAAC,EAC1C,GAAG,EAAE,MAAM,GACT,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAE7B;AAED;;;;;;;GAOG;AACH,wBAAsB,wBAAwB,CAC7C,OAAO,EAAE,kBAAkB,EAC3B,SAAS,EAAE,IAAI,CAAC,gBAAgB,EAAE,OAAO,CAAC,EAC1C,GAAG,EAAE,MAAM,GACT,OAAO,CAAC,iBAAiB,CAAC,CAmC5B"}

package/dist/cli/run/git-source-identity.js

@@ -0,0 +1,73 @@
+import { settle } from '@vibesdotdev/kernel';
+import { GIT_CHILD_ENV } from '@vibesdotdev/git-operations/core';
+import * as z from 'zod/v4';
+import { runRuntimeCommand } from "../shared/runtime-execution.js";
+const ErrnoCodeSchema = z.object({ code: z.string().optional() }).loose();
+function isEnoent(cause) {
+    const facts = ErrnoCodeSchema.safeParse(cause);
+    return facts.success && facts.data.code === 'ENOENT';
+}
+function nonEmpty(value) {
+    const trimmed = value?.trim();
+    return trimmed && trimmed.length > 0 ? trimmed : undefined;
+}
+async function gitOutput(runtime, execution, args, cwd) {
+    const outcome = await settle(() => runRuntimeCommand({ runtime, execution, command: 'git', inheritEnv: GIT_CHILD_ENV, args, cwd }));
+    if (!outcome.ok) {
+        // A host without git records no identity (a confirmed absence); any
+        // other failure to run git fails typed where it was raised.
+        if (isEnoent(outcome.cause))
+            return undefined;
+        throw outcome.cause instanceof Error ? outcome.cause : new Error(String(outcome.cause));
+    }
+    if (outcome.value.code !== 0)
+        return undefined;
+    return nonEmpty(outcome.value.stdout);
+}
+/** Resolve the repository that owns an app without inheriting the CLI host cwd. */
+export async function resolveGitRepositoryRoot(runtime, execution, cwd) {
+    return gitOutput(runtime, execution, ['rev-parse', '--show-toplevel'], cwd);
+}
+/**
+ * Resolve deploy source identity: CI-provided env vars win, then the local git
+ * checkout explicitly supplied by the deploy owner. Requiring `cwd` prevents
+ * an embedded CLI host from stamping its own commit onto another app. Manual
+ * operator deploys (the normal case while CI is disabled) otherwise record
+ * NULL commits in the marker/ledger tables, making "is HEAD deployed?"
+ * unanswerable after the fact.
+ */
+export async function resolveGitSourceIdentity(runtime, execution, cwd) {
+    // `VIBES_SOURCE_SHA` is deliberately NOT read here, and that is the whole
+    // point of this function's contract above.
+    //
+    // The CLI republishes its OWN compile-time bake into that variable at boot
+    // (`cli-bin/src/bin/vibes.ts`: `runtime.getEnv('VIBES_SOURCE_SHA') = bakedSourceSha`)
+    // so provenance consumers — the MCP banner, doctor — can report which CLI
+    // build is running. That is a correct use of the name for a different
+    // question: "which vibes am I?", not "which app source is being deployed?".
+    //
+    // reading it here made the CLI's identity win over the app's checkout, which
+    // is exactly the stamping this function exists to prevent. Measured on
+    // casework 2026-08-20: the app deployed from `5f7e1087` published
+    // `/_app/version.json` = `ed1b031a` — a cli-bin commit from two days earlier.
+    // The freshness gate then compared that value against itself and passed,
+    // certifying only that the CLI built the worker. Worse than no identity: a
+    // confident wrong one, recorded into every deploy marker and ledger row.
+    //
+    // GITHUB_SHA / CI_COMMIT_SHA stay: in CI those name the checked-out app
+    // repository, which is the thing being asked about.
+    const envCommit = nonEmpty(runtime.getEnv('GITHUB_SHA')) ?? nonEmpty(runtime.getEnv('CI_COMMIT_SHA'));
+    const envBranch = nonEmpty(runtime.getEnv('VIBES_SOURCE_BRANCH')) ??
+        nonEmpty(runtime.getEnv('GITHUB_REF_NAME')) ??
+        nonEmpty(runtime.getEnv('CI_COMMIT_BRANCH'));
+    const commit = envCommit ?? (await gitOutput(runtime, execution, ['rev-parse', 'HEAD'], cwd));
+    // A producer's branch without its commit describes its own outer checkout.
+    // Pair the local app commit with the local app branch, never that ambient branch.
+    let branch = (envCommit ? envBranch : undefined) ?? (await gitOutput(runtime, execution, ['rev-parse', '--abbrev-ref', 'HEAD'], cwd));
+    // A detached worktree (the recommended deploy shape) reports the literal
+    // string HEAD — that is the absence of a branch, not a branch name.
+    if (branch === 'HEAD')
+        branch = undefined;
+    return { commit, branch };
+}
+//# sourceMappingURL=git-source-identity.js.map

package/dist/cli/run/git-source-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-source-identity.js","sourceRoot":"","sources":["../../../src/cli/run/git-source-identity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAmB,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,kCAAkC,CAAC;AAEjE,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,iBAAiB,EAAwB,MAAM,gCAAgC,CAAC;AAEzF,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;AAE1E,SAAS,QAAQ,CAAC,KAAc;IAC/B,MAAM,KAAK,GAAG,eAAe,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/C,OAAO,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC;AACtD,CAAC;AAUD,SAAS,QAAQ,CAAC,KAAyB;IAC1C,MAAM,OAAO,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IAC9B,OAAO,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AAC5D,CAAC;AAED,KAAK,UAAU,SAAS,CACvB,OAAwB,EACxB,SAA0C,EAC1C,IAAc,EACd,GAAW;IAEX,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,CACjC,iBAAiB,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,aAAa,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAC/F,CAAC;IACF,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QACjB,oEAAoE;QACpE,4DAA4D;QAC5D,IAAI,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;QAC9C,MAAM,OAAO,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IACzF,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/C,OAAO,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AACvC,CAAC;AAED,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC7C,OAAwB,EACxB,SAA0C,EAC1C,GAAW;IAEX,OAAO,SAAS,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,WAAW,EAAE,iBAAiB,CAAC,EAAE,GAAG,CAAC,CAAC;AAC7E,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC7C,OAA2B,EAC3B,SAA0C,EAC1C,GAAW;IAEX,0EAA0E;IAC1E,2CAA2C;IAC3C,EAAE;IACF,2EAA2E;IAC3E,sFAAsF;IACtF,0EAA0E;IAC1E,sEAAsE;IACtE,4EAA4E;IAC5E,EAAE;IACF,6EAA6E;IAC7E,uEAAuE;IACvE,kEAAkE;IAClE,8EAA8E;IAC9E,yEAAyE;IACzE,2EAA2E;IAC3E,yEAAyE;IACzE,EAAE;IACF,wEAAwE;IACxE,oDAAoD;IACpD,MAAM,SAAS,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC;IACtG,MAAM,SAAS,GACd,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC;QAC/C,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;QAC3C,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAE9C,MAAM,MAAM,GAAG,SAAS,IAAI,CAAC,MAAM,SAAS,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAC9F,2EAA2E;IAC3E,kFAAkF;IAClF,IAAI,MAAM,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,SAAS,CAAC,OAAO,EAAE,SAAS,EAAE,CAAC,WAAW,EAAE,cAAc,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IACtI,yEAAyE;IACzE,oEAAoE;IACpE,IAAI,MAAM,KAAK,MAAM;QAAE,MAAM,GAAG,SAAS,CAAC;IAE1C,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;AAC3B,CAAC"}

package/dist/cli/run/immutable-deployment-release.program.d.ts

@@ -0,0 +1,403 @@
+import { type CapabilityErrorCode, type CaughtFailure, type PluginLoader, type RequestPrincipal, type VibesRuntime } from '@vibesdotdev/kernel';
+import type { RuntimePortMessage, RuntimeThreadBoot, RuntimeThreadOwner } from '@vibesdotdev/kernel/kinds/runtime-plugin-host.kind';
+import { type RpcMessagePort } from '@vibesdotdev/kernel-rpc/messageport';
+import * as z from 'zod/v4';
+export type NonUserRequestPrincipal = Exclude<RequestPrincipal, {
+    readonly kind: 'user';
+}>;
+/**
+ * Non-user request principals that may cross `workerData` into the held release
+ * thread. User principals (which carry a `jwt` bearer) never cross `workerData`
+ * and are never fabricated without a bearer in the child thread; authenticated
+ * parent operations execute on the parent runtime over the owner-private
+ * `@vibesdotdev/kernel-rpc/messageport` channel inside the captured parent invocation.
+ */
+export declare const NonUserRequestPrincipalSchema: z.ZodType<NonUserRequestPrincipal>;
+export declare const RpcMessagePortSchema: z.ZodCustom<RpcMessagePort, RpcMessagePort>;
+export declare const ImmutableDeploymentParentRpcSchema: z.ZodObject<{
+    port: z.ZodCustom<RpcMessagePort, RpcMessagePort>;
+    rootRef: z.ZodString;
+    secretStores: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        id: z.ZodString;
+        kind: z.ZodLiteral<"secrets/store">;
+        name: z.ZodOptional<z.ZodString>;
+        description: z.ZodOptional<z.ZodString>;
+        tags: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        enabled: z.ZodOptional<z.ZodBoolean>;
+        hardware: z.ZodOptional<z.ZodArray<z.ZodString>>;
+        backend: z.ZodString;
+        selection: z.ZodDefault<z.ZodEnum<{
+            scope: "scope";
+            "by-id": "by-id";
+        }>>;
+        managedCredentialValues: z.ZodOptional<z.ZodLiteral<true>>;
+        tiers: z.ZodArray<z.ZodEnum<{
+            local: "local";
+            dev: "dev";
+            staging: "staging";
+            production: "production";
+        }>>;
+        priority: z.ZodDefault<z.ZodNumber>;
+        config: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    }, z.core.$strip>>>;
+}, z.core.$strict>;
+export type ImmutableDeploymentParentRpc = z.infer<typeof ImmutableDeploymentParentRpcSchema>;
+export declare const PARENT_SECRETS_STORE_COMMAND: "infra-deploy.secrets-store";
+export declare const ParentSecretEntrySchema: z.ZodObject<{
+    key: z.ZodString;
+    hasValue: z.ZodBoolean;
+    source: z.ZodString;
+}, z.core.$strict>;
+export declare const ParentSecretsStoreCommandSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    command: z.ZodLiteral<"infra-deploy.secrets-store">;
+    op: z.ZodLiteral<"get">;
+    storeId: z.ZodString;
+    environment: z.ZodString;
+    key: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    command: z.ZodLiteral<"infra-deploy.secrets-store">;
+    op: z.ZodLiteral<"list">;
+    storeId: z.ZodString;
+    environment: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    command: z.ZodLiteral<"infra-deploy.secrets-store">;
+    op: z.ZodLiteral<"getAll">;
+    storeId: z.ZodString;
+    environment: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    command: z.ZodLiteral<"infra-deploy.secrets-store">;
+    op: z.ZodLiteral<"set">;
+    storeId: z.ZodString;
+    environment: z.ZodString;
+    key: z.ZodString;
+    value: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    command: z.ZodLiteral<"infra-deploy.secrets-store">;
+    op: z.ZodLiteral<"unset">;
+    storeId: z.ZodString;
+    environment: z.ZodString;
+    key: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    command: z.ZodLiteral<"infra-deploy.secrets-store">;
+    op: z.ZodLiteral<"setAll">;
+    storeId: z.ZodString;
+    environment: z.ZodString;
+    values: z.ZodRecord<z.ZodString, z.ZodString>;
+}, z.core.$strip>], "op">;
+export type ParentSecretsStoreCommand = z.infer<typeof ParentSecretsStoreCommandSchema>;
+export declare const SerializedLeafReleaseFailureSchema: z.ZodObject<{
+    kind: z.ZodEnum<{
+        error: "error";
+        capability: "capability";
+    }>;
+    message: z.ZodString;
+    code: z.ZodOptional<z.ZodString & z.ZodType<CapabilityErrorCode, string, z.core.$ZodTypeInternals<CapabilityErrorCode, string>>>;
+    reason: z.ZodOptional<z.ZodString>;
+    recoveryHint: z.ZodOptional<z.ZodString>;
+    retryable: z.ZodOptional<z.ZodBoolean>;
+    details: z.ZodOptional<z.ZodType<import("@vibesdotdev/kernel/schemas/json").JsonObject, import("@vibesdotdev/kernel/schemas/json").JsonObject, z.core.$ZodTypeInternals<import("@vibesdotdev/kernel/schemas/json").JsonObject, import("@vibesdotdev/kernel/schemas/json").JsonObject>>>;
+}, z.core.$strict>;
+export type SerializedLeafReleaseFailure = z.infer<typeof SerializedLeafReleaseFailureSchema>;
+export declare const SerializedReleaseFailureSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    message: z.ZodString;
+    code: z.ZodOptional<z.ZodString & z.ZodType<CapabilityErrorCode, string, z.core.$ZodTypeInternals<CapabilityErrorCode, string>>>;
+    reason: z.ZodOptional<z.ZodString>;
+    recoveryHint: z.ZodOptional<z.ZodString>;
+    retryable: z.ZodOptional<z.ZodBoolean>;
+    details: z.ZodOptional<z.ZodType<import("@vibesdotdev/kernel/schemas/json").JsonObject, import("@vibesdotdev/kernel/schemas/json").JsonObject, z.core.$ZodTypeInternals<import("@vibesdotdev/kernel/schemas/json").JsonObject, import("@vibesdotdev/kernel/schemas/json").JsonObject>>>;
+    kind: z.ZodLiteral<"capability">;
+}, z.core.$strict>, z.ZodObject<{
+    message: z.ZodString;
+    code: z.ZodOptional<z.ZodString & z.ZodType<CapabilityErrorCode, string, z.core.$ZodTypeInternals<CapabilityErrorCode, string>>>;
+    reason: z.ZodOptional<z.ZodString>;
+    recoveryHint: z.ZodOptional<z.ZodString>;
+    retryable: z.ZodOptional<z.ZodBoolean>;
+    details: z.ZodOptional<z.ZodType<import("@vibesdotdev/kernel/schemas/json").JsonObject, import("@vibesdotdev/kernel/schemas/json").JsonObject, z.core.$ZodTypeInternals<import("@vibesdotdev/kernel/schemas/json").JsonObject, import("@vibesdotdev/kernel/schemas/json").JsonObject>>>;
+    kind: z.ZodLiteral<"error">;
+}, z.core.$strict>, z.ZodObject<{
+    kind: z.ZodLiteral<"aggregate">;
+    message: z.ZodString;
+    causes: z.ZodArray<z.ZodObject<{
+        kind: z.ZodEnum<{
+            error: "error";
+            capability: "capability";
+        }>;
+        message: z.ZodString;
+        code: z.ZodOptional<z.ZodString & z.ZodType<CapabilityErrorCode, string, z.core.$ZodTypeInternals<CapabilityErrorCode, string>>>;
+        reason: z.ZodOptional<z.ZodString>;
+        recoveryHint: z.ZodOptional<z.ZodString>;
+        retryable: z.ZodOptional<z.ZodBoolean>;
+        details: z.ZodOptional<z.ZodType<import("@vibesdotdev/kernel/schemas/json").JsonObject, import("@vibesdotdev/kernel/schemas/json").JsonObject, z.core.$ZodTypeInternals<import("@vibesdotdev/kernel/schemas/json").JsonObject, import("@vibesdotdev/kernel/schemas/json").JsonObject>>>;
+    }, z.core.$strict>>;
+}, z.core.$strict>], "kind">;
+export type SerializedReleaseFailure = z.infer<typeof SerializedReleaseFailureSchema>;
+export declare function toSerializedLeafFailure(cause: CaughtFailure): SerializedLeafReleaseFailure;
+export declare function toSerializedReleaseFailure(cause: CaughtFailure): SerializedReleaseFailure;
+export declare function fromSerializedReleaseFailure(failure: SerializedReleaseFailure): Error;
+export declare const ParentSecretsStoreResponseSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    success: z.ZodLiteral<true>;
+    data: z.ZodUnion<readonly [z.ZodObject<{
+        entries: z.ZodArray<z.ZodObject<{
+            key: z.ZodString;
+            hasValue: z.ZodBoolean;
+            source: z.ZodString;
+        }, z.core.$strict>>;
+    }, z.core.$strip>, z.ZodObject<{
+        value: z.ZodNullable<z.ZodString>;
+    }, z.core.$strip>, z.ZodObject<{
+        values: z.ZodRecord<z.ZodString, z.ZodString>;
+    }, z.core.$strip>, z.ZodObject<{
+        ok: z.ZodLiteral<true>;
+    }, z.core.$strip>]>;
+}, z.core.$strip>, z.ZodObject<{
+    success: z.ZodLiteral<false>;
+    failure: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        message: z.ZodString;
+        code: z.ZodOptional<z.ZodString & z.ZodType<CapabilityErrorCode, string, z.core.$ZodTypeInternals<CapabilityErrorCode, string>>>;
+        reason: z.ZodOptional<z.ZodString>;
+        recoveryHint: z.ZodOptional<z.ZodString>;
+        retryable: z.ZodOptional<z.ZodBoolean>;
+        details: z.ZodOptional<z.ZodType<import("@vibesdotdev/kernel/schemas/json").JsonObject, import("@vibesdotdev/kernel/schemas/json").JsonObject, z.core.$ZodTypeInternals<import("@vibesdotdev/kernel/schemas/json").JsonObject, import("@vibesdotdev/kernel/schemas/json").JsonObject>>>;
+        kind: z.ZodLiteral<"capability">;
+    }, z.core.$strict>, z.ZodObject<{
+        message: z.ZodString;
+        code: z.ZodOptional<z.ZodString & z.ZodType<CapabilityErrorCode, string, z.core.$ZodTypeInternals<CapabilityErrorCode, string>>>;
+        reason: z.ZodOptional<z.ZodString>;
+        recoveryHint: z.ZodOptional<z.ZodString>;
+        retryable: z.ZodOptional<z.ZodBoolean>;
+        details: z.ZodOptional<z.ZodType<import("@vibesdotdev/kernel/schemas/json").JsonObject, import("@vibesdotdev/kernel/schemas/json").JsonObject, z.core.$ZodTypeInternals<import("@vibesdotdev/kernel/schemas/json").JsonObject, import("@vibesdotdev/kernel/schemas/json").JsonObject>>>;
+        kind: z.ZodLiteral<"error">;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"aggregate">;
+        message: z.ZodString;
+        causes: z.ZodArray<z.ZodObject<{
+            kind: z.ZodEnum<{
+                error: "error";
+                capability: "capability";
+            }>;
+            message: z.ZodString;
+            code: z.ZodOptional<z.ZodString & z.ZodType<CapabilityErrorCode, string, z.core.$ZodTypeInternals<CapabilityErrorCode, string>>>;
+            reason: z.ZodOptional<z.ZodString>;
+            recoveryHint: z.ZodOptional<z.ZodString>;
+            retryable: z.ZodOptional<z.ZodBoolean>;
+            details: z.ZodOptional<z.ZodType<import("@vibesdotdev/kernel/schemas/json").JsonObject, import("@vibesdotdev/kernel/schemas/json").JsonObject, z.core.$ZodTypeInternals<import("@vibesdotdev/kernel/schemas/json").JsonObject, import("@vibesdotdev/kernel/schemas/json").JsonObject>>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>], "kind">;
+}, z.core.$strip>], "success">;
+export declare const ImmutableDeploymentThreadPayloadSchema: z.ZodObject<{
+    appDir: z.ZodString;
+    workspaceRoot: z.ZodString;
+    repositoryRoot: z.ZodString;
+    reference: z.ZodObject<{
+        parent: z.ZodObject<{
+            repoPath: z.ZodString;
+            commit: z.ZodString;
+            tree: z.ZodString;
+        }, z.core.$strip>;
+        source: z.ZodObject<{
+            repoPath: z.ZodString;
+            commit: z.ZodString;
+            tree: z.ZodString;
+        }, z.core.$strip>;
+        siblings: z.ZodArray<z.ZodObject<{
+            repoPath: z.ZodString;
+            commit: z.ZodString;
+            tree: z.ZodString;
+        }, z.core.$strip>>;
+        inputs: z.ZodArray<z.ZodObject<{
+            path: z.ZodString;
+            digest: z.ZodString;
+            size: z.ZodNumber;
+        }, z.core.$strip>>;
+        digest: z.ZodString;
+    }, z.core.$strip>;
+    provider: z.ZodString;
+    appId: z.ZodString;
+    options: z.ZodType<import("@vibesdotdev/kernel/schemas/json").JsonObject, import("@vibesdotdev/kernel/schemas/json").JsonObject, z.core.$ZodTypeInternals<import("@vibesdotdev/kernel/schemas/json").JsonObject, import("@vibesdotdev/kernel/schemas/json").JsonObject>>;
+    selectedEnvironment: z.ZodString;
+    targetEnvironment: z.ZodOptional<z.ZodString>;
+    wranglerEnvironmentOverride: z.ZodOptional<z.ZodString>;
+    credentialSource: z.ZodEnum<{
+        "secrets-store": "secrets-store";
+        ambient: "ambient";
+    }>;
+    skipBuild: z.ZodBoolean;
+    dryRun: z.ZodBoolean;
+    sourceIdentity: z.ZodObject<{
+        commit: z.ZodOptional<z.ZodString>;
+        branch: z.ZodOptional<z.ZodString>;
+    }, z.core.$strict>;
+    actor: z.ZodOptional<z.ZodObject<{
+        agentId: z.ZodOptional<z.ZodPipe<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>, z.ZodString>>;
+        harness: z.ZodOptional<z.ZodPipe<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>, z.ZodString>>;
+        agentSystemId: z.ZodOptional<z.ZodPipe<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>, z.ZodString>>;
+        harnessSessionId: z.ZodOptional<z.ZodPipe<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>, z.ZodString>>;
+        userId: z.ZodOptional<z.ZodPipe<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>, z.ZodString>>;
+        orgId: z.ZodOptional<z.ZodPipe<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>, z.ZodString>>;
+        projectId: z.ZodOptional<z.ZodPipe<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>, z.ZodString>>;
+        teamId: z.ZodOptional<z.ZodPipe<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>, z.ZodString>>;
+        home: z.ZodOptional<z.ZodEnum<{
+            user: "user";
+            organization: "organization";
+            team: "team";
+        }>>;
+        projectIds: z.ZodOptional<z.ZodReadonly<z.ZodArray<z.ZodPipe<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>, z.ZodString>>>>;
+        participantId: z.ZodOptional<z.ZodPipe<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>, z.ZodString>>;
+        sessionId: z.ZodOptional<z.ZodPipe<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>, z.ZodString>>;
+    }, z.core.$strip>>;
+    tenancy: z.ZodOptional<z.ZodObject<{
+        ownerType: z.ZodEnum<{
+            user: "user";
+            organization: "organization";
+            team: "team";
+            system: "system";
+        }>;
+        ownerId: z.ZodString;
+        teamId: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>>;
+    principal: z.ZodOptional<z.ZodType<NonUserRequestPrincipal, unknown, z.core.$ZodTypeInternals<NonUserRequestPrincipal, unknown>>>;
+    parentRpc: z.ZodOptional<z.ZodObject<{
+        port: z.ZodCustom<RpcMessagePort, RpcMessagePort>;
+        rootRef: z.ZodString;
+        secretStores: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            kind: z.ZodLiteral<"secrets/store">;
+            name: z.ZodOptional<z.ZodString>;
+            description: z.ZodOptional<z.ZodString>;
+            tags: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            enabled: z.ZodOptional<z.ZodBoolean>;
+            hardware: z.ZodOptional<z.ZodArray<z.ZodString>>;
+            backend: z.ZodString;
+            selection: z.ZodDefault<z.ZodEnum<{
+                scope: "scope";
+                "by-id": "by-id";
+            }>>;
+            managedCredentialValues: z.ZodOptional<z.ZodLiteral<true>>;
+            tiers: z.ZodArray<z.ZodEnum<{
+                local: "local";
+                dev: "dev";
+                staging: "staging";
+                production: "production";
+            }>>;
+            priority: z.ZodDefault<z.ZodNumber>;
+            config: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        }, z.core.$strip>>>;
+    }, z.core.$strict>>;
+    alreadyAborted: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strict>;
+export type ImmutableDeploymentThreadPayload = z.infer<typeof ImmutableDeploymentThreadPayloadSchema>;
+export declare const ImmutableDeploymentParentMessageSchema: z.ZodUnion<readonly [z.ZodObject<{
+    type: z.ZodLiteral<"abort">;
+}, z.core.$strict>, z.ZodDiscriminatedUnion<[z.ZodObject<{
+    type: z.ZodLiteral<"assert-source-result">;
+    id: z.ZodString;
+    ok: z.ZodLiteral<true>;
+}, z.core.$strict>, z.ZodObject<{
+    type: z.ZodLiteral<"assert-source-result">;
+    id: z.ZodString;
+    ok: z.ZodLiteral<false>;
+    error: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        message: z.ZodString;
+        code: z.ZodOptional<z.ZodString & z.ZodType<CapabilityErrorCode, string, z.core.$ZodTypeInternals<CapabilityErrorCode, string>>>;
+        reason: z.ZodOptional<z.ZodString>;
+        recoveryHint: z.ZodOptional<z.ZodString>;
+        retryable: z.ZodOptional<z.ZodBoolean>;
+        details: z.ZodOptional<z.ZodType<import("@vibesdotdev/kernel/schemas/json").JsonObject, import("@vibesdotdev/kernel/schemas/json").JsonObject, z.core.$ZodTypeInternals<import("@vibesdotdev/kernel/schemas/json").JsonObject, import("@vibesdotdev/kernel/schemas/json").JsonObject>>>;
+        kind: z.ZodLiteral<"capability">;
+    }, z.core.$strict>, z.ZodObject<{
+        message: z.ZodString;
+        code: z.ZodOptional<z.ZodString & z.ZodType<CapabilityErrorCode, string, z.core.$ZodTypeInternals<CapabilityErrorCode, string>>>;
+        reason: z.ZodOptional<z.ZodString>;
+        recoveryHint: z.ZodOptional<z.ZodString>;
+        retryable: z.ZodOptional<z.ZodBoolean>;
+        details: z.ZodOptional<z.ZodType<import("@vibesdotdev/kernel/schemas/json").JsonObject, import("@vibesdotdev/kernel/schemas/json").JsonObject, z.core.$ZodTypeInternals<import("@vibesdotdev/kernel/schemas/json").JsonObject, import("@vibesdotdev/kernel/schemas/json").JsonObject>>>;
+        kind: z.ZodLiteral<"error">;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"aggregate">;
+        message: z.ZodString;
+        causes: z.ZodArray<z.ZodObject<{
+            kind: z.ZodEnum<{
+                error: "error";
+                capability: "capability";
+            }>;
+            message: z.ZodString;
+            code: z.ZodOptional<z.ZodString & z.ZodType<CapabilityErrorCode, string, z.core.$ZodTypeInternals<CapabilityErrorCode, string>>>;
+            reason: z.ZodOptional<z.ZodString>;
+            recoveryHint: z.ZodOptional<z.ZodString>;
+            retryable: z.ZodOptional<z.ZodBoolean>;
+            details: z.ZodOptional<z.ZodType<import("@vibesdotdev/kernel/schemas/json").JsonObject, import("@vibesdotdev/kernel/schemas/json").JsonObject, z.core.$ZodTypeInternals<import("@vibesdotdev/kernel/schemas/json").JsonObject, import("@vibesdotdev/kernel/schemas/json").JsonObject>>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>], "kind">;
+}, z.core.$strict>], "ok">]>;
+export declare const ImmutableDeploymentThreadMessageSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    type: z.ZodLiteral<"assert-source">;
+    id: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    type: z.ZodLiteral<"line">;
+    stream: z.ZodEnum<{
+        stdout: "stdout";
+        stderr: "stderr";
+    }>;
+    line: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    type: z.ZodLiteral<"ui">;
+    level: z.ZodEnum<{
+        error: "error";
+        log: "log";
+        info: "info";
+        warn: "warn";
+    }>;
+    message: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    type: z.ZodLiteral<"result">;
+    value: z.ZodObject<{
+        status: z.ZodEnum<{
+            released: "released";
+            "dry-run": "dry-run";
+        }>;
+        deployedUrl: z.ZodOptional<z.ZodString>;
+        externalDeploymentId: z.ZodOptional<z.ZodString>;
+        providerTraceRef: z.ZodOptional<z.ZodString>;
+        probe: z.ZodBoolean;
+        notes: z.ZodOptional<z.ZodString>;
+        summary: z.ZodOptional<z.ZodString>;
+        result: z.ZodType<import("@vibesdotdev/kernel/schemas/json").JsonObject, import("@vibesdotdev/kernel/schemas/json").JsonObject, z.core.$ZodTypeInternals<import("@vibesdotdev/kernel/schemas/json").JsonObject, import("@vibesdotdev/kernel/schemas/json").JsonObject>>;
+    }, z.core.$strip>;
+}, z.core.$strict>, z.ZodObject<{
+    type: z.ZodLiteral<"error">;
+    error: z.ZodDiscriminatedUnion<[z.ZodObject<{
+        message: z.ZodString;
+        code: z.ZodOptional<z.ZodString & z.ZodType<CapabilityErrorCode, string, z.core.$ZodTypeInternals<CapabilityErrorCode, string>>>;
+        reason: z.ZodOptional<z.ZodString>;
+        recoveryHint: z.ZodOptional<z.ZodString>;
+        retryable: z.ZodOptional<z.ZodBoolean>;
+        details: z.ZodOptional<z.ZodType<import("@vibesdotdev/kernel/schemas/json").JsonObject, import("@vibesdotdev/kernel/schemas/json").JsonObject, z.core.$ZodTypeInternals<import("@vibesdotdev/kernel/schemas/json").JsonObject, import("@vibesdotdev/kernel/schemas/json").JsonObject>>>;
+        kind: z.ZodLiteral<"capability">;
+    }, z.core.$strict>, z.ZodObject<{
+        message: z.ZodString;
+        code: z.ZodOptional<z.ZodString & z.ZodType<CapabilityErrorCode, string, z.core.$ZodTypeInternals<CapabilityErrorCode, string>>>;
+        reason: z.ZodOptional<z.ZodString>;
+        recoveryHint: z.ZodOptional<z.ZodString>;
+        retryable: z.ZodOptional<z.ZodBoolean>;
+        details: z.ZodOptional<z.ZodType<import("@vibesdotdev/kernel/schemas/json").JsonObject, import("@vibesdotdev/kernel/schemas/json").JsonObject, z.core.$ZodTypeInternals<import("@vibesdotdev/kernel/schemas/json").JsonObject, import("@vibesdotdev/kernel/schemas/json").JsonObject>>>;
+        kind: z.ZodLiteral<"error">;
+    }, z.core.$strict>, z.ZodObject<{
+        kind: z.ZodLiteral<"aggregate">;
+        message: z.ZodString;
+        causes: z.ZodArray<z.ZodObject<{
+            kind: z.ZodEnum<{
+                error: "error";
+                capability: "capability";
+            }>;
+            message: z.ZodString;
+            code: z.ZodOptional<z.ZodString & z.ZodType<CapabilityErrorCode, string, z.core.$ZodTypeInternals<CapabilityErrorCode, string>>>;
+            reason: z.ZodOptional<z.ZodString>;
+            recoveryHint: z.ZodOptional<z.ZodString>;
+            retryable: z.ZodOptional<z.ZodBoolean>;
+            details: z.ZodOptional<z.ZodType<import("@vibesdotdev/kernel/schemas/json").JsonObject, import("@vibesdotdev/kernel/schemas/json").JsonObject, z.core.$ZodTypeInternals<import("@vibesdotdev/kernel/schemas/json").JsonObject, import("@vibesdotdev/kernel/schemas/json").JsonObject>>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>], "kind">;
+}, z.core.$strict>], "type">;
+export declare function floor(boot: RuntimeThreadBoot): readonly PluginLoader[];
+export declare function run(runtime: VibesRuntime, owner: RuntimeThreadOwner, rawPayload: RuntimePortMessage): Promise<void>;
+//# sourceMappingURL=immutable-deployment-release.program.d.ts.map

package/dist/cli/run/immutable-deployment-release.program.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"immutable-deployment-release.program.d.ts","sourceRoot":"","sources":["../../../src/cli/run/immutable-deployment-release.program.ts"],"names":[],"mappings":"AAOA,OAAO,EAKN,KAAK,mBAAmB,EACxB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAEX,kBAAkB,EAClB,iBAAiB,EACjB,kBAAkB,EAClB,MAAM,oDAAoD,CAAC;AAI5D,OAAO,EAA4B,KAAK,cAAc,EAAE,MAAM,qCAAqC,CAAC;AAUpG,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAsB5B,MAAM,MAAM,uBAAuB,GAAG,OAAO,CAAC,gBAAgB,EAAE;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAE3F;;;;;;GAMG;AACH,eAAO,MAAM,6BAA6B,EAAE,CAAC,CAAC,OAAO,CAAC,uBAAuB,CAU3E,CAAC;AAEH,eAAO,MAAM,oBAAoB,6CAOhC,CAAC;AAEF,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;;;;;;;;;;;;;;kBAIpC,CAAC;AAEZ,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAE9F,eAAO,MAAM,4BAA4B,EAAG,4BAAqC,CAAC;AAElF,eAAO,MAAM,uBAAuB;;;;kBAIzB,CAAC;AAEZ,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;yBA0C1C,CAAC;AAEH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC;AAExF,eAAO,MAAM,kCAAkC;;;;;;;;;;;kBAQpC,CAAC;AAEZ,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAE9F,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;4BAQzC,CAAC;AAEH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEtF,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,aAAa,GAAG,4BAA4B,CAkB1F;AASD,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,aAAa,GAAG,wBAAwB,CASzF;AAeD,wBAAgB,4BAA4B,CAAC,OAAO,EAAE,wBAAwB,GAAG,KAAK,CAQrF;AASD,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8BAS3C,CAAC;AA+FH,eAAO,MAAM,sCAAsC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAuBxC,CAAC;AAEZ,MAAM,MAAM,gCAAgC,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sCAAsC,CAAC,CAAC;AAEtG,eAAO,MAAM,sCAAsC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;4BAejD,CAAC;AAEH,eAAO,MAAM,sCAAsC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;4BAoBjD,CAAC;AAIH,wBAAgB,KAAK,CAAC,IAAI,EAAE,iBAAiB,GAAG,SAAS,YAAY,EAAE,CAYtE;AAkHD,wBAAsB,GAAG,CAAC,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,kBAAkB,EAAE,UAAU,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC,CAyIzH"}