@vibesdotdev/infra-deploy 0.0.1 → 1.0.0-rc.4

package/dist/cli/shared/build-workspace-artifacts.js

@@ -0,0 +1,2013 @@
+import { satisfies, validRange } from 'semver';
+import * as z from 'zod/v4';
+import { CapabilityError, settle } from '@vibesdotdev/kernel';
+import { JsonValueSchema } from '@vibesdotdev/kernel/schemas/json';
+import { planDag } from '@vibesdotdev/shared/schemas';
+import { resolveHash } from '@vibesdotdev/crypto';
+import { DeploymentBuildEvidenceSchema } from '@vibesdotdev/infra-core/kinds';
+import { realpathChecked, resolveFileSystemAdapter } from '@vibesdotdev/filesystem';
+import { getRuntimePath } from '@vibesdotdev/paths';
+import { declaredPackageDirectories } from "../npm/publish/workspace-discovery.js";
+import { parsePublisherManifest } from "../npm/publish/publisher-manifest.js";
+import { infraDeployLogger } from "../../logger.js";
+import { withWorkspaceArtifactLock } from "./workspace-artifact-lock.js";
+import { runRuntimeCommand, registryTokenEnv } from "./runtime-execution.js";
+function failureMessage(failure) {
+    return failure instanceof Error ? failure.message : failure.description;
+}
+/** The separator `paths.join` actually used, so containment checks follow the host. */
+function pathSeparator(paths) {
+    const joined = paths.join('a', 'b');
+    const separator = joined.slice(1, joined.length - 1);
+    if (separator.length !== 1) {
+        throw new CapabilityError('The path host did not join two segments with one separator.', 'UNAVAILABLE', { reason: 'path-separator-unavailable' });
+    }
+    return separator;
+}
+async function resolveArtifactHost(runtime) {
+    const [files, paths, hash] = await Promise.all([
+        resolveFileSystemAdapter(runtime, { binding: false }),
+        getRuntimePath(runtime),
+        resolveHash(runtime)
+    ]);
+    return {
+        runtime,
+        files,
+        paths,
+        sep: pathSeparator(paths),
+        sha256: () => hash.createSha256()
+    };
+}
+async function readText(files, path) {
+    const contents = await files.readFile(path, 'utf8');
+    return contents instanceof Uint8Array ? new TextDecoder().decode(contents) : contents;
+}
+async function readBytes(files, path) {
+    const contents = await files.readFile(path);
+    return contents instanceof Uint8Array ? contents : new TextEncoder().encode(contents);
+}
+/** Follows one symlink, matching host `stat`. A link is not a directory entry. */
+async function followedStat(host, path) {
+    const listed = await host.files.stat(path);
+    if (listed.kind !== 'symlink')
+        return listed;
+    return host.files.stat(await realpathChecked(host.files, path));
+}
+async function removeIfPresent(files, path) {
+    const removed = await settle(async () => {
+        await files.remove(path);
+    });
+    if (removed.ok || isMissingPathError(removed.cause))
+        return;
+    throw removed.cause;
+}
+/**
+ * The build-artifact directory a package's manifest declares via
+ * `"vibes": { "artifactsDir": "…" }`, or `dist` when it declares nothing.
+ * Every package that does not opt in keeps the original `dist`-only
+ * behaviour untouched.
+ */
+function resolveArtifactsDir(pkg) {
+    return pkg.packageJson.vibes?.artifactsDir ?? 'dist';
+}
+/** Source admission and emitted bytes are separate receipts. A source hash never certifies output. */
+export const WorkspaceBuildArtifactReceiptSchema = DeploymentBuildEvidenceSchema.shape.artifact.unwrap().extend({
+    files: z.array(z.object({ path: z.string(), digest: z.string().regex(/^[a-f0-9]{64}$/) }))
+});
+/** Installed locks are build inputs while a provider prepares its final artifacts. Missing locks participate too. */
+export async function workspaceBuildLockDigest(input) {
+    const host = await resolveArtifactHost(input.runtime);
+    const root = await realpathChecked(host.files, input.workspaceRoot);
+    const locks = [];
+    for (const lock of [...new Set(input.lockFiles)].sort()) {
+        const path = host.paths.resolve(root, lock);
+        if (!isPathWithin(host, root, path))
+            throw new CapabilityError('An installed lock escapes its owned workspace.', 'INVALID_INPUT', { reason: 'workspace-artifact-outside' });
+        const stated = await settle(() => host.files.stat(path));
+        if (!stated.ok) {
+            if (!isMissingPathError(stated.cause))
+                throw stated.cause;
+            locks.push({ path: lock, digest: null });
+            continue;
+        }
+        if (stated.value.kind !== 'file' || !isPathWithin(host, root, await realpathChecked(host.files, path))) {
+            throw new CapabilityError('An installed lock is not an owned regular file.', 'INVALID_INPUT', { reason: 'workspace-artifact-invalid' });
+        }
+        locks.push({ path: lock, digest: host.sha256().update(await readBytes(host.files, path)).digestHex() });
+    }
+    return host.sha256().update(JSON.stringify(locks)).digestHex();
+}
+/** Hash the actual run-owned outputs and installed locks, including additions and same-size edits. */
+export async function sealWorkspaceBuildArtifacts(input) {
+    const host = await resolveArtifactHost(input.runtime);
+    const root = await realpathChecked(host.files, input.workspaceRoot);
+    const files = new Map();
+    const visit = async (path) => {
+        if (!isPathWithin(host, root, path)) {
+            throw new CapabilityError('A build artifact escapes its owned workspace.', 'INVALID_INPUT', { reason: 'workspace-artifact-outside' });
+        }
+        const stated = await settle(() => host.files.stat(path));
+        if (!stated.ok) {
+            if (isMissingPathError(stated.cause))
+                throw new CapabilityError('A build artifact disappeared before consumption.', 'CONFLICT', { reason: 'workspace-artifact-missing', cause: stated.cause });
+            throw stated.cause;
+        }
+        const entry = stated.value;
+        if (entry.kind === 'symlink') {
+            throw new CapabilityError('Build artifact receipts require owned regular files.', 'INVALID_INPUT', { reason: 'workspace-artifact-symlink' });
+        }
+        if (!isPathWithin(host, root, await realpathChecked(host.files, path))) {
+            throw new CapabilityError('A build artifact resolves outside its owned workspace.', 'INVALID_INPUT', { reason: 'workspace-artifact-outside' });
+        }
+        if (entry.kind === 'directory') {
+            for (const child of await host.files.list(path))
+                await visit(host.paths.join(path, child.name));
+            return;
+        }
+        if (entry.kind !== 'file') {
+            throw new CapabilityError('Build output is not a regular file.', 'INVALID_INPUT', { reason: 'workspace-artifact-invalid' });
+        }
+        files.set(toPosixPath(host, host.paths.relative(root, path)), host.sha256().update(await readBytes(host.files, path)).digestHex());
+    };
+    for (const directory of input.directories)
+        await visit(host.paths.resolve(root, directory));
+    if (files.size === 0) {
+        throw new CapabilityError('The build emitted no certifiable artifact bytes.', 'CONFLICT', { reason: 'workspace-artifact-empty' });
+    }
+    for (const lock of input.lockFiles) {
+        const path = host.paths.resolve(root, lock);
+        if (await host.files.exists(path))
+            await visit(path);
+    }
+    const recorded = [...files].sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([path, digest]) => ({ path, digest }));
+    const references = [...new Set(input.references ?? [])].sort();
+    const artifactDigest = host.sha256().update(JSON.stringify(references.length ? { files: recorded, references } : recorded)).digestHex();
+    return WorkspaceBuildArtifactReceiptSchema.parse({ compositionDigest: input.compositionDigest, sourceCommit: input.sourceCommit, artifactDigest, files: recorded, references });
+}
+/** Re-read the bytes at the provider boundary; no mtime, size, or source-stamp shortcut. */
+export async function assertWorkspaceBuildArtifactReceipt(input, receipt) {
+    const admitted = WorkspaceBuildArtifactReceiptSchema.parse(receipt);
+    if (admitted.compositionDigest !== input.compositionDigest || admitted.sourceCommit !== input.sourceCommit) {
+        throw new CapabilityError('Build output belongs to another source or composition.', 'CONFLICT', { reason: 'workspace-artifact-identity-mismatch' });
+    }
+    const current = await sealWorkspaceBuildArtifacts(input);
+    if (current.artifactDigest !== admitted.artifactDigest || JSON.stringify(current.references) !== JSON.stringify([...new Set(admitted.references ?? [])].sort())) {
+        throw new CapabilityError('Build output changed before provider consumption.', 'CONFLICT', { reason: 'workspace-artifact-digest-mismatch' });
+    }
+}
+const CSS_IMPORT_RE = /@import\s+['"](@vibesdotdev\/[a-zA-Z0-9_./-]+)['"]/g;
+const SOURCE_EXTENSIONS = new Set([
+    '.css',
+    '.cjs',
+    '.js',
+    '.json',
+    '.mjs',
+    '.svelte',
+    '.ts',
+    '.tsx'
+]);
+const SKIP_DIRS = new Set([
+    '.git',
+    '.svelte-kit',
+    '.turbo',
+    '__stubs__',
+    '__tests__',
+    'coverage',
+    'dist',
+    'node_modules',
+    'test-results'
+]);
+const WORKSPACE_DIAGNOSTIC_MAX_LINES = 40;
+const WORKSPACE_DIAGNOSTIC_MAX_CHARS = 4000;
+const WORKSPACE_DIAGNOSTIC_MAX_LINE_CHARS = 1000;
+/** The ESC byte of an ANSI color sequence, built from its code point so the
+ * pattern carries no literal control byte (the sequence itself is the target). */
+const ANSI_ESCAPE_START = String.fromCodePoint(27);
+const ANSI_ESCAPE_RE = new RegExp(`${ANSI_ESCAPE_START}\\[[0-9;]*m`, "g");
+const BEARER_RE = /\bBearer\s+[^\s,;]+/gi;
+const SENSITIVE_ASSIGNMENT_RE = /\b([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|CREDENTIAL|API_?KEY|PRIVATE_?KEY)[A-Z0-9_]*)\b\s*[:=]\s*["']?[^"',\s]+["']?/gi;
+const SENSITIVE_QUERY_RE = /([?&](?:token|secret|password|api[_-]?key)=)[^&\s]+/gi;
+const URL_PASSWORD_RE = /(https?:\/\/[^:\s/@]+:)[^@\s/]+@/gi;
+/** True for the C0 control characters the sanitizer strips (tab, newline and
+ * carriage return are preserved as compiler output formatting). */
+function isStrippedControlChar(code) {
+    return (code <= 31 && code !== 9 && code !== 10 && code !== 13) || code === 127;
+}
+export function sanitizeWorkspaceBuildDiagnostic(value) {
+    const stripped = Array.from(value)
+        .filter((ch) => !isStrippedControlChar(ch.codePointAt(0) ?? 0))
+        .join('');
+    return stripped
+        .replace(ANSI_ESCAPE_RE, '')
+        .replace(BEARER_RE, 'Bearer [redacted]')
+        .replace(SENSITIVE_ASSIGNMENT_RE, '$1=[redacted]')
+        .replace(SENSITIVE_QUERY_RE, '$1[redacted]')
+        .replace(URL_PASSWORD_RE, '$1[redacted]@');
+}
+function createWorkspaceDiagnosticTail() {
+    const entries = [];
+    let omitted = 0;
+    const renderedLength = () => entries.reduce((total, entry) => total + entry.line.length + entry.stream.length + 5, 0);
+    return {
+        push(stream, line) {
+            const sanitized = sanitizeWorkspaceBuildDiagnostic(line);
+            const bounded = sanitized.length <= WORKSPACE_DIAGNOSTIC_MAX_LINE_CHARS
+                ? sanitized
+                : `${sanitized.slice(0, WORKSPACE_DIAGNOSTIC_MAX_LINE_CHARS)}… [line truncated]`;
+            entries.push({ stream, line: bounded });
+            while (entries.length > WORKSPACE_DIAGNOSTIC_MAX_LINES ||
+                renderedLength() > WORKSPACE_DIAGNOSTIC_MAX_CHARS) {
+                entries.shift();
+                omitted += 1;
+            }
+            return bounded;
+        },
+        render() {
+            if (entries.length === 0)
+                return '[no compiler output captured]';
+            const prefix = omitted > 0 ? `[${omitted} earlier diagnostic line(s) truncated]\n` : '';
+            return `${prefix}${entries.map((entry) => `[${entry.stream}] ${entry.line}`).join('\n')}`;
+        }
+    };
+}
+/**
+ * App hosts ("app") and other never-published roots ("never-publish") are not
+ * package tiers, whatever their `private` flag says. Publish discovery skips
+ * them the same way; parsing them as publisher manifests refuses every deploy
+ * in a workspace that contains one (for example vessel-desktop, `private: false`).
+ */
+const PrivateAppMemberSchema = z
+    .object({ vibes: z.object({ visibility: z.enum(['app', 'never-publish']) }).loose() })
+    .loose();
+async function readJson(host, path) {
+    const read = await settle(async () => JSON.parse(await readText(host.files, path)));
+    if (!read.ok) {
+        // A missing manifest is a declared-absent input; any other read failure is real.
+        if (isMissingPathError(read.cause))
+            return undefined;
+        throw read.cause;
+    }
+    if (PrivateAppMemberSchema.safeParse(read.value).success)
+        return undefined;
+    return parsePublisherManifest(read.value);
+}
+/**
+ * What the deployed app's own manifest is read for: the workspace packages it
+ * declares. An app is never a publish manifest (`vibes.visibility: "app"`).
+ */
+const AppDependencyManifestSchema = z.looseObject({
+    dependencies: z.record(z.string(), z.string()).optional(),
+    peerDependencies: z.record(z.string(), z.string()).optional(),
+    peerDependenciesMeta: z
+        .record(z.string(), z.object({ optional: z.boolean().optional() }).catchall(JsonValueSchema))
+        .optional()
+});
+async function readAppManifest(host, path) {
+    const read = await settle(async () => AppDependencyManifestSchema.parse(JSON.parse(await readText(host.files, path))));
+    if (read.ok)
+        return read.value;
+    // A missing manifest is a declared-absent input; any other read failure is real.
+    if (isMissingPathError(read.cause))
+        return undefined;
+    throw read.cause;
+}
+/** The errno facts a raw host absence carries. */
+const ErrnoCodeSchema = z.object({ code: z.string().optional() }).loose();
+function isMissingPathError(error) {
+    if (error instanceof CapabilityError && error.code === 'NOT_FOUND')
+        return true;
+    const facts = ErrnoCodeSchema.safeParse(error);
+    return facts.success && (facts.data.code === 'ENOENT' || facts.data.code === 'ENOTDIR');
+}
+/**
+ * A deploy root's declared `workspaces` is a string array or `{ packages: string[] }`.
+ * The kernel's listing reads any other shape as "no members" (kernel
+ * bootstrap/discovery.ts WorkspacesManifestSchema), so the deploy refuses it here
+ * rather than planning an empty closure.
+ */
+const DeployRootWorkspacesSchema = z.looseObject({
+    workspaces: z.union([z.array(z.string()), z.looseObject({ packages: z.array(z.string()) })]).optional()
+});
+async function discoverWorkspacePackages(host, workspaceRoot) {
+    const packages = new Map();
+    const canonicalRoot = await realpathChecked(host.files, workspaceRoot);
+    const directories = new Set();
+    const rootManifest = await settle(async () => DeployRootWorkspacesSchema.parse(JSON.parse(await readText(host.files, host.paths.join(workspaceRoot, 'package.json')))));
+    if (!rootManifest.ok) {
+        throw new Error('Workspace root package.json must declare a string workspaces array');
+    }
+    // The kernel owns the workspace dialect (braces, `!` exclusions, `vibes.packageRoots`)
+    // and lists only declared members that exist, so a deploy from a partial checkout
+    // never fails on a declared path it does not hold.
+    for (const directory of await declaredPackageDirectories(host.runtime, workspaceRoot, undefined)) {
+        const canonicalDirectory = await realpathChecked(host.files, directory);
+        if (canonicalDirectory !== canonicalRoot &&
+            !canonicalDirectory.startsWith(`${canonicalRoot}${host.sep}`)) {
+            throw new Error(`Workspace package escapes the workspace root: ${directory}`);
+        }
+        // Overlapping declarations identify one member, not two.
+        if (directories.has(canonicalDirectory))
+            continue;
+        // A directory that matches a workspace glob but holds no manifest is not a
+        // workspace member — the package manager resolves membership the same way, so
+        // treating it as fatal makes the deploy disagree with the install that produced
+        // node_modules. It also makes the outcome depend on untracked local state: a
+        // folded package leaves `dist/` and `node_modules/` behind at its old path, and
+        // that residue alone would fail every deploy from an otherwise clean checkout.
+        // A manifest that exists but does not parse is still fatal below.
+        const manifestPath = host.paths.join(canonicalDirectory, 'package.json');
+        if (!(await host.files.exists(manifestPath))) {
+            continue;
+        }
+        directories.add(canonicalDirectory);
+        const rawManifestOutcome = await settle(async () => JSON.parse(await readText(host.files, manifestPath)));
+        if (!rawManifestOutcome.ok) {
+            throw new Error(`Invalid workspace package manifest at ${host.paths.relative(workspaceRoot, canonicalDirectory)}: ${failureMessage(rawManifestOutcome.cause)}`);
+        }
+        if (PrivateAppMemberSchema.safeParse(rawManifestOutcome.value).success) {
+            continue;
+        }
+        const manifestOutcome = await settle(async () => parsePublisherManifest(rawManifestOutcome.value));
+        if (!manifestOutcome.ok) {
+            throw new Error(`Invalid workspace package manifest at ${host.paths.relative(workspaceRoot, canonicalDirectory)}: ${failureMessage(manifestOutcome.cause)}`);
+        }
+        const packageJson = manifestOutcome.value;
+        if (!packageJson.name) {
+            throw new Error(`Workspace package manifest has no name: ${host.paths.relative(workspaceRoot, canonicalDirectory)}`);
+        }
+        if (packages.has(packageJson.name)) {
+            throw new Error(`Duplicate workspace package name: ${packageJson.name}`);
+        }
+        packages.set(packageJson.name, {
+            name: packageJson.name,
+            dir: canonicalDirectory,
+            packageJson
+        });
+    }
+    return packages;
+}
+async function resolveWorkspacePackages(host, workspaceRoot, packageScope) {
+    if (!packageScope)
+        return discoverWorkspacePackages(host, workspaceRoot);
+    const canonicalRoot = await realpathChecked(host.files, workspaceRoot);
+    const directories = new Set();
+    const scoped = new Map();
+    for (const [name, pkg] of packageScope) {
+        if (name !== pkg.name || (pkg.packageJson.name && pkg.packageJson.name !== name)) {
+            throw new Error(`Workspace package scope identity mismatch for ${name}`);
+        }
+        const canonicalDirectory = await realpathChecked(host.files, pkg.dir);
+        if (canonicalDirectory !== canonicalRoot &&
+            !canonicalDirectory.startsWith(`${canonicalRoot}${host.sep}`)) {
+            throw new Error(`Workspace package scope escapes the workspace root: ${pkg.dir}`);
+        }
+        if (directories.has(canonicalDirectory)) {
+            throw new Error(`Workspace package scope repeats directory ${canonicalDirectory}`);
+        }
+        directories.add(canonicalDirectory);
+        scoped.set(name, { ...pkg, dir: canonicalDirectory });
+    }
+    return scoped;
+}
+function hasBuildArtifacts(pkg) {
+    if (!pkg.packageJson.scripts?.build)
+        return false;
+    if (pkg.packageJson.vibes?.artifactsDir !== undefined)
+        return true;
+    return JSON.stringify({
+        main: pkg.packageJson.main,
+        types: pkg.packageJson.types,
+        svelte: pkg.packageJson.svelte,
+        exports: pkg.packageJson.exports
+    }).includes(resolveArtifactsDir(pkg));
+}
+/**
+ * `build` is a consumer-facing convenience script, not a contract that it
+ * builds ONLY the publishable artifact. `kit` (and other Svelte packages that
+ * ship both a library and a local preview/demo app) declare `build: "bun run
+ * package && bun run build:app"` — `build:app` is a full Vite/SvelteKit
+ * compile of the preview app, something no consumer resolving `kit`'s dist,
+ * and no publish of `kit` to the registry, ever needs. The `package` script
+ * (the `svelte-package`/`prepack` convention: producing exactly the files
+ * `main`/`exports`/`files` ship) is what a dependency-artifact build wants
+ * whenever a package declares one; `build` stays the fallback for every
+ * package that has not split the two.
+ */
+function resolveBuildScriptName(pkg) {
+    return pkg.packageJson.scripts?.package ? 'package' : 'build';
+}
+/** Written into the artifacts directory only after a build exits 0. */
+export const BUILD_STAMP_FILENAME = '.build-ok.json';
+const TYPESCRIPT_BUILD_INFO_FILENAME = 'tsconfig.tsbuildinfo';
+/** Toolchain packages whose declared versions the stamp records. */
+const STAMPED_TOOL_PACKAGES = ['typescript', 'svelte', '@sveltejs/package', 'vite', 'esbuild', 'tsup'];
+function toPosixPath(host, path) {
+    return host.sep === '/' ? path : path.split(host.sep).join('/');
+}
+/** Tool configuration a package's build reads from its root, beside its tsconfig files. */
+const BUILD_CONFIG_FILE = /^(?:svelte|vite|tsup|esbuild|rollup|vitest)\.config\.[cm]?[jt]s$/;
+const TSCONFIG_FILE = /^tsconfig(?:\.[^/]*)?\.json$/;
+/** A path-looking word in a build script (`scripts/build.ts`, `./tsconfig.svelte.json`, `src/x/y.css`). */
+const SCRIPT_FILE_TOKEN = /^(?:\.{1,2}\/)?[\w@][\w@.\-/]*\.(?:[cm]?[jt]sx?|json|css|scss|svg|md)$/;
+/** Removes `//` and block comments from tsconfig-style JSON without touching string contents. */
+function stripJsonComments(text) {
+    let out = '';
+    for (let index = 0; index < text.length; index += 1) {
+        const char = text[index];
+        if (char === '"') {
+            let end = index + 1;
+            while (end < text.length && text[end] !== '"')
+                end += text[end] === '\\' ? 2 : 1;
+            out += text.slice(index, end + 1);
+            index = end;
+        }
+        else if (char === '/' && text[index + 1] === '/') {
+            while (index < text.length && text[index] !== '\n')
+                index += 1;
+            out += '\n';
+        }
+        else if (char === '/' && text[index + 1] === '*') {
+            const end = text.indexOf('*/', index + 2);
+            index = end === -1 ? text.length : end + 1;
+        }
+        else {
+            out += char;
+        }
+    }
+    return out.replace(/,(\s*[}\]])/g, '$1');
+}
+/**
+ * Every file a tsconfig makes `tsc` read beyond the package's `src/`: the
+ * authored config, its relative `extends` chain, and the literal directories or
+ * files its `include`/`files` name. Generated build directories remain excluded:
+ * SvelteKit sync rewrites their metadata during the very build being stamped.
+ * A config that cannot be parsed contributes
+ * only itself: its bytes are still hashed, so any edit still invalidates.
+ */
+async function collectTsconfigInputs(host, packageRoot, artifactsDir, configPath, inputs) {
+    const configTop = host.paths.relative(packageRoot, configPath).split(host.sep)[0];
+    if (configTop === artifactsDir || SKIP_DIRS.has(configTop))
+        return;
+    if (inputs.has(configPath) || !(await host.files.exists(configPath)))
+        return;
+    inputs.add(configPath);
+    const TsconfigFieldsSchema = z.object({
+        extends: z.union([z.string(), z.array(z.string())]).optional(),
+        include: z.array(z.string()).optional(),
+        files: z.array(z.string()).optional()
+    }).loose();
+    const parsed = await settle(async () => TsconfigFieldsSchema.parse(JSON.parse(stripJsonComments(await readText(host.files, configPath)))));
+    if (!parsed.ok) {
+        infraDeployLogger(host.runtime).warn(`tsconfig ${configPath} is not parseable JSON; only its own bytes are hashed`, {
+            error: failureMessage(parsed.cause)
+        });
+        return;
+    }
+    const config = parsed.value;
+    const parents = config.extends ? [config.extends].flat() : [];
+    for (const parent of parents) {
+        if (!parent.startsWith('.'))
+            continue;
+        const resolved = host.paths.join(host.paths.dirname(configPath), parent);
+        await collectTsconfigInputs(host, packageRoot, artifactsDir, resolved.endsWith('.json') ? resolved : `${resolved}.json`, inputs);
+    }
+    const named = [...(config.include ?? []), ...(config.files ?? [])];
+    for (const entry of named) {
+        const literal = [];
+        for (const segment of entry.split('/')) {
+            if (/[*?{[]/.test(segment))
+                break;
+            literal.push(segment);
+        }
+        const base = host.paths.join(host.paths.dirname(configPath), ...literal);
+        if (base === packageRoot || !isPathWithin(host, packageRoot, base))
+            continue;
+        const top = host.paths.relative(packageRoot, base).split(host.sep)[0];
+        if (top === artifactsDir || SKIP_DIRS.has(top))
+            continue;
+        if (!(await host.files.exists(base)))
+            continue;
+        if ((await followedStat(host, base)).kind === 'directory') {
+            for (const path of await filesInDirectory(host, base, isBuildInput))
+                inputs.add(path);
+        }
+        else {
+            inputs.add(base);
+        }
+    }
+}
+/**
+ * Files the package's own build reads: its manifest,
+ * every `tsconfig*.json` (and their `extends`/`include` targets), tool config
+ * files (`vite.config.*`, `svelte.config.*`, ...), `scripts/`, every file the
+ * selected build script names, and every non-test, non-hidden file under
+ * `src/`. Workspace dependencies are folded in by {@link effectiveSourceHash}.
+ */
+async function packageBuildInputs(host, pkg) {
+    const packageRoot = pkg.dir;
+    const artifactsDir = resolveArtifactsDir(pkg);
+    const inputs = new Set(await filesInDirectory(host, host.paths.join(packageRoot, 'src'), isBuildInput));
+    for (const path of await filesInDirectory(host, host.paths.join(packageRoot, 'scripts'), isBuildInput))
+        inputs.add(path);
+    for (const entry of await host.files.list(packageRoot)) {
+        if (entry.kind !== 'file')
+            continue;
+        if (entry.name === 'package.json' || BUILD_CONFIG_FILE.test(entry.name)) {
+            inputs.add(host.paths.join(packageRoot, entry.name));
+        }
+        if (TSCONFIG_FILE.test(entry.name)) {
+            await collectTsconfigInputs(host, packageRoot, artifactsDir, host.paths.join(packageRoot, entry.name), inputs);
+        }
+    }
+    const buildScript = pkg.packageJson.scripts?.[resolveBuildScriptName(pkg)] ?? '';
+    for (const token of buildScript.split(/[\s"'`=;&|()]+/)) {
+        if (!SCRIPT_FILE_TOKEN.test(token))
+            continue;
+        const path = host.paths.join(packageRoot, token);
+        const top = host.paths.relative(packageRoot, path).split(host.sep)[0];
+        if (top === artifactsDir || top === 'node_modules' || !isPathWithin(host, packageRoot, path))
+            continue;
+        if ((await host.files.exists(path)) && (await followedStat(host, path)).kind === 'file')
+            inputs.add(path);
+        if (TSCONFIG_FILE.test(token.split('/').pop() ?? '')) {
+            await collectTsconfigInputs(host, packageRoot, artifactsDir, path, inputs);
+        }
+    }
+    return inputs;
+}
+async function computePackageSourceHash(host, packageRoot) {
+    const hash = host.sha256();
+    const pkg = await readPackageManifest(host, packageRoot);
+    const entries = [...await packageBuildInputs(host, pkg)]
+        .map((path) => ({ path: toPosixPath(host, host.paths.relative(packageRoot, path)), absolute: path }))
+        .sort((a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0));
+    for (const entry of entries) {
+        const fileHash = host.sha256().update(await readBytes(host.files, entry.absolute)).digestHex();
+        hash.update(`${entry.path}\0${fileHash}\n`);
+    }
+    return hash.digestHex();
+}
+/** One memo for the build inputs and hashes read in a plan or independent postflight. */
+const effectiveHashMemos = new WeakMap();
+function dependencyHashMemo(ownHashes) {
+    let memo = effectiveHashMemos.get(ownHashes);
+    if (!memo) {
+        memo = { effective: new Map(), edges: new Map() };
+        effectiveHashMemos.set(ownHashes, memo);
+    }
+    return memo;
+}
+function buildDependencyNames(host, pkg, packages, memo) {
+    let pending = memo.edges.get(pkg.name);
+    if (!pending) {
+        pending = workspaceDependencyEdges(host, pkg, packages)
+            .then(({ inputs }) => inputs.filter((name) => packages.has(name)));
+        memo.edges.set(pkg.name, pending);
+    }
+    return pending;
+}
+/**
+ * A package's own source hash folded with its workspace dependencies'
+ * effective hashes, computed once per package in linear time.
+ *
+ * Packages that import each other (a tolerated mutual-import cycle) form a
+ * strongly connected component; every member's hash covers the whole
+ * component and everything it depends on, so the result does not depend on
+ * which package the walk started from. A package outside any cycle hashes
+ * exactly as it always has: its own hash, then `\0name\0effective` for each
+ * declared dependency in order.
+ */
+async function effectiveSourceHash(host, pkg, packages, ownHashes) {
+    const scope = dependencyHashMemo(ownHashes);
+    const memo = scope.effective;
+    const known = memo.get(pkg.name);
+    if (known !== undefined)
+        return known;
+    // Hash the planner's build inputs. Imported optional peers participate in
+    // freshness without becoming required members of the build closure.
+    const graph = new Map();
+    const pending = [pkg.name];
+    const queued = new Set(pending);
+    for (let cursor = 0; cursor < pending.length; cursor += 1) {
+        const name = pending[cursor];
+        if (memo.has(name))
+            continue;
+        const dependencies = await buildDependencyNames(host, packages.get(name), packages, scope);
+        graph.set(name, dependencies);
+        for (const dependency of dependencies) {
+            if (memo.has(dependency) || queued.has(dependency))
+                continue;
+            queued.add(dependency);
+            pending.push(dependency);
+        }
+    }
+    // Another concurrent writer may have completed this component during I/O.
+    const completed = memo.get(pkg.name);
+    if (completed !== undefined)
+        return completed;
+    const edges = (name) => graph.get(name) ?? [];
+    // Tarjan's SCC over the packages reachable from `pkg` that are not yet
+    // memoized; components come out dependencies-first.
+    const index = new Map();
+    const low = new Map();
+    const onStack = new Set();
+    const stack = [];
+    const components = [];
+    let counter = 0;
+    const connect = (name) => {
+        index.set(name, counter);
+        low.set(name, counter);
+        counter += 1;
+        stack.push(name);
+        onStack.add(name);
+        for (const dep of edges(name)) {
+            if (memo.has(dep))
+                continue;
+            if (!index.has(dep)) {
+                connect(dep);
+                low.set(name, Math.min(low.get(name), low.get(dep)));
+            }
+            else if (onStack.has(dep)) {
+                low.set(name, Math.min(low.get(name), index.get(dep)));
+            }
+        }
+        if (low.get(name) === index.get(name)) {
+            const component = [];
+            let member;
+            do {
+                member = stack.pop();
+                onStack.delete(member);
+                component.push(member);
+            } while (member !== name);
+            components.push(component);
+        }
+    };
+    connect(pkg.name);
+    const ownOf = async (name) => {
+        let own = ownHashes.get(name);
+        if (own === undefined) {
+            own = await computePackageSourceHash(host, packages.get(name).dir);
+            ownHashes.set(name, own);
+        }
+        return own;
+    };
+    for (const component of components) {
+        const members = new Set(component);
+        const selfLoop = component.length === 1 && edges(component[0]).includes(component[0]);
+        if (component.length === 1 && !selfLoop) {
+            const name = component[0];
+            const hash = host.sha256().update(await ownOf(name));
+            for (const dep of edges(name))
+                hash.update(`\0${dep}\0${memo.get(dep)}`);
+            memo.set(name, hash.digestHex());
+            continue;
+        }
+        // One hash for the whole component: every member's own hash and every
+        // dependency the component reaches outside itself, in a fixed order.
+        const componentHash = host.sha256().update('scc');
+        for (const name of [...component].sort())
+            componentHash.update(`\0${name}\0${await ownOf(name)}`);
+        const external = new Set();
+        for (const name of component)
+            for (const dep of edges(name))
+                if (!members.has(dep))
+                    external.add(dep);
+        for (const dep of [...external].sort())
+            componentHash.update(`\0dep\0${dep}\0${memo.get(dep)}`);
+        const shared = componentHash.digestHex();
+        // Publish the whole component without yielding: concurrent walks must
+        // never observe only part of a cycle as memoized.
+        for (const name of component) {
+            memo.set(name, host.sha256().update(ownHashes.get(name)).update(`\0scc\0${shared}`).digestHex());
+        }
+    }
+    return memo.get(pkg.name);
+}
+/** What a stamp records about a package's workspace dependencies: name -> effective source hash. */
+const RecordedDependencyHashesSchema = z.record(z.string(), z.string());
+async function workspaceDependencyHashes(host, pkg, packages, ownHashes) {
+    const recorded = {};
+    if (!packages)
+        return recorded;
+    for (const name of await buildDependencyNames(host, pkg, packages, dependencyHashMemo(ownHashes))) {
+        const dependency = packages.get(name);
+        if (!dependency)
+            continue;
+        recorded[name] = await effectiveSourceHash(host, dependency, packages, ownHashes);
+    }
+    return recorded;
+}
+/** Every file the build emitted under the artifacts directory (the stamp itself excluded). */
+async function listEmittedFiles(host, artifactsDirectory) {
+    const files = [];
+    const visit = async (directory) => {
+        for (const entry of await host.files.list(directory)) {
+            const entryPath = host.paths.join(directory, entry.name);
+            if (entry.kind === 'directory') {
+                await visit(entryPath);
+                continue;
+            }
+            const relativePath = toPosixPath(host, host.paths.relative(artifactsDirectory, entryPath));
+            if (relativePath === BUILD_STAMP_FILENAME)
+                continue;
+            const stats = await followedStat(host, entryPath);
+            if (stats.kind === 'file')
+                files.push({ path: relativePath, size: stats.size });
+        }
+    };
+    if (await host.files.exists(artifactsDirectory))
+        await visit(artifactsDirectory);
+    return files.sort((a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0));
+}
+/** Declared versions of the toolchain packages a stamp records. */
+const StampedToolVersionsSchema = z.record(z.string(), z.string());
+function declaredToolVersions(packageJson) {
+    const versions = {};
+    for (const name of STAMPED_TOOL_PACKAGES) {
+        const declared = packageJson.devDependencies?.[name] ??
+            packageJson.dependencies?.[name] ??
+            packageJson.peerDependencies?.[name];
+        if (declared)
+            versions[name] = declared;
+    }
+    return versions;
+}
+async function readPackageManifest(host, packageDir) {
+    const packageJson = await readJson(host, host.paths.join(packageDir, 'package.json'));
+    if (!packageJson)
+        throw new Error(`Package has no manifest: ${packageDir}`);
+    return { name: packageJson.name ?? packageDir, dir: packageDir, packageJson };
+}
+/** Removes the build-success stamp, so an interrupted or failed build can never look fresh. */
+async function removeBuildStamp(host, pkg) {
+    await removeIfPresent(host.files, host.paths.join(pkg.dir, resolveArtifactsDir(pkg), BUILD_STAMP_FILENAME));
+}
+/**
+ * Records a successful build: the source content hash it was built from and the
+ * exact files it emitted. Callers write it only after the build exited 0.
+ */
+export async function writeBuildOkStamp(packageDir, 
+/** The runtime whose logger reports a build input the hash could only read as bytes. */
+runtime, packages, dependencySourceHashes = new Map()) {
+    const host = await resolveArtifactHost(runtime);
+    const pkg = await readPackageManifest(host, packageDir);
+    const artifactsDirectory = host.paths.join(pkg.dir, resolveArtifactsDir(pkg));
+    const stamp = {
+        sourceHash: await computePackageSourceHash(host, pkg.dir),
+        dependencies: await workspaceDependencyHashes(host, pkg, packages, dependencySourceHashes),
+        toolVersions: declaredToolVersions(pkg.packageJson),
+        files: await listEmittedFiles(host, artifactsDirectory)
+    };
+    // A build that exited 0 but emitted nothing (an honest outcome the freshness
+    // check reports as "no artifacts") still earns its stamp: recording it must
+    // not crash on the absent directory and mask the build's real result.
+    await host.files.mkdir(artifactsDirectory, { recursive: true });
+    await host.files.writeFile(host.paths.join(artifactsDirectory, BUILD_STAMP_FILENAME), `${JSON.stringify(stamp, null, '\t')}\n`);
+    return stamp;
+}
+/** The admitted shape of a build stamp, parsed once at the boundary. */
+const BuildStampSchema = z.object({
+    sourceHash: z.string(),
+    dependencies: z.record(z.string(), z.string()),
+    toolVersions: z.record(z.string(), z.string()),
+    files: z.array(z.object({ path: z.string(), size: z.number() }).loose())
+}).loose();
+function parseBuildStamp(text) {
+    const parsed = BuildStampSchema.safeParse(JSON.parse(text));
+    if (parsed.success) {
+        // The schema admits extra keys from older and newer writers; the stamp
+        // is the four typed fields, constructed explicitly instead of cast.
+        const { sourceHash, dependencies, toolVersions, files } = parsed.data;
+        return {
+            sourceHash,
+            dependencies,
+            toolVersions,
+            files: files.map((file) => ({ path: file.path, size: file.size }))
+        };
+    }
+    // An unparseable or malformed stamp is an invalid stamp: the caller reports
+    // it as not fresh.
+    return undefined;
+}
+/**
+ * The single freshness decision every caller shares: `assertDeployWorkspacePreflight`
+ * uses it to refuse a deploy over stale inputs, and the build orchestration
+ * below uses the same predicate to skip a closure member that never went
+ * stale. Fresh means a build-success stamp exists, its source hash equals the
+ * hash of the package's current build inputs, and every file it lists still
+ * exists at the recorded size. There is no timestamp heuristic: a package with
+ * no stamp (never built, failed build, interrupted build) is not fresh.
+ */
+async function checkWorkspacePackageFreshness(host, pkg, packages, ownHashes = new Map()) {
+    const resolvedPackageRoot = await realpathChecked(host.files, pkg.dir);
+    const artifactsDir = resolveArtifactsDir(pkg);
+    const artifactsDirectory = host.paths.join(resolvedPackageRoot, artifactsDir);
+    const result = (reason, artifactsMissing = false) => ({
+        fresh: reason === undefined,
+        artifactsDir,
+        resolvedPackageRoot,
+        reason,
+        artifactsMissing
+    });
+    const artifactNames = (await host.files.exists(artifactsDirectory))
+        ? (await host.files.list(artifactsDirectory)).map((entry) => entry.name)
+        : [];
+    if (artifactNames.every((name) => name === BUILD_STAMP_FILENAME)) {
+        return result(`${artifactsDir} has no artifacts`, true);
+    }
+    const stampPath = host.paths.join(artifactsDirectory, BUILD_STAMP_FILENAME);
+    if (!(await host.files.exists(stampPath))) {
+        return result(`${artifactsDir}/${BUILD_STAMP_FILENAME} is missing, so no successful build is recorded`);
+    }
+    const stamp = parseBuildStamp(await readText(host.files, stampPath));
+    if (!stamp)
+        return result(`${artifactsDir}/${BUILD_STAMP_FILENAME} is not a valid build stamp`);
+    if (stamp.files.length === 0)
+        return result(`${artifactsDir}/${BUILD_STAMP_FILENAME} lists no emitted files`);
+    if (stamp.sourceHash !== (await computePackageSourceHash(host, resolvedPackageRoot))) {
+        return result(`package sources changed since the last successful build`);
+    }
+    const currentDependencies = await workspaceDependencyHashes(host, pkg, packages, ownHashes);
+    const dependencyNames = new Set([...Object.keys(stamp.dependencies), ...Object.keys(currentDependencies)]);
+    for (const name of [...dependencyNames].sort()) {
+        if (stamp.dependencies[name] !== currentDependencies[name]) {
+            return result(`workspace dependency ${name} changed since the last successful build`);
+        }
+    }
+    for (const file of stamp.files) {
+        const path = host.paths.join(artifactsDirectory, file.path);
+        if (!isPathWithin(host, artifactsDirectory, path)) {
+            return result(`${artifactsDir}/${BUILD_STAMP_FILENAME} lists a path outside ${artifactsDir}: ${file.path}`);
+        }
+        const stats = await settle(() => followedStat(host, path));
+        if (!stats.ok) {
+            // An emitted file that vanished is not fresh; any other stat failure is real.
+            if (isMissingPathError(stats.cause))
+                return result(`emitted file is missing: ${artifactsDir}/${file.path}`);
+            throw stats.cause;
+        }
+        if (stats.value.kind !== 'file')
+            return result(`emitted file is not a regular file: ${artifactsDir}/${file.path}`);
+        const size = stats.value.size;
+        if (size !== file.size) {
+            return result(`emitted file changed size (${file.size} -> ${size}): ${artifactsDir}/${file.path}`);
+        }
+    }
+    const buildInfoReason = await typeScriptBuildInfoRefusal(host, host.paths.join(artifactsDirectory, TYPESCRIPT_BUILD_INFO_FILENAME));
+    if (buildInfoReason)
+        return result(buildInfoReason);
+    return result(undefined);
+}
+/**
+ * A stamped build whose incremental state still records pending emit or
+ * diagnostics is not a clean build, whatever the stamp says.
+ */
+async function typeScriptBuildInfoRefusal(host, tsBuildInfoPath) {
+    if (!(await host.files.exists(tsBuildInfoPath)))
+        return undefined;
+    const TsBuildInfoSchema = z.object({
+        errors: z.boolean().optional(),
+        affectedFilesPendingEmit: z.array(z.unknown()).optional(),
+        semanticDiagnosticsPerFile: z.array(z.unknown()).optional()
+    }).loose();
+    const buildInfo = TsBuildInfoSchema.safeParse(JSON.parse(await readText(host.files, tsBuildInfoPath)));
+    if (!buildInfo.success) {
+        // An unreadable incremental state cannot vouch for the build.
+        return `${TYPESCRIPT_BUILD_INFO_FILENAME} is not valid JSON`;
+    }
+    if (buildInfo.data.errors === true)
+        return `${TYPESCRIPT_BUILD_INFO_FILENAME} records compile errors`;
+    if (Array.isArray(buildInfo.data.affectedFilesPendingEmit) && buildInfo.data.affectedFilesPendingEmit.length > 0) {
+        return `${TYPESCRIPT_BUILD_INFO_FILENAME} records files pending emit`;
+    }
+    // tsc lists a bare file id for a clean file and `[id, diagnostics]` for one with errors.
+    if (Array.isArray(buildInfo.data.semanticDiagnosticsPerFile) &&
+        buildInfo.data.semanticDiagnosticsPerFile.some((entry) => Array.isArray(entry))) {
+        return `${TYPESCRIPT_BUILD_INFO_FILENAME} records semantic diagnostics`;
+    }
+    return undefined;
+}
+async function buildPackage(host, workspaceRoot, pkg, execution, packages, dependencySourceHashes, onLine) {
+    const scriptName = resolveBuildScriptName(pkg);
+    onLine?.('stdout', `[workspace-artifacts] building ${pkg.name}`);
+    const diagnostics = createWorkspaceDiagnosticTail();
+    // A prior stamp must never outlive the start of a rebuild: only a build that
+    // exits 0 writes one, so an interrupted build reads as not fresh.
+    await removeBuildStamp(host, pkg);
+    let result;
+    try {
+        result = await runRuntimeCommand({
+            runtime: host.runtime,
+            execution,
+            command: 'bun',
+            killTree: true,
+            args: ['run', '--cwd', pkg.dir, scriptName],
+            cwd: workspaceRoot,
+            env: await registryTokenEnv(host.runtime),
+            onLine: (stream, line) => {
+                const sanitized = diagnostics.push(stream, line);
+                onLine?.(stream, sanitized);
+            }
+        });
+    }
+    catch (error) {
+        await invalidateFailedBuild(host, pkg);
+        throw error;
+    }
+    if (result.code !== 0) {
+        await invalidateFailedBuild(host, pkg);
+        throw new Error(`Workspace artifact build failed for ${pkg.name} (exit=${result.code ?? 'unknown'})\n` +
+            `Compiler diagnostics (redacted tail):\n${diagnostics.render()}`);
+    }
+    await writeBuildOkStamp(pkg.dir, host.runtime, packages, dependencySourceHashes);
+}
+/** A failed build leaves neither its stamp nor its incremental state, so the next run rebuilds from scratch. */
+async function invalidateFailedBuild(host, pkg) {
+    const artifactsDirectory = host.paths.join(pkg.dir, resolveArtifactsDir(pkg));
+    await removeIfPresent(host.files, host.paths.join(artifactsDirectory, BUILD_STAMP_FILENAME));
+    await removeIfPresent(host.files, host.paths.join(artifactsDirectory, TYPESCRIPT_BUILD_INFO_FILENAME));
+}
+/**
+ * Builds `plan` with up to `concurrency` packages compiling at once.
+ * Independent branches of the dependency graph (declared or source-discovered
+ * edges, the same edge set the planner used) run concurrently; a mutual-import
+ * cycle — the class `orderCycleMembersByWorkspaceDependencies` already
+ * resolves into one contiguous, order-sensitive run — still builds its
+ * members serially, in the plan's existing order, so a tolerated cycle's
+ * behaviour is unchanged. `run` decides per package whether to actually spawn
+ * a build (it applies the freshness skip); this function only owns the safe
+ * scheduling.
+ */
+async function runWorkspaceBuildPlan(host, plan, packages, concurrency, run) {
+    if (plan.length === 0)
+        return;
+    const dependencyCache = new Map();
+    for (const pkg of plan) {
+        dependencyCache.set(pkg.name, await workspaceDependencyEdges(host, pkg, packages));
+    }
+    const dependenciesOf = (pkg) => {
+        const deps = dependencyCache.get(pkg.name);
+        if (!deps) {
+            throw new Error(`Workspace dependency edges were not loaded for ${pkg.name}`);
+        }
+        return deps;
+    };
+    const components = groupWorkspaceBuildPlanIntoComponents(plan, dependenciesOf);
+    const remaining = components.map((component) => new Set(component.dependsOn));
+    const waiters = components.map(() => []);
+    remaining.forEach((deps, index) => {
+        for (const dep of deps)
+            waiters[dep].push(index);
+    });
+    await new Promise((resolveAll, rejectAll) => {
+        let settled = false;
+        let active = 0;
+        let completed = 0;
+        const queue = components.map((_, index) => index).filter((index) => remaining[index].size === 0);
+        let cursor = 0;
+        const fail = (failure) => {
+            if (settled)
+                return;
+            settled = true;
+            // The caught failure travels whole into the combined rejection.
+            rejectAll(failure);
+        };
+        // One component's build: outcome-based, so a failure travels whole into the
+        // combined rejection and completion always advances the scheduler.
+        const runComponent = async (index) => {
+            const outcome = await settle(async () => {
+                for (const pkg of components[index].members)
+                    await run(pkg);
+            });
+            if (!outcome.ok)
+                fail(outcome.cause);
+            active -= 1;
+            completed += 1;
+            for (const waiter of waiters[index]) {
+                remaining[waiter].delete(index);
+                if (remaining[waiter].size === 0)
+                    queue.push(waiter);
+            }
+            if (completed === components.length) {
+                if (!settled) {
+                    settled = true;
+                    resolveAll();
+                }
+                return;
+            }
+            pump();
+        };
+        const pump = () => {
+            if (settled)
+                return;
+            while (active < concurrency && cursor < queue.length) {
+                const index = queue[cursor];
+                cursor += 1;
+                active += 1;
+                void runComponent(index);
+            }
+        };
+        pump();
+    });
+}
+/**
+ * Groups `plan` into its dependency components on the SAME `.all` edge set
+ * the planner used: a lone acyclic package is its own single-member
+ * component, and a mutual-import cycle collapses into one multi-member
+ * component (mirroring `findStronglyConnectedComponents`'s use inside
+ * `orderCycleMembersByWorkspaceDependencies`). Two components with no path
+ * between them can build at the same time.
+ */
+function groupWorkspaceBuildPlanIntoComponents(plan, dependenciesOf) {
+    const planNames = new Set(plan.map((pkg) => pkg.name));
+    const allEdges = new Map();
+    for (const pkg of plan) {
+        allEdges.set(pkg.name, dependenciesOf(pkg).all.filter((name) => planNames.has(name)));
+    }
+    const componentByName = findStronglyConnectedComponents(plan.map((pkg) => pkg.name), allEdges);
+    const componentOrder = [];
+    const seen = new Set();
+    const membersByComponent = new Map();
+    for (const pkg of plan) {
+        const component = componentByName.get(pkg.name);
+        if (component === undefined)
+            continue;
+        if (!seen.has(component)) {
+            seen.add(component);
+            componentOrder.push(component);
+        }
+        const members = membersByComponent.get(component) ?? [];
+        members.push(pkg);
+        membersByComponent.set(component, members);
+    }
+    const dependsOnByComponent = new Map();
+    for (const component of componentOrder)
+        dependsOnByComponent.set(component, new Set());
+    for (const [name, deps] of allEdges) {
+        const component = componentByName.get(name);
+        if (component === undefined)
+            continue;
+        for (const dep of deps) {
+            const depComponent = componentByName.get(dep);
+            if (depComponent === undefined || depComponent === component)
+                continue;
+            dependsOnByComponent.get(component)?.add(depComponent);
+        }
+    }
+    return componentOrder.map((component) => ({
+        members: membersByComponent.get(component) ?? [],
+        dependsOn: dependsOnByComponent.get(component) ?? new Set()
+    }));
+}
+/** Independent workspace package builds run this many at a time (see `runWorkspaceBuildPlan`). */
+const DEFAULT_WORKSPACE_BUILD_CONCURRENCY = 4;
+async function buildWorkspacePlanWithFreshnessSkip(host, workspaceRoot, plan, packages, execution, onLine) {
+    // Source hashes do not change while a plan builds (builds emit only into artifact directories).
+    const ownHashes = new Map();
+    await runWorkspaceBuildPlan(host, plan, packages, DEFAULT_WORKSPACE_BUILD_CONCURRENCY, async (pkg) => {
+        const freshness = await checkWorkspacePackageFreshness(host, pkg, packages, ownHashes);
+        if (freshness.fresh) {
+            onLine?.('stdout', `[workspace-artifacts] skip ${pkg.name}: ${freshness.artifactsDir} is already fresh`);
+            return;
+        }
+        await buildPackage(host, workspaceRoot, pkg, execution, packages, ownHashes, onLine);
+    });
+}
+async function discoverSvelteKitApps(host, workspaceRoot) {
+    const appsRoot = host.paths.join(workspaceRoot, 'apps');
+    if (!(await host.files.exists(appsRoot)))
+        return [];
+    const apps = [];
+    for (const entry of await host.files.list(appsRoot)) {
+        if (entry.kind !== 'directory')
+            continue;
+        const dir = host.paths.join(appsRoot, entry.name);
+        const hasJs = await host.files.exists(host.paths.join(dir, 'svelte.config.js'));
+        const hasTs = await host.files.exists(host.paths.join(dir, 'svelte.config.ts'));
+        if (!hasJs && !hasTs)
+            continue;
+        apps.push({ name: `apps/${entry.name}`, dir });
+    }
+    return apps.sort((a, b) => a.name.localeCompare(b.name));
+}
+async function needsSvelteKitSync(host, app) {
+    return !(await host.files.exists(host.paths.join(app.dir, '.svelte-kit', 'tsconfig.json')));
+}
+async function syncSvelteKitApp(host, workspaceRoot, app, execution, onLine) {
+    onLine?.('stdout', `[svelte-kit-sync] syncing ${app.name}`);
+    const result = await runRuntimeCommand({
+        runtime: host.runtime,
+        execution,
+        command: 'bun',
+        args: ['--bun', 'svelte-kit', 'sync'],
+        cwd: app.dir,
+        env: await registryTokenEnv(host.runtime),
+        onLine
+    });
+    if (result.code !== 0) {
+        throw new Error(`SvelteKit metadata sync failed for ${app.name} (exit=${result.code ?? 'unknown'})`);
+    }
+    const syncedConfig = host.paths.join(app.dir, '.svelte-kit', 'tsconfig.json');
+    if (!(await host.files.exists(syncedConfig))) {
+        throw new Error(`SvelteKit metadata sync did not produce ${host.paths.relative(workspaceRoot, syncedConfig)}`);
+    }
+}
+async function syncMissingSvelteKitMetadataForWorkspace(host, workspaceRoot, appDir, execution, onLine) {
+    const apps = await discoverSvelteKitApps(host, workspaceRoot);
+    const targetFirst = apps.sort((a, b) => {
+        if (a.dir === appDir)
+            return -1;
+        if (b.dir === appDir)
+            return 1;
+        return a.name.localeCompare(b.name);
+    });
+    const missing = [];
+    for (const app of targetFirst) {
+        if (await needsSvelteKitSync(host, app))
+            missing.push(app);
+    }
+    if (missing.length === 0)
+        return;
+    onLine?.('stdout', `[svelte-kit-sync] preparing generated metadata for ${missing.length} SvelteKit app(s)`);
+    for (const app of missing) {
+        await syncSvelteKitApp(host, workspaceRoot, app, execution, onLine);
+    }
+    onLine?.('stdout', `[svelte-kit-sync] metadata ready for ${missing.length} SvelteKit app(s)`);
+}
+/**
+ * Workspace dependency edges for a package: the union of declared
+ * `dependencies` + `peerDependencies` (the *-svelte packages declare their
+ * core package as a peer dependency, so `dependencies` alone misses e.g.
+ * account-svelte -> @vibesdotdev/account) and the package's own source
+ * imports (catches undeclared imports such as chat-svelte importing
+ * `@vibesdotdev/chat/client`).
+ */
+function selectorResolvesWorkspacePackage(pkg, selector) {
+    if (selector.startsWith('workspace:'))
+        return true;
+    if (!pkg.packageJson.version)
+        return true;
+    return Boolean(validRange(selector) && satisfies(pkg.packageJson.version, selector));
+}
+/** Build scripts/configuration may use development dependencies; public entry points may not. */
+function isBuildOnlyImportSource(host, pkg, path) {
+    const relative = toPosixPath(host, host.paths.relative(pkg.dir, path));
+    const buildOnly = relative.startsWith('scripts/') || BUILD_CONFIG_FILE.test(relative);
+    if (!buildOnly)
+        return false;
+    const entryPoints = [pkg.packageJson.main, pkg.packageJson.types, pkg.packageJson.svelte, pkg.packageJson.bin, pkg.packageJson.exports];
+    const namesPath = (value) => {
+        const targetPath = z.string().safeParse(value);
+        if (targetPath.success) {
+            const target = targetPath.data.replace(/^\.\//, '');
+            const pattern = target.split('*').map((part) => part.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')).join('.*');
+            return new RegExp('^' + pattern + '$').test(relative);
+        }
+        const alternatives = z.array(JsonValueSchema).safeParse(value);
+        if (alternatives.success)
+            return alternatives.data.some(namesPath);
+        const conditions = z.record(z.string(), JsonValueSchema).safeParse(value);
+        return conditions.success && Object.values(conditions.data).some(namesPath);
+    };
+    return !entryPoints.some(namesPath);
+}
+async function workspaceDependencyEdges(host, pkg, workspacePackages) {
+    const workspacePackageNames = new Set(workspacePackages.keys());
+    const declared = new Set();
+    const declaredExternal = new Set();
+    const optionalPeers = new Set();
+    for (const [name, selector] of Object.entries(pkg.packageJson.dependencies ?? {})) {
+        const target = workspacePackages.get(name);
+        if (target && selectorResolvesWorkspacePackage(target, selector ?? ''))
+            declared.add(name);
+        else if (target)
+            declaredExternal.add(name);
+        else if (selector?.startsWith('workspace:')) {
+            throw new Error(`Workspace artifact build plan cannot resolve ${name}, required by ${pkg.name}, to a workspace package manifest`);
+        }
+    }
+    // Optional peers (peerDependenciesMeta[name].optional) are not build
+    // prerequisites — they may be absent at runtime by contract, and treating
+    // them as edges pulls whole optional families into every consumer's plan
+    // and can invert cycle ordering (ai <-> ai-provider-*). Statically-imported
+    // peers are still covered by the source scan below.
+    for (const [name, selector] of Object.entries(pkg.packageJson.peerDependencies ?? {})) {
+        const target = workspacePackages.get(name);
+        // An optional peer is never part of this package's required closure,
+        // whether or not its selector resolves the workspace version: a source
+        // import of it orders the build only when something else already
+        // requires it, and never drags it (or its own cycle) into the plan.
+        if (pkg.packageJson.peerDependenciesMeta?.[name]?.optional === true) {
+            if (target) {
+                declaredExternal.add(name);
+                if (selectorResolvesWorkspacePackage(target, selector ?? ''))
+                    optionalPeers.add(name);
+            }
+            continue;
+        }
+        if (target && selectorResolvesWorkspacePackage(target, selector ?? ''))
+            declared.add(name);
+        else if (target)
+            declaredExternal.add(name);
+        else if (selector?.startsWith('workspace:')) {
+            throw new Error(`Workspace artifact build plan cannot resolve ${name}, required by ${pkg.name}, to a workspace package manifest`);
+        }
+    }
+    const discovered = new Set();
+    const optionalInputs = new Set();
+    for (const path of await packageBuildInputs(host, pkg)) {
+        const dynamicDiscovered = new Set();
+        await collectImportsFromPath(host, path, discovered, workspacePackageNames, dynamicDiscovered);
+        for (const name of dynamicDiscovered) {
+            if (name === pkg.name)
+                continue;
+            const optionalPeer = pkg.packageJson.peerDependencies?.[name] !== undefined &&
+                pkg.packageJson.peerDependenciesMeta?.[name]?.optional === true;
+            if (optionalPeer) {
+                if (optionalPeers.has(name))
+                    optionalInputs.add(name);
+                continue;
+            }
+            if (declaredExternal.has(name))
+                continue;
+            const developmentSelector = isBuildOnlyImportSource(host, pkg, path)
+                ? pkg.packageJson.devDependencies?.[name]
+                : undefined;
+            const requiredDeclaration = pkg.packageJson.dependencies?.[name] !== undefined ||
+                (pkg.packageJson.peerDependencies?.[name] !== undefined && !optionalPeer) ||
+                developmentSelector !== undefined;
+            if (!requiredDeclaration) {
+                throw new Error(`Workspace artifact build plan found undeclared dynamic import ${name}, required by ${pkg.name}; declare it as a dependency, required peer, or optional peer (build-only imports may use a development dependency)`);
+            }
+            const target = workspacePackages.get(name);
+            if (developmentSelector !== undefined && target && !selectorResolvesWorkspacePackage(target, developmentSelector)) {
+                continue;
+            }
+            discovered.add(name);
+        }
+    }
+    for (const name of optionalPeers) {
+        if (discovered.has(name))
+            optionalInputs.add(name);
+    }
+    for (const name of declaredExternal) {
+        if (!declared.has(name))
+            discovered.delete(name);
+    }
+    declared.delete(pkg.name);
+    discovered.delete(pkg.name);
+    const all = new Set([...declared, ...discovered]);
+    return {
+        declared: [...declared].sort(),
+        discovered: [...discovered].sort(),
+        all: [...all].sort(),
+        inputs: [...new Set([...all, ...optionalInputs])].sort()
+    };
+}
+function shouldScanFile(path) {
+    const filename = path.split('/').pop() ?? '';
+    if (filename.includes('.test.') || filename.includes('.spec.') || filename.endsWith('.d.ts')) {
+        return false;
+    }
+    const dot = filename.lastIndexOf('.');
+    return dot >= 0 && SOURCE_EXTENSIONS.has(filename.slice(dot));
+}
+async function collectImportsFromPath(host, path, out, workspacePackageNames, dynamicOut) {
+    if (!(await host.files.exists(path)))
+        return;
+    const stats = await followedStat(host, path);
+    if (stats.kind === 'directory') {
+        for (const entry of await host.files.list(path)) {
+            if (entry.kind === 'directory' && SKIP_DIRS.has(entry.name))
+                continue;
+            await collectImportsFromPath(host, host.paths.join(path, entry.name), out, workspacePackageNames, dynamicOut);
+        }
+        return;
+    }
+    if (stats.kind !== 'file' || !shouldScanFile(path))
+        return;
+    const read = await settle(async () => readText(host.files, path));
+    if (!read.ok) {
+        // The file vanished between the directory walk and the read: nothing to scan.
+        if (isMissingPathError(read.cause))
+            return;
+        throw read.cause;
+    }
+    const text = read.value;
+    const filename = path.split('/').pop() ?? '';
+    const dot = filename.lastIndexOf('.');
+    const extension = dot >= 0 ? filename.slice(dot) : '';
+    if (extension === '.css') {
+        collectCssImports(text, out, workspacePackageNames);
+        return;
+    }
+    if (extension === '.svelte') {
+        for (const script of extractSvelteBlocks(text, 'script')) {
+            collectEcmaScriptImports(script, out, workspacePackageNames, dynamicOut);
+        }
+        for (const style of extractSvelteBlocks(text, 'style')) {
+            collectCssImports(style, out, workspacePackageNames);
+        }
+        return;
+    }
+    collectEcmaScriptImports(text, out, workspacePackageNames, dynamicOut);
+    if (extension === '.js' || extension === '.mjs' || extension === '.cjs') {
+        collectCssImports(text, out, workspacePackageNames);
+    }
+}
+function collectCssImports(text, out, workspacePackageNames) {
+    for (const match of text.matchAll(CSS_IMPORT_RE)) {
+        if (match[1])
+            addPackageFromSpecifier(out, match[1], workspacePackageNames);
+    }
+}
+function extractSvelteBlocks(text, tag) {
+    const blocks = [];
+    const pattern = new RegExp(`<${tag}\\b[^>]*>([\\s\\S]*?)<\\/${tag}>`, 'gi');
+    for (const match of text.matchAll(pattern)) {
+        blocks.push(match[1] ?? '');
+    }
+    return blocks;
+}
+function collectEcmaScriptImports(text, out, workspacePackageNames, dynamicOut) {
+    let index = 0;
+    while (index < text.length) {
+        const skipped = skipWhitespaceAndComments(text, index);
+        index = skipped.index;
+        if (skipped.stoppedInString) {
+            index = skipStringLike(text, index);
+            continue;
+        }
+        if (matchesKeyword(text, index, 'import')) {
+            index = collectImportStatement(text, index + 'import'.length, out, workspacePackageNames, dynamicOut);
+            continue;
+        }
+        if (matchesKeyword(text, index, 'export')) {
+            index = collectExportStatement(text, index + 'export'.length, out, workspacePackageNames);
+            continue;
+        }
+        index += 1;
+    }
+}
+function collectImportStatement(text, index, out, workspacePackageNames, dynamicOut) {
+    let cursor = skipWhitespaceAndComments(text, index).index;
+    if (text[cursor] === '(') {
+        cursor = skipWhitespaceAndComments(text, cursor + 1).index;
+        const literal = readStringLiteral(text, cursor);
+        if (literal) {
+            addPackageFromSpecifier(dynamicOut ?? out, literal.value, workspacePackageNames);
+        }
+        return literal?.end ?? cursor + 1;
+    }
+    if (text[cursor] === '.')
+        return cursor + 1;
+    const sideEffectImport = readStringLiteral(text, cursor);
+    if (sideEffectImport) {
+        addPackageFromSpecifier(out, sideEffectImport.value, workspacePackageNames);
+        return sideEffectImport.end;
+    }
+    return collectFromClause(text, cursor, out, workspacePackageNames);
+}
+function collectExportStatement(text, index, out, workspacePackageNames) {
+    const cursor = skipWhitespaceAndComments(text, index).index;
+    if (text[cursor] === '*' ||
+        text[cursor] === '{' ||
+        matchesKeyword(text, cursor, 'type')) {
+        return collectFromClause(text, cursor, out, workspacePackageNames);
+    }
+    // `export function`, `export const`, and `export default` may contain a
+    // dynamic import in their initializer/body. Keep scanning their contents
+    // instead of consuming the whole declaration while looking for a `from`.
+    return cursor;
+}
+function collectFromClause(text, index, out, workspacePackageNames) {
+    let cursor = index;
+    while (cursor < text.length) {
+        const skipped = skipWhitespaceAndComments(text, cursor);
+        cursor = skipped.index;
+        if (skipped.stoppedInString) {
+            cursor = skipStringLike(text, cursor);
+            continue;
+        }
+        if (text[cursor] === ';')
+            return cursor + 1;
+        if (matchesKeyword(text, cursor, 'from')) {
+            cursor = skipWhitespaceAndComments(text, cursor + 'from'.length).index;
+            const literal = readStringLiteral(text, cursor);
+            if (literal) {
+                addPackageFromSpecifier(out, literal.value, workspacePackageNames);
+                return literal.end;
+            }
+            return cursor;
+        }
+        cursor += 1;
+    }
+    return cursor;
+}
+function addPackageFromSpecifier(out, specifier, workspacePackageNames) {
+    if (workspacePackageNames) {
+        const exactWorkspacePackage = [...workspacePackageNames]
+            .filter((name) => specifier === name || specifier.startsWith(`${name}/`))
+            .sort((a, b) => b.length - a.length || a.localeCompare(b))[0];
+        if (exactWorkspacePackage) {
+            out.add(exactWorkspacePackage);
+        }
+        return;
+    }
+    const match = specifier.match(/^(@vibesdotdev\/[a-zA-Z0-9-]+)(?:\/.*)?$/);
+    if (match?.[1])
+        out.add(match[1]);
+}
+function matchesKeyword(text, index, keyword) {
+    if (!text.startsWith(keyword, index))
+        return false;
+    const before = index > 0 ? text[index - 1] : '';
+    const after = text[index + keyword.length] ?? '';
+    return !isIdentifierChar(before) && !isIdentifierChar(after);
+}
+function isIdentifierChar(char) {
+    return /[A-Za-z0-9_$]/.test(char);
+}
+function skipWhitespaceAndComments(text, index) {
+    let cursor = index;
+    while (cursor < text.length) {
+        const char = text[cursor];
+        const next = text[cursor + 1];
+        if (/\s/.test(char)) {
+            cursor += 1;
+            continue;
+        }
+        if (char === '/' && next === '/') {
+            const lineEnd = text.indexOf('\n', cursor + 2);
+            cursor = lineEnd >= 0 ? lineEnd + 1 : text.length;
+            continue;
+        }
+        if (char === '/' && next === '*') {
+            const commentEnd = text.indexOf('*/', cursor + 2);
+            cursor = commentEnd >= 0 ? commentEnd + 2 : text.length;
+            continue;
+        }
+        return { index: cursor, stoppedInString: char === '"' || char === "'" || char === '`' };
+    }
+    return { index: cursor, stoppedInString: false };
+}
+function skipStringLike(text, index) {
+    const quote = text[index];
+    let cursor = index + 1;
+    while (cursor < text.length) {
+        const char = text[cursor];
+        if (char === '\\') {
+            cursor += 2;
+            continue;
+        }
+        if (char === quote)
+            return cursor + 1;
+        cursor += 1;
+    }
+    return cursor;
+}
+function readStringLiteral(text, index) {
+    const quote = text[index];
+    if (quote !== '"' && quote !== "'")
+        return null;
+    let cursor = index + 1;
+    let value = '';
+    while (cursor < text.length) {
+        const char = text[cursor];
+        if (char === '\\') {
+            value += text[cursor + 1] ?? '';
+            cursor += 2;
+            continue;
+        }
+        if (char === quote)
+            return { value, end: cursor + 1 };
+        value += char;
+        cursor += 1;
+    }
+    return null;
+}
+function appScanPaths(host, appDir) {
+    return [
+        host.paths.join(appDir, 'src'),
+        host.paths.join(appDir, 'vibes.config.js'),
+        host.paths.join(appDir, 'vibes.config.ts'),
+        host.paths.join(appDir, 'deployment.config.js'),
+        host.paths.join(appDir, 'deployment.config.ts'),
+        host.paths.join(appDir, 'svelte.config.js'),
+        host.paths.join(appDir, 'svelte.config.ts'),
+        host.paths.join(appDir, 'vite.config.js'),
+        host.paths.join(appDir, 'vite.config.ts')
+    ];
+}
+function cachedEdges(cache) {
+    return (pkg) => {
+        const deps = cache.get(pkg.name);
+        if (!deps) {
+            throw new Error(`Workspace dependency edges were not loaded for ${pkg.name}`);
+        }
+        return deps;
+    };
+}
+async function edgesOf(host, pkg, packages, cache) {
+    const cached = cache.get(pkg.name);
+    if (cached)
+        return cached;
+    const deps = await workspaceDependencyEdges(host, pkg, packages);
+    cache.set(pkg.name, deps);
+    return deps;
+}
+/**
+ * Computes the complete, dependency-ordered list of workspace packages whose
+ * dist artifacts must exist before the app can build. Pure planning step —
+ * does not run any builds.
+ *
+ * Edges are the union of declared workspace deps (dependencies +
+ * peerDependencies) and source-scanned imports, so transitive deps reachable
+ * only through peerDependencies or undeclared imports are included. Cycles in
+ * that union (e.g. runtime <-> runtime-client via source imports) are
+ * tolerated: a back-edge to a package already on the visit stack is skipped,
+ * which still yields a valid topological order for the acyclic remainder.
+ */
+export async function planWorkspaceArtifactBuilds(options) {
+    const host = await resolveArtifactHost(options.runtime);
+    return (await planWorkspacePackageClosure(host, options)).filter(hasBuildArtifacts);
+}
+/** Closure from explicit package seeds (publish preflight) — same transitive walk as the app path. */
+export async function planWorkspacePackageClosureFromSeeds(runtime, workspaceRoot, seedNames, packageScope) {
+    const host = await resolveArtifactHost(runtime);
+    const packages = await resolveWorkspacePackages(host, workspaceRoot, packageScope);
+    const dependencyCache = new Map();
+    const planned = new Set();
+    const visiting = new Set();
+    const order = [];
+    const visit = async (pkg) => {
+        if (planned.has(pkg.name) || visiting.has(pkg.name))
+            return;
+        visiting.add(pkg.name);
+        for (const depName of (await edgesOf(host, pkg, packages, dependencyCache)).all) {
+            const dep = packages.get(depName);
+            if (!dep) {
+                throw new Error(`Workspace package closure cannot resolve ${depName}, required by ${pkg.name}, to a workspace package manifest`);
+            }
+            await visit(dep);
+        }
+        visiting.delete(pkg.name);
+        planned.add(pkg.name);
+        order.push(pkg);
+    };
+    for (const name of [...seedNames].sort()) {
+        const pkg = packages.get(name);
+        if (!pkg) {
+            throw new Error(`Workspace package closure seed ${name} is not a workspace package`);
+        }
+        await visit(pkg);
+    }
+    return orderCycleMembersByWorkspaceDependencies(order, cachedEdges(dependencyCache));
+}
+async function workspaceAppDependencyNames(host, workspaceRoot, appDir, packages) {
+    const workspacePackageNames = new Set(packages.keys());
+    const appImports = new Set();
+    for (const path of appScanPaths(host, appDir)) {
+        await collectImportsFromPath(host, path, appImports, workspacePackageNames);
+    }
+    const appPackageJson = await readAppManifest(host, host.paths.join(appDir, 'package.json'));
+    const localDeclared = new Set();
+    const declaredExternal = new Set();
+    for (const [name, selector] of Object.entries(appPackageJson?.dependencies ?? {})) {
+        const target = packages.get(name);
+        if (target && selectorResolvesWorkspacePackage(target, selector ?? '')) {
+            appImports.add(name);
+            localDeclared.add(name);
+        }
+        else if (target)
+            declaredExternal.add(name);
+        else if (selector?.startsWith('workspace:')) {
+            throw new Error(`Workspace artifact build plan cannot resolve ${name}, required by ${host.paths.relative(workspaceRoot, appDir)}, to a workspace package manifest`);
+        }
+    }
+    for (const [name, selector] of Object.entries(appPackageJson?.peerDependencies ?? {})) {
+        const target = packages.get(name);
+        if (appPackageJson?.peerDependenciesMeta?.[name]?.optional === true) {
+            if (target && !selectorResolvesWorkspacePackage(target, selector ?? '')) {
+                declaredExternal.add(name);
+            }
+            continue;
+        }
+        if (target && selectorResolvesWorkspacePackage(target, selector ?? '')) {
+            appImports.add(name);
+            localDeclared.add(name);
+        }
+        else if (target)
+            declaredExternal.add(name);
+        else if (selector?.startsWith('workspace:')) {
+            throw new Error(`Workspace artifact build plan cannot resolve ${name}, required by ${host.paths.relative(workspaceRoot, appDir)}, to a workspace package manifest`);
+        }
+    }
+    for (const name of declaredExternal) {
+        if (!localDeclared.has(name))
+            appImports.delete(name);
+    }
+    return [...appImports].sort();
+}
+async function planWorkspacePackageClosure(host, { workspaceRoot, appDir }) {
+    const packages = await discoverWorkspacePackages(host, workspaceRoot);
+    const appImports = await workspaceAppDependencyNames(host, workspaceRoot, appDir, packages);
+    const dependencyCache = new Map();
+    const planned = new Set();
+    const visiting = new Set();
+    const order = [];
+    const visit = async (pkg) => {
+        // A package already on the visit stack is a dependency cycle; skip the
+        // back-edge instead of failing — every member still gets built once.
+        if (planned.has(pkg.name) || visiting.has(pkg.name))
+            return;
+        visiting.add(pkg.name);
+        for (const depName of (await edgesOf(host, pkg, packages, dependencyCache)).all) {
+            const dep = packages.get(depName);
+            if (!dep) {
+                throw new Error(`Workspace artifact build plan cannot resolve ${depName}, required by ${pkg.name}, to a workspace package manifest`);
+            }
+            await visit(dep);
+        }
+        visiting.delete(pkg.name);
+        planned.add(pkg.name);
+        order.push(pkg);
+    };
+    for (const name of appImports) {
+        const pkg = packages.get(name);
+        if (!pkg)
+            continue;
+        await visit(pkg);
+    }
+    return orderCycleMembersByWorkspaceDependencies(order, cachedEdges(dependencyCache));
+}
+/**
+ * Refuses a deploy before its ledger, regeneration, build, or provider phases
+ * when the dependency closure could resolve outside the requested worktree or
+ * consume stale Node-condition artifacts. This deliberately has no skip-build
+ * branch: skipping a rebuild must not permit unverified deploy inputs.
+ */
+export async function assertDeployWorkspacePreflight({ workspaceRoot, runtime, appDir, packageNames, packageScope, artifactPolicy = 'strict' }) {
+    const host = await resolveArtifactHost(runtime);
+    const resolvedWorkspaceRoot = await realpathChecked(host.files, workspaceRoot);
+    const nodeModules = host.paths.join(resolvedWorkspaceRoot, 'node_modules');
+    if (!(await host.files.exists(nodeModules))) {
+        throw deployPreflightFailure(`the deploy worktree has no node_modules at ${nodeModules}. Run \`bun install\` in ${resolvedWorkspaceRoot}.`);
+    }
+    const resolvedNodeModules = await realpathChecked(host.files, nodeModules);
+    if (!isPathWithin(host, resolvedWorkspaceRoot, resolvedNodeModules)) {
+        throw deployPreflightFailure(`node_modules resolves outside the deploy worktree (${resolvedNodeModules}). Run \`bun install\` in ${resolvedWorkspaceRoot}; do not reuse another worktree's dependencies.`);
+    }
+    const warnings = [];
+    if ((appDir === undefined) === (packageNames === undefined)) {
+        throw deployPreflightFailure('workspace preflight needs exactly one of appDir or packageNames as its closure seed');
+    }
+    const workspacePackages = appDir !== undefined
+        ? await discoverWorkspacePackages(host, resolvedWorkspaceRoot)
+        : await resolveWorkspacePackages(host, resolvedWorkspaceRoot, packageScope);
+    let packageClosure;
+    if (appDir !== undefined) {
+        const resolvedAppDir = await realpathChecked(host.files, appDir);
+        if (!isPathWithin(host, resolvedWorkspaceRoot, resolvedAppDir)) {
+            throw deployPreflightFailure(`app resolves outside the deploy worktree (${resolvedAppDir}). Run \`bun install\` in ${resolvedWorkspaceRoot}.`);
+        }
+        packageClosure = await planWorkspacePackageClosure(host, {
+            workspaceRoot: resolvedWorkspaceRoot,
+            appDir: resolvedAppDir
+        });
+        for (const dependencyName of await workspaceAppDependencyNames(host, resolvedWorkspaceRoot, resolvedAppDir, workspacePackages)) {
+            await assertInstalledWorkspacePackageResolution(host, {
+                consumerDir: resolvedAppDir,
+                consumerLabel: host.paths.relative(resolvedWorkspaceRoot, resolvedAppDir),
+                dependencyName,
+                workspaceRoot: resolvedWorkspaceRoot
+            });
+        }
+    }
+    else if (packageNames !== undefined) {
+        packageClosure = selectWorkspacePackagesByName(workspacePackages, packageNames);
+    }
+    else {
+        throw deployPreflightFailure('workspace preflight needs exactly one of appDir or packageNames as its closure seed');
+    }
+    for (const pkg of packageClosure) {
+        const resolvedPackageRoot = await realpathChecked(host.files, pkg.dir);
+        if (!isPathWithin(host, resolvedWorkspaceRoot, resolvedPackageRoot)) {
+            throw deployPreflightFailure(`${pkg.name} resolves outside the deploy worktree (${resolvedPackageRoot}). Run \`bun install\` in ${resolvedWorkspaceRoot}.`);
+        }
+        for (const dependencyName of (await workspaceDependencyEdges(host, pkg, workspacePackages)).all) {
+            await assertInstalledWorkspacePackageResolution(host, {
+                consumerDir: resolvedPackageRoot,
+                consumerLabel: pkg.name,
+                dependencyName,
+                workspaceRoot: resolvedWorkspaceRoot
+            });
+        }
+    }
+    if (artifactPolicy === 'planned-build') {
+        return { warnings };
+    }
+    const ownHashes = new Map();
+    for (const pkg of packageClosure.filter(hasBuildArtifacts)) {
+        // Single source of truth: the same predicate that decides whether the
+        // build orchestration below may skip this package's build (see
+        // `checkWorkspacePackageFreshness`) decides whether this postflight
+        // assertion accepts it as a valid deploy input.
+        const freshness = await checkWorkspacePackageFreshness(host, pkg, workspacePackages, ownHashes);
+        if (freshness.fresh)
+            continue;
+        if (freshness.artifactsMissing) {
+            throw deployPreflightFailure(`${pkg.name} has no ${freshness.artifactsDir} artifacts. ${staleArtifactRemedy(freshness.artifactsDir)}`);
+        }
+        throw deployPreflightFailure(`${pkg.name} ${freshness.artifactsDir} is stale for this deploy: ${freshness.reason}. ${staleArtifactRemedy(freshness.artifactsDir)}`);
+    }
+    return { warnings };
+}
+function selectWorkspacePackagesByName(packages, packageNames) {
+    const selected = [];
+    const seen = new Set();
+    for (const name of packageNames) {
+        if (seen.has(name)) {
+            throw new Error(`Workspace preflight package closure repeats ${name}`);
+        }
+        seen.add(name);
+        const pkg = packages.get(name);
+        if (!pkg) {
+            throw new Error(`Workspace preflight package ${name} is not a workspace package`);
+        }
+        selected.push(pkg);
+    }
+    return selected;
+}
+/**
+ * Orders one caller-owned package set by the dependencies its production
+ * source actually imports. This does not expand the set: Registry owns the
+ * release closure, while this planner owns the artifact order inside it.
+ * A selected package importing an omitted workspace package is a broken sealed
+ * closure and fails before any build starts.
+ */
+export async function planWorkspacePackageBuildOrder(runtime, workspaceRoot, packageNames, packageScope) {
+    const host = await resolveArtifactHost(runtime);
+    const packages = await resolveWorkspacePackages(host, workspaceRoot, packageScope);
+    const selected = selectWorkspacePackagesByName(packages, packageNames);
+    const selectedNames = new Set(selected.map((pkg) => pkg.name));
+    const dependencyCache = new Map();
+    for (const pkg of selected) {
+        const dependencies = await edgesOf(host, pkg, packages, dependencyCache);
+        for (const dependency of dependencies.all) {
+            if (!selectedNames.has(dependency)) {
+                throw new Error(`Workspace artifact package closure omits ${dependency}, imported by ${pkg.name}`);
+            }
+        }
+    }
+    return orderCycleMembersByWorkspaceDependencies(selected, cachedEdges(dependencyCache)).map((pkg) => pkg.name);
+}
+/**
+ * Only the workspace-artifacts builder writes the build stamp, so the remedy
+ * names a run that goes through it; a package's own `build` script never does.
+ */
+function staleArtifactRemedy(artifactsDir) {
+    return `Rerun without \`--skip-build\` so the workspace-artifacts build rebuilds it and records ${artifactsDir}/${BUILD_STAMP_FILENAME}; a package's own \`bun run build\` does not write that stamp.`;
+}
+function deployPreflightFailure(message) {
+    return new Error(`[workspace-preflight] Refusing deploy: ${message}`);
+}
+function isPathWithin(host, root, target) {
+    const pathFromRoot = host.paths.relative(root, target);
+    return (pathFromRoot === '' ||
+        (pathFromRoot !== '..' &&
+            !pathFromRoot.startsWith(`..${host.sep}`) &&
+            !host.paths.isAbsolute(pathFromRoot)));
+}
+async function resolveInstalledWorkspacePackage(host, consumerDir, workspaceRoot, packageName) {
+    let current = await realpathChecked(host.files, consumerDir);
+    while (isPathWithin(host, workspaceRoot, current)) {
+        const candidate = host.paths.join(current, 'node_modules', ...packageName.split('/'));
+        if (await host.files.exists(candidate))
+            return candidate;
+        if (current === workspaceRoot)
+            break;
+        current = host.paths.dirname(current);
+    }
+    return undefined;
+}
+async function assertInstalledWorkspacePackageResolution(host, options) {
+    const installedPackage = await resolveInstalledWorkspacePackage(host, options.consumerDir, options.workspaceRoot, options.dependencyName);
+    if (!installedPackage) {
+        throw deployPreflightFailure(`cannot resolve ${options.dependencyName}, required by ${options.consumerLabel}, from this worktree's node_modules. Run \`bun install\` in ${options.workspaceRoot}.`);
+    }
+    const resolvedInstalledPackage = await realpathChecked(host.files, installedPackage);
+    if (!isPathWithin(host, options.workspaceRoot, resolvedInstalledPackage)) {
+        throw deployPreflightFailure(`${options.dependencyName}, required by ${options.consumerLabel}, resolves outside the deploy worktree (${resolvedInstalledPackage}). Run \`bun install\` in ${options.workspaceRoot}; do not reuse another worktree's dependencies.`);
+    }
+}
+/**
+ * A file under `src/` the build reads. Hidden files are generated sentinels
+ * (`@vibesdotdev/editor`'s nvim install writes `.vibes-install.json` through a
+ * symlink into `editor/src/`), and tests, including whole `__tests__`
+ * directories, are excluded from the tsconfig, so none of them is a build input.
+ */
+function isBuildInput(path) {
+    const filename = path.split('/').pop() ?? '';
+    if (filename.startsWith('.'))
+        return false;
+    if (filename.includes('.test.') || filename.includes('.spec.'))
+        return false;
+    return !path.includes('/__tests__/');
+}
+async function filesInDirectory(host, directory, include = () => true) {
+    if (!(await host.files.exists(directory)))
+        return [];
+    const files = [];
+    const visit = async (path) => {
+        for (const entry of await host.files.list(path)) {
+            const entryPath = host.paths.join(path, entry.name);
+            if (entry.kind === 'directory') {
+                if (!SKIP_DIRS.has(entry.name))
+                    await visit(entryPath);
+                continue;
+            }
+            if (entry.kind === 'file' && include(entryPath))
+                files.push(entryPath);
+        }
+    };
+    await visit(directory);
+    return files;
+}
+function orderCycleMembersByWorkspaceDependencies(order, dependenciesOf) {
+    const allEdges = new Map();
+    const packageByName = new Map(order.map((pkg) => [pkg.name, pkg]));
+    const orderIndex = new Map(order.map((pkg, index) => [pkg.name, index]));
+    const reachable = new Set(packageByName.keys());
+    for (const pkg of order) {
+        allEdges.set(pkg.name, dependenciesOf(pkg).all.filter((name) => reachable.has(name)));
+    }
+    const componentByName = findStronglyConnectedComponents([...reachable], allEdges);
+    const components = new Map();
+    for (const pkg of order) {
+        const component = componentByName.get(pkg.name);
+        if (component === undefined)
+            continue;
+        const members = components.get(component) ?? [];
+        members.push(pkg);
+        components.set(component, members);
+    }
+    const output = [];
+    for (const component of sortComponentsByDependencies(components, componentByName, allEdges, orderIndex)) {
+        const members = components.get(component) ?? [];
+        if (members.length === 0)
+            continue;
+        if (members.length === 1) {
+            output.push(members[0]);
+            continue;
+        }
+        output.push(...sortComponentByDeclaredWorkspaceDependencies(members, dependenciesOf, orderIndex));
+    }
+    return output;
+}
+function sortComponentsByDependencies(components, componentByName, allEdges, orderIndex) {
+    const componentDeps = new Map();
+    for (const component of components.keys())
+        componentDeps.set(component, new Set());
+    for (const [name, deps] of allEdges) {
+        const component = componentByName.get(name);
+        if (component === undefined)
+            continue;
+        const depsForComponent = componentDeps.get(component);
+        if (!depsForComponent)
+            continue;
+        for (const dep of deps) {
+            const depComponent = componentByName.get(dep);
+            if (depComponent === undefined || depComponent === component)
+                continue;
+            depsForComponent.add(depComponent);
+        }
+    }
+    const stableComponents = [...components.keys()].sort((a, b) => {
+        const aIndex = Math.min(...(components.get(a) ?? []).map((pkg) => orderIndex.get(pkg.name) ?? Number.MAX_SAFE_INTEGER));
+        const bIndex = Math.min(...(components.get(b) ?? []).map((pkg) => orderIndex.get(pkg.name) ?? Number.MAX_SAFE_INTEGER));
+        return aIndex - bIndex;
+    });
+    const visiting = new Set();
+    const emitted = new Set();
+    const output = [];
+    const visit = (component) => {
+        if (emitted.has(component))
+            return;
+        if (visiting.has(component))
+            return;
+        visiting.add(component);
+        const deps = [...(componentDeps.get(component) ?? [])].sort((a, b) => stableComponents.indexOf(a) - stableComponents.indexOf(b));
+        for (const dep of deps)
+            visit(dep);
+        visiting.delete(component);
+        emitted.add(component);
+        output.push(component);
+    };
+    for (const component of stableComponents)
+        visit(component);
+    return output;
+}
+function findStronglyConnectedComponents(names, edges) {
+    // The shared traversal primitive (`planDag`): the partition into strongly
+    // connected components, dependencies first. Callers pass names that are
+    // unique and edges that name only known packages (both filter first).
+    const componentByName = new Map();
+    planDag({ nodes: names.map((name) => ({ id: name, dependsOn: edges.get(name) ?? [] })) }).cohorts.forEach((cohort, component) => {
+        for (const name of cohort)
+            componentByName.set(name, component);
+    });
+    return componentByName;
+}
+/**
+ * An SCC exists only because source discovery added a back-edge. Declared
+ * dependency edges are the build contract and must still remain strict inside
+ * that SCC: a package's TypeScript build resolves its declared workspace deps
+ * through their dist exports. Ordering the SCC by the combined edge set lets a
+ * discovered back-edge arbitrarily move a declared prerequisite after its
+ * consumer (for example runtime after runtime-environment-cef).
+ */
+function sortComponentByDeclaredWorkspaceDependencies(members, dependenciesOf, orderIndex) {
+    const memberNames = new Set(members.map((pkg) => pkg.name));
+    const memberByName = new Map(members.map((pkg) => [pkg.name, pkg]));
+    const sortedMembers = [...members].sort((a, b) => (orderIndex.get(a.name) ?? 0) - (orderIndex.get(b.name) ?? 0));
+    const orderBy = (input, selectDependencies) => {
+        const emitted = new Set();
+        const visiting = new Set();
+        const output = [];
+        const visit = (pkg) => {
+            if (emitted.has(pkg.name))
+                return;
+            if (visiting.has(pkg.name))
+                return;
+            visiting.add(pkg.name);
+            for (const depName of selectDependencies(dependenciesOf(pkg))) {
+                if (!memberNames.has(depName))
+                    continue;
+                const dep = memberByName.get(depName);
+                if (dep)
+                    visit(dep);
+            }
+            visiting.delete(pkg.name);
+            emitted.add(pkg.name);
+            output.push(pkg);
+        };
+        for (const pkg of input)
+            visit(pkg);
+        return output;
+    };
+    // Keep as much source-discovered ordering as the SCC permits, then enforce
+    // the non-negotiable manifest contract over that deterministic preference.
+    const preferred = orderBy(sortedMembers, (edges) => edges.all);
+    const output = orderBy(preferred, (edges) => edges.declared);
+    const outputIndex = new Map(output.map((pkg, index) => [pkg.name, index]));
+    for (const pkg of output) {
+        for (const dependency of dependenciesOf(pkg).declared) {
+            if (!memberNames.has(dependency))
+                continue;
+            if ((outputIndex.get(dependency) ?? -1) >= (outputIndex.get(pkg.name) ?? -1)) {
+                throw new Error(`Workspace artifact build plan contains a declared dependency cycle: ${pkg.name} requires ${dependency}`);
+            }
+        }
+    }
+    return output;
+}
+export async function buildWorkspaceArtifactsForApp({ workspaceRoot, appDir, execution, runtime, onLine, dryRun = false, artifactLock }) {
+    if (dryRun) {
+        const plan = await planWorkspaceArtifactBuilds({ workspaceRoot, appDir, runtime });
+        onLine?.('stdout', `[workspace-artifacts] dry-run: planned ${plan.length} package artifact build(s); no builds executed`);
+        return;
+    }
+    return withWorkspaceArtifactLock({ runtime, workspaceRoot, onLine, artifactLock }, async () => {
+        const host = await resolveArtifactHost(runtime);
+        const plan = await planWorkspaceArtifactBuilds({ workspaceRoot, appDir, runtime });
+        const appLabel = host.paths.relative(workspaceRoot, appDir);
+        await syncMissingSvelteKitMetadataForWorkspace(host, workspaceRoot, appDir, execution, onLine);
+        const packages = await discoverWorkspacePackages(host, workspaceRoot);
+        await buildWorkspacePlanWithFreshnessSkip(host, workspaceRoot, plan, packages, execution, onLine);
+        if (plan.length > 0) {
+            onLine?.('stdout', `[workspace-artifacts] built ${plan.length} package artifact(s) for ${appLabel}`);
+        }
+    });
+}
+/**
+ * Builds exactly the package set supplied by its owner, dependency-ordering it
+ * from the selected packages' production source imports. Registry release
+ * planning still owns membership; this step neither expands nor guesses it.
+ */
+export async function buildWorkspaceArtifactsForPackages({ workspaceRoot, packageNames, packageScope, execution, runtime, onLine, artifactLock }) {
+    return withWorkspaceArtifactLock({ runtime, workspaceRoot, onLine, artifactLock }, async () => {
+        const host = await resolveArtifactHost(runtime);
+        const packages = await resolveWorkspacePackages(host, workspaceRoot, packageScope);
+        const packageByName = new Map(selectWorkspacePackagesByName(packages, packageNames).map((pkg) => [pkg.name, pkg]));
+        const plan = (await planWorkspacePackageBuildOrder(runtime, workspaceRoot, packageNames, packageScope))
+            .map((name) => packageByName.get(name))
+            .filter(hasBuildArtifacts);
+        if (plan.length === 0)
+            return;
+        onLine?.('stdout', `[workspace-artifacts] building ${plan.length} package(s) in dependency order`);
+        await buildWorkspacePlanWithFreshnessSkip(host, workspaceRoot, plan, packages, execution, onLine);
+        onLine?.('stdout', `[workspace-artifacts] built ${plan.length} release package artifact(s)`);
+    });
+}
+//# sourceMappingURL=build-workspace-artifacts.js.map