@vibesdotdev/infra-deploy 0.0.2 → 1.0.0-rc.4

package/dist/cli/npm/infra-npm-publish.cli-command.impl.js

@@ -1,383 +1,564 @@
-import { getVibesRuntime } from '@vibesdotdev/runtime';
-import { resolveCurrentEnvironmentConfig } from '@vibesdotdev/config/environment/current';
-import { spawnSync } from 'node:child_process';
-import { chmod, cp, mkdir, mkdtemp, readFile, readdir, rm, stat, writeFile } from 'node:fs/promises';
-import { tmpdir } from 'node:os';
-import { basename, dirname, isAbsolute, join, resolve } from 'node:path';
-function readString(value) {
-    return typeof value === 'string' && value.trim().length > 0 ? value.trim() : undefined;
-}
-function readBoolean(value) {
-    return value === true || value === 'true' || value === 'yes';
-}
-function normalizePaths(value) {
-    if (Array.isArray(value))
-        return value.filter((item) => typeof item === 'string');
-    if (typeof value === 'string' && value.length > 0)
-        return [value];
-    return [process.cwd()];
-}
-async function resolveSecretsEnvironment(environmentOverride) {
-    if (environmentOverride) {
-        const knownTiers = new Set(['local', 'dev', 'staging', 'production']);
-        if (knownTiers.has(environmentOverride)) {
-            return { name: environmentOverride, tier: environmentOverride };
+var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {
+    if (typeof path === "string" && /^\.\.?\//.test(path)) {
+        return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {
+            return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");
+        });
+    }
+    return path;
+};
+import { realpathChecked, resolveFileSystemAdapter } from "@vibesdotdev/filesystem";
+import { getRuntimePath } from "@vibesdotdev/paths";
+import { CapabilityError, requireRuntimeCwd, settle, valueFreeFailure, } from "@vibesdotdev/kernel";
+import {} from "@vibesdotdev/cli";
+import { resolveRuntimeExecution } from "../shared/runtime-execution.js";
+import { createPlatformRegistryClient } from "./publish/platform-registry.js";
+import { positiveInteger, readBoolean, readNumber, readString, resolveReleaseContractVersion, } from "./publish/command-options.js";
+import { resolveReleaseExternalRequirements, sealWorkspaceRegistryInputs, workspaceSelectorVersions, } from "./publish/external-requirements.js";
+import { resolveOnDiskPath } from "./publish/fs-paths.js";
+import { parsePublisherManifest } from "./publish/publisher-manifest.js";
+import { gateReleaseBuildOnLeasePreflight } from "./publish/lease-preflight.js";
+import { isNpmRateLimitError, NpmCommandError, npmOutput } from "./publish/npm-exec.js";
+import { buildReleaseConsumerSourceRegistry } from "./publish/proof-registry.js";
+import { assertRegistryReleaseOutputsRequested, inspectRegistryReleaseAvailability, registryReleaseReusedResults, } from "./publish/registry-availability.js";
+import { formatIgnoredRegistryWriteCredentials, formatVibesRegistryPublishAuthFailure, ignoredRegistryWriteCredentialKeys, normalizeRegistryUrl, publishTokenSetupHint, resolvePublishTokenKey, resolveRegistryReleaseReadCredential, resolveTokenFromSecrets, registryServiceOrigin, VIBES_REGISTRY_READ_TOKEN_KEY, } from "./publish/registry-credentials.js";
+import { assertRegistryReleaseWorkspacePreflight, buildRegistryReleaseWorkspaceArtifacts, ensureRaisedPublishFileDescriptorLimit, removeReleaseArtifactDir, } from "./publish/release-build.js";
+import { assertFollowedFrameworkExecutorIdentity, assertRegistryReleaseExecutorProvenance, RELEASE_EXECUTOR_PATH, } from "./publish/release-executor.js";
+import { verifyRegistryReleaseLock } from "./publish/release-lock.js";
+import { RC_MAJOR_EXCEPTION_NOTICE, rcMajorChangeViolation, rcMajorExceptionIneligibility, } from "./publish/rc-major-exception.js";
+import { runRegistryReleasePublish } from "./publish/release-phases.js";
+import { planRegistryReleaseTargets, } from "./publish/release-plan.js";
+import { applyAssignedReleaseVersions, formatRegistryReleaseVersionAssignments, RegistryPublishReceiptSchema, } from "@vibesdotdev/registry";
+import { projectManagedRegistryReleaseWorkspaceWire } from "./publish/release-workspace.js";
+import { createReleaseTempRoot, SENSITIVE_TEMP_ROOT_PREFIXES, } from "./publish/sensitive-temp.js";
+import { collectRegistryReleaseWorkspaceInventory, resolvePublishPackageDirs, resolvePublishWorkspaceRoot, resolveSealedFollowWorkspaceRoot, } from "./publish/workspace-discovery.js";
+/** Invocation path resolution, also used by `vibes registry publish`. */
+export { resolvePublishPackageDirs, resolvePublishWorkspaceRoot, } from "./publish/workspace-discovery.js";
+/**
+ * Re-enter the sealed framework checkout's own executor when this module is
+ * not it, so release work always runs the sealed source.
+ */
+export async function dispatchToRegistryReleaseExecutor(args, opts, workspaceRoot, context) {
+    const followRoot = await resolveSealedFollowWorkspaceRoot(context.runtime, workspaceRoot);
+    await assertFollowedFrameworkExecutorIdentity(followRoot, context.runtime);
+    const pathOwner = await getRuntimePath(context.runtime);
+    const hostFiles = await resolveFileSystemAdapter(context.runtime, { binding: false });
+    const expectedExecutorPath = await realpathChecked(hostFiles, pathOwner.join(followRoot, RELEASE_EXECUTOR_PATH));
+    const currentExecutorPath = await resolveOnDiskPath(context.runtime, pathOwner.fileURLToPath(import.meta.url));
+    if (currentExecutorPath !== expectedExecutorPath) {
+        const toFileURL = pathOwner.pathToFileURL;
+        if (toFileURL === undefined) {
+            throw new CapabilityError("The selected runtime path host cannot convert a filesystem path to a file URL.", "UNAVAILABLE", { reason: "runtime-path-file-url-unavailable", details: { path: expectedExecutorPath } });
         }
-        try {
-            const envConfig = await resolveCurrentEnvironmentConfig();
-            return { name: environmentOverride, tier: envConfig.tier ?? 'local' };
+        const loaded = await settle(() => import(__rewriteRelativeImportExtension(toFileURL(expectedExecutorPath).href)));
+        if (!loaded.ok) {
+            if (loaded.cause instanceof CapabilityError)
+                throw loaded.cause;
+            throw new CapabilityError("Sealed release executor could not be loaded.", "UNAVAILABLE", {
+                reason: "sealed-release-executor-unreadable",
+                cause: valueFreeFailure(loaded.cause),
+                details: { path: expectedExecutorPath },
+            });
         }
-        catch {
-            return { name: environmentOverride, tier: 'local' };
+        const receiver = loaded.value?.default;
+        const execute = receiver?.execute;
+        if (!(execute instanceof Function)) {
+            throw new CapabilityError("Sealed release executor is invalid.", "UNAVAILABLE", {
+                reason: "sealed-release-executor-invalid",
+                details: { path: expectedExecutorPath },
+            });
         }
+        return {
+            dispatched: true,
+            result: await receiver.execute(args, opts, context),
+        };
     }
-    try {
-        const envConfig = await resolveCurrentEnvironmentConfig();
-        return { name: envConfig.name, tier: envConfig.tier ?? 'local' };
-    }
-    catch {
-        return { name: 'local', tier: 'local' };
-    }
+    await assertRegistryReleaseExecutorProvenance({
+        runtime: context.runtime,
+        workspaceRoot: followRoot,
+        infraDeployModuleUrl: import.meta.url,
+        registryModuleUrl: import.meta.resolve("@vibesdotdev/registry"),
+    });
+    return { dispatched: false, workspaceRoot: followRoot };
 }
-async function resolveTokenFromSecrets(runtime, key, options) {
-    const envValue = process.env[key];
-    if (envValue && envValue.length > 0) {
-        return { value: envValue, source: 'process.env', environment: 'process', tier: 'process' };
-    }
-    const environment = await resolveSecretsEnvironment(options.environment);
-    if (!runtime.hasKind('secrets/store')) {
-        return { environment: environment.name, tier: environment.tier };
-    }
-    const descriptors = runtime.assets('secrets/store').descriptors()
-        .filter((descriptor) => {
-        if (options.backend)
-            return descriptor.id === options.backend;
-        if (descriptor.backend === 'encrypted-local')
-            return true;
-        if (!descriptor.tiers || descriptor.tiers.length === 0)
-            return true;
-        return descriptor.tiers.includes(environment.tier);
-    })
-        .sort((a, b) => (b.priority ?? 0) - (a.priority ?? 0));
-    for (const descriptor of descriptors) {
-        const store = (await runtime
-            .query('secrets/store')
-            .withId(descriptor.id)
-            .resolve());
-        const value = await store.get(environment.name, key);
-        if (value && value.length > 0) {
-            return {
-                value,
-                source: descriptor.id,
-                environment: environment.name,
-                tier: environment.tier
-            };
-        }
-    }
-    return { environment: environment.name, tier: environment.tier };
+/** Rethrow a planning/validation failure as the command's INVALID_INPUT. */
+export function invalidInput(cause) {
+    if (cause instanceof CapabilityError && !(cause instanceof NpmCommandError))
+        throw cause;
+    throw new CapabilityError(cause instanceof Error ? cause.message : "Publish input is invalid.", "INVALID_INPUT", { cause });
 }
-async function readPackageJson(packageDir) {
-    const raw = await readFile(join(packageDir, 'package.json'), 'utf8');
-    const parsed = JSON.parse(raw);
-    if (!parsed.name || !parsed.version) {
-        throw new Error(`${packageDir}/package.json must include name and version`);
-    }
-    return { ...parsed, name: parsed.name, version: parsed.version };
+/** An optional path flag, resolved against the invocation cwd. */
+async function resolveOptionalPath(runtime, value, cwd) {
+    const path = readString(value);
+    if (!path)
+        return undefined;
+    const pathOwner = await getRuntimePath(runtime);
+    return pathOwner.resolve(cwd, path);
 }
-async function pathExists(path) {
-    try {
-        await stat(path);
-        return true;
-    }
-    catch {
-        return false;
-    }
+/** Map a publish-phase failure to the command error, with partial results. */
+export function publishFailure(cause, results) {
+    if (cause instanceof CapabilityError && !(cause instanceof NpmCommandError))
+        return cause;
+    const message = npmOutput(cause).trim();
+    const rateLimited = isNpmRateLimitError(cause);
+    const authHint = formatVibesRegistryPublishAuthFailure(message);
+    const rateLimitAdvice = "npm returned E429. Stop retrying in a loop; rerun this command later and already-published versions will be skipped.";
+    return new CapabilityError(message, rateLimited ? "RATE_LIMITED" : "INTERNAL", {
+        cause,
+        ...(rateLimited
+            ? { recoveryHint: rateLimitAdvice }
+            : authHint
+                ? { recoveryHint: authHint }
+                : {}),
+        details: { rateLimited, results },
+    });
 }
-async function findWorkspaceRoot(startDir) {
-    let current = resolve(startDir);
-    while (true) {
-        const packagePath = join(current, 'package.json');
-        if (await pathExists(packagePath)) {
-            try {
-                const parsed = JSON.parse(await readFile(packagePath, 'utf8'));
-                if (parsed.workspaces)
-                    return current;
-            }
-            catch {
-                // Keep walking; malformed package.json will be reported elsewhere.
-            }
+/**
+ * Announce and publish while the ephemeral artifact directory is still owned.
+ * A refusal from the announcement or the publish removes that directory.
+ */
+export async function publishInsideArtifactCleanup(options) {
+    const publishRun = await settle(async () => {
+        options.announce();
+        return await options.publish();
+    });
+    const cleanup = await settle(options.cleanup);
+    if (!publishRun.ok) {
+        const primary = options.fail(publishRun.cause);
+        if (!cleanup.ok) {
+            throw new AggregateError([primary, cleanup.cause], "Publish failed and release artifact cleanup also failed.", { cause: primary });
         }
-        const parent = dirname(current);
-        if (parent === current)
-            return resolve(startDir);
-        current = parent;
+        throw primary;
     }
+    if (!cleanup.ok)
+        throw cleanup.cause;
+    return publishRun.value;
 }
-async function collectWorkspaceVersions(workspaceRoot) {
-    const versions = new Map();
-    const roots = ['packages', 'libraries', 'apps'].map((entry) => join(workspaceRoot, entry));
-    async function walk(dir) {
-        let entries;
-        try {
-            entries = await readdir(dir, { withFileTypes: true });
+export default {
+    async execute(args, opts, context) {
+        const { runtime } = context;
+        await ensureRaisedPublishFileDescriptorLimit(runtime);
+        const cwd = requireRuntimeCwd(runtime);
+        const packageDirs = await resolvePublishPackageDirs(runtime, args.paths, cwd);
+        const pathWorkspaceRoot = await resolvePublishWorkspaceRoot(runtime, packageDirs, await runtime.context("runtime/workspace-path"));
+        const releaseWorkspaceManifest = readString(opts.releaseWorkspaceManifest);
+        const releaseExecutor = releaseWorkspaceManifest
+            ? await dispatchToRegistryReleaseExecutor(args, opts, pathWorkspaceRoot, context)
+            : undefined;
+        if (releaseExecutor?.dispatched)
+            return releaseExecutor.result;
+        const ui = await runtime.context("cli/ui");
+        const execution = await resolveRuntimeExecution(runtime);
+        // Every Platform Registry call this run makes (session, grants, leases)
+        // uses this runtime's credential and environment.
+        const platformRegistry = createPlatformRegistryClient(runtime);
+        const output = readString(opts.output) ?? "text";
+        const quiet = output === "json";
+        const dryRun = readBoolean(opts.dryRun);
+        const yes = readBoolean(opts.yes);
+        const workspaceRoot = releaseExecutor?.workspaceRoot ?? pathWorkspaceRoot;
+        const { workspace, releaseWorkspacePaths } = await collectRegistryReleaseWorkspaceInventory({
+            runtime,
+            workspaceRoot,
+            releaseWorkspaceManifest,
+        });
+        const workspacePackageScope = new Map([...workspace].map(([name, pkg]) => [
+            name,
+            { name, dir: pkg.directory, packageJson: parsePublisherManifest(pkg.manifest) },
+        ]));
+        const planned = await settle(() => planRegistryReleaseTargets({
+            packageDirs,
+            explicitScope: readString(opts.scope),
+            workspaceRoot,
+            workspace,
+            workspacePackageScope,
+            registryOverride: readString(opts.registry),
+            execution,
+            runtime,
+            forgeApiClient: () => runtime
+                .query("forge/api-client")
+                .withId("forge-api-client")
+                .resolve(),
+        }));
+        if (!planned.ok)
+            invalidInput(planned.cause);
+        const targets = planned.value;
+        const { scope, releasePlan, buildPackageOrder, buildPackages, artifactTargets, workspaceInputRegistryTargets, workspaceInputPackages, lockSourceIdentity, } = targets;
+        let { publishTargets } = targets;
+        const registryOrigin = await registryServiceOrigin(runtime);
+        const resolvedTokenKey = await settle(() => Promise.resolve(resolvePublishTokenKey({
+            registryOrigin,
+            registries: publishTargets.map((target) => target.registry),
+            explicitTokenKey: readString(opts.tokenKey),
+            dryRun,
+        })));
+        if (!resolvedTokenKey.ok)
+            invalidInput(resolvedTokenKey.cause);
+        const tokenKey = resolvedTokenKey.value;
+        const versions = new Map([...workspace].map(([name, pkg]) => [name, pkg.manifest.version]));
+        // Publish-body provenance + freshness: a stale compiled staging module or a
+        // stale package dist must refuse loudly, never publish old semantics
+        // (deploy-preflight parity; the materialized-bundle staleness class).
+        ui.info(`[publish-preflight] module=${import.meta.url}`);
+        {
+            const preflight = await assertRegistryReleaseWorkspacePreflight({
+                workspaceRoot,
+                runtime,
+                releasePlan,
+                workspacePackageScope,
+                artifactPolicy: "planned-build",
+            });
+            for (const warning of preflight.warnings)
+                ui.warn(`[publish-preflight] ${warning}`);
         }
-        catch {
-            return;
+        const sourceTargets = [...artifactTargets, ...workspaceInputRegistryTargets];
+        const releaseRegistries = sourceTargets.map((target) => target.registry);
+        const hostEnvironment = runtime.getEnvSnapshot();
+        const ignoredWriteKeys = ignoredRegistryWriteCredentialKeys(hostEnvironment);
+        if (ignoredWriteKeys.length > 0 &&
+            releaseRegistries.some((registry) => normalizeRegistryUrl(registry) === registryOrigin)) {
+            ui.warn(formatIgnoredRegistryWriteCredentials(ignoredWriteKeys));
         }
-        const packagePath = join(dir, 'package.json');
-        if (await pathExists(packagePath)) {
-            try {
-                const parsed = JSON.parse(await readFile(packagePath, 'utf8'));
-                if (parsed.name && parsed.version)
-                    versions.set(parsed.name, parsed.version);
-            }
-            catch {
-                // Ignore here; the package being published is parsed separately.
-            }
-            return;
+        // The read token is a credential (D3): the runtime resolves it, the host
+        // environment is never a source. Absent is a normal state — the chain
+        // below falls through to the named store and the signed session.
+        const runtimeReadCredential = await runtime.resolveCredential({
+            source: "secret",
+            key: VIBES_REGISTRY_READ_TOKEN_KEY,
+        });
+        const readCredential = await resolveRegistryReleaseReadCredential({
+            runtime,
+            registries: releaseRegistries,
+            explicitTokenKey: readString(opts.tokenKey),
+            registryJwt: runtimeReadCredential.ok
+                ? runtimeReadCredential.value
+                : undefined,
+            resolveSessionJwt: () => platformRegistry.sessionJwt(),
+            resolveFreshSessionJwt: () => platformRegistry.freshSessionJwt(),
+            resolveNamedToken: (key) => resolveTokenFromSecrets(runtime, key, {
+                environment: readString(opts.environment),
+                backend: readString(opts.backend),
+            }),
+        });
+        const readResolution = readCredential.resolution;
+        if (readResolution?.source) {
+            ui.info(`[publish-preflight] registry read credential source=${readResolution.source}`);
         }
-        for (const entry of entries) {
-            if (!entry.isDirectory())
-                continue;
-            if (entry.name === 'node_modules' || entry.name === '.git' || entry.name === 'dist')
-                continue;
-            await walk(join(dir, entry.name));
+        const externalRequirementResolutions = await resolveReleaseExternalRequirements({
+            releasePlan,
+            sourceTargets,
+            workspaceRoot,
+            scope,
+            readToken: readResolution?.value,
+            execution,
+            runtime,
+        });
+        if (releasePlan.externalRequirements.length > 0) {
+            ui.info(`[publish-preflight] ${releasePlan.externalRequirements.length} external requirement(s) satisfiable`);
         }
-    }
-    for (const root of roots)
-        await walk(root);
-    return versions;
-}
-function rewriteWorkspaceDependencyVersions(pkg, versions) {
-    const fields = ['dependencies', 'peerDependencies', 'optionalDependencies'];
-    const next = { ...pkg };
-    for (const field of fields) {
-        const deps = next[field];
-        if (!deps)
-            continue;
-        next[field] = { ...deps };
-        for (const [name, range] of Object.entries(deps)) {
-            if (!range.startsWith('workspace:'))
-                continue;
-            const version = versions.get(name);
-            if (!version) {
-                throw new Error(`Cannot rewrite ${name}@${range}; workspace package version not found`);
+        const publishDelayMs = dryRun
+            ? 0
+            : positiveInteger(readNumber(opts.publishDelayMs, 0), 0);
+        const rateLimitRetries = dryRun
+            ? 0
+            : positiveInteger(readNumber(opts.rateLimitRetries, 0), 0);
+        const rateLimitDelayMs = dryRun
+            ? 0
+            : positiveInteger(readNumber(opts.rateLimitDelayMs, 3600000), 3600000);
+        const authorityVerify = readBoolean(opts.authorityVerify);
+        const releaseContractVersion = await resolveReleaseContractVersion({
+            flagValue: opts.releaseContractVersion,
+            workspaceRoot,
+            runtime,
+        });
+        const artifactDir = await resolveOptionalPath(runtime, opts.packDestination, cwd);
+        const consumerPath = await resolveOptionalPath(runtime, opts.consumer, cwd);
+        const rcMajorException = readBoolean(opts.rcMajorException);
+        if (rcMajorException) {
+            const ineligible = rcMajorExceptionIneligibility({
+                tag: readString(opts.tag),
+                versions: publishTargets,
+            });
+            if (ineligible)
+                invalidInput(new Error(ineligible));
+            ui.warn(`[publish-preflight] ${RC_MAJOR_EXCEPTION_NOTICE}`);
+        }
+        ui.info(`[publish-preflight] Verifying committed source for ${buildPackages.length} build package(s) across ${new Set(buildPackages.map((pkg) => pkg.sourceRoot)).size} repository owner(s)`);
+        const verifiedLock = await settle(() => verifyRegistryReleaseLock({
+            workspaceRoot,
+            buildPackages,
+            buildPackageOrder,
+            lockSource: lockSourceIdentity,
+            releaseWorkspacePaths,
+            execution,
+            runtime,
+            rcMajorException,
+        }));
+        if (!verifiedLock.ok)
+            invalidInput(verifiedLock.cause);
+        const { expectedGitHeads, sealReleaseWorkspace } = verifiedLock.value;
+        const ephemeralArtifactDir = artifactDir
+            ? undefined
+            : await createReleaseTempRoot(runtime, workspaceRoot, SENSITIVE_TEMP_ROOT_PREFIXES.artifacts);
+        const sealArtifactDir = artifactDir ?? ephemeralArtifactDir;
+        const readTokenKey = readCredential.tokenKey;
+        const readTokenResolution = readCredential.resolution;
+        const releaseSourceRegistry = buildReleaseConsumerSourceRegistry({
+            targets: sourceTargets,
+            readToken: readTokenResolution?.value,
+            renewReadToken: readCredential.refreshSessionJwt,
+        });
+        ui.info(`[publish-preflight] Sealing ${externalRequirementResolutions.filter((entry) => entry.requirement.source === 'workspace').length} workspace Registry input(s) against their published artifacts`);
+        const sealedWorkspaceInputs = await sealWorkspaceRegistryInputs({
+            resolutions: externalRequirementResolutions,
+            // Inputs outside the build closure seal by their source record, alongside the built packages.
+            buildPackages: [...buildPackages, ...workspaceInputPackages],
+            expectedGitHeads,
+            sourceRegistry: releaseSourceRegistry,
+            artifactDir: sealArtifactDir,
+            workspaceRoot,
+            scope,
+            readCredential,
+            execution,
+            runtime,
+        });
+        const publishedVersions = new Map();
+        ui.info(`[publish-preflight] Comparing ${artifactTargets.length} release output(s) with published Registry versions`);
+        const availabilityPlan = await inspectRegistryReleaseAvailability({
+            targets: artifactTargets,
+            expectedGitHeads,
+            versioning: "assign",
+            artifactDir: sealArtifactDir,
+            workspaceRoot,
+            scope,
+            readCredential,
+            execution,
+            runtime,
+            onPublishedVersions: (name, listed) => {
+                publishedVersions.set(name, listed);
+                ui.info(`[publish-preflight] ${name}: inspected ${listed.length} published version(s)`);
+            },
+        });
+        if (rcMajorException) {
+            const violations = publishTargets.flatMap((target) => {
+                const version = availabilityPlan.assignments.get(target.name)?.version ?? target.version;
+                const published = publishedVersions.get(target.name);
+                if (!published)
+                    return [`${target.name}@${version}: published versions were not listed`];
+                const violation = rcMajorChangeViolation({
+                    name: target.name,
+                    version,
+                    published,
+                });
+                return violation ? [violation] : [];
+            });
+            if (violations.length > 0)
+                invalidInput(new Error(`The RC major exception does not apply:\n${violations.map((line) => `- ${line}`).join("\n")}`));
+        }
+        // From here on every release output carries its assigned version: the
+        // staged manifests, dependents' workspace selectors, the sealed release
+        // workspace, the installed release proof and the receipts.
+        const sealed = await settle(async () => {
+            assertRegistryReleaseOutputsRequested({
+                availabilityPlan,
+                requested: publishTargets,
+            });
+            const assignedReleasePlan = applyAssignedReleaseVersions(releasePlan, availabilityPlan.assignments);
+            const withAssignedVersion = (entry) => ({
+                ...entry,
+                version: availabilityPlan.assignments.get(entry.name)?.version ?? entry.version,
+            });
+            const assignedPublishTargets = publishTargets.map(withAssignedVersion);
+            for (const [name, version] of workspaceSelectorVersions({
+                sourceVersions: versions,
+                sealedWorkspaceInputs,
+                assignments: availabilityPlan.assignments,
+            }))
+                versions.set(name, version);
+            ui.info(`[publish-preflight] Sealing committed manifest and lock identities for ${buildPackages.length} build package(s)`);
+            const releaseWorkspace = await sealReleaseWorkspace({
+                buildPackages: buildPackages.map(withAssignedVersion),
+                packages: assignedPublishTargets,
+            });
+            return { assignedReleasePlan, assignedPublishTargets, releaseWorkspace };
+        });
+        if (!sealed.ok) {
+            const cleanup = await settle(() => removeReleaseArtifactDir(runtime, ephemeralArtifactDir));
+            if (!cleanup.ok) {
+                throw new AggregateError([sealed.cause, cleanup.cause], "Release sealing failed and release artifact cleanup also failed.", { cause: sealed.cause });
             }
-            next[field][name] = version;
+            invalidInput(sealed.cause);
         }
-    }
-    delete next.devDependencies;
-    return next;
-}
-async function stagePackageForPublish(options) {
-    await cp(options.packageDir, options.stageDir, {
-        recursive: true,
-        filter: (source) => {
-            const name = basename(source);
-            return ![
-                'node_modules',
-                '.git',
-                '.turbo',
-                '.svelte-kit'
-            ].includes(name) && !name.endsWith('.tgz');
+        const assignedReleasePlan = sealed.value.assignedReleasePlan;
+        publishTargets = sealed.value.assignedPublishTargets;
+        const releaseWorkspace = sealed.value.releaseWorkspace;
+        if (!quiet) {
+            for (const line of formatRegistryReleaseVersionAssignments(availabilityPlan.assignments.values()))
+                ui.info(`[publish-plan] ${line}`);
         }
-    });
-    const packagePath = join(options.stageDir, 'package.json');
-    const pkg = JSON.parse(await readFile(packagePath, 'utf8'));
-    const rewritten = rewriteWorkspaceDependencyVersions(pkg, options.versions);
-    await writeFile(packagePath, `${JSON.stringify(rewritten, null, 2)}\n`);
-}
-function npmBin() {
-    return process.platform === 'win32' ? 'npm.cmd' : 'npm';
-}
-function runNpm(args, options) {
-    const child = spawnSync(npmBin(), args, {
-        cwd: options.cwd,
-        stdio: 'inherit',
-        env: options.env ?? process.env
-    });
-    if (child.error)
-        throw child.error;
-    if (child.status !== 0) {
-        throw new Error(`npm ${args.join(' ')} failed with exit ${child.status ?? 'unknown'}`);
-    }
-}
-async function newestTarball(dir) {
-    const entries = await readdir(dir);
-    const tarballs = entries.filter((entry) => entry.endsWith('.tgz')).sort();
-    if (tarballs.length !== 1) {
-        throw new Error(`Expected one packed tarball in ${dir}, found ${tarballs.length}`);
-    }
-    return join(dir, tarballs[0]);
-}
-function authConfigLine(registry) {
-    const url = new URL(registry);
-    const path = url.pathname.endsWith('/') ? url.pathname : `${url.pathname}/`;
-    return `//${url.host}${path}:_authToken`;
-}
-function sanitizeNpmEnv(extra) {
-    const env = { ...process.env };
-    delete env.NPM_TOKEN;
-    delete env.NODE_AUTH_TOKEN;
-    delete env.NPM_CONFIG_USERCONFIG;
-    delete env.NPM_CONFIG_REGISTRY;
-    for (const [key, value] of Object.entries(extra))
-        env[key] = value;
-    return env;
-}
-async function writeTempNpmrc(options) {
-    const lines = [
-        `registry=${options.registry}`,
-        options.scope ? `${options.scope}:registry=${options.registry}` : undefined,
-        options.token ? `${authConfigLine(options.registry)}=${options.token}` : undefined
-    ].filter((line) => Boolean(line));
-    await writeFile(options.path, `${lines.join('\n')}\n`, { mode: 0o600 });
-    await chmod(options.path, 0o600);
-}
-function publishArgs(options) {
-    const args = ['publish', options.tarball, '--registry', options.registry];
-    if (options.access)
-        args.push('--access', options.access);
-    if (options.tag)
-        args.push('--tag', options.tag);
-    if (options.otp)
-        args.push('--otp', options.otp);
-    if (options.provenance)
-        args.push('--provenance');
-    if (options.dryRun)
-        args.push('--dry-run');
-    return args;
-}
-async function publishPackage(options) {
-    const packageDir = isAbsolute(options.packageDir)
-        ? options.packageDir
-        : resolve(process.cwd(), options.packageDir);
-    const pkg = await readPackageJson(packageDir);
-    const registry = options.registry || pkg.publishConfig?.registry || 'https://registry.npmjs.org';
-    const access = options.access ?? pkg.publishConfig?.access;
-    const tag = options.tag ?? pkg.publishConfig?.tag;
-    const tempRoot = await mkdtemp(join(tmpdir(), 'vibes-npm-publish-'));
-    const packDir = join(tempRoot, 'pack');
-    const stageDir = join(tempRoot, 'stage');
-    const npmrcPath = join(tempRoot, 'npmrc');
-    const homeDir = join(tempRoot, 'home');
-    try {
-        await mkdir(packDir, { recursive: true });
-        await mkdir(homeDir, { recursive: true });
-        await stagePackageForPublish({ packageDir, stageDir, versions: options.versions });
-        await writeTempNpmrc({
-            path: npmrcPath,
-            registry,
-            scope: options.scope,
-            token: options.token
+        const reusedResults = registryReleaseReusedResults({
+            availabilityPlan,
+            requested: publishTargets,
+            dryRun,
         });
-        options.ui.info(`Packing ${pkg.name}@${pkg.version} from ${packageDir}`);
-        runNpm(['pack', '--ignore-scripts', '--pack-destination', packDir], { cwd: stageDir });
-        const tarball = await newestTarball(packDir);
-        const env = sanitizeNpmEnv({
-            NPM_CONFIG_USERCONFIG: npmrcPath,
-            HOME: homeDir,
-            USERPROFILE: homeDir
+        if (reusedResults) {
+            // Every target is already published as-is: nothing to build, pack, prove or publish.
+            await removeReleaseArtifactDir(runtime, ephemeralArtifactDir);
+            const receipt = RegistryPublishReceiptSchema.parse({
+                ok: true,
+                dryRun,
+                releasePlan: assignedReleasePlan,
+                versions: [...availabilityPlan.assignments.values()],
+                results: reusedResults,
+            });
+            if (output === "json") {
+                if (opts.suppressOutput !== true)
+                    ui.json(receipt);
+                return receipt;
+            }
+            if (opts.suppressOutput !== true)
+                ui.success(`Published 0 npm package(s); skipped ${reusedResults.length} already-published package(s).`);
+            return receipt;
+        }
+        const releaseWorkspaceWire = projectManagedRegistryReleaseWorkspaceWire(releaseWorkspace, releaseContractVersion, { configPath: (await getRuntimePath(runtime)).join(workspaceRoot, "package.json") });
+        // The lease is requested only after the whole build, pack and consumer
+        // proof; ask whether each one would be granted before spending that.
+        ui.info(`[publish-preflight] Checking Platform publish authority for ${publishTargets.map((target) => `${target.name}@${target.version}`).join(', ')}`);
+        const { viaLease } = await gateReleaseBuildOnLeasePreflight({
+            runtime,
+            platformRegistry,
+            tokenKey: readString(opts.tokenKey),
+            dryRun,
+            yes,
+            publishTargets,
+            availabilityPlan,
+            expectedGitHeads,
+            releaseWorkspace: releaseWorkspaceWire,
+            report: {
+                warn: (line) => ui.warn(`[publish-preflight] ${line}`),
+                info: (line) => {
+                    if (!quiet)
+                        ui.info(`[publish-preflight] ${line}`);
+                },
+            },
+            onFailure: () => removeReleaseArtifactDir(runtime, ephemeralArtifactDir),
         });
-        const args = publishArgs({
-            tarball,
-            registry,
-            access,
-            tag,
-            otp: options.otp,
-            provenance: options.provenance,
-            dryRun: options.dryRun
+        await buildRegistryReleaseWorkspaceArtifacts({
+            workspaceRoot,
+            releasePlan,
+            workspacePackageScope,
+            execution,
+            runtime,
+            onLine: quiet ? undefined : (_stream, line) => ui.log(line),
         });
-        options.ui.info(`${options.dryRun ? 'Dry-running publish' : 'Publishing'} ${pkg.name}@${pkg.version} to ${registry}`);
-        runNpm(args, { cwd: tempRoot, env });
-        return {
-            name: pkg.name,
-            version: pkg.version,
-            packageDir,
-            tarball: basename(tarball),
-            dryRun: options.dryRun,
-            ok: true
-        };
-    }
-    finally {
-        await rm(tempRoot, { recursive: true, force: true });
-    }
-}
-export default {
-    async execute(args, opts) {
-        const runtime = getVibesRuntime();
-        const ui = (await runtime.context('cli/ui'));
-        const output = readString(opts.output) ?? 'text';
-        const dryRun = readBoolean(opts.dryRun);
-        const yes = readBoolean(opts.yes);
-        const tokenKey = readString(opts.tokenKey) ?? 'NPM_TOKEN';
-        const registry = readString(opts.registry) ?? 'https://registry.npmjs.org';
-        const scope = readString(opts.scope);
-        const packagePaths = normalizePaths(args.paths);
-        const workspaceRoot = await findWorkspaceRoot(process.cwd());
-        const versions = await collectWorkspaceVersions(workspaceRoot);
-        if (!dryRun && !yes) {
-            ui.error('Refusing to publish without --yes. Use --dry-run to test without publishing.');
-            process.exitCode = 1;
-            return;
+        {
+            const preflight = await assertRegistryReleaseWorkspacePreflight({
+                workspaceRoot,
+                runtime,
+                releasePlan,
+                workspacePackageScope,
+                artifactPolicy: "strict",
+            });
+            for (const warning of preflight.warnings)
+                ui.warn(`[publish-preflight] ${warning}`);
         }
-        let token;
-        let tokenSource;
-        let tokenEnvironment = 'local';
-        let tokenTier = 'local';
-        if (!dryRun) {
-            const resolved = await resolveTokenFromSecrets(runtime, tokenKey, {
-                environment: readString(opts.environment),
-                backend: readString(opts.backend)
+        const managedLease = !dryRun && viaLease;
+        if (!dryRun && !yes) {
+            throw new CapabilityError("Refusing to publish without --yes.", "INVALID_INPUT", {
+                recoveryHint: "Use --dry-run to test without publishing, or pass --yes to publish.",
             });
-            token = resolved.value;
-            tokenSource = resolved.source;
-            tokenEnvironment = resolved.environment;
-            tokenTier = resolved.tier;
-            if (!token) {
-                ui.error(`Missing ${tokenKey}. Store it with \`vibes secrets set ${tokenKey} --environment ${tokenEnvironment}\` and rerun.`);
-                ui.info('Create a publish token at https://www.npmjs.com/settings/tokens');
-                process.exitCode = 1;
-                return;
+        }
+        let tokenSecret;
+        if (!dryRun && !managedLease) {
+            const resolved = readTokenKey === tokenKey && readTokenResolution
+                ? readTokenResolution
+                : await resolveTokenFromSecrets(runtime, tokenKey, {
+                    environment: readString(opts.environment),
+                    backend: readString(opts.backend),
+                });
+            const backend = readString(opts.backend);
+            tokenSecret = {
+                key: tokenKey,
+                environment: resolved.environment,
+            };
+            if (backend)
+                tokenSecret.backend = backend;
+            if (!resolved.value) {
+                throw new CapabilityError(`Missing ${tokenKey}.`, "AUTH_REQUIRED", {
+                    recoveryHint: `Store it with \`vibes secrets set ${tokenKey} --environment ${resolved.environment}\` and rerun. ` +
+                        publishTokenSetupHint(tokenKey, publishTargets.map((target) => target.registry), registryOrigin),
+                });
             }
-            ui.info(`Resolved ${tokenKey} from ${tokenSource} (${tokenEnvironment}/${tokenTier}).`);
+            if (!quiet)
+                ui.info(`Resolved ${tokenKey} from ${resolved.source} (${resolved.environment}/${resolved.tier}).`);
         }
-        const results = [];
-        try {
-            for (const packagePath of packagePaths) {
-                results.push(await publishPackage({
-                    packageDir: packagePath,
-                    registry,
+        let results = [];
+        const outcome = await publishInsideArtifactCleanup({
+            announce: () => {
+                if (!dryRun && !quiet)
+                    ui.info(`Preflighting ${publishTargets.length} release artifact(s) before publishing.`);
+            },
+            publish: () => runRegistryReleasePublish({
+                platformRegistry,
+                publishTargets,
+                buildPackages,
+                availabilityPlan,
+                expectedGitHeads,
+                versions,
+                releasePlan: assignedReleasePlan,
+                releaseWorkspace: releaseWorkspaceWire,
+                workspaceRoot,
+                workspace,
+                sourceRegistry: releaseSourceRegistry,
+                sealedWorkspaceInputs,
+                sealArtifactDir,
+                consumerPath,
+                settings: {
                     scope,
-                    access: readString(opts.access),
                     tag: readString(opts.tag),
                     otp: readString(opts.otp),
                     provenance: readBoolean(opts.provenance),
-                    dryRun,
-                    token,
-                    ui,
-                    versions
-                }));
-            }
-        }
-        catch (error) {
-            const message = error instanceof Error ? error.message : String(error);
-            if (output === 'json') {
-                ui.json({ ok: false, error: message, results });
-            }
-            else {
-                ui.error(message);
-            }
-            process.exitCode = 1;
-            return;
-        }
-        if (output === 'json') {
-            ui.json({ ok: true, dryRun, results });
-            return;
+                    tokenSecret,
+                    rateLimitRetries,
+                    rateLimitDelayMs,
+                    managedLease,
+                    authorityVerify,
+                    artifactDir,
+                    publishDelayMs,
+                },
+                dryRun,
+                quiet,
+                ui,
+                execution,
+                runtime,
+                rcMajorException,
+                onProgress: (published) => {
+                    results = [...published];
+                },
+            }),
+            cleanup: () => removeReleaseArtifactDir(runtime, ephemeralArtifactDir),
+            fail: (cause) => publishFailure(cause, results),
+        });
+        const receipt = RegistryPublishReceiptSchema.parse({
+            ok: true,
+            dryRun,
+            releasePlan: assignedReleasePlan,
+            versions: [...availabilityPlan.assignments.values()],
+            consumerProof: outcome.consumerProof,
+            consumerSmoke: outcome.consumerSmoke,
+            results: outcome.results,
+        });
+        if (output === "json") {
+            if (opts.suppressOutput !== true)
+                ui.json(receipt);
+            return receipt;
         }
-        ui.success(dryRun
-            ? `npm publish dry-run completed for ${results.length} package(s).`
-            : `Published ${results.length} npm package(s).`);
-    }
+        const skipped = outcome.results.filter((result) => result.skipped).length;
+        const published = outcome.results.length - skipped;
+        if (opts.suppressOutput !== true)
+            ui.success(dryRun
+                ? `npm publish dry-run completed for ${outcome.results.length} package(s).`
+                : `Published ${published} npm package(s); skipped ${skipped} already-published package(s).`);
+        return receipt;
+    },
 };
 //# sourceMappingURL=infra-npm-publish.cli-command.impl.js.map