@vibesdotdev/infra-deploy 0.0.2 → 1.0.0-rc.4

package/dist/cli/npm/publish/external-requirements.js

@@ -0,0 +1,365 @@
+import { resolveFileSystemAdapter } from "@vibesdotdev/filesystem";
+import { getRuntimePath } from "@vibesdotdev/paths";
+import { z } from "zod/v4";
+import { isCanonicalNpmPackageName, } from "@vibesdotdev/registry";
+import { rcompare, satisfies, valid, validRange } from "semver";
+import { mapWithConcurrencyUntilFirstFailure } from "./concurrency.js";
+import { isolatedNpmPackEnv, runNpm, versionSpec, writeTempNpmrc, } from "./npm-exec.js";
+import { buildReleaseConsumerSourceRegistry, readProofArtifactManifest, registryForProofPackage, } from "./proof-registry.js";
+import { inspectRegistryReleaseAvailability, REGISTRY_AVAILABILITY_CONCURRENCY, } from "./registry-availability.js";
+import { npmListPublishedVersions } from "./registry-reads.js";
+import { normalizeRegistryUrl, registryServiceOrigin, } from "./registry-credentials.js";
+import { cleanupSensitiveTempRoot, createReleaseTempRoot, SENSITIVE_TEMP_ROOT_PREFIXES, } from "./sensitive-temp.js";
+import { parseWorkspaceRootManifest, } from "./publisher-manifest.js";
+/**
+ * Throw unless an installed/fetched package is the requirement's package and satisfies its selector.
+ */
+export function assertExternalPackageSelector(options) {
+    const reference = registryExternalReference(options);
+    if (options.resolvedName !== reference.packageName ||
+        !npmRegistryVersionSatisfiesSelector(options.resolvedVersion, reference.selector)) {
+        throw new Error(`Offline release proof selector conflict: ${options.from} -> ${options.name}@${options.selector} resolved to ${options.resolvedName ?? "unknown"}@${options.resolvedVersion}`);
+    }
+}
+/** npm's selector semantics, including `*` accepting any valid version. */
+export function npmRegistryVersionSatisfiesSelector(version, selector) {
+    return (satisfies(version, selector) ||
+        (selector.trim() === "*" && valid(version) !== null));
+}
+/**
+ * Parse a requirement's selector (range or `npm:` alias) into the package it fetches.
+ */
+export function registryExternalReference(options) {
+    if (!isCanonicalNpmPackageName(options.name)) {
+        throw new Error(`Offline release proof requires a canonical npm package name: ${options.from} -> ${options.name}@${options.selector}`);
+    }
+    if (options.selector.trim() && validRange(options.selector)) {
+        return {
+            packageName: options.name,
+            selector: options.selector,
+            dependencySelector: options.selector,
+        };
+    }
+    if (options.selector.startsWith("npm:")) {
+        const targetSpec = options.selector.slice("npm:".length);
+        const slash = targetSpec.startsWith("@") ? targetSpec.indexOf("/") : -1;
+        const separator = targetSpec.startsWith("@")
+            ? slash >= 0
+                ? targetSpec.indexOf("@", slash + 1)
+                : -1
+            : targetSpec.lastIndexOf("@");
+        const packageName = separator > 0 ? targetSpec.slice(0, separator) : "";
+        const selector = separator > 0 ? targetSpec.slice(separator + 1) : "";
+        if (isCanonicalNpmPackageName(packageName) &&
+            selector.trim() &&
+            validRange(selector)) {
+            return {
+                packageName,
+                selector,
+                dependencySelector: options.selector,
+            };
+        }
+    }
+    throw new Error(`Offline release proof requires a semver Registry selector or npm alias: ${options.from} -> ${options.name}@${options.selector}`);
+}
+/**
+ * Throw unless the requirement has a canonical name and a supported selector.
+ */
+export function assertRegistryExternalSelector(options) {
+    registryExternalReference(options);
+}
+/** `npm pack` one external requirement into `downloadDir` from `registry`. */
+export async function runRegistryExternalPack(options, runner = runNpm) {
+    const reference = registryExternalReference(options);
+    const args = [
+        "pack",
+        versionSpec(reference.packageName, reference.selector),
+        "--json",
+        "--ignore-scripts",
+        "--pack-destination",
+        options.downloadDir,
+        "--registry",
+        options.registry,
+    ];
+    return {
+        args,
+        result: await runner(options.execution, args, {
+            runtime: options.runtime,
+            cwd: options.proofRoot,
+            env: options.env,
+            quiet: true,
+            allowFailure: true,
+            redactValues: options.redactValues,
+        }),
+    };
+}
+/**
+ * Every planned external requirement must be satisfiable by the registry
+ * BEFORE anything packs or publishes: a release that records unsatisfiable
+ * externals ships uninstallable-in-isolation packages. The planner is pure,
+ * so this is the publish flow's own gate (previously externals were only
+ * exercised inside the full offline consumer proof).
+ */
+export async function assertExternalRequirementsSatisfiable(options) {
+    const misses = [];
+    const seen = new Map();
+    const resolutions = [];
+    for (const requirement of options.requirements) {
+        const effective = effectiveExternalSelector(options.rootOverrides, requirement.name, requirement.selector);
+        // An npm alias (`npm:<target>@<range>`) is judged against its target
+        // package's published versions and range, never the alias name.
+        const reference = registryExternalReference({
+            from: requirement.from,
+            name: requirement.name,
+            selector: effective,
+        });
+        let versions = seen.get(reference.packageName);
+        if (versions === undefined) {
+            versions = await options.listVersions(requirement, effective);
+            seen.set(reference.packageName, versions);
+        }
+        if (versions === null) {
+            misses.push({
+                ...requirement,
+                effectiveSelector: effective,
+                reason: "unreadable",
+            });
+            continue;
+        }
+        const version = versions
+            .filter((candidate) => valid(candidate))
+            .filter((candidate) => npmRegistryVersionSatisfiesSelector(candidate, reference.selector))
+            .sort(rcompare)[0];
+        if (!version) {
+            misses.push({
+                ...requirement,
+                effectiveSelector: effective,
+                reason: "no-matching-version",
+            });
+            continue;
+        }
+        resolutions.push({ requirement, effectiveSelector: effective, version });
+    }
+    if (misses.length === 0)
+        return resolutions;
+    const lines = misses.map((miss) => `  ${miss.from} -> ${miss.name}@${miss.effectiveSelector}` +
+        (miss.reason === "unreadable"
+            ? " (registry returned no versions: unpublished)"
+            : " (no published version satisfies the selector)"));
+    throw new Error("Registry cannot satisfy external requirements; publishing would ship " +
+        "uninstallable-in-isolation packages. Publish the owning packages first " +
+        "(or fix the selectors/overrides):\n" +
+        lines.join("\n"));
+}
+/**
+ * Workspace-source requirements are release inputs, not implicit outputs. Seal
+ * the exact compatible Registry artifact before any build or remote mutation so
+ * the later consumer proof cannot resolve a different range winner.
+ *
+ * Each distinct Registry coordinate is sealed once, however many requirements
+ * resolve to it, and coordinates are sealed concurrently, each through its own
+ * availability temp root. A package name fixes its Registry, so distinct
+ * coordinates are distinct name@version pairs and never fetch the same
+ * tarball. Sealed inputs keep requirement order, and a failure is the one the
+ * first failing requirement hits.
+ */
+export async function sealWorkspaceRegistryInputs(options) {
+    const buildPackageByName = new Map(options.buildPackages.map((buildPackage) => [buildPackage.name, buildPackage]));
+    const sealingByCoordinate = new Map();
+    const inputArtifactDir = (await getRuntimePath(options.runtime)).join(options.artifactDir, "workspace-inputs");
+    const workspaceResolutions = options.resolutions.filter((resolution) => resolution.requirement.source === "workspace");
+    // A required edge's input must be this source's content; an optional peer or proof peer only
+    // needs the newest published version on its line (see `REQUIRED_INPUT_EDGES`).
+    const requiredInputs = new Set(workspaceResolutions
+        .filter((resolution) => REQUIRED_INPUT_EDGES.has(resolution.requirement.kind))
+        .map((resolution) => `${resolution.requirement.name}\0${resolution.version}`));
+    return mapWithConcurrencyUntilFirstFailure(workspaceResolutions, REGISTRY_AVAILABILITY_CONCURRENCY, async (resolution) => {
+        const buildPackage = buildPackageByName.get(resolution.requirement.name);
+        if (!buildPackage) {
+            throw new Error(`Registry release lost workspace input ${resolution.requirement.name} from its source build closure`);
+        }
+        const lookup = resolveRegistryExternalLookup({
+            requirement: resolution.requirement,
+            effectiveSelector: resolution.effectiveSelector,
+            sourceRegistry: options.sourceRegistry,
+        });
+        if (lookup.packageName !== resolution.requirement.name) {
+            throw new Error(`Workspace Registry input ${resolution.requirement.name} cannot resolve through package alias ${lookup.packageName}`);
+        }
+        const coordinate = `${lookup.registry}\0${lookup.packageName}\0${resolution.version}`;
+        let sealing = sealingByCoordinate.get(coordinate);
+        if (!sealing) {
+            sealing = sealWorkspaceRegistryInput({
+                resolution,
+                requireSourceMatch: requiredInputs.has(`${resolution.requirement.name}\0${resolution.version}`),
+                target: {
+                    ...buildPackage,
+                    version: resolution.version,
+                    registry: lookup.registry,
+                    roles: ["runtime"],
+                },
+                inputArtifactDir,
+                expectedGitHeads: options.expectedGitHeads,
+                workspaceRoot: options.workspaceRoot,
+                scope: options.scope,
+                readCredential: options.readCredential,
+                execution: options.execution,
+                runtime: options.runtime,
+            });
+            sealingByCoordinate.set(coordinate, sealing);
+        }
+        return { ...resolution, ...(await sealing) };
+    });
+}
+/**
+ * The edges whose workspace input must be the dependent's source content: a dependency and a
+ * non-optional peer, present whenever the dependent loads. An optional peer or a proof profile's
+ * optional peer is not a hard requirement (a consumer installs whatever the Registry serves), and a
+ * devDependency never reaches a consumer, so those take the newest published version unchecked:
+ * testing reaches tui only optionally while tui requires testing, so testing publishes first.
+ */
+const REQUIRED_INPUT_EDGES = new Set(["dependency", "peer-dependency"]);
+/** Seal one Registry coordinate: its exact published artifact, reused as-is. */
+async function sealWorkspaceRegistryInput(options) {
+    const { resolution, target } = options;
+    const availability = await inspectRegistryReleaseAvailability({
+        targets: [target],
+        expectedGitHeads: options.expectedGitHeads,
+        versioning: "exact",
+        // A required edge is built against this input's source, so its sealed artifact must be that content.
+        requireSourceMatch: options.requireSourceMatch,
+        artifactDir: options.inputArtifactDir,
+        workspaceRoot: options.workspaceRoot,
+        scope: options.scope,
+        readCredential: options.readCredential,
+        execution: options.execution,
+        runtime: options.runtime,
+    });
+    if (availability.publish.length > 0) {
+        throw new Error(`Workspace Registry input ${resolution.requirement.name}@${resolution.effectiveSelector} ` +
+            `resolved to ${resolution.version}, but that exact artifact is unavailable. ` +
+            "It is a Registry input, not an implicit publish output.");
+    }
+    const reused = availability.reuse.get(target.name);
+    if (!reused?.tarball || !reused.artifactIntegrity) {
+        throw new Error(`Registry input seal lost exact artifact evidence for ${target.name}@${target.version}`);
+    }
+    const manifest = await readProofArtifactManifest(options.execution, options.runtime, reused.tarball);
+    if (manifest.name !== target.name || manifest.version !== target.version) {
+        throw new Error(`Registry input seal expected ${target.name}@${target.version}, artifact contains ${manifest.name}@${manifest.version}`);
+    }
+    return {
+        version: target.version,
+        registry: target.registry,
+        integrity: reused.artifactIntegrity,
+        repository: target.workspaceProvenance.repository,
+        gitHead: reused.gitHead,
+        tarball: reused.tarball,
+    };
+}
+/**
+ * The root `overrides` selector for `name` when set, else the declared selector.
+ */
+export function effectiveExternalSelector(overrides, name, declaredSelector) {
+    const parsed = z.string().safeParse(overrides[name]);
+    return parsed.success && parsed.data.trim()
+        ? parsed.data
+        : declaredSelector;
+}
+/**
+ * The package an external requirement fetches and the source registry it comes from.
+ */
+export function resolveRegistryExternalLookup(options) {
+    const reference = registryExternalReference({
+        ...options.requirement,
+        selector: options.effectiveSelector,
+    });
+    return {
+        packageName: reference.packageName,
+        registry: registryForProofPackage(reference.packageName, options.sourceRegistry),
+    };
+}
+/**
+ * Prove every external requirement of `releasePlan` has a published version
+ * satisfying its (root-overridden) selector, reading each source registry with
+ * the release read token from an owned temporary npm environment.
+ */
+export async function resolveReleaseExternalRequirements(options) {
+    if (options.releasePlan.externalRequirements.length === 0)
+        return [];
+    const sourceRegistry = buildReleaseConsumerSourceRegistry({
+        targets: options.sourceTargets,
+    });
+    const paths = await getRuntimePath(options.runtime);
+    const workspaceFiles = await resolveFileSystemAdapter(options.runtime);
+    const rootPublishManifest = parseWorkspaceRootManifest(JSON.parse(z.string().parse(await workspaceFiles.readFile(paths.join(options.workspaceRoot, "package.json"), "utf8"))));
+    const readTempRoot = await createReleaseTempRoot(options.runtime, options.workspaceRoot, SENSITIVE_TEMP_ROOT_PREFIXES.availability);
+    const hostFiles = await resolveFileSystemAdapter(options.runtime, { binding: false });
+    const readHomeDir = paths.join(readTempRoot, "home");
+    const readCacheDir = paths.join(readTempRoot, "cache");
+    const readNpmrcPath = paths.join(readTempRoot, "npmrc");
+    const readRedact = options.readToken ? [options.readToken] : [];
+    try {
+        await hostFiles.mkdir(readHomeDir, { recursive: true });
+        await hostFiles.mkdir(readCacheDir, { recursive: true });
+        await hostFiles.writeFile(paths.join(readTempRoot, "package.json"), '{"private":true}\n');
+        await writeTempNpmrc({
+            runtime: options.runtime,
+            path: readNpmrcPath,
+            registry: normalizeRegistryUrl(options.sourceTargets[0]?.registry ?? await registryServiceOrigin(options.runtime)),
+            scope: options.scope,
+            token: options.readToken,
+            homeDir: readHomeDir,
+        });
+        const readEnv = isolatedNpmPackEnv({
+            homeDir: readHomeDir,
+            cacheDir: readCacheDir,
+            npmrcPath: readNpmrcPath,
+        });
+        return await assertExternalRequirementsSatisfiable({
+            requirements: options.releasePlan.externalRequirements,
+            rootOverrides: rootPublishManifest.overrides ?? {},
+            listVersions: (requirement, effectiveSelector) => {
+                const lookup = resolveRegistryExternalLookup({
+                    requirement,
+                    effectiveSelector,
+                    sourceRegistry,
+                });
+                return npmListPublishedVersions({
+                    name: lookup.packageName,
+                    registry: lookup.registry,
+                    cwd: readTempRoot,
+                    env: readEnv,
+                    execution: options.execution,
+                    runtime: options.runtime,
+                    redactValues: readRedact,
+                });
+            },
+        });
+    }
+    finally {
+        await cleanupSensitiveTempRoot({
+            runtime: options.runtime,
+            root: readTempRoot,
+            npmrcPath: readNpmrcPath,
+            workspaceRoot: options.workspaceRoot,
+            expectedPrefix: SENSITIVE_TEMP_ROOT_PREFIXES.availability,
+            redactValues: readRedact,
+        });
+    }
+}
+/**
+ * The version each workspace package's `workspace:` selectors are rewritten to: its source version,
+ * else the sealed Registry input a dependent was proven against (an internal dependency outside the
+ * release), else the version this release assigns it. A dependency outside the release keeping its
+ * source version shipped `^<stale source version>`, which `latest` could satisfy with older content.
+ */
+export function workspaceSelectorVersions(options) {
+    const versions = new Map(options.sourceVersions);
+    for (const input of options.sealedWorkspaceInputs)
+        versions.set(input.requirement.name, input.version);
+    for (const [name, assignment] of options.assignments)
+        versions.set(name, assignment.version);
+    return versions;
+}
+//# sourceMappingURL=external-requirements.js.map

package/dist/cli/npm/publish/external-requirements.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"external-requirements.js","sourceRoot":"","sources":["../../../../src/cli/npm/publish/external-requirements.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;AAC3B,OAAO,EACL,yBAAyB,GAG1B,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAChE,OAAO,EAAE,mCAAmC,EAAE,MAAM,kBAAkB,CAAC;AACvE,OAAO,EACL,kBAAkB,EAClB,MAAM,EAEN,WAAW,EACX,cAAc,GACf,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,kCAAkC,EAClC,yBAAyB,EACzB,uBAAuB,GAExB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,kCAAkC,EAClC,iCAAiC,GAClC,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,wBAAwB,EAAE,MAAM,qBAAqB,CAAC;AAC/D,OAAO,EACL,oBAAoB,EAEpB,qBAAqB,GACtB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,wBAAwB,EACxB,qBAAqB,EACrB,4BAA4B,GAC7B,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,0BAA0B,GAE3B,MAAM,yBAAyB,CAAC;AAMjC;;GAEG;AACH,MAAM,UAAU,6BAA6B,CAAC,OAM7C;IACC,MAAM,SAAS,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAC;IACrD,IACE,OAAO,CAAC,YAAY,KAAK,SAAS,CAAC,WAAW;QAC9C,CAAC,mCAAmC,CAClC,OAAO,CAAC,eAAe,EACvB,SAAS,CAAC,QAAQ,CACnB,EACD,CAAC;QACD,MAAM,IAAI,KAAK,CACb,4CAA4C,OAAO,CAAC,IAAI,OAAO,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,QAAQ,gBAAgB,OAAO,CAAC,YAAY,IAAI,SAAS,IAAI,OAAO,CAAC,eAAe,EAAE,CAC9K,CAAC;IACJ,CAAC;AACH,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,mCAAmC,CACjD,OAAe,EACf,QAAgB;IAEhB,OAAO,CACL,SAAS,CAAC,OAAO,EAAE,QAAQ,CAAC;QAC5B,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,GAAG,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,CACrD,CAAC;AACJ,CAAC;AAQD;;GAEG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAIzC;IACC,IAAI,CAAC,yBAAyB,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CACb,gEAAgE,OAAO,CAAC,IAAI,OAAO,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,QAAQ,EAAE,CACtH,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5D,OAAO;YACL,WAAW,EAAE,OAAO,CAAC,IAAI;YACzB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,kBAAkB,EAAE,OAAO,CAAC,QAAQ;SACrC,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACxC,MAAM,UAAU,GAAG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACzD,MAAM,KAAK,GAAG,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACxE,MAAM,SAAS,GAAG,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC;YAC1C,CAAC,CAAC,KAAK,IAAI,CAAC;gBACV,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,GAAG,CAAC,CAAC;gBACpC,CAAC,CAAC,CAAC,CAAC;YACN,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,WAAW,GAAG,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,MAAM,QAAQ,GAAG,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,IACE,yBAAyB,CAAC,WAAW,CAAC;YACtC,QAAQ,CAAC,IAAI,EAAE;YACf,UAAU,CAAC,QAAQ,CAAC,EACpB,CAAC;YACD,OAAO;gBACL,WAAW;gBACX,QAAQ;gBACR,kBAAkB,EAAE,OAAO,CAAC,QAAQ;aACrC,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CACb,2EAA2E,OAAO,CAAC,IAAI,OAAO,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,QAAQ,EAAE,CACjI,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,8BAA8B,CAAC,OAI9C;IACC,yBAAyB,CAAC,OAAO,CAAC,CAAC;AACrC,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAYC,EACD,SAAwB,MAAM;IAE9B,MAAM,SAAS,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAC;IACrD,MAAM,IAAI,GAAG;QACX,MAAM;QACN,WAAW,CAAC,SAAS,CAAC,WAAW,EAAE,SAAS,CAAC,QAAQ,CAAC;QACtD,QAAQ;QACR,kBAAkB;QAClB,oBAAoB;QACpB,OAAO,CAAC,WAAW;QACnB,YAAY;QACZ,OAAO,CAAC,QAAQ;KACjB,CAAC;IACF,OAAO;QACL,IAAI;QACJ,MAAM,EAAE,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE;YAC5C,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,GAAG,EAAE,OAAO,CAAC,SAAS;YACtB,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,KAAK,EAAE,IAAI;YACX,YAAY,EAAE,IAAI;YAClB,YAAY,EAAE,OAAO,CAAC,YAAY;SACnC,CAAC;KACH,CAAC;AACJ,CAAC;AAwBD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,qCAAqC,CAAC,OAO3D;IACC,MAAM,MAAM,GAA8B,EAAE,CAAC;IAC7C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAoC,CAAC;IACzD,MAAM,WAAW,GAA4C,EAAE,CAAC;IAChE,KAAK,MAAM,WAAW,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;QAC/C,MAAM,SAAS,GAAG,yBAAyB,CACzC,OAAO,CAAC,aAAa,EACrB,WAAW,CAAC,IAAI,EAChB,WAAW,CAAC,QAAQ,CACrB,CAAC;QACF,qEAAqE;QACrE,gEAAgE;QAChE,MAAM,SAAS,GAAG,yBAAyB,CAAC;YAC1C,IAAI,EAAE,WAAW,CAAC,IAAI;YACtB,IAAI,EAAE,WAAW,CAAC,IAAI;YACtB,QAAQ,EAAE,SAAS;SACpB,CAAC,CAAC;QACH,IAAI,QAAQ,GAAyC,IAAI,CAAC,GAAG,CAC3D,SAAS,CAAC,WAAW,CACtB,CAAC;QACF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,QAAQ,GAAG,MAAM,OAAO,CAAC,YAAY,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;YAC9D,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,MAAM,CAAC,IAAI,CAAC;gBACV,GAAG,WAAW;gBACd,iBAAiB,EAAE,SAAS;gBAC5B,MAAM,EAAE,YAAY;aACrB,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,MAAM,OAAO,GAAG,QAAQ;aACrB,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;aACvC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CACpB,mCAAmC,CAAC,SAAS,EAAE,SAAS,CAAC,QAAQ,CAAC,CACnE;aACA,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACrB,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC;gBACV,GAAG,WAAW;gBACd,iBAAiB,EAAE,SAAS;gBAC5B,MAAM,EAAE,qBAAqB;aAC9B,CAAC,CAAC;YACH,SAAS;QACX,CAAC;QACD,WAAW,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,iBAAiB,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,WAAW,CAAC;IAC5C,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CACtB,CAAC,IAAI,EAAE,EAAE,CACP,KAAK,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,iBAAiB,EAAE;QAC1D,CAAC,IAAI,CAAC,MAAM,KAAK,YAAY;YAC3B,CAAC,CAAC,+CAA+C;YACjD,CAAC,CAAC,gDAAgD,CAAC,CACxD,CAAC;IACF,MAAM,IAAI,KAAK,CACb,uEAAuE;QACrE,yEAAyE;QACzE,qCAAqC;QACrC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CACnB,CAAC;AACJ,CAAC;AAOD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAAC,OAYjD;IACC,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAChC,OAAO,CAAC,aAAa,CAAC,GAAG,CACvB,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,YAAY,CAAU,CAC7D,CACF,CAAC;IACF,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAGhC,CAAC;IACJ,MAAM,gBAAgB,GAAG,CAAC,MAAM,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CACnE,OAAO,CAAC,WAAW,EACnB,kBAAkB,CACnB,CAAC;IACF,MAAM,oBAAoB,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,CACrD,CAAC,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,MAAM,KAAK,WAAW,CAC9D,CAAC;IACF,6FAA6F;IAC7F,+EAA+E;IAC/E,MAAM,cAAc,GAAG,IAAI,GAAG,CAC5B,oBAAoB;SACjB,MAAM,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,oBAAoB,CAAC,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;SAC7E,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,GAAG,UAAU,CAAC,WAAW,CAAC,IAAI,KAAK,UAAU,CAAC,OAAO,EAAE,CAAC,CAChF,CAAC;IAEF,OAAO,mCAAmC,CACxC,oBAAoB,EACpB,iCAAiC,EACjC,KAAK,EAAE,UAAU,EAAE,EAAE;QACnB,MAAM,YAAY,GAAG,kBAAkB,CAAC,GAAG,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QACzE,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CACb,yCAAyC,UAAU,CAAC,WAAW,CAAC,IAAI,gCAAgC,CACrG,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,6BAA6B,CAAC;YAC3C,WAAW,EAAE,UAAU,CAAC,WAAW;YACnC,iBAAiB,EAAE,UAAU,CAAC,iBAAiB;YAC/C,cAAc,EAAE,OAAO,CAAC,cAAc;SACvC,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,WAAW,KAAK,UAAU,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;YACvD,MAAM,IAAI,KAAK,CACb,4BAA4B,UAAU,CAAC,WAAW,CAAC,IAAI,yCAAyC,MAAM,CAAC,WAAW,EAAE,CACrH,CAAC;QACJ,CAAC;QACD,MAAM,UAAU,GAAG,GAAG,MAAM,CAAC,QAAQ,KAAK,MAAM,CAAC,WAAW,KAAK,UAAU,CAAC,OAAO,EAAE,CAAC;QACtF,IAAI,OAAO,GAAG,mBAAmB,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAClD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,GAAG,0BAA0B,CAAC;gBACnC,UAAU;gBACV,kBAAkB,EAAE,cAAc,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,WAAW,CAAC,IAAI,KAAK,UAAU,CAAC,OAAO,EAAE,CAAC;gBAC/F,MAAM,EAAE;oBACN,GAAG,YAAY;oBACf,OAAO,EAAE,UAAU,CAAC,OAAO;oBAC3B,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,KAAK,EAAE,CAAC,SAAS,CAAC;iBACnB;gBACD,gBAAgB;gBAChB,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;gBAC1C,aAAa,EAAE,OAAO,CAAC,aAAa;gBACpC,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,cAAc,EAAE,OAAO,CAAC,cAAc;gBACtC,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;aACzB,CAAC,CAAC;YACH,mBAAmB,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO,EAAE,GAAG,UAAU,EAAE,GAAG,CAAC,MAAM,OAAO,CAAC,EAAE,CAAC;IAC/C,CAAC,CACF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,oBAAoB,GAAwB,IAAI,GAAG,CAAC,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC,CAAC;AAE7F,gFAAgF;AAChF,KAAK,UAAU,0BAA0B,CAAC,OAazC;IACC,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC;IACvC,MAAM,YAAY,GAAG,MAAM,kCAAkC,CAAC;QAC5D,OAAO,EAAE,CAAC,MAAM,CAAC;QACjB,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;QAC1C,UAAU,EAAE,OAAO;QACnB,qGAAqG;QACrG,kBAAkB,EAAE,OAAO,CAAC,kBAAkB;QAC9C,WAAW,EAAE,OAAO,CAAC,gBAAgB;QACrC,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC,CAAC;IACH,IAAI,YAAY,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CACb,4BAA4B,UAAU,CAAC,WAAW,CAAC,IAAI,IAAI,UAAU,CAAC,iBAAiB,GAAG;YACxF,eAAe,UAAU,CAAC,OAAO,4CAA4C;YAC7E,yDAAyD,CAC5D,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACnD,IAAI,CAAC,MAAM,EAAE,OAAO,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CACb,wDAAwD,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,OAAO,EAAE,CACxF,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,yBAAyB,CAC9C,OAAO,CAAC,SAAS,EACjB,OAAO,CAAC,OAAO,EACf,MAAM,CAAC,OAAO,CACf,CAAC;IACF,IAAI,QAAQ,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,IAAI,QAAQ,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC;QACzE,MAAM,IAAI,KAAK,CACb,gCAAgC,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,OAAO,uBAAuB,QAAQ,CAAC,IAAI,IAAI,QAAQ,CAAC,OAAO,EAAE,CACxH,CAAC;IACJ,CAAC;IACD,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,SAAS,EAAE,MAAM,CAAC,iBAAiB;QACnC,UAAU,EAAE,MAAM,CAAC,mBAAmB,CAAC,UAAU;QACjD,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,OAAO,EAAE,MAAM,CAAC,OAAO;KACxB,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,yBAAyB,CACvC,SAAgE,EAChE,IAAY,EACZ,gBAAwB;IAExB,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IACrD,OAAO,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE;QACzC,CAAC,CAAC,MAAM,CAAC,IAAI;QACb,CAAC,CAAC,gBAAgB,CAAC;AACvB,CAAC;AAOD;;GAEG;AACH,MAAM,UAAU,6BAA6B,CAAC,OAI7C;IACC,MAAM,SAAS,GAAG,yBAAyB,CAAC;QAC1C,GAAG,OAAO,CAAC,WAAW;QACtB,QAAQ,EAAE,OAAO,CAAC,iBAAiB;KACpC,CAAC,CAAC;IACH,OAAO;QACL,WAAW,EAAE,SAAS,CAAC,WAAW;QAClC,QAAQ,EAAE,uBAAuB,CAC/B,SAAS,CAAC,WAAW,EACrB,OAAO,CAAC,cAAc,CACvB;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kCAAkC,CAAC,OAUxD;IACC,IAAI,OAAO,CAAC,WAAW,CAAC,oBAAoB,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrE,MAAM,cAAc,GAAG,kCAAkC,CAAC;QACxD,OAAO,EAAE,OAAO,CAAC,aAAa;KAC/B,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,cAAc,GAAG,MAAM,wBAAwB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACvE,MAAM,mBAAmB,GAAG,0BAA0B,CACpD,IAAI,CAAC,KAAK,CACR,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CACd,MAAM,cAAc,CAAC,QAAQ,CAC3B,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,cAAc,CAAC,EACjD,MAAM,CACP,CACF,CACF,CACF,CAAC;IACF,MAAM,YAAY,GAAG,MAAM,qBAAqB,CAC9C,OAAO,CAAC,OAAO,EACf,OAAO,CAAC,aAAa,EACrB,4BAA4B,CAAC,YAAY,CAC1C,CAAC;IACF,MAAM,SAAS,GAAG,MAAM,wBAAwB,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IACtF,MAAM,WAAW,GAAG,KAAK,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IACrD,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IACvD,MAAM,aAAa,GAAG,KAAK,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IACxD,MAAM,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAChE,IAAI,CAAC;QACH,MAAM,SAAS,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,MAAM,SAAS,CAAC,KAAK,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzD,MAAM,SAAS,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,EAAE,cAAc,CAAC,EAAE,oBAAoB,CAAC,CAAC;QAC1F,MAAM,cAAc,CAAC;YACnB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,IAAI,EAAE,aAAa;YACnB,QAAQ,EAAE,oBAAoB,CAC5B,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,QAAQ,IAAI,MAAM,qBAAqB,CAAC,OAAO,CAAC,OAAO,CAAC,CACnF;YACD,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,KAAK,EAAE,OAAO,CAAC,SAAS;YACxB,OAAO,EAAE,WAAW;SACrB,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,kBAAkB,CAAC;YACjC,OAAO,EAAE,WAAW;YACpB,QAAQ,EAAE,YAAY;YACtB,SAAS,EAAE,aAAa;SACzB,CAAC,CAAC;QACH,OAAO,MAAM,qCAAqC,CAAC;YACjD,YAAY,EAAE,OAAO,CAAC,WAAW,CAAC,oBAAoB;YACtD,aAAa,EAAE,mBAAmB,CAAC,SAAS,IAAI,EAAE;YAClD,YAAY,EAAE,CAAC,WAAW,EAAE,iBAAiB,EAAE,EAAE;gBAC/C,MAAM,MAAM,GAAG,6BAA6B,CAAC;oBAC3C,WAAW;oBACX,iBAAiB;oBACjB,cAAc;iBACf,CAAC,CAAC;gBACH,OAAO,wBAAwB,CAAC;oBAC9B,IAAI,EAAE,MAAM,CAAC,WAAW;oBACxB,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,GAAG,EAAE,YAAY;oBACjB,GAAG,EAAE,OAAO;oBACZ,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,YAAY,EAAE,UAAU;iBACzB,CAAC,CAAC;YACL,CAAC;SACF,CAAC,CAAC;IACL,CAAC;YAAS,CAAC;QACT,MAAM,wBAAwB,CAAC;YAC7B,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,IAAI,EAAE,YAAY;YAClB,SAAS,EAAE,aAAa;YACxB,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,cAAc,EAAE,4BAA4B,CAAC,YAAY;YACzD,YAAY,EAAE,UAAU;SACzB,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAIzC;IACC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;IACjD,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,qBAAqB;QAAE,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACvG,KAAK,MAAM,CAAC,IAAI,EAAE,UAAU,CAAC,IAAI,OAAO,CAAC,WAAW;QAAE,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,OAAO,CAAC,CAAC;IAC7F,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/cli/npm/publish/forge-source-identity.d.ts

@@ -0,0 +1,64 @@
+/**
+ * Forge source identity: canonical repository URLs, which repository owns each
+ * package directory, and the Registry provenance a package publishes with.
+ */
+import type { ChildEnvRuntime } from "../../shared/runtime-execution.ts";
+import type { RegistryReleaseWorkspacePackage } from "@vibesdotdev/registry";
+import type { RuntimeExecution } from "@vibesdotdev/kernel/execution";
+import type { PackageJson, RegistryForgeSourceIdentity, RegistryWorkspaceProvenance } from "./types.ts";
+/** A manifest's repository URL, from either the string or object form. */
+export declare function repositoryUrl(pkg: Pick<PackageJson, "repository">): string | undefined;
+export declare function canonicalForgeRepositoryIdentity(value: string): {
+    repository: string;
+    repositoryRef: string;
+};
+/** Registry authority and published metadata share the canonical SSH source identity. */
+export declare function forgeRegistryRepositoryUrl(value: string): string;
+/**
+ * The Git repository root that owns `packageDir` within the registered workspace.
+ */
+export declare function resolveRegistryOwningRepositoryRoot(options: {
+    registeredWorkspaceRoot: string;
+    packageDir: string;
+    execution: RuntimeExecution;
+    /** The runtime child environments are composed from. */
+    runtime: ChildEnvRuntime;
+}): Promise<string>;
+/**
+ * The owning Git repository root of each package directory within the
+ * registered workspace. Git answers ownership (`git rev-parse
+ * --show-toplevel` in the package directory, once per distinct directory);
+ * nothing walks the filesystem for a `.git` marker. A package whose
+ * repository lies outside the registered workspace is refused.
+ */
+export declare function resolveRegistryOwningRepositoryRoots(options: {
+    registeredWorkspaceRoot: string;
+    packageDirs: readonly string[];
+    execution: RuntimeExecution;
+    /** The runtime child environments are composed from. */
+    runtime: ChildEnvRuntime;
+}): Promise<Map<string, string>>;
+/**
+ * A source root's canonical Forge repository (from its `forge` remote) and repository id.
+ */
+export declare function resolveRegistryForgeSourceIdentity(options: {
+    sourceRoot: string;
+    execution: RuntimeExecution;
+    /** The runtime child environments are composed from. */
+    runtime: ChildEnvRuntime;
+    resolveRepositoryId(repositoryRef: string): Promise<string>;
+}): Promise<RegistryForgeSourceIdentity>;
+/**
+ * The Registry provenance (repository, id, directory) a package publishes with,
+ * rejecting manifest claims that contradict its owning Forge repository.
+ */
+export declare function resolveRegistryWorkspaceProvenance(options: {
+    /** The runtime whose logger reports a repository claim it could not read as a Forge identity. */
+    runtime: ChildEnvRuntime;
+    workspaceRoot: string;
+    packageDir: string;
+    workspace: ReadonlyMap<string, RegistryReleaseWorkspacePackage>;
+    forgeRepository: string;
+    forgeRepositoryId: string;
+}): Promise<RegistryWorkspaceProvenance>;
+//# sourceMappingURL=forge-source-identity.d.ts.map

package/dist/cli/npm/publish/forge-source-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"forge-source-identity.d.ts","sourceRoot":"","sources":["../../../../src/cli/npm/publish/forge-source-identity.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AAIzE,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,uBAAuB,CAAC;AAC7E,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAKtE,OAAO,KAAK,EACV,WAAW,EACX,2BAA2B,EAC3B,2BAA2B,EAC5B,MAAM,YAAY,CAAC;AAEpB,0EAA0E;AAC1E,wBAAgB,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,GAAG,MAAM,GAAG,SAAS,CAKtF;AAwCD,wBAAgB,gCAAgC,CAAC,KAAK,EAAE,MAAM;;;EAQ7D;AAED,yFAAyF;AACzF,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEhE;AAED;;GAEG;AACH,wBAAsB,mCAAmC,CAAC,OAAO,EAAE;IACjE,uBAAuB,EAAE,MAAM,CAAC;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,gBAAgB,CAAC;IAC5B,wDAAwD;IACxD,OAAO,EAAE,eAAe,CAAC;CAC1B,GAAG,OAAO,CAAC,MAAM,CAAC,CASlB;AAED;;;;;;GAMG;AACH,wBAAsB,oCAAoC,CAAC,OAAO,EAAE;IAClE,uBAAuB,EAAE,MAAM,CAAC;IAChC,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,SAAS,EAAE,gBAAgB,CAAC;IAC5B,wDAAwD;IACxD,OAAO,EAAE,eAAe,CAAC;CAC1B,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAwD/B;AAED;;GAEG;AACH,wBAAsB,kCAAkC,CAAC,OAAO,EAAE;IAChE,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,gBAAgB,CAAC;IAC5B,wDAAwD;IACxD,OAAO,EAAE,eAAe,CAAC;IACzB,mBAAmB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC7D,GAAG,OAAO,CAAC,2BAA2B,CAAC,CAgCvC;AAED;;;GAGG;AACH,wBAAsB,kCAAkC,CAAC,OAAO,EAAE;IAChE,iGAAiG;IACjG,OAAO,EAAE,eAAe,CAAC;IACzB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,WAAW,CAAC,MAAM,EAAE,+BAA+B,CAAC,CAAC;IAChE,eAAe,EAAE,MAAM,CAAC;IACxB,iBAAiB,EAAE,MAAM,CAAC;CAC3B,GAAG,OAAO,CAAC,2BAA2B,CAAC,CA0DvC"}

package/dist/cli/npm/publish/forge-source-identity.js

@@ -0,0 +1,201 @@
+import { GIT_CHILD_ENV } from "@vibesdotdev/git-operations/core";
+import { realpathChecked, resolveFileSystemAdapter } from "@vibesdotdev/filesystem";
+import { getRuntimePath } from "@vibesdotdev/paths";
+import { CapabilityError } from "@vibesdotdev/kernel";
+import { z } from "zod/v4";
+import { runRuntimeCommand } from "../../shared/runtime-execution.js";
+import { mapWithConcurrency } from "./concurrency.js";
+/** A manifest's repository URL, from either the string or object form. */
+export function repositoryUrl(pkg) {
+    const text = z.string().safeParse(pkg.repository);
+    if (text.success)
+        return text.data;
+    const record = z.object({ url: z.string().optional() }).safeParse(pkg.repository);
+    return record.success ? record.data.url : undefined;
+}
+function normalizeRepository(value) {
+    return value
+        .replace(/^git\+/, "")
+        .replace(/\.git$/, "")
+        .replace(/\/$/, "");
+}
+/**
+ * The canonical SSH clone URL and `owner/name` ref of a Forge repository URL.
+ */
+function readForgeRepositoryIdentity(value) {
+    const normalized = value.trim().replace(/^git\+/, "");
+    let host = "";
+    let path = "";
+    const url = URL.parse(normalized);
+    if (url) {
+        host = url.hostname;
+        path = url.pathname;
+    }
+    else {
+        const scp = normalized.match(/^(?:[^@\s]+@)?([^:\s]+):(.+)$/);
+        if (scp) {
+            host = scp[1] ?? "";
+            path = scp[2] ?? "";
+        }
+    }
+    const repositoryRef = path
+        .replace(/^\//, "")
+        .replace(/\.git$/, "")
+        .replace(/\/$/, "");
+    if (host !== "git.vibes.dev" || !/^[^/\s]+\/[^/\s]+$/.test(repositoryRef)) {
+        return undefined;
+    }
+    return {
+        repository: `ssh://git@git.vibes.dev/${repositoryRef}.git`,
+        repositoryRef,
+    };
+}
+export function canonicalForgeRepositoryIdentity(value) {
+    const identity = readForgeRepositoryIdentity(value);
+    if (!identity)
+        throw new CapabilityError("Registry release requires a canonical Forge remote.", "INVALID_INPUT", { reason: "registry-forge-remote-invalid" });
+    return identity;
+}
+/** Registry authority and published metadata share the canonical SSH source identity. */
+export function forgeRegistryRepositoryUrl(value) {
+    return canonicalForgeRepositoryIdentity(value).repository;
+}
+/**
+ * The Git repository root that owns `packageDir` within the registered workspace.
+ */
+export async function resolveRegistryOwningRepositoryRoot(options) {
+    return (await resolveRegistryOwningRepositoryRoots({
+        registeredWorkspaceRoot: options.registeredWorkspaceRoot,
+        packageDirs: [options.packageDir],
+        execution: options.execution,
+        runtime: options.runtime,
+    })).get(options.packageDir);
+}
+/**
+ * The owning Git repository root of each package directory within the
+ * registered workspace. Git answers ownership (`git rev-parse
+ * --show-toplevel` in the package directory, once per distinct directory);
+ * nothing walks the filesystem for a `.git` marker. A package whose
+ * repository lies outside the registered workspace is refused.
+ */
+export async function resolveRegistryOwningRepositoryRoots(options) {
+    const files = await resolveFileSystemAdapter(options.runtime, { binding: false });
+    const paths = await getRuntimePath(options.runtime);
+    const registeredWorkspaceRoot = await realpathChecked(files, options.registeredWorkspaceRoot);
+    const within = (path) => {
+        const position = paths.relative(registeredWorkspaceRoot, path);
+        return (position !== ".." &&
+            !position.startsWith("../") &&
+            !position.startsWith("..\\") &&
+            !paths.isAbsolute(position));
+    };
+    const canonicalDirs = new Map();
+    for (const packageDir of options.packageDirs) {
+        const canonical = await realpathChecked(files, packageDir);
+        if (!within(canonical)) {
+            throw new Error(`Registry package is outside the registered workspace: ${packageDir}`);
+        }
+        canonicalDirs.set(packageDir, canonical);
+    }
+    const uniqueDirs = [...new Set(canonicalDirs.values())].sort();
+    const ownerEntries = await mapWithConcurrency(uniqueDirs, 8, async (dir) => {
+        const result = await runRuntimeCommand({
+            runtime: options.runtime,
+            execution: options.execution,
+            command: "git",
+            inheritEnv: GIT_CHILD_ENV,
+            args: ["rev-parse", "--show-toplevel"],
+            cwd: dir,
+        });
+        if (result.code !== 0 || !result.stdout.trim()) {
+            // Git's own diagnostic is the cause; a path and Git's error carry no remote values.
+            throw new Error(`Cannot resolve owning Git repository for ${dir}: git rev-parse exited ${result.code}: ${result.stderr.trim() || "no output"}`);
+        }
+        const sourceRoot = await realpathChecked(files, result.stdout.trim());
+        if (!within(sourceRoot)) {
+            throw new Error(`Owning Git repository ${sourceRoot} of ${dir} is outside the registered workspace ${registeredWorkspaceRoot}`);
+        }
+        return [dir, sourceRoot];
+    });
+    const owners = new Map(ownerEntries);
+    return new Map([...canonicalDirs].map(([packageDir, canonical]) => [packageDir, owners.get(canonical)]));
+}
+/**
+ * A source root's canonical Forge repository (from its `forge` remote) and repository id.
+ */
+export async function resolveRegistryForgeSourceIdentity(options) {
+    const remote = await runRuntimeCommand({
+        runtime: options.runtime,
+        execution: options.execution,
+        command: "git",
+        inheritEnv: GIT_CHILD_ENV,
+        args: ["remote", "get-url", "forge"],
+        cwd: options.sourceRoot,
+    });
+    if (remote.code !== 0 || !remote.stdout.trim()) {
+        throw new Error(`Cannot resolve canonical Forge repository identity for ${options.sourceRoot}`);
+    }
+    const canonical = canonicalForgeRepositoryIdentity(remote.stdout.trim());
+    const repositoryId = await options.resolveRepositoryId(canonical.repositoryRef);
+    if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(repositoryId)) {
+        throw new Error(`Forge returned an invalid repository id for ${canonical.repositoryRef}`);
+    }
+    return {
+        sourceRoot: options.sourceRoot,
+        repository: canonical.repository,
+        repositoryId,
+    };
+}
+/**
+ * The Registry provenance (repository, id, directory) a package publishes with,
+ * rejecting manifest claims that contradict its owning Forge repository.
+ */
+export async function resolveRegistryWorkspaceProvenance(options) {
+    const paths = await getRuntimePath(options.runtime);
+    const isCanonicalMirror = (claimed, canonical) => {
+        const normalizedClaim = normalizeRepository(claimed);
+        const normalizedCanonical = normalizeRepository(canonical);
+        if (normalizedClaim === normalizedCanonical)
+            return true;
+        const canonicalPath = readForgeRepositoryIdentity(normalizedCanonical)?.repositoryRef;
+        const claimedForgePath = readForgeRepositoryIdentity(normalizedClaim)?.repositoryRef;
+        if (canonicalPath && claimedForgePath && canonicalPath === claimedForgePath)
+            return true;
+        // GitHub is the declared backup mirror for this Forge workspace. Accept
+        // only the exact owner/name identity; staged provenance remains canonical.
+        const claimedPath = normalizedClaim.match(/^(?:https?:\/\/|ssh:\/\/|git@)github\.com[/:](.+)$/)?.[1];
+        return Boolean(canonicalPath && claimedPath && canonicalPath === claimedPath);
+    };
+    const identity = {
+        repository: canonicalForgeRepositoryIdentity(options.forgeRepository)
+            .repository,
+        repositoryId: options.forgeRepositoryId,
+    };
+    const relativeDirectory = paths
+        .relative(options.workspaceRoot, options.packageDir)
+        .replaceAll("\\", "/");
+    if (relativeDirectory === ".." ||
+        relativeDirectory.startsWith("../") ||
+        relativeDirectory.startsWith("..\\") ||
+        paths.isAbsolute(relativeDirectory))
+        throw new Error(`Registry package is outside the Forge workspace: ${options.packageDir}`);
+    const directory = relativeDirectory || ".";
+    const target = [...options.workspace.values()].find((entry) => entry.directory === options.packageDir)?.manifest;
+    const claimedRepository = target ? repositoryUrl(target) : undefined;
+    const claimedId = target?.vibes?.registry?.repositoryId;
+    const claimedDirectory = target?.vibes?.registry?.directory;
+    if (claimedRepository &&
+        !isCanonicalMirror(claimedRepository, identity.repository)) {
+        const claimedOwner = readForgeRepositoryIdentity(claimedRepository)?.repositoryRef.split("/")[0];
+        const checkoutOwner = readForgeRepositoryIdentity(identity.repository)?.repositoryRef.split("/")[0];
+        const sameOwner = Boolean(claimedOwner && claimedOwner === checkoutOwner);
+        if (!sameOwner)
+            throw new Error(`Registry repository claim mismatch for ${directory}`);
+    }
+    if (claimedId && claimedId !== identity.repositoryId)
+        throw new Error(`Registry repositoryId claim mismatch for ${directory}`);
+    if (claimedDirectory && claimedDirectory !== directory)
+        throw new Error(`Registry directory claim mismatch for ${directory}`);
+    return { ...identity, directory };
+}
+//# sourceMappingURL=forge-source-identity.js.map