@vibesdotdev/infra-deploy 0.0.2 → 1.0.0-rc.4

package/dist/cli/npm/publish/forge-source-identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"forge-source-identity.js","sourceRoot":"","sources":["../../../../src/cli/npm/publish/forge-source-identity.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,aAAa,EAAE,MAAM,kCAAkC,CAAC;AACjE,OAAO,EAAE,eAAe,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACpF,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAGpD,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;AAC3B,OAAO,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AACtE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAOtD,0EAA0E;AAC1E,MAAM,UAAU,aAAa,CAAC,GAAoC;IAChE,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAClD,IAAI,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC;IACnC,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAClF,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AACtD,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAa;IACxC,OAAO,KAAK;SACT,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;SACrB,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;SACrB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACxB,CAAC;AAED;;GAEG;AACH,SAAS,2BAA2B,CAAC,KAAa;IAChD,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IACtD,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,MAAM,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAClC,IAAI,GAAG,EAAE,CAAC;QACR,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;QACpB,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;IACtB,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;QAC9D,IAAI,GAAG,EAAE,CAAC;YACR,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACpB,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACtB,CAAC;IACH,CAAC;IACD,MAAM,aAAa,GAAG,IAAI;SACvB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;SAClB,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;SACrB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACtB,IAAI,IAAI,KAAK,eAAe,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;QAC1E,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO;QACL,UAAU,EAAE,2BAA2B,aAAa,MAAM;QAC1D,aAAa;KACd,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gCAAgC,CAAC,KAAa;IAC5D,MAAM,QAAQ,GAAG,2BAA2B,CAAC,KAAK,CAAC,CAAC;IACpD,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,eAAe,CACtC,qDAAqD,EACrD,eAAe,EACf,EAAE,MAAM,EAAE,+BAA+B,EAAE,CAC5C,CAAC;IACF,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,0BAA0B,CAAC,KAAa;IACtD,OAAO,gCAAgC,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC;AAC5D,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,mCAAmC,CAAC,OAMzD;IACC,OAAO,CACL,MAAM,oCAAoC,CAAC;QACzC,uBAAuB,EAAE,OAAO,CAAC,uBAAuB;QACxD,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC;QACjC,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC,CACH,CAAC,GAAG,CAAC,OAAO,CAAC,UAAU,CAAE,CAAC;AAC7B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,oCAAoC,CAAC,OAM1D;IACC,MAAM,KAAK,GAAG,MAAM,wBAAwB,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IAClF,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,uBAAuB,GAAG,MAAM,eAAe,CACnD,KAAK,EACL,OAAO,CAAC,uBAAuB,CAChC,CAAC;IACF,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,EAAE;QAC9B,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,uBAAuB,EAAE,IAAI,CAAC,CAAC;QAC/D,OAAO,CACL,QAAQ,KAAK,IAAI;YACjB,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC;YAC3B,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC;YAC5B,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,CAC5B,CAAC;IACJ,CAAC,CAAC;IACF,MAAM,aAAa,GAAG,IAAI,GAAG,EAAkB,CAAC;IAChD,KAAK,MAAM,UAAU,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QAC7C,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QAC3D,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;YACvB,MAAM,IAAI,KAAK,CACb,yDAAyD,UAAU,EAAE,CACtE,CAAC;QACJ,CAAC;QACD,aAAa,CAAC,GAAG,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;IAC3C,CAAC;IACD,MAAM,UAAU,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/D,MAAM,YAAY,GAAG,MAAM,kBAAkB,CAAC,UAAU,EAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QACzE,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC;YACrC,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,OAAO,EAAE,KAAK;YACd,UAAU,EAAE,aAAa;YACzB,IAAI,EAAE,CAAC,WAAW,EAAE,iBAAiB,CAAC;YACtC,GAAG,EAAE,GAAG;SACT,CAAC,CAAC;QACH,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;YAC/C,oFAAoF;YACpF,MAAM,IAAI,KAAK,CACb,4CAA4C,GAAG,0BAA0B,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,WAAW,EAAE,CAC/H,CAAC;QACJ,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QACtE,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CACb,yBAAyB,UAAU,OAAO,GAAG,wCAAwC,uBAAuB,EAAE,CAC/G,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,GAAG,EAAE,UAAU,CAAU,CAAC;IACpC,CAAC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC;IACrC,OAAO,IAAI,GAAG,CACZ,CAAC,GAAG,aAAa,CAAC,CAAC,GAAG,CACpB,CAAC,CAAC,UAAU,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,EAAE,MAAM,CAAC,GAAG,CAAC,SAAS,CAAE,CAAU,CAC3E,CACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,kCAAkC,CAAC,OAMxD;IACC,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC;QACrC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,OAAO,EAAE,KAAK;QACd,UAAU,EAAE,aAAa;QACzB,IAAI,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC;QACpC,GAAG,EAAE,OAAO,CAAC,UAAU;KACxB,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CACb,0DAA0D,OAAO,CAAC,UAAU,EAAE,CAC/E,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,gCAAgC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACzE,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,mBAAmB,CACpD,SAAS,CAAC,aAAa,CACxB,CAAC;IACF,IACE,CAAC,4EAA4E,CAAC,IAAI,CAChF,YAAY,CACb,EACD,CAAC;QACD,MAAM,IAAI,KAAK,CACb,+CAA+C,SAAS,CAAC,aAAa,EAAE,CACzE,CAAC;IACJ,CAAC;IACD,OAAO;QACL,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,UAAU,EAAE,SAAS,CAAC,UAAU;QAChC,YAAY;KACb,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kCAAkC,CAAC,OAQxD;IACC,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,iBAAiB,GAAG,CAAC,OAAe,EAAE,SAAiB,EAAE,EAAE;QAC/D,MAAM,eAAe,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;QACrD,MAAM,mBAAmB,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;QAC3D,IAAI,eAAe,KAAK,mBAAmB;YAAE,OAAO,IAAI,CAAC;QACzD,MAAM,aAAa,GAAG,2BAA2B,CAAC,mBAAmB,CAAC,EAAE,aAAa,CAAC;QACtF,MAAM,gBAAgB,GAAG,2BAA2B,CAAC,eAAe,CAAC,EAAE,aAAa,CAAC;QACrF,IAAI,aAAa,IAAI,gBAAgB,IAAI,aAAa,KAAK,gBAAgB;YACzE,OAAO,IAAI,CAAC;QACd,wEAAwE;QACxE,2EAA2E;QAC3E,MAAM,WAAW,GAAG,eAAe,CAAC,KAAK,CACvC,oDAAoD,CACrD,EAAE,CAAC,CAAC,CAAC,CAAC;QACP,OAAO,OAAO,CACZ,aAAa,IAAI,WAAW,IAAI,aAAa,KAAK,WAAW,CAC9D,CAAC;IACJ,CAAC,CAAC;IACF,MAAM,QAAQ,GAAG;QACf,UAAU,EAAE,gCAAgC,CAAC,OAAO,CAAC,eAAe,CAAC;aAClE,UAAU;QACb,YAAY,EAAE,OAAO,CAAC,iBAAiB;KACxC,CAAC;IACF,MAAM,iBAAiB,GAAG,KAAK;SAC5B,QAAQ,CAAC,OAAO,CAAC,aAAa,EAAE,OAAO,CAAC,UAAU,CAAC;SACnD,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACzB,IACE,iBAAiB,KAAK,IAAI;QAC1B,iBAAiB,CAAC,UAAU,CAAC,KAAK,CAAC;QACnC,iBAAiB,CAAC,UAAU,CAAC,MAAM,CAAC;QACpC,KAAK,CAAC,UAAU,CAAC,iBAAiB,CAAC;QAEnC,MAAM,IAAI,KAAK,CACb,oDAAoD,OAAO,CAAC,UAAU,EAAE,CACzE,CAAC;IACJ,MAAM,SAAS,GAAG,iBAAiB,IAAI,GAAG,CAAC;IAC3C,MAAM,MAAM,GAAG,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CACjD,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,SAAS,KAAK,OAAO,CAAC,UAAU,CAClD,EAAE,QAAQ,CAAC;IACZ,MAAM,iBAAiB,GAAG,MAAM,CAAC,CAAC,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACrE,MAAM,SAAS,GAAG,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,CAAC;IACxD,MAAM,gBAAgB,GAAG,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,CAAC;IAC5D,IACE,iBAAiB;QACjB,CAAC,iBAAiB,CAAC,iBAAiB,EAAE,QAAQ,CAAC,UAAU,CAAC,EAC1D,CAAC;QACD,MAAM,YAAY,GAAG,2BAA2B,CAAC,iBAAiB,CAAC,EAAE,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACjG,MAAM,aAAa,GAAG,2BAA2B,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACpG,MAAM,SAAS,GAAG,OAAO,CAAC,YAAY,IAAI,YAAY,KAAK,aAAa,CAAC,CAAC;QAC1E,IAAI,CAAC,SAAS;YACZ,MAAM,IAAI,KAAK,CAAC,0CAA0C,SAAS,EAAE,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,SAAS,IAAI,SAAS,KAAK,QAAQ,CAAC,YAAY;QAClD,MAAM,IAAI,KAAK,CAAC,4CAA4C,SAAS,EAAE,CAAC,CAAC;IAC3E,IAAI,gBAAgB,IAAI,gBAAgB,KAAK,SAAS;QACpD,MAAM,IAAI,KAAK,CAAC,yCAAyC,SAAS,EAAE,CAAC,CAAC;IACxE,OAAO,EAAE,GAAG,QAAQ,EAAE,SAAS,EAAE,CAAC;AACpC,CAAC"}

package/dist/cli/npm/publish/fs-paths.d.ts

@@ -0,0 +1,25 @@
+import { type RuntimePath } from "@vibesdotdev/paths";
+import type { ChildEnvRuntime } from "../../shared/runtime-execution.ts";
+import type { PackageJson } from "./types.ts";
+/** A file URL from the path owner, or UNAVAILABLE when the host omits pathToFileURL. */
+export declare function requirePathFileURL(paths: RuntimePath, path: string): URL;
+/** Host-owned paths (modules, temp, installed trees) skip the workspace binding. */
+export type HostOwnedFiles = {
+    binding: false;
+};
+/** The `code` of a filesystem error, if it has one. */
+export declare function fileSystemErrorCode(error: unknown): string | undefined;
+/** True for a filesystem error that says the path is absent (ENOENT, ENOTDIR, or NOT_FOUND). */
+export declare function isPathAbsentError(error: unknown): boolean;
+/** A package manifest that must declare `name` and `version`. */
+export declare function readPackageJson(runtime: ChildEnvRuntime, packageDir: string, hostFiles?: HostOwnedFiles): Promise<PackageJson & {
+    name: string;
+    version: string;
+}>;
+/** True when `path` exists. */
+export declare function pathExists(runtime: ChildEnvRuntime, path: string, hostFiles?: HostOwnedFiles): Promise<boolean>;
+/** Bun's compiled CLI stores modules under `/$bunfs/...` with no on-disk realpath. */
+export declare function resolveOnDiskPath(runtime: ChildEnvRuntime, path: string): Promise<string>;
+/** True when `candidate` is `directory` or nested inside it. */
+export declare function isWithinDirectory(runtime: ChildEnvRuntime, directory: string, candidate: string): Promise<boolean>;
+//# sourceMappingURL=fs-paths.d.ts.map

package/dist/cli/npm/publish/fs-paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fs-paths.d.ts","sourceRoot":"","sources":["../../../../src/cli/npm/publish/fs-paths.ts"],"names":[],"mappings":"AAKA,OAAO,EAAkB,KAAK,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAStE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AAEzE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C,wFAAwF;AACxF,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,GAAG,GAAG,CAUxE;AAED,oFAAoF;AACpF,MAAM,MAAM,cAAc,GAAG;IAAE,OAAO,EAAE,KAAK,CAAA;CAAE,CAAC;AAIhD,uDAAuD;AACvD,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAItE;AAED,gGAAgG;AAChG,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAOzD;AAED,iEAAiE;AACjE,wBAAsB,eAAe,CACnC,OAAO,EAAE,eAAe,EACxB,UAAU,EAAE,MAAM,EAClB,SAAS,CAAC,EAAE,cAAc,GACzB,OAAO,CAAC,WAAW,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAU1D;AAMD,+BAA+B;AAC/B,wBAAsB,UAAU,CAC9B,OAAO,EAAE,eAAe,EACxB,IAAI,EAAE,MAAM,EACZ,SAAS,CAAC,EAAE,cAAc,GACzB,OAAO,CAAC,OAAO,CAAC,CAQlB;AAED,sFAAsF;AACtF,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,eAAe,EACxB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,MAAM,CAAC,CASjB;AAED,gEAAgE;AAChE,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,eAAe,EACxB,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,OAAO,CAAC,CAUlB"}

package/dist/cli/npm/publish/fs-paths.js

@@ -0,0 +1,87 @@
+/**
+ * Small filesystem path helpers shared by release modules: existence checks,
+ * containment, on-disk resolution and package manifest reads.
+ */
+import { realpathChecked, resolveFileSystemAdapter } from "@vibesdotdev/filesystem";
+import { getRuntimePath } from "@vibesdotdev/paths";
+import { CapabilityError, CaughtFailureSchema, isCapabilityError, settle, } from "@vibesdotdev/kernel";
+import { z } from "zod/v4";
+import { parsePublisherManifest } from "./publisher-manifest.js";
+/** A file URL from the path owner, or UNAVAILABLE when the host omits pathToFileURL. */
+export function requirePathFileURL(paths, path) {
+    const fileURL = paths.pathToFileURL;
+    if (!fileURL) {
+        throw new CapabilityError("This runtime path host cannot build a file URL.", "UNAVAILABLE", { reason: "runtime-path-file-url-unavailable" });
+    }
+    return fileURL.call(paths, path);
+}
+const fileSystemErrno = z.object({ code: z.string() });
+/** The `code` of a filesystem error, if it has one. */
+export function fileSystemErrorCode(error) {
+    const parsed = fileSystemErrno.safeParse(error);
+    if (!parsed.success)
+        return undefined;
+    return parsed.data.code;
+}
+/** True for a filesystem error that says the path is absent (ENOENT, ENOTDIR, or NOT_FOUND). */
+export function isPathAbsentError(error) {
+    const failure = CaughtFailureSchema.safeParse(error);
+    if (!failure.success)
+        return false;
+    if (isCapabilityError(failure.data) && failure.data.code === "NOT_FOUND")
+        return true;
+    const codeSource = failure.data instanceof Error ? failure.data : failure.data.value;
+    const code = fileSystemErrorCode(codeSource);
+    return code === "ENOENT" || code === "ENOTDIR";
+}
+/** A package manifest that must declare `name` and `version`. */
+export async function readPackageJson(runtime, packageDir, hostFiles) {
+    const paths = await getRuntimePath(runtime);
+    const files = await resolveFileSystemAdapter(runtime, hostFiles);
+    const manifestPath = paths.join(packageDir, "package.json");
+    const raw = z.string().parse(await files.readFile(manifestPath, "utf8"));
+    const parsed = parsePublisherManifest(JSON.parse(raw));
+    if (!parsed.name || !parsed.version) {
+        throw new Error(`${packageDir}/package.json must include name and version`);
+    }
+    return { ...parsed, name: parsed.name, version: parsed.version };
+}
+function rethrowCaught(cause) {
+    throw cause instanceof Error ? cause : cause.value;
+}
+/** True when `path` exists. */
+export async function pathExists(runtime, path, hostFiles) {
+    const stated = await settle(async () => {
+        const files = await resolveFileSystemAdapter(runtime, hostFiles);
+        await files.stat(path);
+    });
+    if (stated.ok)
+        return true;
+    if (isPathAbsentError(stated.cause))
+        return false;
+    rethrowCaught(stated.cause);
+}
+/** Bun's compiled CLI stores modules under `/$bunfs/...` with no on-disk realpath. */
+export async function resolveOnDiskPath(runtime, path) {
+    const resolved = await settle(async () => {
+        const files = await resolveFileSystemAdapter(runtime, { binding: false });
+        return await realpathChecked(files, path);
+    });
+    // A `/$bunfs/...` module path has no on-disk realpath; any other fault is real.
+    if (resolved.ok)
+        return resolved.value;
+    if (isPathAbsentError(resolved.cause))
+        return path;
+    rethrowCaught(resolved.cause);
+}
+/** True when `candidate` is `directory` or nested inside it. */
+export async function isWithinDirectory(runtime, directory, candidate) {
+    const paths = await getRuntimePath(runtime);
+    const nested = paths.relative(directory, candidate);
+    return (nested === "" ||
+        (!paths.isAbsolute(nested) &&
+            nested !== ".." &&
+            !nested.startsWith("../") &&
+            !nested.startsWith("..\\")));
+}
+//# sourceMappingURL=fs-paths.js.map

package/dist/cli/npm/publish/fs-paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fs-paths.js","sourceRoot":"","sources":["../../../../src/cli/npm/publish/fs-paths.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,eAAe,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACpF,OAAO,EAAE,cAAc,EAAoB,MAAM,oBAAoB,CAAC;AACtE,OAAO,EACL,eAAe,EACf,mBAAmB,EACnB,iBAAiB,EACjB,MAAM,GAEP,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;AAE3B,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAGjE,wFAAwF;AACxF,MAAM,UAAU,kBAAkB,CAAC,KAAkB,EAAE,IAAY;IACjE,MAAM,OAAO,GAAG,KAAK,CAAC,aAAa,CAAC;IACpC,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,eAAe,CACvB,iDAAiD,EACjD,aAAa,EACb,EAAE,MAAM,EAAE,mCAAmC,EAAE,CAChD,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;AACnC,CAAC;AAKD,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AAEvD,uDAAuD;AACvD,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAChD,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAChD,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IACtC,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC;AAC1B,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,MAAM,OAAO,GAAG,mBAAmB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACrD,IAAI,CAAC,OAAO,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IACnC,IAAI,iBAAiB,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,KAAK,WAAW;QAAE,OAAO,IAAI,CAAC;IACtF,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,YAAY,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC;IACrF,MAAM,IAAI,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;IAC7C,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,SAAS,CAAC;AACjD,CAAC;AAED,iEAAiE;AACjE,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAAwB,EACxB,UAAkB,EAClB,SAA0B;IAE1B,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,KAAK,GAAG,MAAM,wBAAwB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACjE,MAAM,YAAY,GAAG,KAAK,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC;IAC5D,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC;IACzE,MAAM,MAAM,GAAG,sBAAsB,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IACvD,IAAI,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,GAAG,UAAU,6CAA6C,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC;AACnE,CAAC;AAED,SAAS,aAAa,CAAC,KAAoB;IACzC,MAAM,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC;AACrD,CAAC;AAED,+BAA+B;AAC/B,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,OAAwB,EACxB,IAAY,EACZ,SAA0B;IAE1B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,IAAI,EAAE;QACrC,MAAM,KAAK,GAAG,MAAM,wBAAwB,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QACjE,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAC3B,IAAI,iBAAiB,CAAC,MAAM,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAClD,aAAa,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAwB,EACxB,IAAY;IAEZ,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,KAAK,IAAI,EAAE;QACvC,MAAM,KAAK,GAAG,MAAM,wBAAwB,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1E,OAAO,MAAM,eAAe,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IACH,gFAAgF;IAChF,IAAI,QAAQ,CAAC,EAAE;QAAE,OAAO,QAAQ,CAAC,KAAK,CAAC;IACvC,IAAI,iBAAiB,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnD,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAChC,CAAC;AAED,gEAAgE;AAChE,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,OAAwB,EACxB,SAAiB,EACjB,SAAiB;IAEjB,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IACpD,OAAO,CACL,MAAM,KAAK,EAAE;QACb,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC;YACxB,MAAM,KAAK,IAAI;YACf,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC;YACzB,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAC9B,CAAC;AACJ,CAAC"}

package/dist/cli/npm/publish/lease-preflight-answer.d.ts

@@ -0,0 +1,17 @@
+import { type PlatformRegistryResponse } from "./platform-registry.ts";
+export type PreflightAnswer = {
+    kind: "granted";
+} | {
+    kind: "missing-route";
+} | {
+    kind: "missing-grant";
+    ungranted: string;
+    status: number;
+    message: string;
+} | {
+    kind: "refused";
+    status: number;
+    message: string;
+};
+export declare function classifyPreflightAnswer(response: PlatformRegistryResponse, packageName: string): PreflightAnswer;
+//# sourceMappingURL=lease-preflight-answer.d.ts.map

package/dist/cli/npm/publish/lease-preflight-answer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lease-preflight-answer.d.ts","sourceRoot":"","sources":["../../../../src/cli/npm/publish/lease-preflight-answer.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,KAAK,wBAAwB,EAE9B,MAAM,wBAAwB,CAAC;AAahC,MAAM,MAAM,eAAe,GACvB;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,GACnB;IAAE,IAAI,EAAE,eAAe,CAAA;CAAE,GACzB;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC7E;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzD,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,wBAAwB,EAClC,WAAW,EAAE,MAAM,GAClB,eAAe,CAyBjB"}

package/dist/cli/npm/publish/lease-preflight-answer.js

@@ -0,0 +1,35 @@
+import { z } from "zod";
+import { missingGrantRefusal } from "./managed-lease.js";
+import { registryErrorMessage, } from "./platform-registry.js";
+const PreflightGrantedSchema = z.object({ ok: z.literal(true) });
+/**
+ * The Platform returns an error or message envelope for route refusals. A
+ * router-level missing route has no JSON envelope.
+ */
+const PlatformAnswerEnvelopeSchema = z.union([
+    z.object({ error: z.string().min(1) }),
+    z.object({ message: z.string().min(1) }),
+]);
+export function classifyPreflightAnswer(response, packageName) {
+    if (response.status === 200 &&
+        PreflightGrantedSchema.safeParse(response.payload).success) {
+        return { kind: "granted" };
+    }
+    if (response.status === 404 &&
+        !PlatformAnswerEnvelopeSchema.safeParse(response.payload).success) {
+        return { kind: "missing-route" };
+    }
+    const message = registryErrorMessage(response.payload);
+    const ungranted = missingGrantRefusal(response, packageName);
+    if (ungranted !== null) {
+        return { kind: "missing-grant", ungranted, status: response.status, message };
+    }
+    return {
+        kind: "refused",
+        status: response.status,
+        message: response.ok
+            ? "answered without {\"ok\":true} (" + message + ")"
+            : message,
+    };
+}
+//# sourceMappingURL=lease-preflight-answer.js.map

package/dist/cli/npm/publish/lease-preflight-answer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lease-preflight-answer.js","sourceRoot":"","sources":["../../../../src/cli/npm/publish/lease-preflight-answer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAEL,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAEhC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAEjE;;;GAGG;AACH,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC;IAC3C,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACtC,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;CACzC,CAAC,CAAC;AAQH,MAAM,UAAU,uBAAuB,CACrC,QAAkC,EAClC,WAAmB;IAEnB,IACE,QAAQ,CAAC,MAAM,KAAK,GAAG;QACvB,sBAAsB,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,EAC1D,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAC7B,CAAC;IACD,IACE,QAAQ,CAAC,MAAM,KAAK,GAAG;QACvB,CAAC,4BAA4B,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,EACjE,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;IACnC,CAAC;IACD,MAAM,OAAO,GAAG,oBAAoB,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACvD,MAAM,SAAS,GAAG,mBAAmB,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IAC7D,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;IAChF,CAAC;IACD,OAAO;QACL,IAAI,EAAE,SAAS;QACf,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,OAAO,EAAE,QAAQ,CAAC,EAAE;YAClB,CAAC,CAAC,kCAAkC,GAAG,OAAO,GAAG,GAAG;YACpD,CAAC,CAAC,OAAO;KACZ,CAAC;AACJ,CAAC"}

package/dist/cli/npm/publish/lease-preflight.d.ts

@@ -0,0 +1,92 @@
+/**
+ * Publish-lease preflight: before anything builds, ask the Platform whether the
+ * lease for each release output would be granted. The lease itself is only
+ * requested after the whole local build, pack and consumer proof, so a refusal
+ * learned there costs the full release; learned here it costs seconds.
+ */
+import { CapabilityError, type VibesRuntime } from "@vibesdotdev/kernel";
+import { type ManagedPublishLeaseBody } from "./managed-lease.ts";
+import { type PlatformRegistryResponse, type PlatformRegistryClient } from "./platform-registry.ts";
+import type { RegistryReleaseAvailabilityPlan } from "./registry-availability.ts";
+import type { ManagedRegistryReleaseWorkspaceWire } from "./release-workspace.ts";
+import type { RegistryReleasePublishTarget } from "./types.ts";
+/** Runs the lease route's checks without dispatching a build or minting a token. */
+export declare const PUBLISH_LEASE_PREFLIGHT_PATH = "/api/registry/publish-leases/preflight";
+/** Why the preflight stopped a publish; the command maps each to its error code. */
+export type PublishLeasePreflightFailure = "session" | "unreachable" | "missing-route" | "refused";
+/** A preflight stop, told apart so a signed-out run is not reported as bad input. */
+export declare class PublishLeasePreflightError extends CapabilityError {
+    readonly failure: PublishLeasePreflightFailure;
+    constructor(message: string, failure: PublishLeasePreflightFailure, options?: {
+        cause?: unknown;
+    });
+}
+/** One Platform request for the preflight of one lease body. */
+export type PublishLeasePreflightRequest = (body: ManagedPublishLeaseBody, registry: string) => Promise<PlatformRegistryResponse>;
+/** What `preflightManagedPublishLeases` needs from the publish command. */
+export type PublishLeasePreflightOptions = {
+    /** The runtime whose lifecycle owns the pauses between grant-lag retries. */
+    runtime: VibesRuntime;
+    publishTargets: readonly RegistryReleasePublishTarget[];
+    availabilityPlan: Pick<RegistryReleaseAvailabilityPlan, "reuse">;
+    expectedGitHeads: ReadonlyMap<string, string>;
+    releaseWorkspace: ManagedRegistryReleaseWorkspaceWire;
+    /** The Registry being published to; its owning Platform answers. */
+    registry: string;
+    /** Create the release's grants before asking; only a consented publish run does. */
+    createGrants: boolean;
+    /** The release run's Platform Registry client, bound to the command's runtime. */
+    platformRegistry: PlatformRegistryClient;
+};
+/** The preflight's outcome when nothing refused. */
+export type PublishLeasePreflightOutcome = {
+    checked: number;
+    granted: string[];
+    warnings: string[];
+};
+/**
+ * Preflight the lease of every release output that is not reused, with the
+ * exact body the lease request will send (no integrity yet: nothing is packed).
+ * Throws one error listing every refused package with the Platform's message.
+ *
+ * A publish run creates the release's grants first, as its first lease would.
+ * A dry run creates nothing, so a missing grant comes back as a warning naming
+ * the packages, never as a pass.
+ */
+export declare function preflightManagedPublishLeases(options: PublishLeasePreflightOptions & {
+    request?: PublishLeasePreflightRequest;
+    /** Whether a signed-in Vibes session exists to ask with. */
+    hasSession?: () => Promise<boolean>;
+    ensureGrants?: (releaseWorkspace: ManagedRegistryReleaseWorkspaceWire, registry: string) => Promise<void>;
+}): Promise<PublishLeasePreflightOutcome>;
+/**
+ * Whether a publish writes through Platform leases: every target is on the
+ * Vibes Registry and no `--token-key` names a static token.
+ */
+export declare function publishWritesThroughLeases(options: {
+    registryOrigin: string;
+    tokenKey: string | undefined;
+    registries: readonly string[];
+}): boolean;
+/**
+ * The publish command's gate before the release build. A publish that writes
+ * through leases preflights them, in a dry run too; only a consented publish
+ * run (`--yes`) creates grants. On any stop, `onFailure` runs first (the
+ * command removes what it staged) and the stop becomes the command's error.
+ * Returns whether the publish writes through leases.
+ */
+export declare function gateReleaseBuildOnLeasePreflight(options: Omit<PublishLeasePreflightOptions, "registry" | "createGrants" | "runtime"> & {
+    runtime: VibesRuntime;
+    tokenKey: string | undefined;
+    dryRun: boolean;
+    yes: boolean;
+    report: {
+        warn: (line: string) => void;
+        info: (line: string) => void;
+    };
+    onFailure: () => Promise<void>;
+    preflight?: (options: PublishLeasePreflightOptions) => Promise<PublishLeasePreflightOutcome>;
+}): Promise<{
+    viaLease: boolean;
+}>;
+//# sourceMappingURL=lease-preflight.d.ts.map

package/dist/cli/npm/publish/lease-preflight.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lease-preflight.d.ts","sourceRoot":"","sources":["../../../../src/cli/npm/publish/lease-preflight.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EACL,eAAe,EAIf,KAAK,YAAY,EAClB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAEL,KAAK,uBAAuB,EAE7B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,KAAK,wBAAwB,EAC7B,KAAK,sBAAsB,EAC5B,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,4BAA4B,CAAC;AAKlF,OAAO,KAAK,EAAE,mCAAmC,EAAE,MAAM,wBAAwB,CAAC;AAElF,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAC;AAI/D,oFAAoF;AACpF,eAAO,MAAM,4BAA4B,2CACC,CAAC;AAK3C,oFAAoF;AACpF,MAAM,MAAM,4BAA4B,GACpC,SAAS,GACT,aAAa,GACb,eAAe,GACf,SAAS,CAAC;AAqBd,qFAAqF;AACrF,qBAAa,0BAA2B,SAAQ,eAAe;IAC7D,QAAQ,CAAC,OAAO,EAAE,4BAA4B,CAAC;gBAG7C,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,4BAA4B,EACrC,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAShC;AAED,gEAAgE;AAChE,MAAM,MAAM,4BAA4B,GAAG,CACzC,IAAI,EAAE,uBAAuB,EAC7B,QAAQ,EAAE,MAAM,KACb,OAAO,CAAC,wBAAwB,CAAC,CAAC;AAGvC,2EAA2E;AAC3E,MAAM,MAAM,4BAA4B,GAAG;IACzC,6EAA6E;IAC7E,OAAO,EAAE,YAAY,CAAC;IACtB,cAAc,EAAE,SAAS,4BAA4B,EAAE,CAAC;IACxD,gBAAgB,EAAE,IAAI,CAAC,+BAA+B,EAAE,OAAO,CAAC,CAAC;IACjE,gBAAgB,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C,gBAAgB,EAAE,mCAAmC,CAAC;IACtD,oEAAoE;IACpE,QAAQ,EAAE,MAAM,CAAC;IACjB,oFAAoF;IACpF,YAAY,EAAE,OAAO,CAAC;IACtB,kFAAkF;IAClF,gBAAgB,EAAE,sBAAsB,CAAC;CAC1C,CAAC;AAEF,oDAAoD;AACpD,MAAM,MAAM,4BAA4B,GAAG;IACzC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB,CAAC;AAEF;;;;;;;;GAQG;AACH,wBAAsB,6BAA6B,CACjD,OAAO,EAAE,4BAA4B,GAAG;IACtC,OAAO,CAAC,EAAE,4BAA4B,CAAC;IACvC,4DAA4D;IAC5D,UAAU,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;IACpC,YAAY,CAAC,EAAE,CACb,gBAAgB,EAAE,mCAAmC,EACrD,QAAQ,EAAE,MAAM,KACb,OAAO,CAAC,IAAI,CAAC,CAAC;CACpB,GACA,OAAO,CAAC,4BAA4B,CAAC,CAkIvC;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE;IAClD,cAAc,EAAE,MAAM,CAAC;IACvB,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;CAC/B,GAAG,OAAO,CAOV;AAED;;;;;;GAMG;AACH,wBAAsB,gCAAgC,CACpD,OAAO,EAAE,IAAI,CAAC,4BAA4B,EAAE,UAAU,GAAG,cAAc,GAAG,SAAS,CAAC,GAAG;IACrF,OAAO,EAAE,YAAY,CAAC;IACtB,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,MAAM,EAAE,OAAO,CAAC;IAChB,GAAG,EAAE,OAAO,CAAC;IACb,MAAM,EAAE;QAAE,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;QAAC,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;KAAE,CAAC;IACvE,SAAS,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,SAAS,CAAC,EAAE,CACV,OAAO,EAAE,4BAA4B,KAClC,OAAO,CAAC,4BAA4B,CAAC,CAAC;CAC5C,GACA,OAAO,CAAC;IAAE,QAAQ,EAAE,OAAO,CAAA;CAAE,CAAC,CA6ChC"}

package/dist/cli/npm/publish/lease-preflight.js

@@ -0,0 +1,205 @@
+/**
+ * Publish-lease preflight: before anything builds, ask the Platform whether the
+ * lease for each release output would be granted. The lease itself is only
+ * requested after the whole local build, pack and consumer proof, so a refusal
+ * learned there costs the full release; learned here it costs seconds.
+ */
+import { CapabilityError, settle, CaughtFailureSchema, valueFreeFailure, } from "@vibesdotdev/kernel";
+import { mapWithConcurrency } from "./concurrency.js";
+import { ensureReleaseWorkspaceGrants, managedPublishLeaseBody, } from "./managed-lease.js";
+import {} from "./platform-registry.js";
+import { normalizeRegistryUrl, registryServiceOrigin, } from "./registry-credentials.js";
+import { expectedGitHeadForTarget } from "./source-snapshot.js";
+import { classifyPreflightAnswer } from "./lease-preflight-answer.js";
+import { dispatchReleaseLeasePreflight } from "./release-jobs.client.js";
+/** Runs the lease route's checks without dispatching a build or minting a token. */
+export const PUBLISH_LEASE_PREFLIGHT_PATH = "/api/registry/publish-leases/preflight";
+const PREFLIGHT_CONCURRENCY = 8;
+const PREFLIGHT_CODE = {
+    session: "AUTH_REQUIRED",
+    unreachable: "UNAVAILABLE",
+    "missing-route": "UNAVAILABLE",
+    refused: "INVALID_INPUT",
+};
+/** The one next step for a preflight stop the command can tell the operator. */
+function preflightRecoveryHint(failure) {
+    if (failure === "session")
+        return "Run `vibes auth login`, then rerun.";
+    if (failure === "unreachable")
+        return "Check `vibes auth status` and that the Platform answers, then rerun.";
+    if (failure === "missing-route")
+        return "Deploy platform-web with the publish-lease preflight route, then rerun.";
+    return undefined;
+}
+/** A preflight stop, told apart so a signed-out run is not reported as bad input. */
+export class PublishLeasePreflightError extends CapabilityError {
+    failure;
+    constructor(message, failure, options) {
+        super(message, PREFLIGHT_CODE[failure], {
+            cause: options?.cause,
+            recoveryHint: preflightRecoveryHint(failure),
+        });
+        this.name = "PublishLeasePreflightError";
+        this.failure = failure;
+    }
+}
+/**
+ * Preflight the lease of every release output that is not reused, with the
+ * exact body the lease request will send (no integrity yet: nothing is packed).
+ * Throws one error listing every refused package with the Platform's message.
+ *
+ * A publish run creates the release's grants first, as its first lease would.
+ * A dry run creates nothing, so a missing grant comes back as a warning naming
+ * the packages, never as a pass.
+ */
+export async function preflightManagedPublishLeases(options) {
+    const request = options.request;
+    const hasSession = options.hasSession ?? (() => options.platformRegistry.hasSession());
+    const ensureGrants = options.ensureGrants ??
+        ((releaseWorkspace, registry) => ensureReleaseWorkspaceGrants(releaseWorkspace, registry, {
+            runtime: options.runtime,
+            request: options.platformRegistry.raw,
+        }));
+    const targets = options.publishTargets.filter((target) => !options.availabilityPlan.reuse.has(target.name));
+    if (targets.length === 0)
+        return { checked: 0, granted: [], warnings: [] };
+    // Checked once up front so a signed-out run gets one sign-in error, not one
+    // failed request per package.
+    if (!(await hasSession())) {
+        throw new PublishLeasePreflightError(`Publishing to ${options.registry} asks its Platform whether each publish lease would be granted, in a dry run too, and there is no signed-in Vibes session.`, "session");
+    }
+    if (options.createGrants)
+        await ensureGrants(options.releaseWorkspace, options.registry);
+    // Every package gets the same 404 from a Platform without the route; stop
+    // asking after the first one.
+    let routeMissing = false;
+    const answers = await mapWithConcurrency(targets, PREFLIGHT_CONCURRENCY, async (target) => {
+        const label = `${target.name}@${target.version}`;
+        if (routeMissing)
+            return { label, answer: { kind: "missing-route" } };
+        const body = managedPublishLeaseBody({
+            pkg: {
+                name: target.name,
+                version: target.version,
+                repository: target.workspaceProvenance.repository,
+                vibes: {
+                    registry: {
+                        repositoryId: target.workspaceProvenance.repositoryId,
+                        directory: target.workspaceProvenance.directory,
+                    },
+                },
+            },
+            gitHead: expectedGitHeadForTarget(target, options.expectedGitHeads),
+            releaseWorkspace: options.releaseWorkspace,
+        });
+        const ask = async () => {
+            if (request) {
+                let response;
+                try {
+                    response = await request(body, options.registry);
+                }
+                catch (error) {
+                    throw new PublishLeasePreflightError(`Publish-lease preflight for ${label} could not ask the Platform`, "unreachable", { cause: valueFreeFailure(CaughtFailureSchema.parse(error)) });
+                }
+                return classifyPreflightAnswer(response, target.name);
+            }
+            const result = await dispatchReleaseLeasePreflight({
+                runtime: options.runtime,
+                body,
+                registry: options.registry,
+                createGrants: options.createGrants,
+            });
+            if (result.status === "unreachable") {
+                throw new PublishLeasePreflightError(`Publish-lease preflight for ${label} could not ask the Platform`, "unreachable", { cause: result.failure });
+            }
+            return classifyPreflightAnswer(result.response, target.name);
+        };
+        const answer = await ask();
+        if (answer.kind === "missing-route")
+            routeMissing = true;
+        return { label, answer };
+    });
+    if (routeMissing) {
+        throw new PublishLeasePreflightError(`The Platform that owns ${options.registry} answered its router's 404 for POST ${PUBLISH_LEASE_PREFLIGHT_PATH}: it predates the publish-lease preflight contract.`, "missing-route");
+    }
+    const refusals = answers.flatMap(({ label, answer }) => answer.kind === "refused" ||
+        (answer.kind === "missing-grant" && options.createGrants)
+        ? [`  ${label} (${answer.status}): ${answer.message}`]
+        : []);
+    const grantStops = answers.flatMap(({ label, answer }) => answer.kind === "missing-grant" && !options.createGrants
+        ? [{ label, ungranted: answer.ungranted }]
+        : []);
+    const warnings = [];
+    if (grantStops.length > 0) {
+        const ungranted = [
+            ...new Set(grantStops.map((stop) => stop.ungranted)),
+        ].sort();
+        warnings.push(`no exact Registry package grant for ${ungranted.join(", ")}. A publish run will try to create these grants before it asks; that needs admin on the repository and ownership of the package namespace, so this dry run cannot say whether those leases would be granted`, `lease checks for ${grantStops.length} package(s) stopped at the grant check, so their source and version checks did not run: ${grantStops.map((stop) => stop.label).join(", ")}`);
+    }
+    if (refusals.length > 0) {
+        throw new PublishLeasePreflightError([
+            `Publish-lease preflight refused ${refusals.length} of ${targets.length} release output(s) before any build:`,
+            ...refusals,
+            ...warnings.map((warning) => `  note: ${warning}`),
+        ].join("\n"), "refused");
+    }
+    return {
+        checked: targets.length,
+        granted: answers.flatMap(({ label, answer }) => answer.kind === "granted" ? [label] : []),
+        warnings,
+    };
+}
+/**
+ * Whether a publish writes through Platform leases: every target is on the
+ * Vibes Registry and no `--token-key` names a static token.
+ */
+export function publishWritesThroughLeases(options) {
+    return (!options.tokenKey &&
+        options.registries.every((registry) => normalizeRegistryUrl(registry) === normalizeRegistryUrl(options.registryOrigin)));
+}
+/**
+ * The publish command's gate before the release build. A publish that writes
+ * through leases preflights them, in a dry run too; only a consented publish
+ * run (`--yes`) creates grants. On any stop, `onFailure` runs first (the
+ * command removes what it staged) and the stop becomes the command's error.
+ * Returns whether the publish writes through leases.
+ */
+export async function gateReleaseBuildOnLeasePreflight(options) {
+    const registryOrigin = await registryServiceOrigin(options.runtime);
+    const viaLease = publishWritesThroughLeases({
+        registryOrigin,
+        tokenKey: options.tokenKey,
+        registries: options.publishTargets.map((target) => target.registry),
+    });
+    if (!viaLease)
+        return { viaLease };
+    const preflight = options.preflight ?? preflightManagedPublishLeases;
+    const checked = await settle(() => preflight({
+        runtime: options.runtime,
+        publishTargets: options.publishTargets,
+        availabilityPlan: options.availabilityPlan,
+        expectedGitHeads: options.expectedGitHeads,
+        releaseWorkspace: options.releaseWorkspace,
+        registry: registryOrigin,
+        createGrants: !options.dryRun && options.yes,
+        platformRegistry: options.platformRegistry,
+    }));
+    if (!checked.ok) {
+        const error = checked.cause;
+        const cleanup = await settle(options.onFailure);
+        if (!cleanup.ok) {
+            throw new AggregateError([error, cleanup.cause], "Publish-lease preflight failed and release artifact cleanup also failed.", { cause: error });
+        }
+        if (error instanceof PublishLeasePreflightError)
+            throw error;
+        if (error instanceof CapabilityError)
+            throw error;
+        throw new CapabilityError("Publish-lease preflight failed.", "INVALID_INPUT", { cause: valueFreeFailure(CaughtFailureSchema.parse(error)) });
+    }
+    const outcome = checked.value;
+    for (const warning of outcome.warnings)
+        options.report.warn(warning);
+    options.report.info(`Platform would grant ${outcome.granted.length} of ${outcome.checked} publish lease(s)`);
+    return { viaLease };
+}
+//# sourceMappingURL=lease-preflight.js.map

package/dist/cli/npm/publish/lease-preflight.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lease-preflight.js","sourceRoot":"","sources":["../../../../src/cli/npm/publish/lease-preflight.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EACL,eAAe,EACf,MAAM,EACN,mBAAmB,EACnB,gBAAgB,GAEjB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EACL,4BAA4B,EAE5B,uBAAuB,GACxB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAGN,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EACL,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAEhE,OAAO,EAAE,uBAAuB,EAAwB,MAAM,6BAA6B,CAAC;AAC5F,OAAO,EAAE,6BAA6B,EAAE,MAAM,0BAA0B,CAAC;AAEzE,oFAAoF;AACpF,MAAM,CAAC,MAAM,4BAA4B,GACvC,wCAAwC,CAAC;AAE3C,MAAM,qBAAqB,GAAG,CAAC,CAAC;AAUhC,MAAM,cAAc,GAAG;IACrB,OAAO,EAAE,eAAe;IACxB,WAAW,EAAE,aAAa;IAC1B,eAAe,EAAE,aAAa;IAC9B,OAAO,EAAE,eAAe;CAChB,CAAC;AAEX,gFAAgF;AAChF,SAAS,qBAAqB,CAC5B,OAAqC;IAErC,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,qCAAqC,CAAC;IACxE,IAAI,OAAO,KAAK,aAAa;QAC3B,OAAO,sEAAsE,CAAC;IAChF,IAAI,OAAO,KAAK,eAAe;QAC7B,OAAO,yEAAyE,CAAC;IACnF,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,qFAAqF;AACrF,MAAM,OAAO,0BAA2B,SAAQ,eAAe;IACpD,OAAO,CAA+B;IAE/C,YACE,OAAe,EACf,OAAqC,EACrC,OAA6B;QAE7B,KAAK,CAAC,OAAO,EAAE,cAAc,CAAC,OAAO,CAAC,EAAE;YACtC,KAAK,EAAE,OAAO,EAAE,KAAK;YACrB,YAAY,EAAE,qBAAqB,CAAC,OAAO,CAAC;SAC7C,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;QACzC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF;AAgCD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CACjD,OAQC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAChC,MAAM,UAAU,GACd,OAAO,CAAC,UAAU,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,gBAAgB,CAAC,UAAU,EAAE,CAAC,CAAC;IACtE,MAAM,YAAY,GAChB,OAAO,CAAC,YAAY;QACpB,CAAC,CAAC,gBAAgB,EAAE,QAAQ,EAAE,EAAE,CAC9B,4BAA4B,CAAC,gBAAgB,EAAE,QAAQ,EAAE;YACvD,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,OAAO,EAAE,OAAO,CAAC,gBAAgB,CAAC,GAAG;SACtC,CAAC,CAAC,CAAC;IAER,MAAM,OAAO,GAAG,OAAO,CAAC,cAAc,CAAC,MAAM,CAC3C,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAC7D,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC3E,4EAA4E;IAC5E,8BAA8B;IAC9B,IAAI,CAAC,CAAC,MAAM,UAAU,EAAE,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,0BAA0B,CAClC,iBAAiB,OAAO,CAAC,QAAQ,4HAA4H,EAC7J,SAAS,CACV,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,CAAC,YAAY;QACtB,MAAM,YAAY,CAAC,OAAO,CAAC,gBAAgB,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAEjE,0EAA0E;IAC1E,8BAA8B;IAC9B,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,MAAM,OAAO,GAAG,MAAM,kBAAkB,CACtC,OAAO,EACP,qBAAqB,EACrB,KAAK,EAAE,MAAM,EAAuD,EAAE;QACpE,MAAM,KAAK,GAAG,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACjD,IAAI,YAAY;YAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,EAAE,CAAC;QACtE,MAAM,IAAI,GAAG,uBAAuB,CAAC;YACnC,GAAG,EAAE;gBACH,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,UAAU,EAAE,MAAM,CAAC,mBAAmB,CAAC,UAAU;gBACjD,KAAK,EAAE;oBACL,QAAQ,EAAE;wBACR,YAAY,EAAE,MAAM,CAAC,mBAAmB,CAAC,YAAY;wBACrD,SAAS,EAAE,MAAM,CAAC,mBAAmB,CAAC,SAAS;qBAChD;iBACF;aACF;YACD,OAAO,EAAE,wBAAwB,CAAC,MAAM,EAAE,OAAO,CAAC,gBAAgB,CAAC;YACnE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;SAC3C,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,KAAK,IAA8B,EAAE;YAC/C,IAAI,OAAO,EAAE,CAAC;gBACZ,IAAI,QAAkC,CAAC;gBACvC,IAAI,CAAC;oBACH,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;gBACnD,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,IAAI,0BAA0B,CAClC,+BAA+B,KAAK,6BAA6B,EACjE,aAAa,EACb,EAAE,KAAK,EAAE,gBAAgB,CAAC,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAC9D,CAAC;gBACJ,CAAC;gBACD,OAAO,uBAAuB,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;YACxD,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,6BAA6B,CAAC;gBACjD,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,IAAI;gBACJ,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,YAAY,EAAE,OAAO,CAAC,YAAY;aACnC,CAAC,CAAC;YACH,IAAI,MAAM,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;gBACpC,MAAM,IAAI,0BAA0B,CAClC,+BAA+B,KAAK,6BAA6B,EACjE,aAAa,EACb,EAAE,KAAK,EAAE,MAAM,CAAC,OAAO,EAAE,CAC1B,CAAC;YACJ,CAAC;YACD,OAAO,uBAAuB,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAC/D,CAAC,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,GAAG,EAAE,CAAC;QAC3B,IAAI,MAAM,CAAC,IAAI,KAAK,eAAe;YAAE,YAAY,GAAG,IAAI,CAAC;QACzD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAC3B,CAAC,CACF,CAAC;IAEF,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,IAAI,0BAA0B,CAClC,0BAA0B,OAAO,CAAC,QAAQ,uCAAuC,4BAA4B,qDAAqD,EAClK,eAAe,CAChB,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CACrD,MAAM,CAAC,IAAI,KAAK,SAAS;QACzB,CAAC,MAAM,CAAC,IAAI,KAAK,eAAe,IAAI,OAAO,CAAC,YAAY,CAAC;QACvD,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,MAAM,CAAC,MAAM,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;QACtD,CAAC,CAAC,EAAE,CACP,CAAC;IACF,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CACvD,MAAM,CAAC,IAAI,KAAK,eAAe,IAAI,CAAC,OAAO,CAAC,YAAY;QACtD,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;QAC1C,CAAC,CAAC,EAAE,CACP,CAAC;IACF,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,SAAS,GAAG;YAChB,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;SACrD,CAAC,IAAI,EAAE,CAAC;QACT,QAAQ,CAAC,IAAI,CACX,uCAAuC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,6MAA6M,EACxQ,oBAAoB,UAAU,CAAC,MAAM,2FAA2F,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAClL,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,0BAA0B,CAClC;YACE,mCAAmC,QAAQ,CAAC,MAAM,OAAO,OAAO,CAAC,MAAM,sCAAsC;YAC7G,GAAG,QAAQ;YACX,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,WAAW,OAAO,EAAE,CAAC;SACnD,CAAC,IAAI,CAAC,IAAI,CAAC,EACZ,SAAS,CACV,CAAC;IACJ,CAAC;IACD,OAAO;QACL,OAAO,EAAE,OAAO,CAAC,MAAM;QACvB,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,CAC7C,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CACzC;QACD,QAAQ;KACT,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CAAC,OAI1C;IACC,OAAO,CACL,CAAC,OAAO,CAAC,QAAQ;QACjB,OAAO,CAAC,UAAU,CAAC,KAAK,CACtB,CAAC,QAAQ,EAAE,EAAE,CAAC,oBAAoB,CAAC,QAAQ,CAAC,KAAK,oBAAoB,CAAC,OAAO,CAAC,cAAc,CAAC,CAC9F,CACF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,OAUC;IAED,MAAM,cAAc,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACpE,MAAM,QAAQ,GAAG,0BAA0B,CAAC;QAC1C,cAAc;QACd,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,UAAU,EAAE,OAAO,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC;KACpE,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;IACnC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,6BAA6B,CAAC;IACrE,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,CAChC,SAAS,CAAC;QACR,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;QAC1C,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;QAC1C,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;QAC1C,QAAQ,EAAE,cAAc;QACxB,YAAY,EAAE,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG;QAC5C,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;KAC3C,CAAC,CACH,CAAC;IACF,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAChB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC5B,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QAChD,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,MAAM,IAAI,cAAc,CACtB,CAAC,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,EACtB,0EAA0E,EAC1E,EAAE,KAAK,EAAE,KAAK,EAAE,CACjB,CAAC;QACJ,CAAC;QACD,IAAI,KAAK,YAAY,0BAA0B;YAAE,MAAM,KAAK,CAAC;QAC7D,IAAI,KAAK,YAAY,eAAe;YAAE,MAAM,KAAK,CAAC;QAClD,MAAM,IAAI,eAAe,CACvB,iCAAiC,EACjC,eAAe,EACf,EAAE,KAAK,EAAE,gBAAgB,CAAC,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAC9D,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC;IAC9B,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,QAAQ;QAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACrE,OAAO,CAAC,MAAM,CAAC,IAAI,CACjB,wBAAwB,OAAO,CAAC,OAAO,CAAC,MAAM,OAAO,OAAO,CAAC,OAAO,mBAAmB,CACxF,CAAC;IACF,OAAO,EAAE,QAAQ,EAAE,CAAC;AACtB,CAAC"}

package/dist/cli/npm/publish/managed-lease.d.ts

@@ -0,0 +1,110 @@
+/**
+ * Managed publish leases: package grants for a release's outputs, minting and
+ * revoking the short-lived publish credential, and proof that stale leases fail.
+ */
+import { CapabilityError, type RuntimeRef, type ValueFreeFailure } from "@vibesdotdev/kernel";
+import { type JsonValue } from "@vibesdotdev/kernel/schemas/json";
+import type { JobExecutionContext } from "@vibesdotdev/kernel/kinds";
+import type { RunNpmResult } from "./npm-exec.ts";
+import { type ManagedPublishLease, type PlatformRegistryClient, type PlatformRegistryRawRequest, type PlatformRegistryResponse } from "./platform-registry.ts";
+import type { ManagedRegistryReleasePackage, ManagedRegistryReleaseWorkspaceWire } from "./release-workspace.ts";
+import { type ManagedPublishLeaseBody } from "../../../schemas/release-jobs.ts";
+import type { PackageJson, RegistryReleaseBuildPackage } from "./types.ts";
+/**
+ * Throw unless an npm attempt failed with an authority rejection (401/403 or lease error).
+ */
+export declare function assertAuthorityLeaseRejected(result: RunNpmResult, label: string): void;
+/** The release outputs of one source repository, as lease release packages. */
+export declare function managedReleasePackagesForSource(publishTargets: readonly (RegistryReleaseBuildPackage | ManagedRegistryReleasePackage)[], repositoryId: string): Array<{
+    directory: string;
+    packageName: string;
+    version: string;
+}>;
+export type { PlatformRegistryRawRequest } from "./platform-registry.ts";
+/**
+ * The Platform calls a lease mint and its grant pass make: the release run's
+ * `createPlatformRegistryClient(runtime).raw`, or a test's recorder.
+ */
+export type ManagedLeaseDeps = {
+    /** Runtime lifecycle for deadlines and the owner of the release-grants client. */
+    runtime: Pick<RuntimeRef, "lifecycle" | "hasKind" | "registerPlugin" | "query">;
+    request: PlatformRegistryRawRequest;
+    signal?: AbortSignal;
+    park?: JobExecutionContext<unknown>["park"];
+    sleep?: (ms: number) => Promise<void>;
+};
+/**
+ * A grant this run just created can still read as missing: concurrent creates
+ * race, and the lease check can read before the write is visible. Publish jobs
+ * use these delays for Workers continuations; lease preflight uses the same
+ * bounded read-lag window while checking grants.
+ */
+export declare const GRANT_READ_LAG_RETRY_DELAYS_MS: readonly number[];
+/**
+ * The missing-grant refusal the lease route and its preflight share: 403
+ * without a name when the requested package has no exact grant, 409 naming the
+ * release-workspace package that has none. Returns the ungranted package, or
+ * null for any other answer.
+ */
+export declare function missingGrantRefusal(response: PlatformRegistryResponse, requestedPackage: string): string | null;
+/**
+ * Grant every Registry output of the sealed release workspace, source by source.
+ * The lease route and its preflight check an exact grant for every workspace
+ * package of every source, not only the package they name, so the first lease
+ * of a release needs the whole set. The only owner of release grants: every
+ * lease mint and the preflight of a publish run come through here.
+ */
+export declare function ensureReleaseWorkspaceGrants(releaseWorkspace: ManagedRegistryReleaseWorkspaceWire, registry: string | undefined, deps: ManagedLeaseDeps): Promise<void>;
+/** The JSON body the publish-lease route and its preflight both take. */
+export type { ManagedPublishLeaseBody };
+/**
+ * The JSON object a platform lease request will send.
+ * `JSON.stringify` omits undefined fields the typed wire object may carry.
+ */
+export declare function registryJsonBody(value: ManagedPublishLeaseBody): JsonValue;
+/**
+ * The lease request for one exact publish output of the sealed release
+ * workspace. A preflight sends it before anything is packed, so without an
+ * integrity.
+ */
+export declare function managedPublishLeaseBody(options: {
+    pkg: PackageJson & {
+        name: string;
+        version: string;
+    };
+    gitHead: string;
+    integrity?: string;
+    releaseWorkspace: ManagedRegistryReleaseWorkspaceWire;
+    ttlSeconds?: number;
+}): ManagedPublishLeaseBody;
+export declare class RegistryGrantReadLagError extends CapabilityError {
+    readonly refusal: Error;
+    constructor(refusal: Error);
+}
+/**
+ * Grant the release workspace's outputs and make one idempotent lease request.
+ * Workers owns subsequent polling and read-lag continuation.
+ */
+export declare function mintManagedPublishLease(options: {
+    pkg: PackageJson & {
+        name: string;
+        version: string;
+    };
+    gitHead: string;
+    integrity: string;
+    releaseWorkspace: ManagedRegistryReleaseWorkspaceWire;
+    registry?: string;
+    ttlSeconds?: number;
+    deadlineAt?: number;
+} & ManagedLeaseDeps): Promise<ManagedPublishLease>;
+/**
+ * Revoke a publish lease. A failed revoke is returned value-free so the caller
+ * can report it and continue; one-use credentials expire on their own.
+ */
+export declare function revokeManagedPublishLease(client: Pick<PlatformRegistryClient, "request">, id: string, registry?: string): Promise<{
+    ok: true;
+} | {
+    ok: false;
+    cause: ValueFreeFailure;
+}>;
+//# sourceMappingURL=managed-lease.d.ts.map