@vibesdotdev/infra-deploy 0.0.2 → 1.0.0-rc.4

package/dist/cli/npm/publish/managed-lease.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"managed-lease.d.ts","sourceRoot":"","sources":["../../../../src/cli/npm/publish/managed-lease.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EACL,eAAe,EAIf,KAAK,UAAU,EACf,KAAK,gBAAgB,EACtB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAmB,KAAK,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAGnF,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAMrE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC3B,KAAK,0BAA0B,EAC/B,KAAK,wBAAwB,EAI9B,MAAM,wBAAwB,CAAC;AAChC,OAAO,KAAK,EACV,6BAA6B,EAC7B,mCAAmC,EACpC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAiC,KAAK,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAC/G,OAAO,KAAK,EAAE,WAAW,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAC;AAE3E;;GAEG;AACH,wBAAgB,4BAA4B,CAC1C,MAAM,EAAE,YAAY,EACpB,KAAK,EAAE,MAAM,GACZ,IAAI,CASN;AAED,+EAA+E;AAC/E,wBAAgB,+BAA+B,CAC7C,cAAc,EAAE,SAAS,CACvB,2BAA2B,GAAG,6BAA6B,CAC5D,EAAE,EACH,YAAY,EAAE,MAAM,GACnB,KAAK,CAAC;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAqBpE;AAED,YAAY,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AAEzE;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,kFAAkF;IAClF,OAAO,EAAE,IAAI,CAAC,UAAU,EAAE,WAAW,GAAG,SAAS,GAAG,gBAAgB,GAAG,OAAO,CAAC,CAAC;IAChF,OAAO,EAAE,0BAA0B,CAAC;IACpC,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,IAAI,CAAC,EAAE,mBAAmB,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC;IAC5C,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC,CAAC;AAKF;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,EAAE,SAAS,MAAM,EAE3D,CAAC;AAMF;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,QAAQ,EAAE,wBAAwB,EAClC,gBAAgB,EAAE,MAAM,GACvB,MAAM,GAAG,IAAI,CAKf;AAeD;;;;;;GAMG;AACH,wBAAsB,4BAA4B,CAChD,gBAAgB,EAAE,mCAAmC,EACrD,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,IAAI,EAAE,gBAAgB,GACrB,OAAO,CAAC,IAAI,CAAC,CAcf;AAED,yEAAyE;AACzE,YAAY,EAAE,uBAAuB,EAAE,CAAC;AAExC;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,uBAAuB,GAAG,SAAS,CAmB1E;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE;IAC/C,GAAG,EAAE,WAAW,GAAG;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IACrD,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gBAAgB,EAAE,mCAAmC,CAAC;IACtD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,uBAAuB,CA0C1B;AAED,qBAAa,yBAA0B,SAAQ,eAAe;IAChD,QAAQ,CAAC,OAAO,EAAE,KAAK;gBAAd,OAAO,EAAE,KAAK;CAQpC;AAED;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE;IACP,GAAG,EAAE,WAAW,GAAG;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IACrD,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,mCAAmC,CAAC;IACtD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GAAG,gBAAgB,GACnB,OAAO,CAAC,mBAAmB,CAAC,CAgC9B;AAED;;;GAGG;AACH,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,IAAI,CAAC,sBAAsB,EAAE,SAAS,CAAC,EAC/C,EAAE,EAAE,MAAM,EACV,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,gBAAgB,CAAA;CAAE,CAAC,CAYhE"}

package/dist/cli/npm/publish/managed-lease.js

@@ -0,0 +1,191 @@
+/**
+ * Managed publish leases: package grants for a release's outputs, minting and
+ * revoking the short-lived publish credential, and proof that stale leases fail.
+ */
+import { CapabilityError, settle, settleNow, valueFreeFailure, } from "@vibesdotdev/kernel";
+import { JsonValueSchema } from "@vibesdotdev/kernel/schemas/json";
+import { z } from "zod";
+import { getVibesClient } from "@vibesdotdev/kernel/client";
+import { forgeRegistryRepositoryUrl, repositoryUrl, } from "./forge-source-identity.js";
+import { MANAGED_LEASE_POLL_DEADLINE_MS, pollManagedPublishLease, registryErrorMessage, } from "./platform-registry.js";
+import { ManagedPublishLeaseBodySchema } from "../../../schemas/release-jobs.js";
+/**
+ * Throw unless an npm attempt failed with an authority rejection (401/403 or lease error).
+ */
+export function assertAuthorityLeaseRejected(result, label) {
+    if (result.status === 0)
+        throw new Error(`${label} unexpectedly succeeded`);
+    if (!/(?:401|403|publish lease|authentication required|unauthorized|forbidden)/i.test(`${result.stdout}\n${result.stderr}`)) {
+        throw new Error(`${label} did not return an authority rejection`);
+    }
+}
+/** The release outputs of one source repository, as lease release packages. */
+export function managedReleasePackagesForSource(publishTargets, repositoryId) {
+    return publishTargets
+        .filter((candidate) => ("workspaceProvenance" in candidate
+        ? candidate.workspaceProvenance.repositoryId
+        : candidate.sourceRepositoryId) === repositoryId)
+        .map((candidate) => "workspaceProvenance" in candidate
+        ? {
+            directory: candidate.workspaceProvenance.directory,
+            packageName: candidate.name,
+            version: candidate.version,
+        }
+        : {
+            directory: candidate.directory,
+            packageName: candidate.packageName,
+            version: candidate.version,
+        });
+}
+const PUBLISH_LEASES_PATH = "/api/registry/publish-leases";
+const PUBLISH_LEASE_REVOCATION_TIMEOUT_MS = 10_000;
+/**
+ * A grant this run just created can still read as missing: concurrent creates
+ * race, and the lease check can read before the write is visible. Publish jobs
+ * use these delays for Workers continuations; lease preflight uses the same
+ * bounded read-lag window while checking grants.
+ */
+export const GRANT_READ_LAG_RETRY_DELAYS_MS = [
+    2_000, 4_000, 6_000,
+];
+const MissingGrantRefusalSchema = z.object({
+    error: z.string().regex(/^No exact Registry package grant(?: for \S+)?/),
+});
+/**
+ * The missing-grant refusal the lease route and its preflight share: 403
+ * without a name when the requested package has no exact grant, 409 naming the
+ * release-workspace package that has none. Returns the ungranted package, or
+ * null for any other answer.
+ */
+export function missingGrantRefusal(response, requestedPackage) {
+    if (response.status !== 403 && response.status !== 409)
+        return null;
+    const refusal = MissingGrantRefusalSchema.safeParse(response.payload);
+    if (!refusal.success)
+        return null;
+    return / for (\S+)/.exec(refusal.data.error)?.[1] ?? requestedPackage;
+}
+/** The Registry outputs one source contributes to the sealed release workspace. */
+function releaseSourceGrants(releaseWorkspace, repositoryId) {
+    return releaseWorkspace.packages
+        .filter((candidate) => candidate.sourceRepositoryId === repositoryId)
+        .map((candidate) => ({
+        packageName: candidate.packageName,
+        directory: candidate.directory,
+    }));
+}
+/**
+ * Grant every Registry output of the sealed release workspace, source by source.
+ * The lease route and its preflight check an exact grant for every workspace
+ * package of every source, not only the package they name, so the first lease
+ * of a release needs the whole set. The only owner of release grants: every
+ * lease mint and the preflight of a publish run come through here.
+ */
+export async function ensureReleaseWorkspaceGrants(releaseWorkspace, registry, deps) {
+    const client = await getVibesClient("infra-deploy.release-grants", deps.runtime);
+    const repositoryIds = new Set(releaseWorkspace.packages.map((candidate) => candidate.sourceRepositoryId));
+    for (const repositoryId of repositoryIds) {
+        await client.ensureGrants(repositoryId, releaseSourceGrants(releaseWorkspace, repositoryId), registry, deps.signal, deps.park);
+    }
+}
+/**
+ * The JSON object a platform lease request will send.
+ * `JSON.stringify` omits undefined fields the typed wire object may carry.
+ */
+export function registryJsonBody(value) {
+    const admittedBody = ManagedPublishLeaseBodySchema.parse(value);
+    const encoded = settleNow(() => JSON.parse(JSON.stringify(admittedBody)));
+    if (!encoded.ok) {
+        throw new CapabilityError("Registry request body was not JSON.", "INVALID_INPUT", { reason: "registry-body-not-json", cause: valueFreeFailure(encoded.cause) });
+    }
+    const admitted = JsonValueSchema.safeParse(encoded.value);
+    if (!admitted.success) {
+        throw new CapabilityError("Registry request body was not JSON.", "INVALID_INPUT", { reason: "registry-body-not-json" });
+    }
+    return admitted.data;
+}
+/**
+ * The lease request for one exact publish output of the sealed release
+ * workspace. A preflight sends it before anything is packed, so without an
+ * integrity.
+ */
+export function managedPublishLeaseBody(options) {
+    const repositoryId = options.pkg.vibes?.registry?.repositoryId;
+    const directory = options.pkg.vibes?.registry?.directory;
+    const repository = repositoryUrl(options.pkg);
+    if (!repositoryId || !directory || !repository) {
+        throw new Error(`${options.pkg.name}@${options.pkg.version} requires vibes.registry repositoryId/directory and repository metadata`);
+    }
+    const releasePackages = managedReleasePackagesForSource(options.releaseWorkspace.packages, repositoryId);
+    if (!releasePackages.some((candidate) => candidate.packageName === options.pkg.name &&
+        candidate.version === options.pkg.version &&
+        candidate.directory === directory)) {
+        throw new Error(`${options.pkg.name}@${options.pkg.version} is not an exact sealed publish output`);
+    }
+    const body = {
+        packageName: options.pkg.name,
+        version: options.pkg.version,
+        repositoryId,
+        repository: forgeRegistryRepositoryUrl(repository),
+        directory,
+        gitHead: options.gitHead,
+        releasePackages,
+        releaseWorkspace: options.releaseWorkspace,
+    };
+    if (options.integrity !== undefined)
+        body.integrity = options.integrity;
+    // Zero is not a lease lifetime. It stays omitted, as an absent ttl does, so
+    // the platform default applies. Any other number is sent.
+    if (options.ttlSeconds !== undefined && options.ttlSeconds !== 0) {
+        body.ttlSeconds = options.ttlSeconds;
+    }
+    return body;
+}
+export class RegistryGrantReadLagError extends CapabilityError {
+    refusal;
+    constructor(refusal) {
+        super(refusal.message, "UNAVAILABLE", {
+            reason: "registry-grant-read-lag",
+            retryable: true,
+            cause: refusal,
+        });
+        this.refusal = refusal;
+        this.name = "RegistryGrantReadLagError";
+    }
+}
+/**
+ * Grant the release workspace's outputs and make one idempotent lease request.
+ * Workers owns subsequent polling and read-lag continuation.
+ */
+export async function mintManagedPublishLease(options) {
+    const leaseBody = managedPublishLeaseBody(options);
+    const request = options.request;
+    await ensureReleaseWorkspaceGrants(options.releaseWorkspace, options.registry, {
+        runtime: options.runtime,
+        request,
+        signal: options.signal,
+        park: options.park,
+    });
+    const response = await request(PUBLISH_LEASES_PATH, "POST", registryJsonBody(leaseBody), options.registry, options.signal);
+    const ungranted = missingGrantRefusal(response, leaseBody.packageName);
+    if (ungranted !== null) {
+        throw new RegistryGrantReadLagError(new Error(`Registry authority request failed (${response.status}): ${registryErrorMessage(response.payload)}`));
+    }
+    const now = () => options.runtime.lifecycle.now();
+    return pollManagedPublishLease({
+        request: async () => response,
+        deadlineAt: options.deadlineAt ?? now() + MANAGED_LEASE_POLL_DEADLINE_MS,
+        now,
+    });
+}
+/**
+ * Revoke a publish lease. A failed revoke is returned value-free so the caller
+ * can report it and continue; one-use credentials expire on their own.
+ */
+export async function revokeManagedPublishLease(client, id, registry) {
+    const revoked = await settle(() => client.request("/api/registry/tokens", "DELETE", { id }, registry, AbortSignal.timeout(PUBLISH_LEASE_REVOCATION_TIMEOUT_MS)));
+    if (revoked.ok)
+        return { ok: true };
+    return { ok: false, cause: valueFreeFailure(revoked.cause) };
+}
+//# sourceMappingURL=managed-lease.js.map

package/dist/cli/npm/publish/managed-lease.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"managed-lease.js","sourceRoot":"","sources":["../../../../src/cli/npm/publish/managed-lease.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EACL,eAAe,EACf,MAAM,EACN,SAAS,EACT,gBAAgB,GAGjB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,eAAe,EAAkB,MAAM,kCAAkC,CAAC;AACnF,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAG5D,OAAO,EACL,0BAA0B,EAC1B,aAAa,GACd,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EAKL,8BAA8B,EAC9B,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,wBAAwB,CAAC;AAKhC,OAAO,EAAE,6BAA6B,EAAgC,MAAM,kCAAkC,CAAC;AAG/G;;GAEG;AACH,MAAM,UAAU,4BAA4B,CAC1C,MAAoB,EACpB,KAAa;IAEb,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,yBAAyB,CAAC,CAAC;IAC5E,IACE,CAAC,2EAA2E,CAAC,IAAI,CAC/E,GAAG,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,CACrC,EACD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,GAAG,KAAK,wCAAwC,CAAC,CAAC;IACpE,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,+BAA+B,CAC7C,cAEG,EACH,YAAoB;IAEpB,OAAO,cAAc;SAClB,MAAM,CACL,CAAC,SAAS,EAAE,EAAE,CACZ,CAAC,qBAAqB,IAAI,SAAS;QACjC,CAAC,CAAC,SAAS,CAAC,mBAAmB,CAAC,YAAY;QAC5C,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,KAAK,YAAY,CACrD;SACA,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CACjB,qBAAqB,IAAI,SAAS;QAChC,CAAC,CAAC;YACE,SAAS,EAAE,SAAS,CAAC,mBAAmB,CAAC,SAAS;YAClD,WAAW,EAAE,SAAS,CAAC,IAAI;YAC3B,OAAO,EAAE,SAAS,CAAC,OAAO;SAC3B;QACH,CAAC,CAAC;YACE,SAAS,EAAE,SAAS,CAAC,SAAS;YAC9B,WAAW,EAAE,SAAS,CAAC,WAAW;YAClC,OAAO,EAAE,SAAS,CAAC,OAAO;SAC3B,CACN,CAAC;AACN,CAAC;AAiBD,MAAM,mBAAmB,GAAG,8BAA8B,CAAC;AAC3D,MAAM,mCAAmC,GAAG,MAAM,CAAC;AAEnD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAsB;IAC/D,KAAK,EAAE,KAAK,EAAE,KAAK;CACpB,CAAC;AAEF,MAAM,yBAAyB,GAAG,CAAC,CAAC,MAAM,CAAC;IACzC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,+CAA+C,CAAC;CACzE,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CACjC,QAAkC,EAClC,gBAAwB;IAExB,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACpE,MAAM,OAAO,GAAG,yBAAyB,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACtE,IAAI,CAAC,OAAO,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAClC,OAAO,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,gBAAgB,CAAC;AACxE,CAAC;AAED,mFAAmF;AACnF,SAAS,mBAAmB,CAC1B,gBAAqD,EACrD,YAAoB;IAEpB,OAAO,gBAAgB,CAAC,QAAQ;SAC7B,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,kBAAkB,KAAK,YAAY,CAAC;SACpE,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QACnB,WAAW,EAAE,SAAS,CAAC,WAAW;QAClC,SAAS,EAAE,SAAS,CAAC,SAAS;KAC/B,CAAC,CAAC,CAAC;AACR,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,gBAAqD,EACrD,QAA4B,EAC5B,IAAsB;IAEtB,MAAM,MAAM,GAAG,MAAM,cAAc,CAAsB,6BAA6B,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACtG,MAAM,aAAa,GAAG,IAAI,GAAG,CAC3B,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAC3E,CAAC;IACF,KAAK,MAAM,YAAY,IAAI,aAAa,EAAE,CAAC;QACzC,MAAM,MAAM,CAAC,YAAY,CACvB,YAAY,EACZ,mBAAmB,CAAC,gBAAgB,EAAE,YAAY,CAAC,EACnD,QAAQ,EACR,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,IAAI,CACV,CAAC;IACJ,CAAC;AACH,CAAC;AAKD;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAA8B;IAC7D,MAAM,YAAY,GAAG,6BAA6B,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAChE,MAAM,OAAO,GAAG,SAAS,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAC1E,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAChB,MAAM,IAAI,eAAe,CACvB,qCAAqC,EACrC,eAAe,EACf,EAAE,MAAM,EAAE,wBAAwB,EAAE,KAAK,EAAE,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAC7E,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,eAAe,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IAC1D,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtB,MAAM,IAAI,eAAe,CACvB,qCAAqC,EACrC,eAAe,EACf,EAAE,MAAM,EAAE,wBAAwB,EAAE,CACrC,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,CAAC;AACvB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAMvC;IACC,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,YAAY,CAAC;IAC/D,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,SAAS,CAAC;IACzD,MAAM,UAAU,GAAG,aAAa,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9C,IAAI,CAAC,YAAY,IAAI,CAAC,SAAS,IAAI,CAAC,UAAU,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CACb,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,yEAAyE,CACpH,CAAC;IACJ,CAAC;IACD,MAAM,eAAe,GAAG,+BAA+B,CACrD,OAAO,CAAC,gBAAgB,CAAC,QAAQ,EACjC,YAAY,CACb,CAAC;IACF,IACE,CAAC,eAAe,CAAC,IAAI,CACnB,CAAC,SAAS,EAAE,EAAE,CACZ,SAAS,CAAC,WAAW,KAAK,OAAO,CAAC,GAAG,CAAC,IAAI;QAC1C,SAAS,CAAC,OAAO,KAAK,OAAO,CAAC,GAAG,CAAC,OAAO;QACzC,SAAS,CAAC,SAAS,KAAK,SAAS,CACpC,EACD,CAAC;QACD,MAAM,IAAI,KAAK,CACb,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,wCAAwC,CACnF,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAA4B;QACpC,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI;QAC7B,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO;QAC5B,YAAY;QACZ,UAAU,EAAE,0BAA0B,CAAC,UAAU,CAAC;QAClD,SAAS;QACT,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,eAAe;QACf,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;KAC3C,CAAC;IACF,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS;QAAE,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;IACxE,4EAA4E;IAC5E,0DAA0D;IAC1D,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,IAAI,OAAO,CAAC,UAAU,KAAK,CAAC,EAAE,CAAC;QACjE,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IACvC,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,OAAO,yBAA0B,SAAQ,eAAe;IACvC;IAArB,YAAqB,OAAc;QACjC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,aAAa,EAAE;YACpC,MAAM,EAAE,yBAAyB;YACjC,SAAS,EAAE,IAAI;YACf,KAAK,EAAE,OAAO;SACf,CAAC,CAAC;QALgB,YAAO,GAAP,OAAO,CAAO;QAMjC,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAQoB;IAEpB,MAAM,SAAS,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;IACnD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAChC,MAAM,4BAA4B,CAAC,OAAO,CAAC,gBAAgB,EAAE,OAAO,CAAC,QAAQ,EAAE;QAC7E,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,OAAO;QACP,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,IAAI,EAAE,OAAO,CAAC,IAAI;KACnB,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAC5B,mBAAmB,EACnB,MAAM,EACN,gBAAgB,CAAC,SAAS,CAAC,EAC3B,OAAO,CAAC,QAAQ,EAChB,OAAO,CAAC,MAAM,CACf,CAAC;IACF,MAAM,SAAS,GAAG,mBAAmB,CAAC,QAAQ,EAAE,SAAS,CAAC,WAAW,CAAC,CAAC;IACvE,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,MAAM,IAAI,yBAAyB,CACjC,IAAI,KAAK,CACP,sCAAsC,QAAQ,CAAC,MAAM,MAAM,oBAAoB,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CACpG,CACF,CAAC;IACJ,CAAC;IAED,MAAM,GAAG,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC;IAClD,OAAO,uBAAuB,CAAC;QAC7B,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC,QAAQ;QAC7B,UAAU,EAAE,OAAO,CAAC,UAAU,IAAI,GAAG,EAAE,GAAG,8BAA8B;QACxE,GAAG;KACJ,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,MAA+C,EAC/C,EAAU,EACV,QAAiB;IAEjB,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,CAChC,MAAM,CAAC,OAAO,CACZ,sBAAsB,EACtB,QAAQ,EACR,EAAE,EAAE,EAAE,EACN,QAAQ,EACR,WAAW,CAAC,OAAO,CAAC,mCAAmC,CAAC,CACzD,CACF,CAAC;IACF,IAAI,OAAO,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACpC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;AAC/D,CAAC"}

package/dist/cli/npm/publish/npm-exec.d.ts

@@ -0,0 +1,148 @@
+/**
+ * npm command execution: the isolated npm environment, npmrc rendering,
+ * secret redaction, publish arguments, and classification of npm failures.
+ */
+import type { ChildEnvRuntime } from "../../shared/runtime-execution.ts";
+import { CapabilityError } from "@vibesdotdev/kernel";
+import type { RuntimeExecution } from "@vibesdotdev/kernel/execution";
+import { type ExecutionOutputLine } from "../../shared/runtime-execution.ts";
+/** Exit status and captured output of one npm run. */
+export type RunNpmResult = {
+    status: number | null;
+    stdout: string;
+    stderr: string;
+};
+/** A failed npm command, carrying its arguments and (redacted) output. */
+export declare class NpmCommandError extends CapabilityError {
+    readonly args: string[];
+    readonly status: number | null;
+    readonly stdout: string;
+    readonly stderr: string;
+    constructor(args: string[], result: RunNpmResult);
+}
+/** Replace every exact occurrence of each secret with `[REDACTED]`. */
+export declare function redactExactSecrets(value: string, secrets: readonly string[]): string;
+/**
+ * Run npm through the runtime execution with secrets redacted from output;
+ * throws `NpmCommandError` on failure unless `allowFailure`.
+ */
+export declare function runNpm(execution: RuntimeExecution, args: string[], options: {
+    /** The runtime the npm child's environment is composed from. */
+    runtime: ChildEnvRuntime;
+    cwd: string;
+    env?: Record<string, string>;
+    quiet?: boolean;
+    allowFailure?: boolean;
+    onLine?: ExecutionOutputLine;
+    redactValues?: readonly string[];
+}): Promise<RunNpmResult>;
+/** The npm output (plus any Registry auth hint) or message of a failure. */
+export declare function npmOutput(error: unknown): string;
+/** The file list and integrity from `npm pack --json` output. */
+export declare function parsePackManifest(stdout: string): {
+    files: string[];
+    integrity: string;
+};
+/** True when npm failed with a rate limit (E429). */
+export declare function isNpmRateLimitError(error: unknown): boolean;
+/**
+ * True when a publish attempt failed in transport or the registry marked its
+ * PUT refusal retryable: the same publish may run again. A retry whose first
+ * upload did land is refused as an existing version, which the caller skips.
+ */
+export declare function isTransientPublishError(error: unknown): boolean;
+/** True when npm refused to publish over an existing version (E409). */
+export declare function isNpmExistingVersionError(error: unknown): boolean;
+/** The `name@version` npm spec. */
+export declare function versionSpec(name: string, version: string): string;
+/** The file name `npm pack` gives `name@version`. */
+export declare function npmTarballFilename(name: string, version: string): string;
+/**
+ * npm's output with its `npm error` lines first and each repeated line kept
+ * once. npm prints its warnings before the error that failed the command, so
+ * a bounded message cut from the front would otherwise show only warnings.
+ */
+export declare function npmErrorLinesFirst(output: string): string;
+/**
+ * A redacted, whitespace-collapsed failure message of at most `limit`
+ * characters (500 by default).
+ */
+export declare function boundedCleanupFailureMessage(error: unknown, redactValues: readonly string[], limit?: number): string;
+export declare function releaseConsumerNpmInstallFailure(error: unknown, redactValues: readonly string[]): Error;
+/**
+ * npm treats the nearest directory with a package.json as the project root and
+ * stops walking ancestor `.npmrc` files there. Release temp dirs live under
+ * `<workspace>/.vibes/tmp/registry-release/`, so without this file npm loads
+ * the compose-root `//packages.vibes.dev/:_authToken=${VIBES_REGISTRY_TOKEN}`
+ * line, interpolates the env var this command deletes, and overrides the
+ * isolated lease with an empty Bearer.
+ */
+export declare const ISOLATED_NPM_PROJECT_MANIFEST = "{\"private\":true}\n";
+/** Pin `dir` as its own npm project so ancestor `.npmrc` files are not read. */
+export declare function writeIsolatedNpmProjectManifest(runtime: ChildEnvRuntime, dir: string): Promise<void>;
+/**
+ * bun walks ancestor `bunfig.toml` files independently of package.json.
+ * Release temps live under `<workspace>/.vibes/tmp/registry-release/`, so a
+ * throwaway consumer with `envMode:replace` (no VIBES_REGISTRY_TOKEN) still
+ * inherits the worktree `[install.scopes] token = "$VIBES_REGISTRY_TOKEN"`.
+ * Bun interpolates the empty env var and 404s restricted packuments — a leak
+ * that looks like a missing publish. Nearest bunfig wins: pin one with no
+ * scopes so that walk stops before the worktree file.
+ */
+export declare const ISOLATED_BUNFIG = "# Isolated release temp: do not inherit ancestor [install.scopes].\n[install]\n";
+/** Pin `dir` with a scope-free bunfig so ancestor bunfig files are not read. */
+export declare function writeIsolatedBunfig(runtime: ChildEnvRuntime, dir: string): Promise<void>;
+/** The single tarball in `dir`; throws unless exactly one exists. */
+export declare function newestTarball(runtime: ChildEnvRuntime, dir: string): Promise<string>;
+/** The npmrc `_authToken` key for `registry`. */
+export declare function authConfigLine(registry: string): string;
+/** An npmrc for authenticated Registry reads; one token never spans origins. */
+export declare function registryReadNpmrc(options: {
+    registries: readonly string[];
+    scope?: string;
+    token?: string;
+}): string;
+/**
+ * The declared environment of an isolated npm run: its own home, cache and user
+ * config. The child composes its base from the runtime (`envMode: 'replace'`),
+ * so no host variable, npm config or Registry credential is inherited.
+ */
+export declare function isolatedNpmPackEnv(options: {
+    homeDir: string;
+    cacheDir: string;
+    npmrcPath: string;
+}): {
+    HOME: string;
+    USERPROFILE: string;
+    NPM_CONFIG_CACHE: string;
+    NPM_CONFIG_USERCONFIG: string;
+};
+/**
+ * An npmrc for publishing to `registry`, optionally scoped and authenticated.
+ */
+export declare function registryPublishNpmrc(options: {
+    registry: string;
+    scope?: string;
+    token?: string;
+}): string;
+/**
+ * Write a mode-0600 publish npmrc (and the same file in `homeDir`, if given).
+ */
+export declare function writeTempNpmrc(options: {
+    runtime: ChildEnvRuntime;
+    path: string;
+    registry: string;
+    scope?: string;
+    token?: string;
+    homeDir?: string;
+}): Promise<void>;
+/** The `npm publish` arguments for a tarball. */
+export declare function publishArgs(options: {
+    tarball: string;
+    registry: string;
+    access?: string;
+    tag?: string;
+    provenance: boolean;
+    dryRun: boolean;
+}): string[];
+//# sourceMappingURL=npm-exec.d.ts.map

package/dist/cli/npm/publish/npm-exec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"npm-exec.d.ts","sourceRoot":"","sources":["../../../../src/cli/npm/publish/npm-exec.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AAGzE,OAAO,EACL,eAAe,EAGhB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAEtE,OAAO,EACL,KAAK,mBAAmB,EAEzB,MAAM,mCAAmC,CAAC;AAM3C,sDAAsD;AACtD,MAAM,MAAM,YAAY,GAAG;IACzB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,0EAA0E;AAC1E,qBAAa,eAAgB,SAAQ,eAAe;IAClD,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBAEZ,IAAI,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,YAAY;CAYjD;AAED,uEAAuE;AACvE,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,SAAS,MAAM,EAAE,GACzB,MAAM,CAOR;AAED;;;GAGG;AACH,wBAAsB,MAAM,CAC1B,SAAS,EAAE,gBAAgB,EAC3B,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,EAAE;IACP,gEAAgE;IAChE,OAAO,EAAE,eAAe,CAAC;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,MAAM,CAAC,EAAE,mBAAmB,CAAC;IAC7B,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAClC,GACA,OAAO,CAAC,YAAY,CAAC,CAwBvB;AAED,4EAA4E;AAC5E,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAUhD;AAuBD,iEAAiE;AACjE,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM;;;EAiC/C;AAED,qDAAqD;AACrD,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAM3D;AAED;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAU/D;AAED,wEAAwE;AACxE,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAMjE;AAED,mCAAmC;AACnC,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAEjE;AAED,qDAAqD;AACrD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAExE;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAKzD;AAED;;;GAGG;AACH,wBAAgB,4BAA4B,CAC1C,KAAK,EAAE,OAAO,EACd,YAAY,EAAE,SAAS,MAAM,EAAE,EAC/B,KAAK,SAAM,GACV,MAAM,CAWR;AAQD,wBAAgB,gCAAgC,CAC9C,KAAK,EAAE,OAAO,EACd,YAAY,EAAE,SAAS,MAAM,EAAE,GAC9B,KAAK,CASP;AAED;;;;;;;GAOG;AACH,eAAO,MAAM,6BAA6B,yBAAuB,CAAC;AAElE,gFAAgF;AAChF,wBAAsB,+BAA+B,CACnD,OAAO,EAAE,eAAe,EACxB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,IAAI,CAAC,CAIf;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,eAAe,oFACuD,CAAC;AAEpF,gFAAgF;AAChF,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,eAAe,EACxB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,IAAI,CAAC,CAIf;AAED,qEAAqE;AACrE,wBAAsB,aAAa,CACjC,OAAO,EAAE,eAAe,EACxB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,CAcjB;AAED,iDAAiD;AACjD,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAIvD;AAED,gFAAgF;AAChF,wBAAgB,iBAAiB,CAAC,OAAO,EAAE;IACzC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GAAG,MAAM,CAmBT;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;;;;;EAOA;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE;IAC5C,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,GAAG,MAAM,CAST;AAED;;GAEG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAAE;IAC5C,OAAO,EAAE,eAAe,CAAC;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GAAG,OAAO,CAAC,IAAI,CAAC,CAYhB;AAED,iDAAiD;AACjD,wBAAgB,WAAW,CAAC,OAAO,EAAE;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,OAAO,CAAC;IACpB,MAAM,EAAE,OAAO,CAAC;CACjB,GAAG,MAAM,EAAE,CAOX"}