@vibesdotdev/infra-deploy 0.0.2 → 1.0.0-rc.4

package/dist/cli/npm/publish/release-build.d.ts

@@ -0,0 +1,46 @@
+import { type RuntimeRef } from "@vibesdotdev/kernel";
+import type { RegistryReleaseSetPlan } from "@vibesdotdev/registry";
+import { type RuntimeExecution } from "@vibesdotdev/kernel/execution";
+import { type ChildEnvRuntime, type ExecutionOutputLine } from "../../shared/runtime-execution.ts";
+import { type WorkspacePackage } from "../../shared/build-workspace-artifacts.ts";
+/**
+ * Expand the Registry's publish closure to the production-source build closure.
+ * These extra packages are build inputs only: they never become publish targets.
+ */
+export declare function planRegistryReleaseBuildPackageOrder(options: {
+    workspaceRoot: string;
+    releasePlan: Pick<RegistryReleaseSetPlan, "publishOrder">;
+    workspacePackageScope?: ReadonlyMap<string, WorkspacePackage>;
+    /** The runtime whose files, paths, and hash read the workspace closure. */
+    runtime: ChildEnvRuntime;
+}): Promise<string[]>;
+/** Applies deploy-grade artifact freshness to the complete source build closure. */
+export declare function assertRegistryReleaseWorkspacePreflight(options: {
+    workspaceRoot: string;
+    /** The runtime whose logger reports a build input the freshness hash could only read as bytes. */
+    runtime: ChildEnvRuntime;
+    releasePlan: Pick<RegistryReleaseSetPlan, "publishOrder">;
+    workspacePackageScope?: ReadonlyMap<string, WorkspacePackage>;
+    artifactPolicy?: "strict" | "planned-build";
+}): Promise<{
+    warnings: string[];
+}>;
+/** Build every package of the release closure in dependency-first order. */
+export declare function buildRegistryReleaseWorkspaceArtifacts(options: {
+    workspaceRoot: string;
+    releasePlan: Pick<RegistryReleaseSetPlan, "publishOrder">;
+    workspacePackageScope?: ReadonlyMap<string, WorkspacePackage>;
+    execution: RuntimeExecution;
+    /** The runtime child environments are composed from. */
+    runtime: ChildEnvRuntime;
+    onLine?: ExecutionOutputLine;
+}): Promise<void>;
+/**
+ * macOS launchd still ships a 256-file soft ceiling. Sealed closure publish
+ * packs dozens of artifacts then installs them; that blows EMFILE and the
+ * cleanup rm can hide the original error. Re-exec once under a raised limit.
+ */
+export declare function ensureRaisedPublishFileDescriptorLimit(runtime: RuntimeRef): Promise<void>;
+/** Remove a temporary artifact directory; failures reach the release lifecycle. */
+export declare function removeReleaseArtifactDir(runtime: RuntimeRef, path: string | undefined): Promise<void>;
+//# sourceMappingURL=release-build.d.ts.map

package/dist/cli/npm/publish/release-build.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"release-build.d.ts","sourceRoot":"","sources":["../../../../src/cli/npm/publish/release-build.ts"],"names":[],"mappings":"AAQA,OAAO,EAAmD,KAAK,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEvG,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,EAAuB,KAAK,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAC3F,OAAO,EAEL,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACzB,MAAM,mCAAmC,CAAC;AAE3C,OAAO,EAGL,KAAK,gBAAgB,EACtB,MAAM,2CAA2C,CAAC;AACnD;;;GAGG;AACH,wBAAsB,oCAAoC,CAAC,OAAO,EAAE;IAClE,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,IAAI,CAAC,sBAAsB,EAAE,cAAc,CAAC,CAAC;IAC1D,qBAAqB,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC9D,2EAA2E;IAC3E,OAAO,EAAE,eAAe,CAAC;CAC1B,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAepB;AAED,oFAAoF;AACpF,wBAAsB,uCAAuC,CAAC,OAAO,EAAE;IACrE,aAAa,EAAE,MAAM,CAAC;IACtB,kGAAkG;IAClG,OAAO,EAAE,eAAe,CAAC;IACzB,WAAW,EAAE,IAAI,CAAC,sBAAsB,EAAE,cAAc,CAAC,CAAC;IAC1D,qBAAqB,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC9D,cAAc,CAAC,EAAE,QAAQ,GAAG,eAAe,CAAC;CAC7C,GAAG,OAAO,CAAC;IAAE,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC,CAUlC;AAED,4EAA4E;AAC5E,wBAAsB,sCAAsC,CAAC,OAAO,EAAE;IACpE,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,IAAI,CAAC,sBAAsB,EAAE,cAAc,CAAC,CAAC;IAC1D,qBAAqB,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC9D,SAAS,EAAE,gBAAgB,CAAC;IAC5B,wDAAwD;IACxD,OAAO,EAAE,eAAe,CAAC;IACzB,MAAM,CAAC,EAAE,mBAAmB,CAAC;CAC9B,GAAG,OAAO,CAAC,IAAI,CAAC,CAYhB;AAkDD;;;;GAIG;AACH,wBAAsB,sCAAsC,CAC1D,OAAO,EAAE,UAAU,GAClB,OAAO,CAAC,IAAI,CAAC,CA0Bf;AAED,mFAAmF;AACnF,wBAAsB,wBAAwB,CAC5C,OAAO,EAAE,UAAU,EACnB,IAAI,EAAE,MAAM,GAAG,SAAS,GACvB,OAAO,CAAC,IAAI,CAAC,CAWf"}

package/dist/cli/npm/publish/release-build.js

@@ -0,0 +1,140 @@
+/**
+ * Release build orchestration: dependency-first build order for the release
+ * closure, artifact preflight, the publish process file-descriptor ceiling and
+ * artifact directory cleanup.
+ */
+import { requestCLIExit } from "@vibesdotdev/cli";
+import { hostArgv } from "@vibesdotdev/cli/providers";
+import { resolveFileSystemAdapter } from "@vibesdotdev/filesystem";
+import { CapabilityError, getRuntimeHostCommands, settle } from "@vibesdotdev/kernel";
+import { z } from "zod";
+import { getRuntimeExecution } from "@vibesdotdev/kernel/execution";
+import { runRuntimeCommand, } from "../../shared/runtime-execution.js";
+import { hostPlatformFacts } from "./workspace-discovery.js";
+import { planWorkspacePackageBuildOrder, planWorkspacePackageClosureFromSeeds, } from "../../shared/build-workspace-artifacts.js";
+/**
+ * Expand the Registry's publish closure to the production-source build closure.
+ * These extra packages are build inputs only: they never become publish targets.
+ */
+export async function planRegistryReleaseBuildPackageOrder(options) {
+    const closure = (await planWorkspacePackageClosureFromSeeds(options.runtime, options.workspaceRoot, options.releasePlan.publishOrder, options.workspacePackageScope)).map((pkg) => pkg.name);
+    return planWorkspacePackageBuildOrder(options.runtime, options.workspaceRoot, closure, options.workspacePackageScope);
+}
+/** Applies deploy-grade artifact freshness to the complete source build closure. */
+export async function assertRegistryReleaseWorkspacePreflight(options) {
+    const { assertDeployWorkspacePreflight } = await import("../../shared/build-workspace-artifacts.js");
+    return assertDeployWorkspacePreflight({
+        workspaceRoot: options.workspaceRoot,
+        runtime: options.runtime,
+        packageNames: await planRegistryReleaseBuildPackageOrder(options),
+        packageScope: options.workspacePackageScope,
+        artifactPolicy: options.artifactPolicy,
+    });
+}
+/** Build every package of the release closure in dependency-first order. */
+export async function buildRegistryReleaseWorkspaceArtifacts(options) {
+    const { buildWorkspaceArtifactsForPackages } = await import("../../shared/build-workspace-artifacts.js");
+    const packageNames = await planRegistryReleaseBuildPackageOrder(options);
+    await buildWorkspaceArtifactsForPackages({
+        workspaceRoot: options.workspaceRoot,
+        packageNames,
+        packageScope: options.workspacePackageScope,
+        execution: options.execution,
+        runtime: options.runtime,
+        onLine: options.onLine,
+    });
+}
+const PUBLISH_NOFILE_TARGET = 65536;
+const PUBLISH_NOFILE_MIN = 8192;
+async function readPublishFileDescriptorLimit(runtime) {
+    if (hostPlatformFacts(runtime).platform === "win32")
+        return null;
+    const queried = await settle(async () => runRuntimeCommand({
+        runtime,
+        execution: await getRuntimeExecution(runtime),
+        command: "/bin/sh",
+        args: ["-c", "ulimit -n"],
+    }));
+    if (!queried.ok) {
+        throw new CapabilityError("Publish file-descriptor limit query failed.", "UNAVAILABLE", {
+            reason: "publish-nofile-query-failed",
+            cause: queried.cause,
+        });
+    }
+    if (queried.value.code !== 0) {
+        throw new CapabilityError("Publish file-descriptor limit query failed.", "UNAVAILABLE", {
+            reason: "publish-nofile-query-failed",
+            details: { exitCode: queried.value.code },
+            cause: queried.value,
+        });
+    }
+    const raw = queried.value.stdout.trim();
+    if (raw === "unlimited")
+        return Number.POSITIVE_INFINITY;
+    const parsed = z.string()
+        .regex(/^\d+$/)
+        .transform(Number)
+        .pipe(z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER))
+        .safeParse(raw);
+    if (!parsed.success) {
+        throw new CapabilityError("Publish file-descriptor limit query returned invalid output.", "INVALID_INPUT", {
+            reason: "publish-nofile-output-invalid",
+            // Value-free: whether the shell answered nothing or something unparsable, never the text.
+            details: {
+                exitCode: queried.value.code,
+                stdoutLength: queried.value.stdout.length,
+                stderrLength: queried.value.stderr.length,
+            },
+            cause: parsed.error,
+        });
+    }
+    return parsed.data;
+}
+/**
+ * macOS launchd still ships a 256-file soft ceiling. Sealed closure publish
+ * packs dozens of artifacts then installs them; that blows EMFILE and the
+ * cleanup rm can hide the original error. Re-exec once under a raised limit.
+ */
+export async function ensureRaisedPublishFileDescriptorLimit(runtime) {
+    if (hostPlatformFacts(runtime).platform === "win32")
+        return;
+    if (runtime.getEnv("VIBES_PUBLISH_NOFILE_RAISED") === "1")
+        return;
+    const current = await readPublishFileDescriptorLimit(runtime);
+    if (current === null || current >= PUBLISH_NOFILE_MIN)
+        return;
+    const spawnArgv = (await getRuntimeHostCommands(runtime)).selfSpawnArgv("infra-npm-publish");
+    const child = await (await getRuntimeExecution(runtime)).spawn({
+        command: "/bin/sh",
+        args: [
+            "-c",
+            `ulimit -n ${PUBLISH_NOFILE_TARGET} 2>/dev/null; exec "$0" "$@"`,
+            ...spawnArgv,
+            ...hostArgv(runtime).slice(spawnArgv.length),
+        ],
+        envMode: "inherit",
+        inheritReason: "re-exec the publish command under a raised file-descriptor ceiling",
+        env: { VIBES_PUBLISH_NOFILE_RAISED: "1" },
+        stdin: "inherit",
+        stdout: "inherit",
+        stderr: "inherit",
+    });
+    const result = await child.exited;
+    requestCLIExit(result.code ?? 1);
+}
+/** Remove a temporary artifact directory; failures reach the release lifecycle. */
+export async function removeReleaseArtifactDir(runtime, path) {
+    if (!path)
+        return;
+    try {
+        const files = await resolveFileSystemAdapter(runtime, { binding: false });
+        await files.remove(path, { recursive: true });
+    }
+    catch (cause) {
+        throw new CapabilityError("Release artifact cleanup failed.", "INTERNAL", {
+            reason: "release-artifact-cleanup-failed",
+            cause,
+        });
+    }
+}
+//# sourceMappingURL=release-build.js.map

package/dist/cli/npm/publish/release-build.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"release-build.js","sourceRoot":"","sources":["../../../../src/cli/npm/publish/release-build.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,QAAQ,EAAE,MAAM,4BAA4B,CAAC;AACtD,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,eAAe,EAAE,sBAAsB,EAAE,MAAM,EAAmB,MAAM,qBAAqB,CAAC;AACvG,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,mBAAmB,EAAyB,MAAM,+BAA+B,CAAC;AAC3F,OAAO,EACL,iBAAiB,GAGlB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,EACL,8BAA8B,EAC9B,oCAAoC,GAErC,MAAM,2CAA2C,CAAC;AACnD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,oCAAoC,CAAC,OAM1D;IACC,MAAM,OAAO,GAAG,CACd,MAAM,oCAAoC,CACxC,OAAO,CAAC,OAAO,EACf,OAAO,CAAC,aAAa,EACrB,OAAO,CAAC,WAAW,CAAC,YAAY,EAChC,OAAO,CAAC,qBAAqB,CAC9B,CACF,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACzB,OAAO,8BAA8B,CACnC,OAAO,CAAC,OAAO,EACf,OAAO,CAAC,aAAa,EACrB,OAAO,EACP,OAAO,CAAC,qBAAqB,CAC9B,CAAC;AACJ,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,uCAAuC,CAAC,OAO7D;IACC,MAAM,EAAE,8BAA8B,EAAE,GACtC,MAAM,MAAM,CAAC,2CAA2C,CAAC,CAAC;IAC5D,OAAO,8BAA8B,CAAC;QACpC,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,YAAY,EAAE,MAAM,oCAAoC,CAAC,OAAO,CAAC;QACjE,YAAY,EAAE,OAAO,CAAC,qBAAqB;QAC3C,cAAc,EAAE,OAAO,CAAC,cAAc;KACvC,CAAC,CAAC;AACL,CAAC;AAED,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,sCAAsC,CAAC,OAQ5D;IACC,MAAM,EAAE,kCAAkC,EAAE,GAC1C,MAAM,MAAM,CAAC,2CAA2C,CAAC,CAAC;IAC5D,MAAM,YAAY,GAAG,MAAM,oCAAoC,CAAC,OAAO,CAAC,CAAC;IACzE,MAAM,kCAAkC,CAAC;QACvC,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,YAAY;QACZ,YAAY,EAAE,OAAO,CAAC,qBAAqB;QAC3C,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,qBAAqB,GAAG,KAAK,CAAC;AACpC,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAEhC,KAAK,UAAU,8BAA8B,CAAC,OAAmB;IAC/D,IAAI,iBAAiB,CAAC,OAAO,CAAC,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IACjE,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,IAAI,EAAE,CACtC,iBAAiB,CAAC;QAChB,OAAO;QACP,SAAS,EAAE,MAAM,mBAAmB,CAAC,OAAO,CAAC;QAC7C,OAAO,EAAE,SAAS;QAClB,IAAI,EAAE,CAAC,IAAI,EAAE,WAAW,CAAC;KAC1B,CAAC,CACH,CAAC;IACF,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAChB,MAAM,IAAI,eAAe,CAAC,6CAA6C,EAAE,aAAa,EAAE;YACtF,MAAM,EAAE,6BAA6B;YACrC,KAAK,EAAE,OAAO,CAAC,KAAK;SACrB,CAAC,CAAC;IACL,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,eAAe,CAAC,6CAA6C,EAAE,aAAa,EAAE;YACtF,MAAM,EAAE,6BAA6B;YACrC,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE;YACzC,KAAK,EAAE,OAAO,CAAC,KAAK;SACrB,CAAC,CAAC;IACL,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACxC,IAAI,GAAG,KAAK,WAAW;QAAE,OAAO,MAAM,CAAC,iBAAiB,CAAC;IACzD,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE;SACtB,KAAK,CAAC,OAAO,CAAC;SACd,SAAS,CAAC,MAAM,CAAC;SACjB,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;SACjE,SAAS,CAAC,GAAG,CAAC,CAAC;IAClB,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,eAAe,CAAC,8DAA8D,EAAE,eAAe,EAAE;YACzG,MAAM,EAAE,+BAA+B;YACvC,0FAA0F;YAC1F,OAAO,EAAE;gBACP,QAAQ,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI;gBAC5B,YAAY,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM;gBACzC,YAAY,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM;aAC1C;YACD,KAAK,EAAE,MAAM,CAAC,KAAK;SACpB,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,sCAAsC,CAC1D,OAAmB;IAEnB,IAAI,iBAAiB,CAAC,OAAO,CAAC,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO;IAC5D,IAAI,OAAO,CAAC,MAAM,CAAC,6BAA6B,CAAC,KAAK,GAAG;QAAE,OAAO;IAClE,MAAM,OAAO,GAAG,MAAM,8BAA8B,CAAC,OAAO,CAAC,CAAC;IAC9D,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,IAAI,kBAAkB;QAAE,OAAO;IAC9D,MAAM,SAAS,GAAG,CAAC,MAAM,sBAAsB,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,CACrE,mBAAmB,CACpB,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,mBAAmB,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;QAC7D,OAAO,EAAE,SAAS;QAClB,IAAI,EAAE;YACJ,IAAI;YACJ,aAAa,qBAAqB,8BAA8B;YAChE,GAAG,SAAS;YACZ,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC;SAC7C;QACD,OAAO,EAAE,SAAS;QAClB,aAAa,EACX,oEAAoE;QACtE,GAAG,EAAE,EAAE,2BAA2B,EAAE,GAAG,EAAE;QACzC,KAAK,EAAE,SAAS;QAChB,MAAM,EAAE,SAAS;QACjB,MAAM,EAAE,SAAS;KAClB,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC;IAClC,cAAc,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;AACnC,CAAC;AAED,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,OAAmB,EACnB,IAAwB;IAExB,IAAI,CAAC,IAAI;QAAE,OAAO;IAClB,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,wBAAwB,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1E,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,eAAe,CAAC,kCAAkC,EAAE,UAAU,EAAE;YACxE,MAAM,EAAE,iCAAiC;YACzC,KAAK;SACN,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}

package/dist/cli/npm/publish/release-consumer-proof.d.ts

@@ -0,0 +1,70 @@
+/**
+ * The installed release proof: install the sealed release set plus its exact
+ * external closure into a clean consumer from a local proof registry, then
+ * verify every internal and external resolution, import, surface and bin.
+ * Phases live in `proof-*.ts`; this module sequences them.
+ */
+import type { ChildEnvRuntime } from "../../shared/runtime-execution.ts";
+import type { RegistryReleaseSetPlan, RegistryReleaseWorkspacePackage } from "@vibesdotdev/registry";
+import type { RuntimeExecution } from "@vibesdotdev/kernel/execution";
+import { runPublisherConsumerSmoke } from "./consumer-smoke.ts";
+import { type SealedWorkspaceRegistryInput } from "./external-requirements.ts";
+import { type ReleaseConsumerSourceRegistry } from "./proof-registry.ts";
+import type { PublishResult } from "./types.ts";
+export declare function runSealedReleaseConsumerChecks(options: {
+    sealed: readonly PublishResult[];
+    smoke: Omit<Parameters<typeof runPublisherConsumerSmoke>[0], "members">;
+    proof: Parameters<typeof runReleaseConsumerProof>[0];
+}): Promise<{
+    consumerSmoke: import("./consumer-smoke.ts").PublisherConsumerSmokeResult;
+    consumerProof: {
+        installed: number;
+        imports: string[];
+        bins: string[];
+        withheld: string[];
+        internalResolutions: string[];
+        externalResolutions: string[];
+        externalGraphResolutions: string[];
+    };
+}>;
+/**
+ * Install the sealed release set, plus its exact external closure, into a
+ * clean consumer from a local proof registry and verify the result: every
+ * resolution, profile import, declared surface, SSR probe, bin and withhold.
+ */
+export declare function runReleaseConsumerProof(options: {
+    artifactDir: string;
+    plan: RegistryReleaseSetPlan;
+    workspaceRoot: string;
+    workspace: ReadonlyMap<string, RegistryReleaseWorkspacePackage>;
+    execution: RuntimeExecution;
+    /** The runtime child environments are composed from. */
+    runtime: ChildEnvRuntime;
+    sourceRegistry?: ReleaseConsumerSourceRegistry;
+    sealedWorkspaceInputs?: readonly SealedWorkspaceRegistryInput[];
+    /**
+     * Basenames of reused release outputs the availability step moved into
+     * `artifactDir`. They are release outputs but not publish nodes, so the
+     * proof excludes them from the one-tarball-per-planned-package count.
+     */
+    reusedTarballs?: ReadonlySet<string>;
+    now?: () => number;
+}): Promise<{
+    installed: number;
+    imports: string[];
+    bins: string[];
+    withheld: string[];
+    internalResolutions: string[];
+    externalResolutions: string[];
+    externalGraphResolutions: string[];
+}>;
+/**
+ * Tarballs in `artifactDir` that the release plan does not account for.
+ *
+ * `artifactDir` holds one tarball per publish node (packed, or a reused version
+ * the availability step moved in) plus reused versions of packages outside the
+ * plan, which the proof installs as inputs. Anything else — a leftover run, a
+ * superseded published version — is unexpected and fails the proof.
+ */
+export declare function unexpectedReleaseTarballEntries(entries: readonly string[], plannedTarballs: ReadonlySet<string>, reusedTarballs?: ReadonlySet<string>): string[];
+//# sourceMappingURL=release-consumer-proof.d.ts.map

package/dist/cli/npm/publish/release-consumer-proof.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"release-consumer-proof.d.ts","sourceRoot":"","sources":["../../../../src/cli/npm/publish/release-consumer-proof.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AAIzE,OAAO,KAAK,EACV,sBAAsB,EACtB,+BAA+B,EAChC,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAEtE,OAAO,EAAE,yBAAyB,EAAE,MAAM,qBAAqB,CAAC;AAMhE,OAAO,EAEL,KAAK,4BAA4B,EAClC,MAAM,4BAA4B,CAAC;AAepC,OAAO,EAEL,KAAK,6BAA6B,EAGnC,MAAM,qBAAqB,CAAC;AAe7B,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAUhD,wBAAsB,8BAA8B,CAAC,OAAO,EAAE;IAC5D,MAAM,EAAE,SAAS,aAAa,EAAE,CAAC;IACjC,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,OAAO,yBAAyB,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IACxE,KAAK,EAAE,UAAU,CAAC,OAAO,uBAAuB,CAAC,CAAC,CAAC,CAAC,CAAC;CACtD;;;mBA6CY,MAAM;iBACR,MAAM,EAAE;cACX,MAAM,EAAE;kBACJ,MAAM,EAAE;6BACG,MAAM,EAAE;6BACR,MAAM,EAAE;kCACH,MAAM,EAAE;;GA/BnC;AAED;;;;GAIG;AACH,wBAAsB,uBAAuB,CAAC,OAAO,EAAE;IACrD,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,sBAAsB,CAAC;IAC7B,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,WAAW,CAAC,MAAM,EAAE,+BAA+B,CAAC,CAAC;IAChE,SAAS,EAAE,gBAAgB,CAAC;IAC5B,wDAAwD;IACxD,OAAO,EAAE,eAAe,CAAC;IACzB,cAAc,CAAC,EAAE,6BAA6B,CAAC;IAC/C,qBAAqB,CAAC,EAAE,SAAS,4BAA4B,EAAE,CAAC;IAChE;;;;OAIG;IACH,cAAc,CAAC,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACrC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB,GAAG,OAAO,CAAC;IACV,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,wBAAwB,EAAE,MAAM,EAAE,CAAC;CACpC,CAAC,CA8PD;AAqBD;;;;;;;GAOG;AACH,wBAAgB,+BAA+B,CAC7C,OAAO,EAAE,SAAS,MAAM,EAAE,EAC1B,eAAe,EAAE,WAAW,CAAC,MAAM,CAAC,EACpC,cAAc,GAAE,WAAW,CAAC,MAAM,CAAa,GAC9C,MAAM,EAAE,CASV"}