@vibesdotdev/infra-deploy 0.0.2 → 1.0.0-rc.5

package/dist/cli/npm/npm-protocol-package-registry.js

@@ -0,0 +1,237 @@
+/**
+ * The npm registry protocol as an `infra/package-registry` implementation: the
+ * Vibes Registry and public npm both answer it. Reads go through the packument
+ * (`GET /<name>`) and the version document, writes through the attested publish
+ * PUT; a write returns when the registry accepts it.
+ *
+ * The credential comes from the runtime Secrets owner under the descriptor's
+ * `publish.credential.secret` and is never printed. The second factor follows
+ * `publish.secondFactor`; a write that the descriptor says needs one refuses
+ * typed when the caller hands none.
+ */
+import { CapabilityError, settle } from '@vibesdotdev/kernel';
+import { serviceOrigin } from '@vibesdotdev/infra-core/service';
+import { z } from 'zod/v4';
+import { bytesToBase64, putAttestedPackument, registryErrorText, registryRefusalDetails, writeWithSecondFactor } from "./put-attested-packument.js";
+import { normalizeRegistryUrl, resolveTokenFromSecrets } from "./publish/registry-credentials.js";
+/** The packument media types npm's client sends (npm-registry-fetch `corgiDoc`, then full JSON). */
+const NPM_PACKUMENT_ACCEPT = 'application/vnd.npm.install-v1+json; q=1.0, application/json; q=0.8, */*';
+/** The adapter id an `infra/package-registry` descriptor names to select this implementation. */
+export const NPM_PROTOCOL_ADAPTER = 'npm-protocol';
+const VersionSchema = z.object({
+    dist: z.object({ tarball: z.string().url(), integrity: z.string().startsWith('sha512-') })
+});
+const PackumentSchema = z.object({
+    'dist-tags': z.record(z.string(), z.string()).default({}),
+    versions: z.record(z.string(), z.unknown()).default({})
+});
+async function digest(algorithm, bytes) {
+    return new Uint8Array(await crypto.subtle.digest(algorithm, new Uint8Array(bytes)));
+}
+/** The npm `dist.integrity` of `bytes`. */
+export async function sha512Integrity(bytes) {
+    return `sha512-${bytesToBase64(await digest('SHA-512', bytes))}`;
+}
+/** The npm `dist.shasum` of `bytes`. */
+export async function sha1Hex(bytes) {
+    return [...(await digest('SHA-1', bytes))].map((byte) => byte.toString(16).padStart(2, '0')).join('');
+}
+/** A packument version's `dist`; a version without a tarball and sha512 integrity refuses typed. */
+function versionDist(entry, where) {
+    const version = VersionSchema.safeParse(entry);
+    if (version.success)
+        return version.data.dist;
+    throw new CapabilityError(`${where} has no tarball with a sha512 integrity`, 'UNAVAILABLE', { reason: 'registry-version-invalid' });
+}
+export function createNpmProtocolPackageRegistry(options) {
+    const { descriptor, runtime } = options;
+    const fetchImpl = options.fetchImpl ?? fetch;
+    const session = options.session ?? crypto.randomUUID().replaceAll('-', '').slice(0, 16);
+    let origin;
+    let token;
+    const readCredential = async () => options.credential === undefined
+        ? resolveTokenFromSecrets(runtime, descriptor.publish.credential.secret, { environment: options.environment })
+        : { value: await options.credential(), environment: options.environment ?? 'supplied' };
+    // What a registry serves its installers is the anonymous view when it needs no credential to read
+    // (an authenticated read of public npm can omit published versions).
+    const readsAnonymously = !descriptor.authRequired || descriptor.publish === undefined;
+    const resolveOrigin = () => (origin ??= descriptor.url !== undefined
+        ? Promise.resolve(normalizeRegistryUrl(descriptor.url))
+        : serviceOrigin(runtime, descriptor.service).then(normalizeRegistryUrl));
+    /** The credential when the descriptor names one; `undefined` when it names none. */
+    const resolveToken = () => (token ??= descriptor.publish === undefined
+        ? Promise.resolve(undefined)
+        : readCredential().then((credential) => {
+            if (credential.value !== undefined)
+                return credential.value;
+            throw new CapabilityError(`No ${descriptor.publish.credential.secret} in the ${credential.environment} secrets for package registry ${descriptor.id}. Store it with \`vibes secrets set ${descriptor.publish.credential.secret}\`.`, 'PERMISSION_DENIED', { reason: 'package-registry-credential-missing', details: { registry: descriptor.id, secret: descriptor.publish.credential.secret, environment: credential.environment } });
+        }));
+    /** A packument read: `null` when the registry answers 404 (absent, or not served to this reader). */
+    async function readPackument(name, anonymous) {
+        const url = `${await resolveOrigin()}/${encodeURIComponent(name)}`;
+        const credential = anonymous ? undefined : await resolveToken();
+        // npm's own client asks for the install document first. Public npm serves it fresh after a
+        // publish while its full JSON document can still answer a cached 404.
+        const headers = new Headers({ accept: NPM_PACKUMENT_ACCEPT });
+        if (credential !== undefined)
+            headers.set('authorization', `Bearer ${credential}`);
+        const secrets = credential === undefined ? [] : [credential];
+        const response = await fetchImpl(url, { headers });
+        if (response.status === 404) {
+            await response.body?.cancel();
+            return null;
+        }
+        if (!response.ok) {
+            const details = registryRefusalDetails(response, secrets);
+            const said = await registryErrorText(response, secrets);
+            throw new CapabilityError(`packument read ${url} failed (${response.status})${said === undefined ? '' : `: ${said}`}`, 'UNAVAILABLE', {
+                reason: 'registry-packument-read-failed',
+                retryable: response.status === 429 || response.status >= 500,
+                details
+            });
+        }
+        const body = await settle(() => response.json());
+        const packument = body.ok ? PackumentSchema.safeParse(body.value) : undefined;
+        if (packument?.success)
+            return packument.data;
+        throw new CapabilityError(`packument read ${url} answered ${response.status} with a body that is not a packument`, 'UNAVAILABLE', {
+            reason: 'registry-packument-invalid',
+            details: registryRefusalDetails(response, secrets)
+        });
+    }
+    /**
+     * The version document (`GET /<name>/<version>`) first: public npm serves it as soon as
+     * a publish lands, while either packument document can lag. A
+     * registry without that route (404) is read through its packument.
+     */
+    async function versionIntegrity(name, version) {
+        const anonymous = readsAnonymously;
+        const credential = anonymous ? undefined : await resolveToken();
+        const url = `${await resolveOrigin()}/${encodeURIComponent(name)}/${encodeURIComponent(version)}`;
+        const headers = new Headers({ accept: 'application/json' });
+        if (credential !== undefined)
+            headers.set('authorization', `Bearer ${credential}`);
+        const response = await fetchImpl(url, { headers });
+        if (response.ok) {
+            const body = await settle(() => response.json());
+            if (body.ok)
+                return versionDist(body.value, `${descriptor.id} ${name}@${version}`).integrity;
+        }
+        else {
+            await response.body?.cancel();
+        }
+        const packument = await readPackument(name, anonymous);
+        const entry = packument?.versions[version];
+        return entry === undefined ? undefined : versionDist(entry, `${descriptor.id} ${name}@${version}`).integrity;
+    }
+    /** A write's second factor checked against what the descriptor asks for. */
+    function requireSecondFactor(factor) {
+        const policy = descriptor.publish;
+        if (policy === undefined) {
+            throw new CapabilityError(`Package registry ${descriptor.id} declares no publish credential.`, 'PERMISSION_DENIED', {
+                reason: 'package-registry-publish-undeclared',
+                details: { registry: descriptor.id }
+            });
+        }
+        if (policy.secondFactor !== 'none' && factor === undefined) {
+            throw new CapabilityError(`Package registry ${descriptor.id} asks for a ${policy.secondFactor} second factor on writes.`, 'PERMISSION_DENIED', {
+                reason: 'package-registry-second-factor-required',
+                details: { registry: descriptor.id, secondFactor: policy.secondFactor }
+            });
+        }
+        return {
+            otp: factor?.kind === 'otp' ? factor.code : undefined,
+            webAuth: factor?.kind === 'web' ? { announce: factor.announce, session, retryOnTimeout: factor.retryOnTimeout } : undefined
+        };
+    }
+    const implementation = {
+        config: descriptor,
+        forEnvironment: (environment) => createNpmProtocolPackageRegistry({ ...options, environment, session }),
+        origin: resolveOrigin,
+        async readRelease(name, tag, read = {}) {
+            const packument = await readPackument(name, read.anonymous === true);
+            if (packument === null)
+                return { state: 'absent' };
+            const version = packument['dist-tags'][tag];
+            if (version === undefined)
+                return { state: 'untagged' };
+            const { integrity } = versionDist(packument.versions[version], `${descriptor.id} ${name}@${version}`);
+            return { state: 'released', release: { version, integrity } };
+        },
+        async readReleases(name, read = {}) {
+            const packument = await readPackument(name, read.anonymous === true);
+            if (packument === null)
+                return { state: 'absent' };
+            const tags = {};
+            for (const [tag, version] of Object.entries(packument['dist-tags'])) {
+                tags[tag] = { version, integrity: versionDist(packument.versions[version], `${descriptor.id} ${name}@${version}`).integrity };
+            }
+            return { state: 'released', tags };
+        },
+        async distTags(name) {
+            return (await readPackument(name, readsAnonymously))?.['dist-tags'] ?? {};
+        },
+        async setTag(input) {
+            const factor = requireSecondFactor(input.secondFactor);
+            const token = (await resolveToken());
+            const response = await writeWithSecondFactor({
+                runtime,
+                url: `${await resolveOrigin()}/-/package/${encodeURIComponent(input.name)}/dist-tags/${encodeURIComponent(input.tag)}`,
+                body: JSON.stringify(input.version),
+                token,
+                ...factor,
+                fetchImpl
+            });
+            if (!response.ok) {
+                const details = registryRefusalDetails(response, [token]);
+                const said = await registryErrorText(response, [token]);
+                throw new CapabilityError(`Dist-tag ${input.tag} → ${input.name}@${input.version} on ${descriptor.id} failed (${response.status})${said === undefined ? '' : `: ${said}`}`, 'UNAVAILABLE', { reason: 'registry-put-failed', retryable: response.status === 429 || response.status >= 500, details });
+            }
+            await response.body?.cancel();
+        },
+        versionIntegrity,
+        async tarball(name, version, integrity) {
+            const packument = await readPackument(name, true);
+            const entry = packument?.versions[version];
+            if (entry === undefined) {
+                throw new CapabilityError(`${descriptor.id} does not serve ${name}@${version}`, 'NOT_FOUND', { reason: 'registry-version-absent' });
+            }
+            const { tarball } = versionDist(entry, `${descriptor.id} ${name}@${version}`);
+            const download = await fetchImpl(tarball);
+            if (!download.ok) {
+                await download.body?.cancel();
+                throw new CapabilityError(`tarball read for ${name}@${version} failed (${download.status})`, 'UNAVAILABLE', {
+                    reason: 'registry-tarball-read-failed',
+                    retryable: download.status === 429 || download.status >= 500,
+                    details: { status: download.status }
+                });
+            }
+            const bytes = new Uint8Array(await download.arrayBuffer());
+            if ((await sha512Integrity(bytes)) !== integrity) {
+                throw new CapabilityError(`tarball for ${name}@${version} does not match its recorded integrity`, 'INVALID_INPUT', {
+                    reason: 'registry-tarball-integrity-mismatch'
+                });
+            }
+            return bytes;
+        },
+        async publish(input) {
+            const factor = requireSecondFactor(input.secondFactor);
+            const put = await putAttestedPackument({
+                runtime,
+                tarball: { bytes: input.bytes },
+                registry: await resolveOrigin(),
+                token: (await resolveToken()),
+                tag: input.tag,
+                access: input.access,
+                dist: input.dist,
+                ...factor,
+                fetchImpl
+            });
+            // Accepted is published: a registry can take minutes to serve a fresh write, and the
+            // next read reports it present.
+            return { name: put.name, version: put.version, integrity: input.dist.integrity };
+        }
+    };
+    return implementation;
+}
+//# sourceMappingURL=npm-protocol-package-registry.js.map

package/dist/cli/npm/npm-protocol-package-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"npm-protocol-package-registry.js","sourceRoot":"","sources":["../../../src/cli/npm/npm-protocol-package-registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,eAAe,EAAE,MAAM,EAAqB,MAAM,qBAAqB,CAAC;AACjF,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAShE,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;AAC3B,OAAO,EAAE,aAAa,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AACpJ,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,MAAM,mCAAmC,CAAC;AAElG,oGAAoG;AACpG,MAAM,oBAAoB,GAAG,0EAA0E,CAAC;AAExG,iGAAiG;AACjG,MAAM,CAAC,MAAM,oBAAoB,GAAG,cAAc,CAAC;AAEnD,MAAM,aAAa,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9B,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;CAC1F,CAAC,CAAC;AACH,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACzD,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;CACvD,CAAC,CAAC;AAGH,KAAK,UAAU,MAAM,CAAC,SAA8B,EAAE,KAAiB;IACtE,OAAO,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACrF,CAAC;AAED,2CAA2C;AAC3C,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAAiB;IACtD,OAAO,UAAU,aAAa,CAAC,MAAM,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;AAClE,CAAC;AAED,wCAAwC;AACxC,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,KAAiB;IAC9C,OAAO,CAAC,GAAG,CAAC,MAAM,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACvG,CAAC;AAED,oGAAoG;AACpG,SAAS,WAAW,CAAC,KAAc,EAAE,KAAa;IACjD,MAAM,OAAO,GAAG,aAAa,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/C,IAAI,OAAO,CAAC,OAAO;QAAE,OAAO,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;IAC9C,MAAM,IAAI,eAAe,CAAC,GAAG,KAAK,yCAAyC,EAAE,aAAa,EAAE,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC,CAAC;AACrI,CAAC;AAcD,MAAM,UAAU,gCAAgC,CAAC,OAAmC;IACnF,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IACxC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;IAC7C,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACxF,IAAI,MAAmC,CAAC;IACxC,IAAI,KAA8C,CAAC;IAEnD,MAAM,cAAc,GAAG,KAAK,IAAsD,EAAE,CACnF,OAAO,CAAC,UAAU,KAAK,SAAS;QAC/B,CAAC,CAAC,uBAAuB,CAAC,OAAO,EAAE,UAAU,CAAC,OAAQ,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC;QAC/G,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,OAAO,CAAC,UAAU,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,UAAU,EAAE,CAAC;IAE1F,kGAAkG;IAClG,qEAAqE;IACrE,MAAM,gBAAgB,GAAG,CAAC,UAAU,CAAC,YAAY,IAAI,UAAU,CAAC,OAAO,KAAK,SAAS,CAAC;IAEtF,MAAM,aAAa,GAAG,GAAG,EAAE,CAC1B,CAAC,MAAM,KAAK,UAAU,CAAC,GAAG,KAAK,SAAS;QACvC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,oBAAoB,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;QACvD,CAAC,CAAC,aAAa,CAAC,OAAO,EAAE,UAAU,CAAC,OAAQ,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC;IAE5E,oFAAoF;IACpF,MAAM,YAAY,GAAG,GAAG,EAAE,CACzB,CAAC,KAAK,KAAK,UAAU,CAAC,OAAO,KAAK,SAAS;QAC1C,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC;QAC5B,CAAC,CAAC,cAAc,EAAE,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,EAAE;YACrC,IAAI,UAAU,CAAC,KAAK,KAAK,SAAS;gBAAE,OAAO,UAAU,CAAC,KAAK,CAAC;YAC5D,MAAM,IAAI,eAAe,CACxB,MAAM,UAAU,CAAC,OAAQ,CAAC,UAAU,CAAC,MAAM,WAAW,UAAU,CAAC,WAAW,iCAAiC,UAAU,CAAC,EAAE,uCAAuC,UAAU,CAAC,OAAQ,CAAC,UAAU,CAAC,MAAM,KAAK,EAC3M,mBAAmB,EACnB,EAAE,MAAM,EAAE,qCAAqC,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,OAAQ,CAAC,UAAU,CAAC,MAAM,EAAE,WAAW,EAAE,UAAU,CAAC,WAAW,EAAE,EAAE,CAC3K,CAAC;QACH,CAAC,CAAC,CAAC,CAAC;IAEP,qGAAqG;IACrG,KAAK,UAAU,aAAa,CAAC,IAAY,EAAE,SAAkB;QAC5D,MAAM,GAAG,GAAG,GAAG,MAAM,aAAa,EAAE,IAAI,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;QACnE,MAAM,UAAU,GAAG,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,YAAY,EAAE,CAAC;QAChE,2FAA2F;QAC3F,sEAAsE;QACtE,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC,CAAC;QAC9D,IAAI,UAAU,KAAK,SAAS;YAAE,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,UAAU,EAAE,CAAC,CAAC;QACnF,MAAM,OAAO,GAAG,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QAC7D,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QACnD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC7B,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;YAC9B,OAAO,IAAI,CAAC;QACb,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAClB,MAAM,OAAO,GAAG,sBAAsB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC1D,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;YACxD,MAAM,IAAI,eAAe,CAAC,kBAAkB,GAAG,YAAY,QAAQ,CAAC,MAAM,IAAI,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,EAAE,EAAE,aAAa,EAAE;gBACrI,MAAM,EAAE,gCAAgC;gBACxC,SAAS,EAAE,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG;gBAC5D,OAAO;aACP,CAAC,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;QACjD,MAAM,SAAS,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9E,IAAI,SAAS,EAAE,OAAO;YAAE,OAAO,SAAS,CAAC,IAAI,CAAC;QAC9C,MAAM,IAAI,eAAe,CAAC,kBAAkB,GAAG,aAAa,QAAQ,CAAC,MAAM,sCAAsC,EAAE,aAAa,EAAE;YACjI,MAAM,EAAE,4BAA4B;YACpC,OAAO,EAAE,sBAAsB,CAAC,QAAQ,EAAE,OAAO,CAAC;SAClD,CAAC,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,UAAU,gBAAgB,CAAC,IAAY,EAAE,OAAe;QAC5D,MAAM,SAAS,GAAG,gBAAgB,CAAC;QACnC,MAAM,UAAU,GAAG,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,YAAY,EAAE,CAAC;QAChE,MAAM,GAAG,GAAG,GAAG,MAAM,aAAa,EAAE,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;QAClG,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAC;QAC5D,IAAI,UAAU,KAAK,SAAS;YAAE,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,UAAU,EAAE,CAAC,CAAC;QACnF,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC;QACnD,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;YACjD,IAAI,IAAI,CAAC,EAAE;gBAAE,OAAO,WAAW,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,UAAU,CAAC,EAAE,IAAI,IAAI,IAAI,OAAO,EAAE,CAAC,CAAC,SAAS,CAAC;QAC9F,CAAC;aAAM,CAAC;YACP,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;QAC/B,CAAC;QACD,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACvD,MAAM,KAAK,GAAG,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC3C,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,EAAE,GAAG,UAAU,CAAC,EAAE,IAAI,IAAI,IAAI,OAAO,EAAE,CAAC,CAAC,SAAS,CAAC;IAC9G,CAAC;IAED,4EAA4E;IAC5E,SAAS,mBAAmB,CAAC,MAA+C;QAC3E,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC;QAClC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,IAAI,eAAe,CAAC,oBAAoB,UAAU,CAAC,EAAE,kCAAkC,EAAE,mBAAmB,EAAE;gBACnH,MAAM,EAAE,qCAAqC;gBAC7C,OAAO,EAAE,EAAE,QAAQ,EAAE,UAAU,CAAC,EAAE,EAAE;aACpC,CAAC,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,YAAY,KAAK,MAAM,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YAC5D,MAAM,IAAI,eAAe,CAAC,oBAAoB,UAAU,CAAC,EAAE,eAAe,MAAM,CAAC,YAAY,2BAA2B,EAAE,mBAAmB,EAAE;gBAC9I,MAAM,EAAE,yCAAyC;gBACjD,OAAO,EAAE,EAAE,QAAQ,EAAE,UAAU,CAAC,EAAE,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE;aACvE,CAAC,CAAC;QACJ,CAAC;QACD,OAAO;YACN,GAAG,EAAE,MAAM,EAAE,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;YACrD,OAAO,EAAE,MAAM,EAAE,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,SAAS;SAC3H,CAAC;IACH,CAAC;IAED,MAAM,cAAc,GAAkC;QACrD,MAAM,EAAE,UAAU;QAClB,cAAc,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,gCAAgC,CAAC,EAAE,GAAG,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC;QACvG,MAAM,EAAE,aAAa;QAErB,KAAK,CAAC,WAAW,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,GAAG,EAAE;YACrC,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC;YACrE,IAAI,SAAS,KAAK,IAAI;gBAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;YACnD,MAAM,OAAO,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC;YAC5C,IAAI,OAAO,KAAK,SAAS;gBAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;YACxD,MAAM,EAAE,SAAS,EAAE,GAAG,WAAW,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,GAAG,UAAU,CAAC,EAAE,IAAI,IAAI,IAAI,OAAO,EAAE,CAAC,CAAC;YACtG,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC;QAC/D,CAAC;QAED,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,GAAG,EAAE;YACjC,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC;YACrE,IAAI,SAAS,KAAK,IAAI;gBAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;YACnD,MAAM,IAAI,GAA2D,EAAE,CAAC;YACxE,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;gBACrE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,GAAG,UAAU,CAAC,EAAE,IAAI,IAAI,IAAI,OAAO,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC;YAC/H,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;QACpC,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,IAAI;YAClB,OAAO,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;QAC3E,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,KAAK;YACjB,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YACvD,MAAM,KAAK,GAAG,CAAC,MAAM,YAAY,EAAE,CAAE,CAAC;YACtC,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC;gBAC5C,OAAO;gBACP,GAAG,EAAE,GAAG,MAAM,aAAa,EAAE,cAAc,kBAAkB,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE;gBACtH,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC;gBACnC,KAAK;gBACL,GAAG,MAAM;gBACT,SAAS;aACT,CAAC,CAAC;YACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBAClB,MAAM,OAAO,GAAG,sBAAsB,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC1D,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC;gBACxD,MAAM,IAAI,eAAe,CACxB,YAAY,KAAK,CAAC,GAAG,MAAM,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,OAAO,OAAO,UAAU,CAAC,EAAE,YAAY,QAAQ,CAAC,MAAM,IAAI,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,EAAE,EAChJ,aAAa,EACb,EAAE,MAAM,EAAE,qBAAqB,EAAE,SAAS,EAAE,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,CACxG,CAAC;YACH,CAAC;YACD,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;QAC/B,CAAC;QAED,gBAAgB;QAEhB,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS;YACrC,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAClD,MAAM,KAAK,GAAG,SAAS,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;YAC3C,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACzB,MAAM,IAAI,eAAe,CAAC,GAAG,UAAU,CAAC,EAAE,mBAAmB,IAAI,IAAI,OAAO,EAAE,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC,CAAC;YACrI,CAAC;YACD,MAAM,EAAE,OAAO,EAAE,GAAG,WAAW,CAAC,KAAK,EAAE,GAAG,UAAU,CAAC,EAAE,IAAI,IAAI,IAAI,OAAO,EAAE,CAAC,CAAC;YAC9E,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC;YAC1C,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBAClB,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC;gBAC9B,MAAM,IAAI,eAAe,CAAC,oBAAoB,IAAI,IAAI,OAAO,YAAY,QAAQ,CAAC,MAAM,GAAG,EAAE,aAAa,EAAE;oBAC3G,MAAM,EAAE,8BAA8B;oBACtC,SAAS,EAAE,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG;oBAC5D,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE;iBACpC,CAAC,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;YAC3D,IAAI,CAAC,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;gBAClD,MAAM,IAAI,eAAe,CAAC,eAAe,IAAI,IAAI,OAAO,wCAAwC,EAAE,eAAe,EAAE;oBAClH,MAAM,EAAE,qCAAqC;iBAC7C,CAAC,CAAC;YACJ,CAAC;YACD,OAAO,KAAK,CAAC;QACd,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,KAAkC;YAC/C,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YACvD,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC;gBACtC,OAAO;gBACP,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE;gBAC/B,QAAQ,EAAE,MAAM,aAAa,EAAE;gBAC/B,KAAK,EAAE,CAAC,MAAM,YAAY,EAAE,CAAE;gBAC9B,GAAG,EAAE,KAAK,CAAC,GAAG;gBACd,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,GAAG,MAAM;gBACT,SAAS;aACT,CAAC,CAAC;YACH,qFAAqF;YACrF,gCAAgC;YAChC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QAClF,CAAC;KACD,CAAC;IACF,OAAO,cAAc,CAAC;AACvB,CAAC"}

package/dist/cli/npm/publish/command-options.d.ts

@@ -0,0 +1,24 @@
+import type { ChildEnvRuntime } from "../../shared/runtime-execution.ts";
+/** A trimmed non-empty string option, else undefined. */
+export declare function readString(value: unknown): string | undefined;
+/** CLI/wire contract version. v1 cannot represent a build-only closure. */
+export declare function parseReleaseContractVersion(value: unknown): 1 | 2;
+/**
+ * Release contract version for this run. The CLI flag wins; otherwise the
+ * release workspace root declares it via `vibes.release.contractVersion` in
+ * its package.json; otherwise v1. An unreadable root manifest or an invalid
+ * configured value fails closed with the file named: a release must never
+ * silently run under a contract the operator did not choose.
+ */
+export declare function resolveReleaseContractVersion(options: {
+    flagValue: unknown;
+    workspaceRoot: string;
+    runtime: ChildEnvRuntime;
+}): Promise<1 | 2>;
+/** A flag option: true for `true`, `"true"` or `"yes"`. */
+export declare function readBoolean(value: unknown): boolean;
+/** A finite numeric option (number or numeric string), else `fallback`. */
+export declare function readNumber(value: unknown, fallback: number): number;
+/** `value` floored and clamped at zero; `fallback` when not finite. */
+export declare function positiveInteger(value: number, fallback: number): number;
+//# sourceMappingURL=command-options.d.ts.map

package/dist/cli/npm/publish/command-options.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"command-options.d.ts","sourceRoot":"","sources":["../../../../src/cli/npm/publish/command-options.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AAIzE,yDAAyD;AACzD,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAK7D;AAED,2EAA2E;AAC3E,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,OAAO,GAAG,CAAC,GAAG,CAAC,CAmBjE;AAED;;;;;;GAMG;AACH,wBAAsB,6BAA6B,CAAC,OAAO,EAAE;IAC3D,SAAS,EAAE,OAAO,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,eAAe,CAAC;CAC1B,GAAG,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CA+BjB;AAED,2DAA2D;AAC3D,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAGnD;AAED,2EAA2E;AAC3E,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAOnE;AAED,uEAAuE;AACvE,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAGvE"}

package/dist/cli/npm/publish/command-options.js

@@ -0,0 +1,85 @@
+/**
+ * Parsing of loosely typed CLI option values and the release contract version.
+ */
+import { resolveFileSystemAdapter } from "@vibesdotdev/filesystem";
+import { getRuntimePath } from "@vibesdotdev/paths";
+import { CapabilityError, CaughtFailureSchema, settle, valueFreeFailure } from "@vibesdotdev/kernel";
+import { z } from "zod/v4";
+import { parseWorkspaceRootManifest } from "./publisher-manifest.js";
+/** A trimmed non-empty string option, else undefined. */
+export function readString(value) {
+    const parsed = z.string().safeParse(value);
+    if (!parsed.success)
+        return undefined;
+    const trimmed = parsed.data.trim();
+    return trimmed.length > 0 ? trimmed : undefined;
+}
+/** CLI/wire contract version. v1 cannot represent a build-only closure. */
+export function parseReleaseContractVersion(value) {
+    const parsed = z
+        .union([z.null(), z.undefined(), z.number().int(), z.string()])
+        .safeParse(value);
+    if (!parsed.success) {
+        throw new CapabilityError("Registry release contract version must be 1 or 2", "INVALID_INPUT");
+    }
+    if (parsed.data === null || parsed.data === undefined)
+        return 1;
+    const asNumber = z.number().safeParse(parsed.data);
+    const text = asNumber.success ? String(asNumber.data) : readString(parsed.data);
+    if (text === "1")
+        return 1;
+    if (text === "2")
+        return 2;
+    throw new CapabilityError("Registry release contract version must be 1 or 2", "INVALID_INPUT");
+}
+/**
+ * Release contract version for this run. The CLI flag wins; otherwise the
+ * release workspace root declares it via `vibes.release.contractVersion` in
+ * its package.json; otherwise v1. An unreadable root manifest or an invalid
+ * configured value fails closed with the file named: a release must never
+ * silently run under a contract the operator did not choose.
+ */
+export async function resolveReleaseContractVersion(options) {
+    if (options.flagValue !== undefined && options.flagValue !== null) {
+        return parseReleaseContractVersion(options.flagValue);
+    }
+    const manifestPath = (await getRuntimePath(options.runtime)).join(options.workspaceRoot, "package.json");
+    const files = await resolveFileSystemAdapter(options.runtime);
+    const read = await settle(async () => JSON.parse(z.string().parse(await files.readFile(manifestPath, "utf8"))));
+    if (!read.ok) {
+        throw new CapabilityError(`Cannot resolve the release contract version: ${manifestPath} is unreadable`, "INVALID_INPUT", { cause: valueFreeFailure(read.cause) });
+    }
+    const manifest = parseWorkspaceRootManifest(read.value);
+    const configured = manifest.vibes?.release?.contractVersion;
+    if (configured === undefined || configured === null)
+        return 1;
+    try {
+        return parseReleaseContractVersion(configured);
+    }
+    catch (error) {
+        throw new CapabilityError(`Registry release contract version must be 1 or 2 (vibes.release.contractVersion in ${manifestPath})`, "INVALID_INPUT", { cause: valueFreeFailure(CaughtFailureSchema.parse(error)) });
+    }
+}
+/** A flag option: true for `true`, `"true"` or `"yes"`. */
+export function readBoolean(value) {
+    const parsed = z.union([z.literal(true), z.literal("true"), z.literal("yes")]).safeParse(value);
+    return parsed.success;
+}
+/** A finite numeric option (number or numeric string), else `fallback`. */
+export function readNumber(value, fallback) {
+    const asNumber = z.number().safeParse(value);
+    if (asNumber.success && Number.isFinite(asNumber.data))
+        return asNumber.data;
+    const asText = z.string().safeParse(value);
+    if (!asText.success || asText.data.trim().length === 0)
+        return fallback;
+    const parsed = Number(asText.data);
+    return Number.isFinite(parsed) ? parsed : fallback;
+}
+/** `value` floored and clamped at zero; `fallback` when not finite. */
+export function positiveInteger(value, fallback) {
+    if (!Number.isFinite(value))
+        return fallback;
+    return Math.max(0, Math.floor(value));
+}
+//# sourceMappingURL=command-options.js.map

package/dist/cli/npm/publish/command-options.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"command-options.js","sourceRoot":"","sources":["../../../../src/cli/npm/publish/command-options.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACnE,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACrG,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;AAE3B,OAAO,EAAE,0BAA0B,EAAE,MAAM,yBAAyB,CAAC;AAGrE,yDAAyD;AACzD,MAAM,UAAU,UAAU,CAAC,KAAc;IACvC,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IACtC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IACnC,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AAClD,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,2BAA2B,CAAC,KAAc;IACxD,MAAM,MAAM,GAAG,CAAC;SACb,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;SAC9D,SAAS,CAAC,KAAK,CAAC,CAAC;IACpB,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,eAAe,CACvB,kDAAkD,EAClD,eAAe,CAChB,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACnD,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAChF,IAAI,IAAI,KAAK,GAAG;QAAE,OAAO,CAAC,CAAC;IAC3B,IAAI,IAAI,KAAK,GAAG;QAAE,OAAO,CAAC,CAAC;IAC3B,MAAM,IAAI,eAAe,CACvB,kDAAkD,EAClD,eAAe,CAChB,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAAC,OAInD;IACC,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,OAAO,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QAClE,OAAO,2BAA2B,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACxD,CAAC;IACD,MAAM,YAAY,GAAG,CAAC,MAAM,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAC/D,OAAO,CAAC,aAAa,EACrB,cAAc,CACf,CAAC;IACF,MAAM,KAAK,GAAG,MAAM,wBAAwB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9D,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,KAAK,IAAI,EAAE,CACnC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,CACzE,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,MAAM,IAAI,eAAe,CACvB,gDAAgD,YAAY,gBAAgB,EAC5E,eAAe,EACf,EAAE,KAAK,EAAE,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CACxC,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAA0B,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC/E,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,EAAE,OAAO,EAAE,eAAe,CAAC;IAC5D,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,IAAI;QAAE,OAAO,CAAC,CAAC;IAC9D,IAAI,CAAC;QACH,OAAO,2BAA2B,CAAC,UAAU,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,eAAe,CACvB,sFAAsF,YAAY,GAAG,EACrG,eAAe,EACf,EAAE,KAAK,EAAE,gBAAgB,CAAC,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAC9D,CAAC;IACJ,CAAC;AACH,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAChG,OAAO,MAAM,CAAC,OAAO,CAAC;AACxB,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,UAAU,CAAC,KAAc,EAAE,QAAgB;IACzD,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC7C,IAAI,QAAQ,CAAC,OAAO,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,QAAQ,CAAC,IAAI,CAAC;IAC7E,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IACxE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACnC,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;AACrD,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,eAAe,CAAC,KAAa,EAAE,QAAgB;IAC7D,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC7C,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;AACxC,CAAC"}

package/dist/cli/npm/publish/concurrency.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Bounded-concurrency mapping used by Registry probes, Git inspection and
+ * Registry input sealing.
+ */
+export declare function mapWithConcurrency<T, R>(values: readonly T[], limit: number, map: (value: T, index: number) => Promise<R>): Promise<R[]>;
+/**
+ * `mapWithConcurrency` for work whose side effects must not outlive a failure
+ * (child processes in a temp root the caller removes once this rejects). After
+ * the first rejection no further value starts and `signal` aborts, so a started
+ * mapping can skip work it no longer needs; every started mapping settles, and
+ * then the rejection with the lowest index is rethrown.
+ *
+ * Values start in index order, so every value below a failing one has started
+ * by then, and the error is the one a sequential loop would have thrown, as
+ * long as a mapping honours `signal` only where its remaining work cannot
+ * reject. A rejection with `signal.reason` is that stop, not a failure.
+ */
+export declare function mapWithConcurrencyUntilFirstFailure<T, R>(values: readonly T[], limit: number, map: (value: T, index: number, signal: AbortSignal) => Promise<R>): Promise<R[]>;
+//# sourceMappingURL=concurrency.d.ts.map

package/dist/cli/npm/publish/concurrency.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"concurrency.d.ts","sourceRoot":"","sources":["../../../../src/cli/npm/publish/concurrency.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,wBAAsB,kBAAkB,CAAC,CAAC,EAAE,CAAC,EAC3C,MAAM,EAAE,SAAS,CAAC,EAAE,EACpB,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,GAC3C,OAAO,CAAC,CAAC,EAAE,CAAC,CAiBd;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,mCAAmC,CAAC,CAAC,EAAE,CAAC,EAC5D,MAAM,EAAE,SAAS,CAAC,EAAE,EACpB,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,CAAC,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,KAAK,OAAO,CAAC,CAAC,CAAC,GAChE,OAAO,CAAC,CAAC,EAAE,CAAC,CA0Bd"}

package/dist/cli/npm/publish/concurrency.js

@@ -0,0 +1,60 @@
+/**
+ * Bounded-concurrency mapping used by Registry probes, Git inspection and
+ * Registry input sealing.
+ */
+import { settle } from "@vibesdotdev/kernel";
+export async function mapWithConcurrency(values, limit, map) {
+    const results = [];
+    results.length = values.length;
+    let cursor = 0;
+    const workers = Array.from({ length: Math.min(Math.max(1, limit), values.length) }, async () => {
+        while (true) {
+            const index = cursor;
+            cursor += 1;
+            if (index >= values.length)
+                return;
+            results[index] = await map(values[index], index);
+        }
+    });
+    await Promise.all(workers);
+    return results;
+}
+/**
+ * `mapWithConcurrency` for work whose side effects must not outlive a failure
+ * (child processes in a temp root the caller removes once this rejects). After
+ * the first rejection no further value starts and `signal` aborts, so a started
+ * mapping can skip work it no longer needs; every started mapping settles, and
+ * then the rejection with the lowest index is rethrown.
+ *
+ * Values start in index order, so every value below a failing one has started
+ * by then, and the error is the one a sequential loop would have thrown, as
+ * long as a mapping honours `signal` only where its remaining work cannot
+ * reject. A rejection with `signal.reason` is that stop, not a failure.
+ */
+export async function mapWithConcurrencyUntilFirstFailure(values, limit, map) {
+    const stop = new AbortController();
+    let failure;
+    const settled = await mapWithConcurrency(values, limit, async (value, index) => {
+        if (stop.signal.aborted)
+            return undefined;
+        const outcome = await settle(() => map(value, index, stop.signal));
+        if (outcome.ok)
+            return { result: outcome.value };
+        if (stop.signal.aborted && outcome.cause === stop.signal.reason)
+            return undefined;
+        if (!failure || index < failure.index)
+            failure = { index, cause: outcome.cause };
+        stop.abort(new Error("Stopped after an earlier mapping failed"));
+        return undefined;
+    });
+    if (failure) {
+        const cause = failure.cause;
+        throw cause instanceof Error ? cause : cause.value;
+    }
+    return settled.map((entry, index) => {
+        if (!entry)
+            throw new Error(`Mapping ${index} settled without a result`);
+        return entry.result;
+    });
+}
+//# sourceMappingURL=concurrency.js.map

package/dist/cli/npm/publish/concurrency.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"concurrency.js","sourceRoot":"","sources":["../../../../src/cli/npm/publish/concurrency.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,MAAM,EAAsB,MAAM,qBAAqB,CAAC;AAEjE,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAoB,EACpB,KAAa,EACb,GAA4C;IAE5C,MAAM,OAAO,GAAQ,EAAE,CAAC;IACxB,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;IAC/B,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CACxB,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,EACvD,KAAK,IAAI,EAAE;QACT,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,KAAK,GAAG,MAAM,CAAC;YACrB,MAAM,IAAI,CAAC,CAAC;YACZ,IAAI,KAAK,IAAI,MAAM,CAAC,MAAM;gBAAE,OAAO;YACnC,OAAO,CAAC,KAAK,CAAC,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,KAAK,CAAE,EAAE,KAAK,CAAC,CAAC;QACpD,CAAC;IACH,CAAC,CACF,CAAC;IACF,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC3B,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACvD,MAAoB,EACpB,KAAa,EACb,GAAiE;IAEjE,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;IACnC,IAAI,OAA4D,CAAC;IACjE,MAAM,OAAO,GAAG,MAAM,kBAAkB,CACtC,MAAM,EACN,KAAK,EACL,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;QACrB,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO,SAAS,CAAC;QAC1C,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QACnE,IAAI,OAAO,CAAC,EAAE;YAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;QACjD,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,OAAO,CAAC,KAAK,KAAK,IAAI,CAAC,MAAM,CAAC,MAAM;YAC7D,OAAO,SAAS,CAAC;QACnB,IAAI,CAAC,OAAO,IAAI,KAAK,GAAG,OAAO,CAAC,KAAK;YACnC,OAAO,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC;QAC5C,IAAI,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC,CAAC;QACjE,OAAO,SAAS,CAAC;IACnB,CAAC,CACF,CAAC;IACF,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC5B,MAAM,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC;IACrD,CAAC;IACD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QAClC,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,WAAW,KAAK,2BAA2B,CAAC,CAAC;QACzE,OAAO,KAAK,CAAC,MAAM,CAAC;IACtB,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/cli/npm/publish/consumer-smoke.d.ts

@@ -0,0 +1,83 @@
+/**
+ * Publisher consumer smoke: install the sealed batch as a plain consumer and
+ * import every reachable export target, refusing every failed runtime import.
+ */
+import type { ChildEnvRuntime } from "../../shared/runtime-execution.ts";
+import type { UIContext } from "@vibesdotdev/cli/providers";
+import type { RegistryPublishManifest } from "@vibesdotdev/registry";
+import type { RuntimeExecution } from "@vibesdotdev/kernel/execution";
+import type { ReleaseConsumerSourceRegistry } from "./proof-registry.ts";
+/**
+ * Every import-time export-map/main target this package could load at runtime, following
+ * the same enumeration `verifyPackedPackage` uses to prove every target
+ * exists in the tarball. Wildcard subpaths (`./*`) have no single concrete
+ * file to import, and non-script targets (`.d.ts`, `.svelte`, `.css`, …) are
+ * not importable by a bare Node/Bun runtime — both are already covered by
+ * `verifyPackedPackage`'s existence check and the SvelteKit SSR proof, so
+ * this only returns the concrete `.js`/`.mjs`/`.cjs` files a plain
+ * `import()` can actually execute.
+ */
+export declare function publisherConsumerSmokeImportTargets(manifest: Pick<RegistryPublishManifest, "main" | "exports">): string[];
+/** One sealed batch member the smoke installs from its packed tarball. */
+export type PublisherConsumerSmokeMember = {
+    name: string;
+    version: string;
+    tarball: string;
+};
+/** What the smoke installed and imported, and any consumer check it ran. */
+export type PublisherConsumerSmokeResult = {
+    installed: number;
+    imports: string[];
+    durationMs: number;
+    consumerCheck?: {
+        ok: boolean;
+        log: string;
+    };
+};
+/** Upper bound for the smoke consumer's install. */
+export declare const PUBLISHER_CONSUMER_INSTALL_TIMEOUT_MS = 120000;
+/**
+ * Installs every non-skipped sealed batch member into a throwaway consumer by
+ * its packed tarball (`file:<path>`, the exact bytes about to be uploaded)
+ * and imports every export-map/main target from the installed copy. This
+ * closes the gap `verifyPackedPackage` cannot: that gate inspects the
+ * tarball's file *list*, not what happens when a real installer (hoisting,
+ * peer resolution, duplicate dependency trees) lays the batch out and a
+ * runtime actually loads it. A `.ts` import specifier surviving into a
+ * shipped `.js` file, or an export target missing after a real install,
+ * throws here — before any package in the batch reaches the registry.
+ *
+ * Reuses the already-packed, already-retained tarballs from the seal phase —
+ * no rebuild, no re-pack — so this stays fast enough to run on every publish
+ * and every `--dry-run`.
+ */
+export declare function runPublisherConsumerSmoke(options: {
+    members: readonly PublisherConsumerSmokeMember[];
+    workspaceRoot: string;
+    execution: RuntimeExecution;
+    /** The runtime child environments are composed from. */
+    runtime: ChildEnvRuntime;
+    ui: UIContext;
+    quiet: boolean;
+    sourceRegistry?: ReleaseConsumerSourceRegistry;
+    consumerPath?: string;
+}): Promise<PublisherConsumerSmokeResult>;
+/**
+ * The optional heavier proof: install the exact batch tarballs into a real
+ * consumer checkout (e.g. a `vibes-app-template` clone) with `bun add`, then
+ * run its own `check`/`build`. Off by default (`--consumer` is unset in
+ * ordinary publishes); this exercises a real project's own toolchain against
+ * the batch, which the throwaway-consumer import smoke above does not.
+ */
+export declare function runPublisherConsumerSmokeConsumerCheck(options: {
+    consumerPath: string;
+    members: readonly PublisherConsumerSmokeMember[];
+    execution: RuntimeExecution;
+    /** The runtime child environments are composed from. */
+    runtime: ChildEnvRuntime;
+    sourceRegistry?: ReleaseConsumerSourceRegistry;
+}): Promise<{
+    ok: boolean;
+    log: string;
+}>;
+//# sourceMappingURL=consumer-smoke.d.ts.map

package/dist/cli/npm/publish/consumer-smoke.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consumer-smoke.d.ts","sourceRoot":"","sources":["../../../../src/cli/npm/publish/consumer-smoke.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAQ5D,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAGrE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAQtE,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,qBAAqB,CAAC;AAwGzE;;;;;;;;;GASG;AACH,wBAAgB,mCAAmC,CACjD,QAAQ,EAAE,IAAI,CAAC,uBAAuB,EAAE,MAAM,GAAG,SAAS,CAAC,GAC1D,MAAM,EAAE,CAgCV;AAqCD,0EAA0E;AAC1E,MAAM,MAAM,4BAA4B,GAAG;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,4EAA4E;AAC5E,MAAM,MAAM,4BAA4B,GAAG;IACzC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC;CAC9C,CAAC;AAEF,oDAAoD;AACpD,eAAO,MAAM,qCAAqC,SAAU,CAAC;AAE7D;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,yBAAyB,CAAC,OAAO,EAAE;IACvD,OAAO,EAAE,SAAS,4BAA4B,EAAE,CAAC;IACjD,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,gBAAgB,CAAC;IAC5B,wDAAwD;IACxD,OAAO,EAAE,eAAe,CAAC;IACzB,EAAE,EAAE,SAAS,CAAC;IACd,KAAK,EAAE,OAAO,CAAC;IACf,cAAc,CAAC,EAAE,6BAA6B,CAAC;IAC/C,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,GAAG,OAAO,CAAC,4BAA4B,CAAC,CA8LxC;AAED;;;;;;GAMG;AACH,wBAAsB,sCAAsC,CAAC,OAAO,EAAE;IACpE,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,SAAS,4BAA4B,EAAE,CAAC;IACjD,SAAS,EAAE,gBAAgB,CAAC;IAC5B,wDAAwD;IACxD,OAAO,EAAE,eAAe,CAAC;IACzB,cAAc,CAAC,EAAE,6BAA6B,CAAC;CAChD,GAAG,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CA8DxC"}