@vibesdotdev/infra-deploy 0.0.2 → 1.0.0-rc.5

package/dist/cli/npm/publish/release-lock.js

@@ -0,0 +1,371 @@
+import { hashHex } from "@vibesdotdev/crypto";
+import { assertRegistryStandaloneWorkspaceReady } from '@vibesdotdev/registry/standalone-install';
+import { realpathChecked, resolveFileSystemAdapter } from "@vibesdotdev/filesystem";
+import { GIT_CHILD_ENV } from "@vibesdotdev/git-operations/core";
+import { getRuntimePath } from "@vibesdotdev/paths";
+import { z } from "zod/v4";
+import { runRuntimeCommand, } from "../../shared/runtime-execution.js";
+import { canonicalForgeRepositoryIdentity } from "./forge-source-identity.js";
+import { parsePublisherManifest } from "./publisher-manifest.js";
+import { assertRegistryReleaseSnapshot, assertRegistryReleaseSnapshots, assertRegistryReleaseSourceLanded, COMPOSE_ROOT_RELEASE_PATH_PREFIXES, } from "./source-snapshot.js";
+import { DEFAULT_REGISTRY_RELEASE_MANIFEST, assertManagedRegistryReleaseWorkspaceManifest, buildManagedRegistryReleaseWorkspace, } from "./release-workspace.js";
+/**
+ * The release workspace manifest and its sibling `bun.lock`, relative and absolute,
+ * rejecting paths that escape the workspace.
+ */
+export async function resolveRegistryReleaseWorkspacePaths(options) {
+    const paths = await getRuntimePath(options.runtime);
+    const workspaceManifestPath = (options.workspaceManifestPath ?? DEFAULT_REGISTRY_RELEASE_MANIFEST).replaceAll("\\", "/");
+    const segments = workspaceManifestPath.split("/");
+    if (paths.isAbsolute(workspaceManifestPath) ||
+        segments.some((segment) => !segment || segment === "." || segment === "..") ||
+        segments.at(-1) !== "package.json" ||
+        segments[0] !== "release" ||
+        segments[1] !== "registry") {
+        throw new Error("Registry release workspace manifest must be an exact package.json path under release/registry");
+    }
+    const lockfilePath = [...segments.slice(0, -1), "bun.lock"].join("/");
+    const workspaceManifestAbsolutePath = paths.resolve(options.workspaceRoot, workspaceManifestPath);
+    const lockfileAbsolutePath = paths.resolve(options.workspaceRoot, lockfilePath);
+    for (const absolute of [
+        workspaceManifestAbsolutePath,
+        lockfileAbsolutePath,
+    ]) {
+        const position = paths.relative(paths.resolve(options.workspaceRoot), absolute);
+        if (!position ||
+            position === ".." ||
+            position.startsWith("../") ||
+            paths.isAbsolute(position)) {
+            throw new Error("Registry release workspace path escapes the registered workspace");
+        }
+    }
+    return {
+        workspaceManifestPath,
+        lockfilePath,
+        workspaceManifestAbsolutePath,
+        lockfileAbsolutePath,
+    };
+}
+/**
+ * Throw unless every segment of the path is a real (non-symlink) entry in the workspace.
+ */
+export async function assertCanonicalRegistryReleaseWorkspaceFile(options) {
+    const pathOwner = await getRuntimePath(options.runtime);
+    const files = await resolveFileSystemAdapter(options.runtime, { binding: false });
+    const canonicalRoot = await realpathChecked(files, options.workspaceRoot);
+    const segments = options.path.split("/");
+    let cursor = canonicalRoot;
+    for (const [index, segment] of segments.entries()) {
+        cursor = pathOwner.join(cursor, segment);
+        const entry = await files.stat(cursor);
+        if (entry.isSymlink || entry.kind === "symlink") {
+            throw new Error(`Registry release workspace path must not be a symlink: ${options.path}`);
+        }
+        const isFile = index === segments.length - 1;
+        if ((isFile && entry.kind !== "file") || (!isFile && entry.kind !== "directory")) {
+            throw new Error(`Registry release workspace path is not a canonical ${isFile ? "file" : "directory"}: ${options.path}`);
+        }
+    }
+    const position = pathOwner.relative(canonicalRoot, await realpathChecked(files, cursor));
+    if (!position ||
+        position === ".." ||
+        position.startsWith("../") ||
+        position.startsWith("..\\") ||
+        pathOwner.isAbsolute(position)) {
+        throw new Error(`Registry release workspace path escapes the registered workspace: ${options.path}`);
+    }
+}
+/** Landed `refs/heads/main` on the canonical Forge remote — not a dirty local HEAD. */
+export async function resolveForgeRefSha(options) {
+    const canonical = canonicalForgeRepositoryIdentity(options.repository);
+    const remote = await runRuntimeCommand({
+        runtime: options.runtime,
+        execution: options.execution,
+        command: "git",
+        inheritEnv: GIT_CHILD_ENV,
+        args: ["ls-remote", canonical.repository, options.ref],
+        cwd: options.sourceRoot,
+    });
+    const sha = remote.stdout.trim().split(/\s+/)[0] ?? "";
+    if (remote.code !== 0 || !/^[0-9a-f]{40}$/.test(sha)) {
+        throw new Error(`Cannot resolve landed Forge ref ${options.ref} for ${options.sourceRoot}`);
+    }
+    return sha;
+}
+/**
+ * The commit a session publish locks to: the workspace's verified snapshot, else Forge main.
+ */
+export async function resolveSessionPublishLockGitHead(options) {
+    // A standalone owner supplies both package sources and the root lock. Reuse
+    // its verified snapshot instead of racing a second read of moving main.
+    const sourceGitHead = options.expectedGitHeads.get(options.workspaceRoot);
+    if (sourceGitHead)
+        return sourceGitHead;
+    return resolveForgeRefSha({
+        sourceRoot: options.workspaceRoot,
+        repository: options.lockSource.repository,
+        ref: "refs/heads/main",
+        execution: options.execution,
+        runtime: options.runtime,
+    });
+}
+/** SHA-256 of a file as committed at `gitHead` (never the worktree copy). */
+export async function hashCommittedGitPath(options) {
+    const pathOwner = await getRuntimePath(options.runtime);
+    if (!options.path ||
+        options.path === "." ||
+        pathOwner.isAbsolute(options.path) ||
+        options.path
+            .split("/")
+            .some((segment) => !segment || segment === "." || segment === "..")) {
+        throw new Error(`Registry release committed path is not a nested file: ${options.path}`);
+    }
+    const shown = await runRuntimeCommand({
+        runtime: options.runtime,
+        execution: options.execution,
+        command: "git",
+        inheritEnv: GIT_CHILD_ENV,
+        args: ["show", `${options.gitHead}:${options.path}`],
+        cwd: options.sourceRoot,
+    });
+    if (shown.code !== 0) {
+        throw new Error(`Registry release committed path ${options.path} is missing at ${options.gitHead}`);
+    }
+    return hashHex(options.runtime, "sha256", shown.stdout);
+}
+/**
+ * Throw unless the worktree release manifest and lock match their committed bytes;
+ * returns the committed manifest and both digests.
+ */
+export async function assertRegistryReleaseWorkspaceFilesCommitted(options) {
+    const files = await resolveFileSystemAdapter(options.runtime);
+    const [workspaceManifestRaw, lockfileRaw, committedManifestSha256, committedLockfileSha256,] = await Promise.all([
+        files.readFile(options.paths.workspaceManifestAbsolutePath),
+        files.readFile(options.paths.lockfileAbsolutePath),
+        hashCommittedGitPath({
+            sourceRoot: options.workspaceRoot,
+            gitHead: options.lockGitHead,
+            path: options.paths.workspaceManifestPath,
+            execution: options.execution,
+            runtime: options.runtime,
+        }),
+        hashCommittedGitPath({
+            sourceRoot: options.workspaceRoot,
+            gitHead: options.lockGitHead,
+            path: options.paths.lockfilePath,
+            execution: options.execution,
+            runtime: options.runtime,
+        }),
+    ]);
+    const workspaceManifest = z.instanceof(Uint8Array).parse(workspaceManifestRaw);
+    const lockfile = z.instanceof(Uint8Array).parse(lockfileRaw);
+    const workspaceManifestSha256 = await hashHex(options.runtime, "sha256", workspaceManifest);
+    const lockfileSha256 = await hashHex(options.runtime, "sha256", lockfile);
+    if (workspaceManifestSha256 !== committedManifestSha256) {
+        throw new Error("Registry release workspace manifest differs from the landed lock authority");
+    }
+    if (lockfileSha256 !== committedLockfileSha256) {
+        throw new Error("Registry release lockfile differs from the landed lock authority");
+    }
+    return {
+        workspaceManifest,
+        workspaceManifestSha256: committedManifestSha256,
+        lockfileSha256: committedLockfileSha256,
+    };
+}
+/**
+ * Session product path: pack a developer-workspace member without requiring it
+ * in `release/registry/package.json`. A Developer composition binds to its
+ * committed release manifest and lock; a standalone owner repository binds to
+ * its committed root manifest and Bun lock. `--release-workspace-manifest`
+ * remains the sealed closure path.
+ */
+export async function resolveSessionPublishLockPaths(options) {
+    const releasePaths = await resolveRegistryReleaseWorkspacePaths({
+        runtime: options.runtime,
+        workspaceRoot: options.composeWorkspaceRoot,
+    });
+    const rootPaths = {
+        workspaceManifestPath: "package.json",
+        lockfilePath: "bun.lock",
+    };
+    const candidates = [
+        releasePaths.workspaceManifestPath,
+        releasePaths.lockfilePath,
+        rootPaths.workspaceManifestPath,
+        rootPaths.lockfilePath,
+    ];
+    const listed = await runRuntimeCommand({
+        runtime: options.runtime,
+        execution: options.execution,
+        command: "git",
+        inheritEnv: GIT_CHILD_ENV,
+        args: ["ls-tree", "--name-only", options.lockGitHead, "--", ...candidates],
+        cwd: options.composeWorkspaceRoot,
+    });
+    if (listed.code !== 0) {
+        throw new Error(`Cannot inspect the landed Registry session lock at ${options.lockGitHead}`);
+    }
+    const committed = new Set(listed.stdout.split(/\r?\n/).filter(Boolean));
+    const selectPair = (pair) => {
+        const manifest = committed.has(pair.workspaceManifestPath);
+        const lock = committed.has(pair.lockfilePath);
+        if (manifest !== lock) {
+            throw new Error(`Registry session lock is incomplete at ${options.lockGitHead}: ${pair.workspaceManifestPath} and ${pair.lockfilePath} must be committed together`);
+        }
+        return manifest ? pair : undefined;
+    };
+    return (selectPair({
+        workspaceManifestPath: releasePaths.workspaceManifestPath,
+        lockfilePath: releasePaths.lockfilePath,
+    }) ??
+        selectPair(rootPaths) ??
+        (() => {
+            throw new Error(`Registry session lock is missing at ${options.lockGitHead}: expected release/registry/{package.json,bun.lock} or repository-root {package.json,bun.lock}`);
+        })());
+}
+/**
+ * The release workspace of a session publish, locked to the committed root or
+ * `release/registry` manifest and lock.
+ */
+export async function buildSessionPublishReleaseWorkspace(options) {
+    const paths = await resolveSessionPublishLockPaths({
+        composeWorkspaceRoot: options.composeWorkspaceRoot,
+        lockGitHead: options.lockGitHead,
+        execution: options.execution,
+        runtime: options.runtime,
+    });
+    const workspaceManifestSha256 = await hashCommittedGitPath({
+        sourceRoot: options.composeWorkspaceRoot,
+        gitHead: options.lockGitHead,
+        path: paths.workspaceManifestPath,
+        execution: options.execution,
+        runtime: options.runtime,
+    });
+    const lockfileSha256 = await hashCommittedGitPath({
+        sourceRoot: options.composeWorkspaceRoot,
+        gitHead: options.lockGitHead,
+        path: paths.lockfilePath,
+        execution: options.execution,
+        runtime: options.runtime,
+    });
+    return buildManagedRegistryReleaseWorkspace({
+        runtime: options.runtime,
+        workspaceRoot: options.composeWorkspaceRoot,
+        buildPackages: options.buildPackages,
+        packages: options.packages,
+        buildPackageOrder: options.buildPackageOrder,
+        expectedGitHeads: options.expectedGitHeads,
+        lockSource: options.lockSource,
+        lockGitHead: options.lockGitHead,
+        workspaceManifestPath: paths.workspaceManifestPath,
+        lockfilePath: paths.lockfilePath,
+        workspaceManifestSha256,
+        lockfileSha256,
+    });
+}
+/**
+ * Verify every build source is a clean, landed snapshot and the release lock
+ * is committed and landed. Returns each source root's verified commit and the
+ * sealer for the release workspace, which names exact outputs and so is
+ * sealed only after version assignment.
+ */
+export async function verifyRegistryReleaseLock(options) {
+    const { workspaceRoot, execution, lockSource } = options;
+    const requireLanded = options.rcMajorException !== true;
+    const expectedGitHeads = await assertRegistryReleaseSnapshots({
+        targets: options.buildPackages,
+        execution,
+        runtime: options.runtime,
+        requireLanded,
+    });
+    const paths = options.releaseWorkspacePaths;
+    if (paths) {
+        const lockGitHead = await assertRegistryReleaseSnapshot({
+            workspaceRoot,
+            execution,
+            runtime: options.runtime,
+            ignoreUntracked: true,
+            relevantPathPrefixes: COMPOSE_ROOT_RELEASE_PATH_PREFIXES,
+        });
+        if (requireLanded)
+            await assertRegistryReleaseSourceLanded({
+                sourceRoot: workspaceRoot,
+                repository: lockSource.repository,
+                expectedGitHead: lockGitHead,
+                execution,
+                runtime: options.runtime,
+            });
+        const committedReleaseFiles = await assertRegistryReleaseWorkspaceFilesCommitted({
+            workspaceRoot,
+            lockGitHead,
+            paths,
+            execution,
+            runtime: options.runtime,
+        });
+        const workspaceManifest = parsePublisherManifest(JSON.parse(new TextDecoder().decode(committedReleaseFiles.workspaceManifest)));
+        await assertManagedRegistryReleaseWorkspaceManifest({
+            runtime: options.runtime,
+            workspaceRoot,
+            buildPackages: options.buildPackages,
+            manifest: workspaceManifest,
+        });
+        await assertRegistryStandaloneWorkspaceReady(options.runtime, { cwd: workspaceRoot, manifest: workspaceManifest });
+        return {
+            expectedGitHeads,
+            sealReleaseWorkspace: async (assigned) => buildManagedRegistryReleaseWorkspace({
+                runtime: options.runtime,
+                workspaceRoot,
+                buildPackages: assigned.buildPackages,
+                packages: assigned.packages,
+                buildPackageOrder: options.buildPackageOrder,
+                expectedGitHeads,
+                lockSource,
+                lockGitHead,
+                workspaceManifestPath: paths.workspaceManifestPath,
+                lockfilePath: paths.lockfilePath,
+                workspaceManifestSha256: committedReleaseFiles.workspaceManifestSha256,
+                lockfileSha256: committedReleaseFiles.lockfileSha256,
+            }),
+        };
+    }
+    const lockGitHead = requireLanded
+        ? await resolveSessionPublishLockGitHead({
+            workspaceRoot,
+            expectedGitHeads,
+            lockSource,
+            execution,
+            runtime: options.runtime,
+        })
+        : (expectedGitHeads.get(workspaceRoot) ??
+            (await assertRegistryReleaseSnapshot({
+                workspaceRoot,
+                execution,
+                runtime: options.runtime,
+                ignoreUntracked: true,
+                relevantPathPrefixes: COMPOSE_ROOT_RELEASE_PATH_PREFIXES,
+            })));
+    if (requireLanded)
+        await assertRegistryReleaseSourceLanded({
+            sourceRoot: workspaceRoot,
+            repository: lockSource.repository,
+            expectedGitHead: lockGitHead,
+            execution,
+            runtime: options.runtime,
+        });
+    return {
+        expectedGitHeads,
+        sealReleaseWorkspace: (assigned) => buildSessionPublishReleaseWorkspace({
+            composeWorkspaceRoot: workspaceRoot,
+            buildPackages: assigned.buildPackages,
+            packages: assigned.packages,
+            buildPackageOrder: options.buildPackageOrder,
+            expectedGitHeads,
+            lockSource,
+            lockGitHead,
+            execution,
+            runtime: options.runtime,
+        }),
+    };
+}
+//# sourceMappingURL=release-lock.js.map

package/dist/cli/npm/publish/release-lock.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"release-lock.js","sourceRoot":"","sources":["../../../../src/cli/npm/publish/release-lock.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAC9C,OAAO,EAAE,sCAAsC,EAAE,MAAM,0CAA0C,CAAC;AAClG,OAAO,EAAE,eAAe,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAC;AACpF,OAAO,EAAE,aAAa,EAAE,MAAM,kCAAkC,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAEpD,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;AAC3B,OAAO,EACL,iBAAiB,GAChB,MAAM,mCAAmC,CAAC;AAC7C,OAAO,EAAE,gCAAgC,EAAE,MAAM,4BAA4B,CAAC;AAC9E,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,EACL,6BAA6B,EAC7B,8BAA8B,EAC9B,iCAAiC,EACjC,kCAAkC,GACnC,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,iCAAiC,EAEjC,6CAA6C,EAC7C,oCAAoC,GACrC,MAAM,wBAAwB,CAAC;AAchC;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,oCAAoC,CAAC,OAI1D;IACC,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACpD,MAAM,qBAAqB,GAAG,CAC5B,OAAO,CAAC,qBAAqB,IAAI,iCAAiC,CACnE,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACxB,MAAM,QAAQ,GAAG,qBAAqB,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClD,IACE,KAAK,CAAC,UAAU,CAAC,qBAAqB,CAAC;QACvC,QAAQ,CAAC,IAAI,CACX,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,CAC7D;QACD,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,cAAc;QAClC,QAAQ,CAAC,CAAC,CAAC,KAAK,SAAS;QACzB,QAAQ,CAAC,CAAC,CAAC,KAAK,UAAU,EAC1B,CAAC;QACD,MAAM,IAAI,KAAK,CACb,+FAA+F,CAChG,CAAC;IACJ,CAAC;IACD,MAAM,YAAY,GAAG,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACtE,MAAM,6BAA6B,GAAG,KAAK,CAAC,OAAO,CACjD,OAAO,CAAC,aAAa,EACrB,qBAAqB,CACtB,CAAC;IACF,MAAM,oBAAoB,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,EAAE,YAAY,CAAC,CAAC;IAChF,KAAK,MAAM,QAAQ,IAAI;QACrB,6BAA6B;QAC7B,oBAAoB;KACrB,EAAE,CAAC;QACF,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,QAAQ,CAAC,CAAC;QAChF,IACE,CAAC,QAAQ;YACT,QAAQ,KAAK,IAAI;YACjB,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC;YAC1B,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC,EAC1B,CAAC;YACD,MAAM,IAAI,KAAK,CACb,kEAAkE,CACnE,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO;QACL,qBAAqB;QACrB,YAAY;QACZ,6BAA6B;QAC7B,oBAAoB;KACrB,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,2CAA2C,CAAC,OAIjE;IACC,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACxD,MAAM,KAAK,GAAG,MAAM,wBAAwB,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IAClF,MAAM,aAAa,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;IAC1E,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,MAAM,GAAG,aAAa,CAAC;IAC3B,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC;QAClD,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACzC,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CACb,0DAA0D,OAAO,CAAC,IAAI,EAAE,CACzE,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,KAAK,KAAK,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;QAC7C,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,CAAC,EAAE,CAAC;YACjF,MAAM,IAAI,KAAK,CACb,sDAAsD,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,KAAK,OAAO,CAAC,IAAI,EAAE,CACvG,CAAC;QACJ,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,SAAS,CAAC,QAAQ,CAAC,aAAa,EAAE,MAAM,eAAe,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;IACzF,IACE,CAAC,QAAQ;QACT,QAAQ,KAAK,IAAI;QACjB,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC;QAC1B,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC;QAC3B,SAAS,CAAC,UAAU,CAAC,QAAQ,CAAC,EAC9B,CAAC;QACD,MAAM,IAAI,KAAK,CACb,qEAAqE,OAAO,CAAC,IAAI,EAAE,CACpF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAOxC;IACC,MAAM,SAAS,GAAG,gCAAgC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACvE,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC;QACrC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,OAAO,EAAE,KAAK;QACd,UAAU,EAAE,aAAa;QACzB,IAAI,EAAE,CAAC,WAAW,EAAE,SAAS,CAAC,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC;QACtD,GAAG,EAAE,OAAO,CAAC,UAAU;KACxB,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACvD,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,KAAK,CACb,mCAAmC,OAAO,CAAC,GAAG,QAAQ,OAAO,CAAC,UAAU,EAAE,CAC3E,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,gCAAgC,CAAC,OAOtD;IACC,4EAA4E;IAC5E,wEAAwE;IACxE,MAAM,aAAa,GAAG,OAAO,CAAC,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAC1E,IAAI,aAAa;QAAE,OAAO,aAAa,CAAC;IACxC,OAAO,kBAAkB,CAAC;QACxB,UAAU,EAAE,OAAO,CAAC,aAAa;QACjC,UAAU,EAAE,OAAO,CAAC,UAAU,CAAC,UAAU;QACzC,GAAG,EAAE,iBAAiB;QACtB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC,CAAC;AACL,CAAC;AAED,6EAA6E;AAC7E,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAO1C;IACC,MAAM,SAAS,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACxD,IACE,CAAC,OAAO,CAAC,IAAI;QACb,OAAO,CAAC,IAAI,KAAK,GAAG;QACpB,SAAS,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC;QAClC,OAAO,CAAC,IAAI;aACT,KAAK,CAAC,GAAG,CAAC;aACV,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,CAAC,EACrE,CAAC;QACD,MAAM,IAAI,KAAK,CACb,yDAAyD,OAAO,CAAC,IAAI,EAAE,CACxE,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC;QACpC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,OAAO,EAAE,KAAK;QACd,UAAU,EAAE,aAAa;QACzB,IAAI,EAAE,CAAC,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACpD,GAAG,EAAE,OAAO,CAAC,UAAU;KACxB,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CACb,mCAAmC,OAAO,CAAC,IAAI,kBAAkB,OAAO,CAAC,OAAO,EAAE,CACnF,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;AAC1D,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,4CAA4C,CAAC,OAOlE;IAKC,MAAM,KAAK,GAAG,MAAM,wBAAwB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9D,MAAM,CACJ,oBAAoB,EACpB,WAAW,EACX,uBAAuB,EACvB,uBAAuB,EACxB,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACpB,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,6BAA6B,CAAC;QAC3D,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,oBAAoB,CAAC;QAClD,oBAAoB,CAAC;YACnB,UAAU,EAAE,OAAO,CAAC,aAAa;YACjC,OAAO,EAAE,OAAO,CAAC,WAAW;YAC5B,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,qBAAqB;YACzC,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC;QACF,oBAAoB,CAAC;YACnB,UAAU,EAAE,OAAO,CAAC,aAAa;YACjC,OAAO,EAAE,OAAO,CAAC,WAAW;YAC5B,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,YAAY;YAChC,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC;KACH,CAAC,CAAC;IACH,MAAM,iBAAiB,GAAG,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;IAC/E,MAAM,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC7D,MAAM,uBAAuB,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE,iBAAiB,CAAC,CAAC;IAC5F,MAAM,cAAc,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC1E,IAAI,uBAAuB,KAAK,uBAAuB,EAAE,CAAC;QACxD,MAAM,IAAI,KAAK,CACb,4EAA4E,CAC7E,CAAC;IACJ,CAAC;IACD,IAAI,cAAc,KAAK,uBAAuB,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CACb,kEAAkE,CACnE,CAAC;IACJ,CAAC;IACD,OAAO;QACL,iBAAiB;QACjB,uBAAuB,EAAE,uBAAuB;QAChD,cAAc,EAAE,uBAAuB;KACxC,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,OAMpD;IACC,MAAM,YAAY,GAAG,MAAM,oCAAoC,CAAC;QAC9D,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,aAAa,EAAE,OAAO,CAAC,oBAAoB;KAC5C,CAAC,CAAC;IACH,MAAM,SAAS,GAAG;QAChB,qBAAqB,EAAE,cAAc;QACrC,YAAY,EAAE,UAAU;KACzB,CAAC;IACF,MAAM,UAAU,GAAG;QACjB,YAAY,CAAC,qBAAqB;QAClC,YAAY,CAAC,YAAY;QACzB,SAAS,CAAC,qBAAqB;QAC/B,SAAS,CAAC,YAAY;KACvB,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC;QACrC,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,OAAO,EAAE,KAAK;QACd,UAAU,EAAE,aAAa;QACzB,IAAI,EAAE,CAAC,SAAS,EAAE,aAAa,EAAE,OAAO,CAAC,WAAW,EAAE,IAAI,EAAE,GAAG,UAAU,CAAC;QAC1E,GAAG,EAAE,OAAO,CAAC,oBAAoB;KAClC,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CACb,sDAAsD,OAAO,CAAC,WAAW,EAAE,CAC5E,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;IACxE,MAAM,UAAU,GAAG,CAAC,IAAsB,EAAgC,EAAE;QAC1E,MAAM,QAAQ,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QAC3D,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC9C,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CACb,0CAA0C,OAAO,CAAC,WAAW,KAAK,IAAI,CAAC,qBAAqB,QAAQ,IAAI,CAAC,YAAY,6BAA6B,CACnJ,CAAC;QACJ,CAAC;QACD,OAAO,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACrC,CAAC,CAAC;IACF,OAAO,CACL,UAAU,CAAC;QACT,qBAAqB,EAAE,YAAY,CAAC,qBAAqB;QACzD,YAAY,EAAE,YAAY,CAAC,YAAY;KACxC,CAAC;QACF,UAAU,CAAC,SAAS,CAAC;QACrB,CAAC,GAAG,EAAE;YACJ,MAAM,IAAI,KAAK,CACb,uCAAuC,OAAO,CAAC,WAAW,gGAAgG,CAC3J,CAAC;QACJ,CAAC,CAAC,EAAE,CACL,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mCAAmC,CAAC,OAWzD;IACC,MAAM,KAAK,GAAG,MAAM,8BAA8B,CAAC;QACjD,oBAAoB,EAAE,OAAO,CAAC,oBAAoB;QAClD,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC,CAAC;IACH,MAAM,uBAAuB,GAAG,MAAM,oBAAoB,CAAC;QACzD,UAAU,EAAE,OAAO,CAAC,oBAAoB;QACxC,OAAO,EAAE,OAAO,CAAC,WAAW;QAC5B,IAAI,EAAE,KAAK,CAAC,qBAAqB;QACjC,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC,CAAC;IACH,MAAM,cAAc,GAAG,MAAM,oBAAoB,CAAC;QAChD,UAAU,EAAE,OAAO,CAAC,oBAAoB;QACxC,OAAO,EAAE,OAAO,CAAC,WAAW;QAC5B,IAAI,EAAE,KAAK,CAAC,YAAY;QACxB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC,CAAC;IACH,OAAO,oCAAoC,CAAC;QAC1C,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,aAAa,EAAE,OAAO,CAAC,oBAAoB;QAC3C,aAAa,EAAE,OAAO,CAAC,aAAa;QACpC,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;QAC5C,gBAAgB,EAAE,OAAO,CAAC,gBAAgB;QAC1C,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;QAClD,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,uBAAuB;QACvB,cAAc;KACf,CAAC,CAAC;AACL,CAAC;AAQD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,OAgB/C;IAIC,MAAM,EAAE,aAAa,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,OAAO,CAAC;IACzD,MAAM,aAAa,GAAG,OAAO,CAAC,gBAAgB,KAAK,IAAI,CAAC;IACxD,MAAM,gBAAgB,GAAG,MAAM,8BAA8B,CAAC;QAC5D,OAAO,EAAE,OAAO,CAAC,aAAa;QAC9B,SAAS;QACT,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,aAAa;KACd,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAC5C,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,WAAW,GAAG,MAAM,6BAA6B,CAAC;YACtD,aAAa;YACb,SAAS;YACT,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,eAAe,EAAE,IAAI;YACrB,oBAAoB,EAAE,kCAAkC;SACzD,CAAC,CAAC;QACH,IAAI,aAAa;YACf,MAAM,iCAAiC,CAAC;gBACtC,UAAU,EAAE,aAAa;gBACzB,UAAU,EAAE,UAAU,CAAC,UAAU;gBACjC,eAAe,EAAE,WAAW;gBAC5B,SAAS;gBACT,OAAO,EAAE,OAAO,CAAC,OAAO;aACzB,CAAC,CAAC;QACL,MAAM,qBAAqB,GACzB,MAAM,4CAA4C,CAAC;YACjD,aAAa;YACb,WAAW;YACX,KAAK;YACL,SAAS;YACT,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC,CAAC;QACL,MAAM,iBAAiB,GAAG,sBAAsB,CAC9C,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,iBAAiB,CAAC,CAAC,CAC9E,CAAC;QACF,MAAM,6CAA6C,CAAC;YAClD,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,aAAa;YACb,aAAa,EAAE,OAAO,CAAC,aAAa;YACpC,QAAQ,EAAE,iBAAiB;SAC5B,CAAC,CAAC;QACH,MAAM,sCAAsC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,aAAa,EAAE,QAAQ,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACnH,OAAO;YACL,gBAAgB;YAChB,oBAAoB,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,CACvC,oCAAoC,CAAC;gBACnC,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,aAAa;gBACb,aAAa,EAAE,QAAQ,CAAC,aAAa;gBACrC,QAAQ,EAAE,QAAQ,CAAC,QAAQ;gBAC3B,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;gBAC5C,gBAAgB;gBAChB,UAAU;gBACV,WAAW;gBACX,qBAAqB,EAAE,KAAK,CAAC,qBAAqB;gBAClD,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,uBAAuB,EAAE,qBAAqB,CAAC,uBAAuB;gBACtE,cAAc,EAAE,qBAAqB,CAAC,cAAc;aACrD,CAAC;SACL,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,aAAa;QAC/B,CAAC,CAAC,MAAM,gCAAgC,CAAC;YACrC,aAAa;YACb,gBAAgB;YAChB,UAAU;YACV,SAAS;YACT,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC;QACJ,CAAC,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC,aAAa,CAAC;YACpC,CAAC,MAAM,6BAA6B,CAAC;gBACnC,aAAa;gBACb,SAAS;gBACT,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,eAAe,EAAE,IAAI;gBACrB,oBAAoB,EAAE,kCAAkC;aACzD,CAAC,CAAC,CAAC,CAAC;IACT,IAAI,aAAa;QACf,MAAM,iCAAiC,CAAC;YACtC,UAAU,EAAE,aAAa;YACzB,UAAU,EAAE,UAAU,CAAC,UAAU;YACjC,eAAe,EAAE,WAAW;YAC5B,SAAS;YACT,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC,CAAC;IACL,OAAO;QACL,gBAAgB;QAChB,oBAAoB,EAAE,CAAC,QAAQ,EAAE,EAAE,CACjC,mCAAmC,CAAC;YAClC,oBAAoB,EAAE,aAAa;YACnC,aAAa,EAAE,QAAQ,CAAC,aAAa;YACrC,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;YAC5C,gBAAgB;YAChB,UAAU;YACV,WAAW;YACX,SAAS;YACT,OAAO,EAAE,OAAO,CAAC,OAAO;SACzB,CAAC;KACL,CAAC;AACJ,CAAC"}

package/dist/cli/npm/publish/release-phases.d.ts

@@ -0,0 +1,93 @@
+/**
+ * Release phases: seal every publish target (or take its verified reuse),
+ * prove the sealed set as a consumer, re-verify the source snapshots, then
+ * publish dependency-first. Nothing reaches the Registry until every target
+ * is sealed and proven.
+ */
+import type { ChildEnvRuntime } from "../../shared/runtime-execution.ts";
+import type { UIContext } from "@vibesdotdev/cli/providers";
+import type { VibesRuntime } from "@vibesdotdev/kernel";
+import type { RegistryReleaseSetPlan, RegistryReleaseWorkspacePackage } from "@vibesdotdev/registry";
+import type { RuntimeExecution } from "@vibesdotdev/kernel/execution";
+import type { PublisherConsumerSmokeResult } from "./consumer-smoke.ts";
+import type { SealedWorkspaceRegistryInput } from "./external-requirements.ts";
+import type { ReleaseConsumerSourceRegistry } from "./proof-registry.ts";
+import type { ReleasePublishJobInput } from "../../../schemas/release-jobs.ts";
+import type { PlatformRegistryClient } from "./platform-registry.ts";
+import type { RegistryReleaseAvailabilityPlan } from "./registry-availability.ts";
+import type { ManagedRegistryReleaseWorkspaceWire } from "./release-workspace.ts";
+import type { PublishResult, RegistryReleaseBuildPackage, RegistryReleasePublishTarget } from "./types.ts";
+/** Seal the whole release set before the first real remote mutation. */
+export declare function runRegistryReleasePhases<TTarget, TResult>(options: {
+    targets: readonly TTarget[];
+    dryRun: boolean;
+    preflight(target: TTarget): Promise<TResult>;
+    afterSeal?(results: readonly TResult[]): Promise<void>;
+    beforePublish?(results: readonly TResult[]): Promise<void>;
+    publish(target: TTarget, index: number, sealed: TResult): Promise<TResult>;
+    onPublishProgress?(results: readonly TResult[]): Promise<void> | void;
+    afterPublish?(result: TResult, index: number): Promise<void>;
+}): Promise<TResult[]>;
+/** Publish options shared by the seal and publish phases of every target. */
+export type RegistryReleasePublishSettings = {
+    scope: string;
+    tag?: string;
+    otp?: string;
+    provenance: boolean;
+    tokenSecret?: NonNullable<ReleasePublishJobInput["tokenSecret"]>;
+    rateLimitRetries: number;
+    rateLimitDelayMs: number;
+    managedLease: boolean;
+    authorityVerify: boolean;
+    /** Where published tarballs are retained (`--pack-destination`), if anywhere. */
+    artifactDir?: string;
+    /** Delay between real publishes. */
+    publishDelayMs: number;
+};
+/** Results of every target plus the consumer smoke and proof evidence. */
+export type RegistryReleasePublishOutcome = {
+    results: PublishResult[];
+    consumerSmoke?: PublisherConsumerSmokeResult;
+    consumerProof?: {
+        installed: number;
+        imports: string[];
+        bins: string[];
+        withheld: string[];
+    };
+};
+/**
+ * Run the release phases for `publishTargets` (at their assigned versions).
+ * `onProgress` observes results as they land so a caller can report partial
+ * progress when a later publish fails.
+ */
+export declare function runRegistryReleasePublish(options: {
+    /** The release run's Platform Registry client, bound to the command's runtime. */
+    platformRegistry: PlatformRegistryClient;
+    publishTargets: readonly RegistryReleasePublishTarget[];
+    buildPackages: readonly RegistryReleaseBuildPackage[];
+    availabilityPlan: RegistryReleaseAvailabilityPlan;
+    expectedGitHeads: ReadonlyMap<string, string>;
+    /** Workspace versions for `workspace:` selectors, with assigned versions applied. */
+    versions: Map<string, string>;
+    releasePlan: RegistryReleaseSetPlan;
+    releaseWorkspace: ManagedRegistryReleaseWorkspaceWire;
+    workspaceRoot: string;
+    workspace: ReadonlyMap<string, RegistryReleaseWorkspacePackage>;
+    sourceRegistry: ReleaseConsumerSourceRegistry;
+    sealedWorkspaceInputs: readonly SealedWorkspaceRegistryInput[];
+    /** Temporary directory the release seals artifacts into. */
+    sealArtifactDir: string;
+    consumerPath?: string;
+    settings: RegistryReleasePublishSettings;
+    dryRun: boolean;
+    quiet: boolean;
+    ui: UIContext;
+    execution: RuntimeExecution;
+    /** The runtime child environments are composed from; the release jobs
+     * client dispatches through the same runtime's Workers client. */
+    runtime: ChildEnvRuntime & VibesRuntime;
+    onProgress(results: readonly PublishResult[]): void;
+    /** ADR-0017 RC major-version exception: skip only the landed-on-main checks. */
+    rcMajorException?: boolean;
+}): Promise<RegistryReleasePublishOutcome>;
+//# sourceMappingURL=release-phases.d.ts.map

package/dist/cli/npm/publish/release-phases.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"release-phases.d.ts","sourceRoot":"","sources":["../../../../src/cli/npm/publish/release-phases.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,mCAAmC,CAAC;AACzE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAExD,OAAO,KAAK,EACV,sBAAsB,EACtB,+BAA+B,EAChC,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACtE,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,qBAAqB,CAAC;AACxE,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,4BAA4B,CAAC;AAC/E,OAAO,KAAK,EAAE,6BAA6B,EAAE,MAAM,qBAAqB,CAAC;AAGzE,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAC;AAC/E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AACrE,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,4BAA4B,CAAC;AAElF,OAAO,KAAK,EAAE,mCAAmC,EAAE,MAAM,wBAAwB,CAAC;AAOlF,OAAO,KAAK,EACV,aAAa,EACb,2BAA2B,EAC3B,4BAA4B,EAC7B,MAAM,YAAY,CAAC;AAEpB,wEAAwE;AACxE,wBAAsB,wBAAwB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE;IACxE,OAAO,EAAE,SAAS,OAAO,EAAE,CAAC;IAC5B,MAAM,EAAE,OAAO,CAAC;IAChB,SAAS,CAAC,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7C,SAAS,CAAC,CAAC,OAAO,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACvD,aAAa,CAAC,CAAC,OAAO,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC3E,iBAAiB,CAAC,CAAC,OAAO,EAAE,SAAS,OAAO,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IACtE,YAAY,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9D,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAmBrB;AAED,6EAA6E;AAC7E,MAAM,MAAM,8BAA8B,GAAG;IAC3C,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,OAAO,CAAC;IACpB,WAAW,CAAC,EAAE,WAAW,CAAC,sBAAsB,CAAC,aAAa,CAAC,CAAC,CAAC;IACjE,gBAAgB,EAAE,MAAM,CAAC;IACzB,gBAAgB,EAAE,MAAM,CAAC;IACzB,YAAY,EAAE,OAAO,CAAC;IACtB,eAAe,EAAE,OAAO,CAAC;IACzB,iFAAiF;IACjF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oCAAoC;IACpC,cAAc,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF,0EAA0E;AAC1E,MAAM,MAAM,6BAA6B,GAAG;IAC1C,OAAO,EAAE,aAAa,EAAE,CAAC;IACzB,aAAa,CAAC,EAAE,4BAA4B,CAAC;IAC7C,aAAa,CAAC,EAAE;QACd,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,EAAE,MAAM,EAAE,CAAC;QAClB,IAAI,EAAE,MAAM,EAAE,CAAC;QACf,QAAQ,EAAE,MAAM,EAAE,CAAC;KACpB,CAAC;CACH,CAAC;AAEF;;;;GAIG;AACH,wBAAsB,yBAAyB,CAAC,OAAO,EAAE;IACvD,kFAAkF;IAClF,gBAAgB,EAAE,sBAAsB,CAAC;IACzC,cAAc,EAAE,SAAS,4BAA4B,EAAE,CAAC;IACxD,aAAa,EAAE,SAAS,2BAA2B,EAAE,CAAC;IACtD,gBAAgB,EAAE,+BAA+B,CAAC;IAClD,gBAAgB,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C,qFAAqF;IACrF,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,WAAW,EAAE,sBAAsB,CAAC;IACpC,gBAAgB,EAAE,mCAAmC,CAAC;IACtD,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,WAAW,CAAC,MAAM,EAAE,+BAA+B,CAAC,CAAC;IAChE,cAAc,EAAE,6BAA6B,CAAC;IAC9C,qBAAqB,EAAE,SAAS,4BAA4B,EAAE,CAAC;IAC/D,4DAA4D;IAC5D,eAAe,EAAE,MAAM,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,8BAA8B,CAAC;IACzC,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;IACf,EAAE,EAAE,SAAS,CAAC;IACd,SAAS,EAAE,gBAAgB,CAAC;IAC5B;sEACkE;IAClE,OAAO,EAAE,eAAe,GAAG,YAAY,CAAC;IACxC,UAAU,CAAC,OAAO,EAAE,SAAS,aAAa,EAAE,GAAG,IAAI,CAAC;IACpD,gFAAgF;IAChF,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B,GAAG,OAAO,CAAC,6BAA6B,CAAC,CA0JzC"}

package/dist/cli/npm/publish/release-phases.js

@@ -0,0 +1,175 @@
+import { getRuntimePath } from "@vibesdotdev/paths";
+import { publishPackage } from "./publish-package.js";
+import { dispatchSealedReleasePublish } from "./release-jobs.client.js";
+import { runSealedReleaseConsumerChecks } from "./release-consumer-proof.js";
+import { assertRegistryReleaseSourceCommit, assertRegistryReleaseSnapshots, assertRegistryReleaseTargetSnapshot, expectedGitHeadForTarget, } from "./source-snapshot.js";
+/** Seal the whole release set before the first real remote mutation. */
+export async function runRegistryReleasePhases(options) {
+    const sealed = [];
+    for (const target of options.targets)
+        sealed.push(await options.preflight(target));
+    await options.afterSeal?.(sealed);
+    await options.beforePublish?.(sealed);
+    if (options.dryRun)
+        return sealed;
+    const results = [];
+    for (let index = 0; index < options.targets.length; index += 1) {
+        const result = await options.publish(options.targets[index], index, sealed[index]);
+        results.push(result);
+        await options.onPublishProgress?.(results);
+        await options.afterPublish?.(result, index);
+    }
+    return results;
+}
+/**
+ * Run the release phases for `publishTargets` (at their assigned versions).
+ * `onProgress` observes results as they land so a caller can report partial
+ * progress when a later publish fails.
+ */
+export async function runRegistryReleasePublish(options) {
+    const { settings, execution, expectedGitHeads, ui, quiet } = options;
+    const outcome = {};
+    let delayNextPublish = false;
+    const results = await runRegistryReleasePhases({
+        targets: options.publishTargets,
+        dryRun: options.dryRun,
+        preflight: async (target) => {
+            const reused = options.availabilityPlan.reuse.get(target.name);
+            if (reused)
+                return reused;
+            return publishPackage({
+                platformRegistry: options.platformRegistry,
+                packageDir: target.packageDir,
+                workspaceRoot: options.workspaceRoot,
+                registry: target.registry,
+                scope: settings.scope,
+                tag: settings.tag,
+                otp: undefined,
+                provenance: settings.provenance,
+                dryRun: true,
+                rateLimitRetries: 0,
+                rateLimitDelayMs: 0,
+                ui,
+                versions: options.versions,
+                sourceRegistry: options.sourceRegistry,
+                version: target.version,
+                execution,
+                runtime: options.runtime,
+                quiet,
+                managedLease: false,
+                authorityVerify: false,
+                artifactDir: options.sealArtifactDir,
+                workspaceProvenance: target.workspaceProvenance,
+                expectedGitHead: expectedGitHeadForTarget(target, expectedGitHeads),
+                build: false,
+            });
+        },
+        afterSeal: async (sealed) => {
+            const pathOwner = await getRuntimePath(options.runtime);
+            const checks = await runSealedReleaseConsumerChecks({
+                sealed,
+                smoke: {
+                    workspaceRoot: options.workspaceRoot,
+                    execution,
+                    runtime: options.runtime,
+                    ui,
+                    quiet,
+                    sourceRegistry: options.sourceRegistry,
+                    consumerPath: options.consumerPath,
+                },
+                proof: {
+                    artifactDir: options.sealArtifactDir,
+                    plan: options.releasePlan,
+                    workspaceRoot: options.workspaceRoot,
+                    workspace: options.workspace,
+                    execution,
+                    runtime: options.runtime,
+                    sourceRegistry: options.sourceRegistry,
+                    sealedWorkspaceInputs: options.sealedWorkspaceInputs,
+                    reusedTarballs: new Set([...options.availabilityPlan.reuse.values()].flatMap((result) => result.tarball ? [pathOwner.basename(result.tarball)] : [])),
+                },
+            });
+            outcome.consumerSmoke = checks.consumerSmoke;
+            outcome.consumerProof = checks.consumerProof;
+        },
+        beforePublish: async (sealed) => {
+            for (const result of sealed) {
+                if (result.skipped)
+                    continue;
+                const target = options.publishTargets.find((candidate) => candidate.name === result.name);
+                if (!target) {
+                    throw new Error(`Sealed release source commit differs for ${result.name}`);
+                }
+                const expected = expectedGitHeadForTarget(target, expectedGitHeads);
+                assertRegistryReleaseSourceCommit({
+                    expected,
+                    observed: result.gitHead,
+                    message: `Sealed release source commit differs for ${result.name}`,
+                });
+            }
+            await assertRegistryReleaseSnapshots({
+                targets: options.buildPackages,
+                execution,
+                runtime: options.runtime,
+                expectedGitHeads,
+                requireLanded: options.rcMajorException !== true,
+            });
+        },
+        publish: async (target, _index, sealed) => {
+            await assertRegistryReleaseTargetSnapshot({
+                target,
+                execution,
+                runtime: options.runtime,
+                expectedGitHeads,
+                requireLanded: options.rcMajorException !== true,
+            });
+            const expectedGitHead = expectedGitHeadForTarget(target, expectedGitHeads);
+            if (!sealed.skipped) {
+                assertRegistryReleaseSourceCommit({
+                    expected: expectedGitHead,
+                    observed: sealed.gitHead,
+                    message: `Sealed release source commit differs for ${sealed.name}`,
+                });
+            }
+            const delayBeforePublish = delayNextPublish;
+            delayNextPublish = false;
+            return sealed.skipped
+                ? { ...sealed, dryRun: false }
+                : dispatchSealedReleasePublish({
+                    runtime: options.runtime,
+                    target,
+                    sealedArtifact: sealed,
+                    workspaceRoot: options.workspaceRoot,
+                    scope: settings.scope,
+                    tag: settings.tag,
+                    otp: settings.otp,
+                    provenance: settings.provenance,
+                    rateLimitRetries: settings.rateLimitRetries,
+                    rateLimitDelayMs: settings.rateLimitDelayMs,
+                    publishDelayMs: settings.publishDelayMs,
+                    delayBeforePublish,
+                    quiet,
+                    managedLease: settings.managedLease,
+                    authorityVerify: settings.authorityVerify,
+                    artifactDir: settings.artifactDir,
+                    workspaceProvenance: target.workspaceProvenance,
+                    expectedGitHead,
+                    releaseWorkspace: options.releaseWorkspace,
+                    publishTargets: options.publishTargets,
+                    tokenSecret: settings.tokenSecret,
+                    ui,
+                });
+        },
+        afterPublish: async (result, index) => {
+            const hasNext = index < options.publishTargets.length - 1;
+            delayNextPublish =
+                !options.dryRun &&
+                    hasNext &&
+                    settings.publishDelayMs > 0 &&
+                    !result.skipped;
+        },
+        onPublishProgress: (published) => options.onProgress(published),
+    });
+    return { ...outcome, results };
+}
+//# sourceMappingURL=release-phases.js.map